PDN 5.0.13 on .NET 7 ... when .NET 8?

[Frank_017]

Hi Rick, Paint.net currently uses the components of .NET 7 - is it known that the EOL for this version has been reached on May 14, 2024 and there is no further support?
Is there a version of Paint.net that uses .NET 8 or is that planned? We would like to continue using Paint.net, but for security reasons we must strictly observe the EOL's of the runtime components and are not allowed to use unsupported software.

[Rick Brewster]

I split this out into its own post.

 

Paint.NET v5.1 is coming very soon* and is using .NET 8. Unless .NET 7 has some major security vulnerabilities that specifically affect desktop applications like Paint.NET, I wouldn't worry about it too much.

 

There will not be a Paint.NET v5.0.14 (for example) based on .NET 8, because that is too large of a change for a maintenance release. Every time I've done that sort of thing I ended up regretting it. Pushing out 5.0.14 on .NET 8 would risk causing much worse problems than having a small gap between 5.013 (on .NET 7) and 5.1 (on .NET 8).

 

* as in, I'm releasing an alpha as soon as this afternoon

[Rick Brewster]

Also it's important to know what "unsupported" actually means in this context. It means that .NET 7 won't be updated further, including to fix security vulnerabilities. That doesn't mean .NET 7 is "immediately toxic". It's fine until there's a newly discovered security vulnerability that isn't fixed which then necessitates migration to .NET 8+.

 

And, since Paint.NET uses SCD (self-contained deployment), you really need to consider the scope and meaning of "supported"/"unsupported". Microsoft does not "support" Paint.NET. I do, this forum does. If there was a security vulnerability in .NET 7 that was important to Paint.NET, and 5.1 wasn't ready yet, then yes I would push forward with a 5.0.14-on-.NET 8 release. Unless that happens, just chill and wait for PDN 5.1 on .NET 8 which is already coming soon.

 

PDN isn't enterprise software with an SLA or a support contract (although if you need that then we can talk). As such, you need to temper your support expectations. I do take security very seriously, I learned a lot of this mentality at Microsoft in the mid-to-late 2000s, but unless I'm being paid for it you can't expect me to drop everything and change course just because .NET 7 transitions to "unsupported" status. It's fine to have a gap if there's not actually a security vulnerability to worry about. (I'm not making the assumption that you were being aggressive/entitled, I'm just making things clear)

[Rick Brewster]

3 hours ago, Rick Brewster said:

Every time I've done that sort of thing I ended up regretting it

 

Here are some examples, btw of huge issues in early releases of major .NET versions:

• The initial releases of .NET 6 were quite problematic for PDN v4.3.3, which was the first version that used .NET 6. I had .NET 5 for v4.3 - v4.3.2 and then naively believed I could just "push the button" and go straight to .NET 6 for a +0.0.1 release without a public beta testing period: Catastrophic regression introduced in .NET 6.0.1 WinForms, completely broke Paint.NET v4.3.6 #6464 https://github.com/dotnet/winforms/issues/6464
   
• .NET 7 was initially untenable for WinForms apps entirely and prevented me from shipping PDN 5.0 at all until it was fixed: Major regression in Form.ShowDialog(IWin32Window) in .NET 7 -- ship blocker for Paint.NET 5.0 #8280 https://github.com/dotnet/winforms/issues/8280
   
• And here's one that was a hard block on Paint.NET using .NET 8 or 8.0.1: ExecutionEngineException in WinForms app (Paint.NET) on .NET 8 RC2, which does not occur in .NET 7 (GCStress) #94579 https://github.com/dotnet/runtime/issues/94579. This affected any app that made use of COM interop, even indirectly, which means a LOT of WinForms and WPF apps were probably affected too.

In other words, please don't believe that "it needs to be on .NET 8 ASAP" is actually a good/smart idea. It's fine for PDN to be on .NET 7 until the PDN-on-8 release is ready, which will be soon.