Oqtane 6.0 and .NET 9

[sbwalker]

.NET 9 will be released the week of Nov 12 during .NET Conf - which is ~3 weeks from now. Oqtane has always followed the release cadence of .NET for major version releases, so the plan is to release Oqtane 6.0 at the same time that .NET 9 is released. I will be merging the primary changes to migrate Oqtane to .NET 9 RC2 into the Dev branch within the next few days.

In addition to moving the framework dependencies to .NET 9 I would like to integrate a few of the new .NET 9 features into Oqtane:

• use MapStaticAssets middleware
• ensure new Blazor Server Reconnect UI behaves properly and potentially remove the custom JavaScript reconnect logic in Oqtane
• replace MemoryCache with HybridCache (this is required as part of a larger "scale out" enhancement which will be implemented in subsequent Oqtane 6.x releases)
• replace Swagger with OpenAPI

Oqtane will NOT be integrating the following new feature available in .NET 9:

• ExcludeFromInteractiveRouting attribute (relies on the default Blazor router and is not compatible with Oqtane's rendering approach)

Note that this also means that Oqtane 5.2.4 is the last official release on .NET 8.

[sbwalker]

#4761 migrates the framework to .NET 9 RC2. This includes updating the Oqtane version to 6.0.0 and updating the default Module and Theme templates.

There are a few ways to install .NET 9 RC2 onto your machine:

• download and install the latest version of Visual Studio Preview (https://visualstudio.microsoft.com/vs/preview/)
• or download the .NET 9 SDK (https://dotnet.microsoft.com/en-us/download/dotnet/9.0)

Please refer to the following blog post to understand how existing module and theme projects can be updated to work with .NET 9:

https://www.oqtane.org/blog/!/73/upgrading-to-new-net-versions

The most important thing to remember is that your assemblies need to be copied to the bin\Debug\net9.0 folder (whereas previously they were copied to bin\Debug\net8.0 for Oqtane 5.x)

[sbwalker]

Only one breaking change was discovered so far in the upgrade to .NET 9 RC2. The issue affected the install wizard:

An Error Occurred Provisioning The Master Database. This Is Usually Related To The Master Database Not Being In A Supported State. System.InvalidOperationException: An error was generated for warning 'Microsoft.EntityFrameworkCore.Migrations.PendingModelChangesWarning': The model for context 'MasterDBContext' has pending changes. Add a new migration before updating the database. This exception can be suppressed or logged by passing event ID 'RelationalEventId.PendingModelChangesWarning' to the 'ConfigureWarnings' method in 'DbContext.OnConfiguring' or 'AddDbContext'. at Microsoft.EntityFrameworkCore.Diagnostics.EventDefinition1.Log[TLoggerCategory](IDiagnosticsLogger1 logger, TParam arg) at Microsoft.EntityFrameworkCore.Diagnostics.RelationalLoggerExtensions.PendingModelChangesWarning(IDiagnosticsLogger`1 diagnostics, Type contextType) at Microsoft.EntityFrameworkCore.Migrations.Internal.Migrator.Migrate(String targetMigration) at Microsoft.EntityFrameworkCore.RelationalDatabaseFacadeExtensions.Migrate(DatabaseFacade databaseFacade) at Oqtane.Infrastructure.DatabaseManager.MigrateMaster(InstallConfig install) in C:\Source\Projects\oqtane.framework\Oqtane.Server\Infrastructure\DatabaseManager.cs:line 271

This issue had been reported previously here:

dotnet/efcore#34431

The workaround was implemented in Oqtane to allow the install wizard to function properly.

[sbwalker]

Another issue to resolve on .NET 9 RC2. The Oqtane.Client project reports a critical warning:

warning NU1904: Package 'System.Text.Encodings.Web' 4.5.0 has a known critical severity vulnerability

System.Text.Encodings.Web is a dependency of Microsoft.AspNetCore.Localization version 2.2.0:

Microsoft.AspNetCore.Localization version 2.2.0 has been flagged as deprecated for quite some time - @thabaum brought this up previously in the migration to .NET 8. The problem is that there is no guidance from Microsoft on what developers are supposed to use to replace this functionality in their applications. It is also very strange that the exact same Nuget package (ie. version 2.2.0) is flagged as a critical severity issue in .NET 9 - but not in .NET 8 (yet the CVE has existed since 2021 - GHSA-ghhp-997w-qr28).

[sbwalker]

Upon further investigation, we are not going to be able to use MapStaticAssets in Oqtane. As usual, the "marketing" info about this feature sounds great... but once you read the fine print, the limitations become obvious. You can read about this feature here:

https://learn.microsoft.com/en-us/aspnet/core/blazor/fundamentals/static-files?view=aspnetcore-9.0

In particular:

"Map Static Assets Middleware operates by combining build and publish processes to collect information about the static assets in the app. This information is utilized by the runtime library to efficiently serve the static assets to browsers. Map Static Assets Middleware can replace UseStaticFiles in most situations. However, Map Static Assets Middleware is optimized for serving the assets from known locations in the app at build and publish time. If the app serves assets from other locations, such as disk or embedded resources, UseStaticFiles should be used."

Basically this means that the feature is designed for monolithic tightly-coupled application scenarios where all of the static assets are known during build/deployment. It will not support modular application scenarios where there are multiple independent projects which are built/deployed separately and composed at runtime. It will also not support the upload of static content files at run-time. It will also not support other enhancements which are expected in Oqtane 6.0 such as Folder Providers which will allow content to be stored in other locations (which is essential to scale out scenarios).