Open jviau opened 7 months ago
We discussed this and have decided not to proceed with this design for the time being. We will instead improve our validation to ensure we are keeping extension packages up to date.
We are reconsidering this feature
It is critical for our team to have a way to add or update packages on the inner build. We have critical CVE items against our team that we cannot resolve because of the WorkerExtension.csproj inner build.
Could we please get an update on this feature?
Another issue was opened recently that talks to the need for this feature.
Currently dealing with 3 dependencies that are referenced from generated WorkerExtensions.csproj
project that are vulnerable, while I can't override package versions to resolve the issues from my own function project:
[REDACTED]
I have issues with the same dependencies In the same project.
Get Outlook for iOShttps://aka.ms/o0ukef
From: Max @.> Sent: Tuesday, July 16, 2024 7:44:42 AM To: Azure/azure-functions-dotnet-worker @.> Cc: Jose Sosa @.>; Comment @.> Subject: Re: [Azure/azure-functions-dotnet-worker] Allow for modifying inner-builds packages from outer-build (Issue #2221)
Currently dealing with 3 dependencies that are referenced from generated WorkerExtensions.csproj project that are vulnerable, while I can't override package versions to resolve the issues from my own function project:
— Reply to this email directly, view it on GitHubhttps://github.com/Azure/azure-functions-dotnet-worker/issues/2221#issuecomment-2230686196, or unsubscribehttps://github.com/notifications/unsubscribe-auth/BDMAHFYF7R3EHYSSX3T37LTZMUBSVAVCNFSM6AAAAABCA5MUJGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDEMZQGY4DMMJZGY. You are receiving this because you commented.Message ID: @.***>
There was another issue about this #2604 but it has also been deleted, the same as #2593?
In addition to the ones mentioned by @MaxMommersteeg, the [REDACTED]
This issue is primarily a response to the issue of vulnerable packages being brought in as part of
WorkerExtensions.csproj
. Today there is no convenient way to manually update these vulnerable packages from the outer-build. This issue is to track an enhancement that will allow for modification from the outer build.Goals
WorkerExtensions.csproj
extension.json
. Additionally, today we default to including an extension only if a trigger or binding from it is actually used.Non Goals
Preliminary Design
We will introduce a new MSBuild item group which can be used to add or update packages on the inner build.
The above will add an explicit
<PackageReference Include="System.Net.Http" Version="4.3.4" />
to theWorkerExtensions.csproj
.