Modernize sample dependencies, fix Dependabot alerts, drop EOL SDK installs (#1357)

Author: torosent

Directory.Packages.props

@@ -48,7 +48,7 @@
 
   <!-- Test dependencies -->
   <ItemGroup>
-    <PackageVersion Include="Azure.Monitor.OpenTelemetry.Exporter" Version="1.6.0" />
+    <PackageVersion Include="Azure.Monitor.OpenTelemetry.Exporter" Version="1.8.1" />
     <PackageVersion Include="CommandLineParser" Version="2.9.1" Condition="'$(TargetFramework)' == 'net8.0'" />
     <PackageVersion Include="CommandLineParser" Version="1.9.71" Condition="'$(TargetFramework)' == 'net48'" />
     <PackageVersion Include="EnterpriseLibrary.SemanticLogging.EventSourceAnalyzer.NetCore" Version="2.0.1406.4" />
@@ -62,7 +62,7 @@
     <PackageVersion Include="System.Data.SqlClient" Version="4.8.6" />
     <PackageVersion Include="System.Net.Http" Version="4.3.4" />
     <PackageVersion Include="System.Text.RegularExpressions" Version="4.3.1" />
-    <PackageVersion Include="System.Text.Json" Version="10.0.3" />
+    <PackageVersion Include="System.Text.Json" Version="10.0.8" />
     <PackageVersion Include="WindowsAzure.Storage" Version="9.3.3" Condition="'$(TargetFramework)' == 'net8.0'" />
     <PackageVersion Include="WindowsAzure.Storage" Version="8.7.0" Condition="'$(TargetFramework)' == 'net48'" />
   </ItemGroup>
@@ -90,17 +90,17 @@
 
   <!-- Samples dependencies -->
   <ItemGroup>
-    <PackageVersion Include="Azure.Identity" Version="1.18.0" />
-    <PackageVersion Include="Microsoft.ApplicationInsights.DependencyCollector" Version="2.12.0" />
-    <PackageVersion Include="Microsoft.ApplicationInsights.WorkerService" Version="2.21.0" />
+    <PackageVersion Include="Azure.Identity" Version="1.21.0" />
+    <PackageVersion Include="Microsoft.ApplicationInsights.DependencyCollector" Version="2.23.0" />
+    <PackageVersion Include="Microsoft.ApplicationInsights.WorkerService" Version="2.23.0" />
     <PackageVersion Include="Microsoft.Azure.DurableTask.AzureStorage" Version="1.17.3" />
-    <PackageVersion Include="Microsoft.Extensions.Azure" Version="1.7.4" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration" Version="3.1.32" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="3.1.32" />
-    <PackageVersion Include="Microsoft.Extensions.Hosting" Version="6.0.1" />
-    <PackageVersion Include="OpenTelemetry.Exporter.Console" Version="1.1.0" />
-    <PackageVersion Include="OpenTelemetry.Exporter.Zipkin" Version="1.15.3" />
-    <PackageVersion Include="Vio.DurableTask.Hosting" Version="2.2.1" />
+    <PackageVersion Include="Microsoft.Extensions.Azure" Version="1.14.0" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration" Version="10.0.8" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="10.0.8" />
+    <PackageVersion Include="Microsoft.Extensions.Hosting" Version="10.0.8" />
+    <PackageVersion Include="OpenTelemetry.Exporter.Console" Version="1.15.3" />
+    <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.15.3" />
+    <PackageVersion Include="Vio.DurableTask.Hosting" Version="2.2.17" />
   </ItemGroup>
 
   <!-- Dependencies specific to net8.0-->
@@ -118,7 +118,7 @@
 
   <!-- Samples dependencies with net48-->
   <ItemGroup Condition="'$(TargetFramework)' == 'net48'">
-    <PackageVersion Include="ncrontab" version="1.0.0" />
+    <PackageVersion Include="ncrontab" Version="3.4.0" />
   </ItemGroup>
 
 </Project>

eng/templates/build-steps.yml

@@ -11,19 +11,6 @@ steps:
 # Start by restoring all the dependencies. This needs to be its own task
 # from what I can tell. We specifically only target DurableTask.AzureStorage
 # and its direct dependencies.
-# Configure all the .NET SDK versions we need
-- task: UseDotNet@2
-  displayName: 'Use the .NET Core 2.1 SDK (required for build signing)'
-  inputs:
-    packageType: 'sdk'
-    version: '2.1.x'
-
-- task: UseDotNet@2
-  displayName: 'Use the .NET Core 3.1 SDK'
-  inputs:
-    packageType: 'sdk'
-    version: '3.1.x'
-
 - task: UseDotNet@2
   displayName: 'Use the .NET 8 SDK'
   inputs:

samples/Correlation.Samples/Correlation.Samples.csproj

@@ -21,6 +21,8 @@
   <ItemGroup>
     <PackageReference Include="System.Data.SqlClient" />
     <PackageReference Include="System.Net.Http" />
+    <!-- Pinned to override vulnerable transitive (GHSA-cmhx-cq75-c4mj). -->
+    <PackageReference Include="System.Text.RegularExpressions" />
     <None Update="appsettings.json">
       <CopyToOutputDirectory>Always</CopyToOutputDirectory>
     </None>

samples/Correlation.Samples/TelemetryActivator.cs

@@ -69,7 +69,21 @@ void SetUpTelemetryClient()
             telemetryInitializer.ExcludeComponentCorrelationHttpHeadersOnDomains.Add("127.0.0.1");
             config.TelemetryInitializers.Add(telemetryInitializer);
 
-            config.InstrumentationKey = Environment.GetEnvironmentVariable("APPINSIGHTS_INSTRUMENTATIONKEY");
+            string connectionString = Environment.GetEnvironmentVariable("APPLICATIONINSIGHTS_CONNECTION_STRING");
+            if (!string.IsNullOrEmpty(connectionString))
+            {
+                config.ConnectionString = connectionString;
+            }
+            else
+            {
+                string instrumentationKey = Environment.GetEnvironmentVariable("APPINSIGHTS_INSTRUMENTATIONKEY");
+                if (!string.IsNullOrEmpty(instrumentationKey))
+                {
+#pragma warning disable CS0618 // InstrumentationKey is obsolete; kept for backward compatibility.
+                    config.InstrumentationKey = instrumentationKey;
+#pragma warning restore CS0618
+                }
+            }
 
             module.Initialize(config);
 

samples/DistributedTraceSample/ApplicationInsights/ApplicationInsightsSample.csproj

@@ -9,10 +9,11 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="System.Diagnostics.DiagnosticSource" VersionOverride="7.0.2" />
     <PackageReference Include="Vio.DurableTask.Hosting" />
     <PackageReference Include="Microsoft.Extensions.Hosting" />
     <PackageReference Include="Microsoft.ApplicationInsights.WorkerService" />
+    <!-- Pinned to override vulnerable transitive System.Text.Json 6.0.0 (GHSA-8g4q-xg66-9fp4). -->
+    <PackageReference Include="System.Text.Json" />
   </ItemGroup>
 
   <ItemGroup>

samples/DistributedTraceSample/OpenTelemetry/OpenTelemetrySample.csproj

@@ -9,7 +9,7 @@
   <ItemGroup>
     <PackageReference Include="OpenTelemetry.Api" />
     <PackageReference Include="OpenTelemetry.Exporter.Console" />
-    <PackageReference Include="OpenTelemetry.Exporter.Zipkin" />
+    <PackageReference Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" />
     <PackageReference Include="Azure.Monitor.OpenTelemetry.Exporter" />
   </ItemGroup>
 

samples/DistributedTraceSample/OpenTelemetry/Program.cs

@@ -31,7 +31,7 @@ static async Task Main(string[] args)
                 .SetResourceBuilder(ResourceBuilder.CreateDefault().AddService("MySample"))
                 .AddSource("DurableTask.Core")
                 .AddConsoleExporter()
-                .AddZipkinExporter()
+                .AddOtlpExporter()
                 .AddAzureMonitorTraceExporter(options =>
                 {
                     options.ConnectionString = Environment.GetEnvironmentVariable("AZURE_MONITOR_CONNECTION_STRING");

samples/ManagedIdentitySample/DTFx.AzureStorage v1.x/ManagedIdentity.AzStorageV1.csproj

@@ -14,6 +14,9 @@
     <PackageReference Include="Microsoft.Extensions.Logging" />
     <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" />
     <PackageReference Include="Microsoft.Extensions.Logging.Console" />
+    <!-- Pinned to override vulnerable transitives from DurableTask 1.x / WindowsAzure.Storage 9.x (GHSA-7jgj-8wvc-jh57, GHSA-cmhx-cq75-c4mj). -->
+    <PackageReference Include="System.Net.Http" />
+    <PackageReference Include="System.Text.RegularExpressions" />
   </ItemGroup>
 
 </Project>