Add netcoreapp3.1 target framework #215
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add a target framework moniker for .NET Core 3.1.
Context
We have a number of .NET Core 3.1 Lambda functions that use the X-Ray recorder, and due to the only Target Framework Moniker for .NET Core being
netstandard2.0, it will publish the application with all of the relevant binary files, such asMicrosoft.AspNetCore.Http.dll.However, in .NET Core 3.0 and later, these binaries are no longer published as NuGet packages, and instead are included in the ASP.NET Core shared framework. This means that versions of the binary greater than 2.2.2 are not available to be upgraded to explicitly, leading to "old" binaries that don't need to be used being published with the application.
As all versions of ASP.NET Core earlier than 3.1 are now out-of-support, any security vulnerabilities in these tools get flagged when using security scanning tools such as Nexus Sonatype.
As there are no "non-vulnerable" versions of the dependency available from NuGet (because they're in the shared framework), it is not possible to upgrade to a .NET Core 3.1 version of this dependency to resolve the issue.
This PR attempts to resolve this issue by adding a
netcoreapp3.1Target Framework Moniker so that the relevant recorder libraries understand the ASP.NET Core Framework, and will not include the relevant binaries as part of the deployment package.