Facilitating the Spread of Knowledge and Innovation in Professional Software Development

Write for InfoQ


Choose your language

InfoQ Homepage News ASP.NET Core 3.0 Projects Go on a Diet

ASP.NET Core 3.0 Projects Go on a Diet

Leia em Português

New ASP.NET Core projects use an omnibus package called the Microsoft.AspNetCore.App. Also known as the "ASP.NET Core Shared Framework", the basic idea behind this package is it includes all the things a typical application would need. But if you look at the dependencies for this package, the definition of "need" appears to be rather loose.

Currently Microsoft.AspNetCore.App has 150 explicitly listed dependencies, up from 144 seven months ago. Among these you'll find nine different authentication provider packages.

  • Cookies
  • Facebook
  • Google
  • JwtBearer
  • Microsoft Account
  • OAuth
  • OpenIdConnect
  • Twitter
  • WsFederation

You'll also find eight packages for supporting Entity Framework Core with SQL Server, a SQL Server caching library, an EF Core package for diagnostics, an EF Core package for identity, and many more.

From the list of 150 dependencies, 31 are slated to be removed from ASP.NET Core 3.0's Shared Framework for violating the new inclusion criteria because they:

(1) have dependencies on 3rd party code that we have no ability to service

(2) the assemblies themselves are being deprecated in 3.0

(3) they implement protocols or auth mechanism which are highly subject to change (for instance, Facebook/Google/Twitter could decide tomorrow to change the way auth works)

Nate McMaster, senior software engineer on the ASP.NET Core project, goes on to say:

We added too many things in 2.0, and we are re-adjusting back to what we believe is a maintainable set of things for the foreseeable road ahead. Most of the assemblies removed from Microsoft.AspNetCore.App will still be offered as NuGet packages. If we were to find later that 90% of all customers reference the same package, that's a good candidate for the shared framework. As mentioned in the guidance doc, however, how much an API is used is an important metric, but not the only factor we consider.

How does this affect current projects?

If you decide to upgrade to ASP.NET Core 3.0, your application will break if you are using any of the packages excluded from the Shared Framework. However, the fix is to simply manually add the excluded packages to your project as you would any other Nuget style dependency.

What packages do I actually need?

The answer to that question varies depending on what your application actually does. But if we were to consider just a simple REST server, then you only need to directly reference three packages:

  • Microsoft.AspNetCore
  • Microsoft.AspNetCore.Mvc
  • Microsoft.AspNetCore.HttpsPolicy

The first of these, Microsoft.AspNetCore, has 18 direct dependencies. Mvc adds 13 dependencies of its own and HttpsPolicy adds five more. This count doesn't include overlap or indirect dependencies, but still reflects a much smaller and more easily managed set of dependencies.

Rate this Article