System.Text.Json 5.0.2 assembly in project dependencies in version 0.5.10 - Impacting Azure Functions v3 + Microsoft.Net.Sdk.Functions .12,.13 Nuget packages.

[drivardxrm]

Hi,

it seems that there is a dependency on a .NET 5 package in the latest version (0.5.10)

In an Azure Function project (.NET Core 3.1) I receive this error at runtime whenever I make a call using the new package.

One or more errors occurred. (Could not load file or assembly 'System.Text.Encodings.Web, Version=5.0.0.0, Culture=neutral, PublicKeyToken=cc7b13ffcd2ddd51'. The system cannot find the file specified.)

I have no such issues with earlier version (0.5.7)

Might be because of the System.Text.Json that seems to have changed from 4.72 to 5.0.2

[MattB-msft]

We have been seeing this with direct rebuilds as we have been cleaning up dependencies, which is where our new compile + run tests have come in to work though build issues.

If your seeing at runtime ( which you indicate ) can you give me an example of what method your calling that is causing it to appear, or is it appearing on Login?

If your seeing it on build, flushing out your Obj folders usually clears the issue.

System.Text.Json 5.0.2 and its dependencies go all the back to .net core 3.0, so that should not be the challenge there..
Also that dependency is being pulled though by the Dataverse server itself,

[drivardxrm]

I did some further testing and here are my results

I am able to instantiate my ServiceClient without any problem.

Howerver, when I call the Create method I receive this error message.

Could not load file or assembly 'System.Text.Encodings.Web, Version=5.0.0.0, Culture=neutral, PublicKeyToken=cc7b13ffcd2ddd51'. The system cannot find the file specified.

Also, when I try to query the data (early bound, using an OrganizationServiceContext)
ex.

I get this error:
Could not load file or assembly 'System.Security.Permissions, Version=5.0.0.0, Culture=neutral, PublicKeyToken=cc7b13ffcd2ddd51'. The system cannot find the file specified.

When I revert back to version 0.5.7, I have no problems.

[MattB-msft]

@drivardxrm
What function host are you using? .net core 3.1 +?
and which hosting / code model in functions are you using?

We were able to get a repro of the permissions lib on netcore 3.1 which we think is a bug in a supporting lib from the dataverse server we are checking into and should be able to fix soon.

But not of the System.TextEncodings issue your seeing.

Is it possible for you to share a local repro?

[drivardxrm]

Hi @MattB-msft ,
Yes i'm using Azure function .Net Core 3.1
Consumption model, but I see the errors even when I run the function project locally.

the System.Text.Encodings.Web error happens on a HTTP trigger function
the System.Security.Permissions error happens on a ServiceBus trigger function

I cannot share the actual repo but I will try to create a simple test repo tonight and I will gladly share with you.

Thanks,

[MattB-msft]

@drivardxrm
You say using Azure Functions locally, thus I assume your using a windows host and not a Linux host?

[drivardxrm]

@MattB-msft , yes its windows

[MattB-msft]

@drivardxrm Which functions version?
we are testing on

<TargetFramework>netcoreapp3.1</TargetFramework>
<AzureFunctionsVersion>v3</AzureFunctionsVersion>

and things are working as expected.

[drivardxrm]

same

[MattB-msft]

@drivardxrm are you getting the same behavior with Dataverse.Client 5.10?

<PackageReference Include="Microsoft.PowerPlatform.Dataverse.Client" Version="0.5.10" />

[drivardxrm]

yes, I have the problem only with 0.5.10

on the image in the comment, I have reverted back to 0.5.7, I shouldnt have put this. sorry for the confusion

[MattB-msft]

Ok the issue is actually with the Microsoft.Net.Sdk.Functions Nuget package... 3.0.13 causes it, 3.0.3 works.. checking into the 4.0 version now,

[MattB-msft]

@drivardxrm
Ok, looks like Functions introduced a boxed set of dependencies in 3.0.12 and 3.0.13 of their packages.
That is where the dependence issue coming from. it looks like an issue in the linage of the dependencies that is causing the issue. Link: System.Text.Json Not working on Azure Functions v3

Specifically its the use of System.Text.Json, 5.0.1 is looking for assembly versions 5.0.0.0, and 5.0.2, is looking for assembly versions 5.0.0.1 ( yes that's weird... )

Looks like our hosts are caught in the crossfire between changes in the System.Text.Json and System.Text.Endcodings.* assemblies in .net .

We are talking to the .net team about this now and will let you know when we know and or downgrade if we can.

Short term though, I would suggest downgrading to use Microsoft.Net.Sdk.Functions at most 3.0.11, that will clear the issue for you right now.

Or You can use .UseWebApi = false on the connection, and it will disable the codepath that is causing this issue all up, and you can use current version of Microsoft.Net.Sdk.Functions.

[petrochuk]

Might be related to this issue closed as by design:
System.Text.Json Not working on Azure Functions v3

[MattB-msft]

One more follow-up to this.. we just retested with .net 6.x RC and all versions of the Functions SDK up to 13. they all work.
so once .net 6 ships as official, we will have a answer to supporting current versions.

[s-bauer]

Can't really confirm this. For me this seems to be clearly the issue of the Dataverse package. As the initial screenshot reveals, there is a 5.x package referenced for .net core 3.1. It's been the same thing with the reference to Microsoft.Extensions.Caching.Memory just a couple of weeks ago in version 0.5.4, which got fixed a day after in version 0.5.5.

This stuff always causes issues with the in-process model of Azure functions. It's the same issue with the 5.x versions of Logging and DependencyInjection which simply cannot be used in a v3 Azure function. Simply fix your nuspec and release and updated version to solve this issue. Thanks!

[MattB-msft]

@s-bauer, wish it was that easy :(
We were able to fix Extentions.Caching.Memory's dependencies as we own ( in this project ) all of its dependencies, In the case of System.Text.Json dependencies its coming from much deeper in the supporting libs stack, and the requirement for using the 5.0.2 version is driven by this security alert: CVE-2021-26701.

Per Azure function statement's they dropped the assembly mentioned in CVE-2021-26701 from their .12 and .13 support packages, thus breaking anything that depends on System.Text.Json 5.0.2 and its dependencies

Please also keep in mind that the version number attached to the Nuget package versions for any of the System.* nuget packages are not directly related to the version of .net. They are related to the release wave that the .net team is doing.
Its an easy assumption to make based on the way we market .net, but its not accurate. Once .net started shipping the 6.rc release packages, they stopped shipping updates to the 5.x packages.

Right now the guidance I can provide is to downgrade Microsoft.Net.Sdk.Functions to .11 or lower for the v3 functions area until the System.Text.Json 6.0 ships.

[s-bauer]

@MattB-msft The CVE you've linked states that version 4.7.2 is safe as well. Isn't it possible to just use that one instead of 5.0.2?

[MattB-msft]

We are actively discussing it with the dataverse teams

[s-bauer]

Any update on this topic?

[MattB-msft]

Not at this time. Its a fairly complicated change ( going backward on a dependency ) in the server platform.
How we can do this is still being worked though.

In the mean time.. the guidance we provided above for functions is what you should use for now.

[MattB-msft]

@drivardxrm FYI, I updated the title of this item to help other searchers find the issue.

[aditmer]

Hello, I can confirm that upgrading to .NET 6 and Microsoft.NET.Sdk.Functions Version 4.1.0 resolved this issue for me. I hope it helps someone else.

[MattB-msft]

Moving this to Discussions / Q/A area at this point... 0.6 + is shipping with System.Text.Json 6.0 as a dependency.