Duende.IdentityServer 7.4.8 runtime FileNotFoundException for Microsoft.Bcl.Memory on .NET 8

[PascalAlbrechtComparis]

Updating from Duende.IdentityServer 7.4.7 to 7.4.8 causes a runtime failure on .NET 8 at the /.well-known/openid-configuration/jwks endpoint:

FileNotFoundException: Could not load file or assembly 'Microsoft.Bcl.Memory, Version=10.0.0.10, Culture=neutral, PublicKeyToken=cc7b13ffcd2ddd51'. The system cannot find the file specified.

As far as I could determine, Duende.IdentityServer 7.4.8 was compiled against Microsoft.Bcl.Memory 10.0.10 (assembly version 10.0.0.10), but its .nuspec doesn't declare this as a direct dependency. It relies on Duende.IdentityModel 8.0.1 to bring it in transitively. However, Duende.IdentityModel 8.0.1 was compiled against 10.0.4 (assembly version 10.0.0.4) and only declares >= 10.0.4, so NuGet resolves 10.0.4, which doesn't satisfy Duende.IdentityServer 7.4.8's runtime requirement.

Explicitly placing a dependency to Microsoft.Bcl.Memory 10.0.10 in the consuming project as a workaround resolves the issue:

<PackageReference Include="Microsoft.Bcl.Memory" Version="10.0.10" />

[wcabus]

@PascalAlbrechtComparis Thanks for raising this! Your workaround is indeed the way to go for now.
I've asked our engineering team to have a look at this, so that a next update of Duende IdentityServer v7.* may contain a fix for this dependency issue in .NET 8.

[PascalAlbrechtComparis]

The issue has been fixed in Duende.IdentityServer 7.4.9, which adds a direct Microsoft.Bcl.Memory dependency for net8.0 (see the release notes). Upgrading to 7.4.9 or later removes the need for the workaround.