Why Microsoft.AspNetCore.Authentication.AzureAD.UI is still get updated? Where is the source code?

[chucklu]

You have announced AzureAD.UI is obsoleted on Sep 11, 2020, #25807
Breaking change: Authentication: AzureAD.UI and AzureADB2C.UI APIs and packages marked obsolete - .NET | Microsoft Learn
Why the nuget package https://www.nuget.org/packages/Microsoft.AspNetCore.Authentication.AzureAD.UI still get updated with new version? and the source Repository still pointed to https://github.com/dotnet/aspnetcore/

However I can not find related source code in dotnet/aspnetcore repository.

[gfoidl]

The source lives here, but note this is not on main-branch, as it got removed in #42546 for .NET 7.

In NuGet you'll see builds for .NET 7 previews, and not newer ones, it didn't even make it into .NET 7.

[chucklu]

@gfoidl Yeah, I know that the code exists in git history, as when I search the code on all github repository, I find the old version of the forked repository

I am just wondering why the version still get updated since it's obsoleted and not maintained
https://www.nuget.org/packages/Microsoft.AspNetCore.Authentication.AzureAD.UI/6.0.20 was released two days ago 2023-07-11T12:55:47.9830000

In my opinion, we should not release new version for it. And set the repository link of nuget package to the last commit which map to the folder of the Microsoft.AspNetCore.Authentication.AzureAD.UI

[gfoidl]

.NET 6 is a LTS (long term support) release, so for that version there needs to be updates, according the support policy.

And set the repository link of nuget package to the last commit which map to the folder of the Microsoft.AspNetCore.Authentication.AzureAD.UI

Hm, I understand what you mean, but I think this is more likely something for the NuGet-site to consider i.e. that they show the commit from which the package was built. There's the package explorer (see
https://nuget.info/packages/Microsoft.AspNetCore.Authentication.AzureAD.UI/6.0.20) where one can see the commit and tree from which it's built, so the info is there, but not as prominent as you'd like to have.

[chucklu]

@gfoidl You remind me to check the commit id in the ProductVersion of the .dll file, you are right, the commit id is 39e0501.

The package info you provided contains

This package was built from the source code at https://github.com/dotnet/aspnetcore/tree/39e0501ee91dcf2b9b885d647795184815fb0408

I have tried to view the commit id of other tag, https://nuget.info/packages/Microsoft.AspNetCore.Authentication.AzureAD.UI/6.0.19
It seems although the code freezed, the new released version will have a new commit id, there are repository level commits

https://github.com/dotnet/aspnetcore/commits/v6.0.20
https://github.com/dotnet/aspnetcore/commits/v6.0.19
And the commits are on diverged branches, as I supposed the git history linear instead of diverged
It's weird for me to see such kind of git history

[chucklu]

@gfoidl Thanks for you reminding me check the commit id of released dll file.

[martincostello]

And the commits are on diverged branches, as I supposed the git history linear instead of diverged

When there's a release containing security fixes, they are developed internally by the .NET teams in Azure DevOps so that vulnerabilities can't be inferred from ongoing in-progress development work before the patches are available to users. Once the vulnerabilities are disclosed, the changes are merged into the public branches from the internal one.

Here's an example of such a PR: #49336