KeyVault old dependency causes warning at restore time

[EPinci]

Version

v4.9.0

Describe the bug

Bot builder 4.9.0 references "Microsoft.Azure.Storage.Blob" v9.4.2 that, on restore, shows:

Package 'Microsoft.Azure.KeyVault.Core 1.0.0' was restored using '.NETFramework,Version=v4.6.1, .NETFramework,Version=v4.6.2, .NETFramework,Version=v4.7, .NETFramework,Version=v4.7.1, .NETFramework,Version=v4.7.2, .NETFramework,Version=v4.8' instead of the project target framework '.NETCoreApp,Version=v3.1'. This package may not be fully compatible with your project.

With later versions (I believe, starting with v10) of "Microsoft.Azure.Storage.Blob", that warning is removed. Can it be updated?

To Reproduce

Refere

Expected behavior

Although it is understood that the warning has no impact, still packaged dependencies should not throw non user-fixable warnings. Can you update the dependency?

[EricDahlvang]

Hi @EPinci

Unfortuantely, v10 of Microsoft.Azure.Storage.Blob has different dependencies and Bot Builder AzureBlobStorage and AzureBlobTranscriptStore expose CloudStorageAccount via the constructor. We cannot update the Microsoft.Azure.Storage.Blob lib without a major version bump of Bot Builder, since the break would not adhere to semver rules we are following.

[EricDahlvang]

@cleemullins maybe we should consider a v5 of just https://www.nuget.org/packages/Microsoft.Bot.Builder.Azure in order to bring our dependencies up to the latest versions, and remove deprecated code.

[tracyboehrer]

Assigned to R10

[EricDahlvang]

@EPinci We have released a new package https://www.nuget.org/packages/Microsoft.Bot.Builder.Azure.Blobs which uses https://www.nuget.org/packages/Azure.Storage.Blobs/

Thank you for raising this issue. Closing now.

[EPinci]

Oh, hey, great! I'm trying to use it and I have a few questions. Since the problem was with Microsoft.Bot.Builder.Azure do I have to assume this package is a substitute (with a few type names changes) that does not include support for cosmos? If I also need cosmos I need the former package and I'm back to square one? Thank you.

[EricDahlvang]

@EPinci The new package uses the latest libraries for blob storage, so is not just a 'substitute' for the previous.

You are correct, if you also need CosmosDb then you will need to use Microsoft.Bot.Builder.Azure and the warning will still show. We are somewhat tied down here, since we cannot upgrade to the latest Microsoft.Azure.Storage.Blob in a minor release due to the backward compat issues mentioned earlier.

Something you could do is ignore the NU1701 warning, as instructed in this issue: https://github.com/Azure/azure-storage-net/issues/834

[EPinci]

@EricDahlvang I see. Since now I don't need CosmosDB... I'm perfectly fine with this new implementation. ;)

As a curiosity, have you guys figured out a long term for this? Is this implementation going to fall back on Microsoft.Bot.Builder.Azure in the next major release? Or are you going to split providers in different packages? Or... neither of the two? :)

Thank you.

[EricDahlvang]

I believe the long term plan is to release individual packages, similar to what Azure is doing with Azure.Storage.* and as the Bot Framework team has done in 4.10.n with these two:

https://www.nuget.org/packages/Microsoft.Bot.Builder.Azure.Blobs https://www.nuget.org/packages/Microsoft.Bot.Builder.Azure.Queues (preview)

We have found that a single Microsoft.Bot.Builder.Azure package, pulling in various storage dependencies, results in compatibility issues, like this KeyVault problem.