.NET Core 3.1 is there a removal date?

[markatky46]

Hi, We are being asked why an end of life version of .NET Core SDK and tools (3.1) are still being deployed in our image. It is causing critical vulnerabilities on our scanning tools.

Is there a date to remove the .NET 3.1 from the .NET Core Tools?

[markatky46]

.NET Core | 2 latest LTS versions and 1 latest version. For each feature version only latest patch is installed

[ilia-shipitsin]

can you please provide more details on how do you invoke scanning tools ?

[markatky46]

Qualys scans a deployed image daily. I assume it works in the same way as Nessus and scans installed components.

[shamil-mubarakshin]

Hello @markatky46. We cannot remove .Net Core 3.1 yet as it will break some users who still use it. Its removal will be announced separately

[markatky46]

But it is totally end of life, out of support and has huge vulnerabilities. It also goes against your published strategy.

For the users who need it they should/could install via pipeline still. There is no reliance on this version for the agent anymore either. V3 of the agent now uses .Net 6

I can't be the only end user consuming this that is getting hammered off our security team for having end of life, unsupported and highly vulnerable build tools installed

[markatky46]

[ilia-shipitsin]

pardon, what is "deployed image" ?

[iZnoGod722]

According to the policy

"Tools and versions will typically be removed 6 months after they are deprecated or have reached end-of-life"

Net Core 3.1 should be removed from the images around June/July period?

[markatky46]

@iZnoGod722 thank you for the concise answer. I will feed this back internally.

[samus-aran]

We're locking this discussion because it has not had recent activity and/or other members have asked for more information to assist you but received no response. Thank you for helping us maintain a productive and tidy community for all our members.