Not able to install Duende.AccessTokenManagement with dotnet 8

[Niputi]

Affected component

Duende.AccessTokenManagement

Version

4.2.0

Describe the bug

The required nuget versions seem to be wrong

this is how it looks like in visual studio nuget install

net8.0
Duende.IdentityModel (>= 8.1.0)
Microsoft.Extensions.Caching.Hybrid (>= 10.0.0)
Microsoft.Extensions.Http (>= 10.0.4)
Microsoft.Extensions.Http.Resilience (>= 10.0.0)
Microsoft.Extensions.Logging.Abstractions (>= 10.0.4)
Microsoft.Extensions.Options (>= 10.0.4)
Microsoft.Extensions.Telemetry.Abstractions (>= 10.0.0)
System.IdentityModel.Tokens.Jwt (>= 8.0.1 && < 9.0.0)

net9.0
Duende.IdentityModel (>= 8.1.0)
Microsoft.Extensions.Caching.Hybrid (>= 10.0.0)
Microsoft.Extensions.Http (>= 10.0.4)
Microsoft.Extensions.Http.Resilience (>= 10.0.0)
Microsoft.Extensions.Logging.Abstractions (>= 10.0.4)
Microsoft.Extensions.Options (>= 10.0.4)
Microsoft.Extensions.Telemetry.Abstractions (>= 10.0.0)
System.IdentityModel.Tokens.Jwt (>= 8.0.1 && < 9.0.0)

net10.0
Duende.IdentityModel (>= 8.1.0)
Microsoft.Extensions.Caching.Hybrid (>= 10.0.0)
Microsoft.Extensions.Http (>= 10.0.4)
Microsoft.Extensions.Http.Resilience (>= 10.0.0)
Microsoft.Extensions.Logging.Abstractions (>= 10.0.4)
Microsoft.Extensions.Options (>= 10.0.4)
Microsoft.Extensions.Telemetry.Abstractions (>= 10.0.0)
System.IdentityModel.Tokens.Jwt (>= 8.0.1 && < 9.0.0)

Steps to reproduce

Trying to install the nuget package in a .net 8 project

Expected behavior

is able to install with a .net 8 project

Additional context

No response

[damianh]

Hi @Niputi

I was able to install it into a net8.0 project

What errors are you seeing?

[Niputi]

@damianh I can't because this dependency for dotnet 8 is requiring dotnet 10 packages and I have nuget packages which currently require dotnet 8 versions in my dotnet 8 project.

That's why I posted the nuget requirements, they look wrong for different dotnet versions

[damianh]

Hi Niputi,

dotnet 8 is requiring dotnet 10 packages

These are not "dotnet 10" packages.

https://www.nuget.org/packages/Microsoft.Extensions.Http/10.0.8#supportedframeworks-body-tab

https://nuget.info/packages/Microsoft.Extensions.Http/10.0.8

I'd agree that Microsoft extensions versioning scheme that follows-the-sdk-version-but-doesn't-really-and-not-semver can be confusing but they're not been TFM version locked since net6.0 days.

Duende.AccessTokenManagement leverages Microsoft.Extensions.Caching.Hybrid as an explicit design decision. The first version of that was 9.3.0 (which also supported net8.0) but the first usable version was 10.0.0 and as you can see it has transitive dependencies on other MS.Ext. v10.x packages.

Closing this as it's by-design.