How to update ASP.NET Core 2.1 (running on .NET Framework) to newer builds?

Question

I have an old app running on ASP.NET Core 2.1 and running on .NET Framework (yes, that is a thing).

OK fine. But I need to update that old project to include some new updates - specifically patched UseCookiePolicy support - as described at https://devblogs.microsoft.com/dotnet/upcoming-samesite-cookie-changes-in-asp-net-and-asp-net-core/comment-page-3/ - and some other security patches).

Extract from the csproj file:

    <TargetFramework>net48</TargetFramework>
    <AspNetCoreModuleName>AspNetCoreModuleV2</AspNetCoreModuleName>
    <AspNetCoreHostingModel>OutOfProcess</AspNetCoreHostingModel>
  </PropertyGroup>

  <ItemGroup>
    <PackageReference Include="Microsoft.AspNetCore" Version="2.1.7" />
    <PackageReference Include="Microsoft.AspNetCore.Mvc" Version="2.1.3" />
    <PackageReference Include="Microsoft.AspNetCore.Authentication.Cookies" Version="2.1.2" />
    <PackageReference Include="Microsoft.AspNetCore.Authentication.Core" Version="2.1.1" />
    <PackageReference Include="Microsoft.AspNetCore.Mvc.Versioning" Version="3.0.1" />
    <PackageReference Include="Microsoft.Extensions.Configuration" Version="2.1.1" />
    <PackageReference Include="Microsoft.Extensions.Logging" Version="2.1.1" />
  </ItemGroup>

So we can see that the ASP.NET Core dependencies are referenced via NuGet.

OK, fine - so I need to go and update those packages. But here comes the issue - the packages don't exist any more. https://www.nuget.org/packages/Microsoft.AspNetCore/2.1.7 is the latest version, but alas that was released prior to the fixes that I need. https://github.com/dotnet/announcements/issues/217 is the announcement where they said they would stop generating the NuGet packages.

So now I am a bit stuck. I can download the latest SDK etc from https://github.com/dotnet/core/blob/main/release-notes/2.1/2.1.30/2.1.30.md#downloads - but how do I change my project from its NuGet references to the files at C:\Program Files\dotnet\shared instead?

You may be tempted to suggest using https://www.nuget.org/packages/Microsoft.AspNetCore.App/2.1.34#supportedframeworks-body-tab - but that doesn't work either since it explicitly excludes .NET Framework support.

.NET Core 2.1 on .NET Framework is a supported thing. How do other people solve this upgrade problem?

Answer 1

As per ASP.NET Core 2.1 MVC SameSite cookie sample (found via https://stackoverflow.com/a/65834637/34092):

To get the ASP.NET Core changes for .NET Framework ensure that you have a direct reference to the patched packages and versions (2.1.14 or later 2.1 versions).

<PackageReference Include="Microsoft.Net.Http.Headers" Version="2.1.14" />
<PackageReference Include="Microsoft.AspNetCore.CookiePolicy" Version="2.1.14" />

Answer 2

According to this post:

As for packages, in the 2.1 world, we only publish packages that are directly affected by a servicing change, we don't push all packages, or all packages that transitively reference the affected package. This isn't ideal because it means you have to watch for bulletins in packages you transitively depend on and lift them, but there other reasons that make it difficult for us to re-publish all transitive packages.

Meaning: There won't be an update for the Microsoft.AspNetCore top-level NuGet package any more. You have to go through all dependencies (and their dependencies, and so on...) yourself and update the individual dependencies.

If your project still uses packages.config files then you should be able to see all available updates in the NuGet package manager.

If your project uses PackageReferences then you should be able to use the dotnet list package --include-transitive --outdated (documentation) command to find all referenced packages that have updates available. To update those, you can either reference them directly, or use Central Package Management with Transitive pinning.