[BUG] Exception: Could not load file or assembly 'System.Diagnostics.DiagnosticSource, Version=6.0.0.0 after upgrading Azure.Identity from 1.5.0 to 1.10.2 as per security vulnerability

[aayushsin]

Library name and version

Azure.Identity 1.10.2

Describe the bug

We are facing an exception as detailed below when we tried upgrading Azure.Identity from 1.5.0 to 1.10.2 which is required as per security vulnerability.

Encountered exception: Could not load file or assembly 'System.Diagnostics.DiagnosticSource, Version=6.0.0.0, Culture=neutral, PublicKeyToken=cc7b13ffcd2ddd51'. The located assembly's manifest definition does not match the assembly reference. (0x80131040). Retrying after waiting 250000000 ticks. Stack trace:
2023-10-31 09:04:35.095725: at Azure.Core.Pipeline.DiagnosticScopeFactory..ctor(String clientNamespace, String resourceProviderNamespace, Boolean isActivityEnabled, Boolean suppressNestedClientActivities)
2023-10-31 09:04:35.096857: at Azure.Core.Pipeline.ClientDiagnostics..ctor(String optionsNamespace, String providerNamespace, DiagnosticsOptions diagnosticsOptions, Nullable1 suppressNestedClientActivities) 2023-10-31 09:04:35.097762: at Azure.Core.Pipeline.ClientDiagnostics..ctor(ClientOptions options, Nullable1 suppressNestedClientActivities)
2023-10-31 09:04:35.098471: at Azure.Identity.CredentialPipeline..ctor(TokenCredentialOptions options)
2023-10-31 09:04:35.098754: at Azure.Identity.CredentialPipeline.GetInstance(TokenCredentialOptions options)
2023-10-31 09:04:35.100529: at Azure.Identity.ManagedIdentityCredential..ctor(String clientId, TokenCredentialOptions options)

Expected behavior

The issue does not occur with Azure.Identity 1.3.0 or 1.5.0. Is there any breaking change while upgrading?

Actual behavior

The exception as mentioned above.

Reproduction Steps

Upgrade Azure.Idenity from 1.5.0 to 1.10.2

Environment

.netcoreapp3.1

[jsquire]

Hi @aayushsin. Thanks for reaching out and we regret that you're experiencing difficulties. This problem generally occurs when the runtime is unable to load the needed set of dependencies; normally, this is due to a version mismatch due to an application reference that pins an older version either directly or as a transitive dependency. Most often, this can be mitigated by adding an explicit reference to the application that hoists the version. In this case, I'd suggest trying a direct reference to the latest Azure.Core in the application and seeing if that helps.

That said, you seem to be running/targeting netcoreapp3.1, which reached end-of-life in December 2022 and is no longer a supported framework. (src) Unfortunately, we're unable to assist with problems specific to that environment and would need to be able to reproduce in net6 or another supported version to help further.

[github-actions]

Hi @aayushsin. Thank you for opening this issue and giving us the opportunity to assist. To help our team better understand your issue and the details of your scenario please provide a response to the question asked above or the information requested above. This will help us more accurately address your issue.

[Jiadosi]

Hi @jsquire , I am facing the same exception. I added a direct package reference to the latest Azure.Core 1.35.0 but still no help.

Could not load file or assembly 'System.Diagnostics.DiagnosticSource, Version=6.0.0.0, Culture=neutral, PublicKeyToken=cc7b13ffcd2ddd51'. The system cannot find the file specified.
at Azure.Core.Pipeline.DiagnosticScopeFactory..ctor(String clientNamespace, String resourceProviderNamespace, Boolean isActivityEnabled, Boolean suppressNestedClientActivities)
at Azure.Core.Pipeline.ClientDiagnostics..ctor(String optionsNamespace, String providerNamespace, DiagnosticsOptions diagnosticsOptions, Nullable1 suppressNestedClientActivities) at Azure.Core.Pipeline.ClientDiagnostics..ctor(ClientOptions options, Nullable1 suppressNestedClientActivities)
at Azure.Identity.CredentialPipeline..ctor(TokenCredentialOptions options)
at Azure.Identity.CredentialPipeline.<>c.<.cctor>b__16_0()
at System.Lazy`1.ViaFactory(LazyThreadSafetyMode mode)

[avendel]

For netstandard2.0, it looks like the Azure.Core nuspec specifies a dependency on System.Diagnostic.DiagnosticSource 6.0.1, but the assembly manifest indicates that the build dependency is for 6.0.0.

[m-redding]

This is the same as #39798 - @Jiadosi & @aayushsin I'm going to close this issue and put updates on my investigation in the other thread.