Nuget Microsoft.AspNetCore.Identity references 2.3.0 of Microsoft.Extensions.Identity.Core and resolves to 3.0.0 which is very old

[pauldendulk]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

Version 2.3.0 (the latest) of the Microsoft.AspNetCore.Identity nuget package depends on Microsoft.Extensions.Identity.Core 2.3.0. But that does not exist. Therefore it resolves tp version 3.0.0, which is from 2019. I don't think this is intended.

Expected Behavior

It depends on a newer version.

Steps To Reproduce

You could check the urls on nuget to see the problem:

• https://www.nuget.org/packages/Microsoft.AspNetCore.Identity/2.3.0#dependencies-body-tab
• https://www.nuget.org/packages/Microsoft.Extensions.Identity.Core/

By adding a reference to a project you can see this warning:

Microsoft.AspNetCore.Identity 2.3.0 depends on Microsoft.Extensions.Identity.Core (>= 2.3.0) but Microsoft.Extensions.Identity.Core 2.3.0 was not found. Microsoft.Extensions.Identity.Core 3.0.0 was resolved instead.

Exceptions (if any)

No response

.NET Version

9.0.102

Anything else?

[MackinnonBuck]

Looks like we'll want to ship a 2.3.0 version of Microsoft.Extensions.Identity.Core.

@wtgodbe, do we need to mark this package as shipping in the release/2.3 branch?

[wtgodbe]

Looks like a mistake in https://dotnet.microsoft.com/en-us/platform/support/policy/aspnet/2.3-packages - that package is part of the dependency closure, but isn't on that list. It should be on the list - we did produce it, but didn't publish it because it isn't there. We just need to update the list & publish the package that got produced. I'll sync with some folks offline

[wtgodbe]

Other option is to ship a 2.3.1 version of Microsoft.Aspnetcore.Identity, which depends on the latest 8.0 version of Microsoft.Extensions.Identity.Core

[wtgodbe]

The 2.3.0 version of Microsoft.Extensions.Identity.Core is now on nuget.org & will be added to the list of supported packages: https://www.nuget.org/packages/Microsoft.Extensions.Identity.Core/2.3.0

[pauldendulk]

Publishing Microsoft.Extensions.Identity.Core 2.3.0 is a temporary workaround. The Microsoft.Extensions.Identity.Core package you just published has a version that is in sync with Microsoft.AspNetCore.Identity, which would be a good solution if they were in sync from the start. But Microsoft.Extensions.Identity.Core is already on 9.0.2. If you try to keep it in sync it will fail as soon as you try to publish 3.0.0. So, this needs a fix in the references of Microsoft.AspNetCore.Identity.

Also semver is messed up. Users that are on a recent version would want to upgrade Microsoft.AspNetCore.Identity to a more recent version in will run into problems.