[6.0] Dependency Cleanup #3840

paulmedynski · 2025-12-10T23:32:17Z

Description

Removed unused dependencies across all driver and test projects.
Updated some dependencies, avoiding transitive vulnerabilities.
Updated nuspec files to remove/update dependencies accordingly.

Details

MDS

Package	Target Framework	Previous Dependency Type	Previous Version	Current Dependency Type	Current Version
Microsoft.Bcl.Cryptography	net462, net8.0, net9.0	Direct	8.0.0	None
Microsoft.Extensions.Caching.Memory	net9.0	Direct	9.0.4	Direct	9.0.11
Microsoft.IdentityModel.JsonWebTokens	net462, net8.0, net9.0	Direct	7.5.0	Direct	7.7.1
Microsoft.IdentityModel.Protocols.OpenIdConnect	net462, net8.0, net9.0	Direct	7.5.0	Direct	7.7.1
System.Buffers	net462	Direct	4.5.1	Direct	4.6.1
System.Text.Encodings.Web	net462	Direct	8.0.0	Transitive	8.0.0
System.Text.Json	net462	Direct	8.0.5	Direct	8.0.6

AKV

Package	Target Framework	Previous Dependency Type	Previous Version	Current Dependency Type	Current Version
Microsoft.Extensions.Caching.Memory	net9.0	Direct	9.0.4	Direct	9.0.11
System.Text.Encodings.Web	net462	Direct	8.0.0	Transitive	8.0.0
System.Text.Encodings.Web	net8.0, net9.0	Direct	8.0.0	None

Issues

Resolves #3808.

Testing

CI will validate the changes.
Manually inspected the full package dependency tree for the driver projects to ensure no major version increments.
Manuall inspected CI runs to observe that tests are being executed for the expected target frameworks and architectures.

- Updated some dependencies, avoiding transitive vulnerabilities. - Updated nuspec files to remove/update dependencies accordingly.

paulmedynski · 2025-12-10T23:34:09Z

...sts/tools/Microsoft.Data.SqlClient.ExtUtilities/Microsoft.Data.SqlClient.ExtUtilities.csproj

    <PackageReference Include="Newtonsoft.Json" Version="$(NewtonsoftJsonVersion)" />
    <PackageReference Include="Microsoft.SqlServer.SqlManagementObjects" Version="$(MicrosoftSqlServerSqlManagementObjectsVersion)" />
+    <!--
+      Explicitly reference the latest published MDS 5.1.x version here to avoid


This took a long time to figure out.

Copilot

Pull request overview

This pull request performs a comprehensive dependency cleanup for the 6.0 branch, removing unused dependencies and updating others to address security vulnerabilities. The changes ensure consistency across NuGet package specifications, version property files, and project references for both the main SqlClient driver and the AlwaysEncrypted AzureKeyVaultProvider add-on.

Key changes include:

Removal of unused dependencies (Microsoft.Bcl.Cryptography, System.Text.Encodings.Web, and several test-only packages)
Updates to identity and security-related packages (Microsoft.IdentityModel.* from 7.5.0 to 7.7.1, Azure.* packages, System.Buffers, System.Text.Json)
Addition of an explicit MDS 5.1.8 reference in ExtUtilities to mitigate vulnerable transitive dependencies
Change from version ranges to fixed versions for Azure.Core and Azure.Security.KeyVault.Keys in the AKV provider

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tools/specs/add-ons/Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider.nuspec	Updated Azure.Core and Azure.Security.KeyVault.Keys from version ranges to fixed versions; updated Microsoft.Extensions.Caching.Memory for net9.0
tools/specs/Microsoft.Data.SqlClient.nuspec	Removed Microsoft.Bcl.Cryptography and System.Text.Encodings.Web; updated Microsoft.IdentityModel.*, System.Buffers, System.Text.Json, and Microsoft.Extensions.Caching.Memory versions
tools/props/VersionsNet9OrLater.props	Removed Microsoft.Bcl.Cryptography version property; updated Microsoft.Extensions.Caching.Memory to 9.0.11
tools/props/Versions.props	Removed properties for unused dependencies (Microsoft.Bcl.Cryptography, System.Text.Encodings.Web, test dependencies); updated versions for IdentityModel, System.Buffers, System.Text.Json, Azure packages, and test SDKs
src/Microsoft.Data.SqlClient/tests/tools/Microsoft.Data.SqlClient.TestUtilities/Microsoft.Data.SqlClient.TestUtilities.csproj	Removed unused System.Formats.Asn1 and System.Security.Cryptography.Cng package references
src/Microsoft.Data.SqlClient/tests/tools/Microsoft.Data.SqlClient.ExtUtilities/Microsoft.Data.SqlClient.ExtUtilities.csproj	Added explicit MDS 5.1.8 reference with explanatory comment to avoid vulnerable transitive dependency
src/Microsoft.Data.SqlClient/tests/ManualTests/Microsoft.Data.SqlClient.ManualTesting.Tests.csproj	Removed Microsoft.Bcl.Cryptography package reference
src/Microsoft.Data.SqlClient/tests/FunctionalTests/Microsoft.Data.SqlClient.Tests.csproj	Removed Microsoft.Bcl.Cryptography package reference
src/Microsoft.Data.SqlClient/netfx/src/Microsoft.Data.SqlClient.csproj	Removed System.Text.Encodings.Web and Microsoft.Bcl.Cryptography package references
src/Microsoft.Data.SqlClient/netfx/ref/Microsoft.Data.SqlClient.csproj	Removed System.Text.Encodings.Web and Microsoft.Bcl.Cryptography package references
src/Microsoft.Data.SqlClient/netcore/src/Microsoft.Data.SqlClient.csproj	Removed Microsoft.Bcl.Cryptography package reference
src/Microsoft.Data.SqlClient/netcore/ref/Microsoft.Data.SqlClient.csproj	Removed Microsoft.Bcl.Cryptography package reference
src/Microsoft.Data.SqlClient/add-ons/AzureKeyVaultProvider/Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider.csproj	Removed System.Text.Encodings.Web package reference

tools/specs/add-ons/Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider.nuspec

paulmedynski · 2025-12-11T13:07:35Z

/azp run

azure-pipelines · 2025-12-11T13:07:55Z

Azure Pipelines successfully started running 2 pipeline(s).

codecov · 2025-12-11T14:36:39Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 62.59%. Comparing base (fd34d5e) to head (a3b7550).

Additional details and impacted files

@@             Coverage Diff              @@
##           release/6.0    #3840   +/-   ##
============================================
  Coverage        62.58%   62.59%           
============================================
  Files              285      285           
  Lines            59152    59152           
============================================
+ Hits             37019    37024    +5     
+ Misses           22133    22128    -5

Flag	Coverage Δ
addons	`92.58% <ø> (ø)`
netcore	`67.94% <ø> (+0.01%)`	⬆️
netfx	`63.66% <ø> (+0.02%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

…Text.Json 8.

mdaigle · 2025-12-11T22:12:33Z

src/Microsoft.Data.SqlClient/netcore/ref/Microsoft.Data.SqlClient.csproj

    <PackageReference Include="Microsoft.IdentityModel.JsonWebTokens" Version="$(MicrosoftIdentityModelJsonWebTokensVersion)" />
    <PackageReference Include="System.Configuration.ConfigurationManager" Version="$(SystemConfigurationConfigurationManagerVersion)" />
    <PackageReference Include="System.Security.Cryptography.Pkcs" Version="$(SystemSecurityCryptographyPkcsVersion)" />
-    <PackageReference Include="Microsoft.Bcl.Cryptography" Version="$(MicrosoftBclCryptographyVersion)" />


This is supposed to provide the System.Security.Cryptography.X509Certificates.X509CertificateLoader type, which became required in .NET 9. But because we ended up only making the change conditionally for .NET 9, Framework code was unchanged and didn't need this type: https://github.com/dotnet/SqlClient/blob/main/src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/VirtualSecureModeEnclaveProvider.cs#L172

Yes, saw the #if NET_9_0_Or_Greater conditionals and was able to remove this package without incident.

mdaigle · 2025-12-11T22:16:01Z

tools/props/Versions.props

    <MicrosoftExtensionsHosting>8.0.1</MicrosoftExtensionsHosting>
    <MicrosoftNETFrameworkReferenceAssembliesVersion>1.0.3</MicrosoftNETFrameworkReferenceAssembliesVersion>
-    <MicrosoftNETTestSdkVersion>17.11.1</MicrosoftNETTestSdkVersion>
+    <MicrosoftNETTestSdkVersion>17.12.0</MicrosoftNETTestSdkVersion>


👀 note to self to double check that tests still run

Please do - I eyeballed a bunch of the jobs, and tests are running. I didn't do an exhaustive comparison with a previous run.

mdaigle · 2025-12-11T22:28:26Z

tools/specs/Microsoft.Data.SqlClient.nuspec

+        <dependency id="Microsoft.IdentityModel.JsonWebTokens" version="7.7.1" />
+        <dependency id="Microsoft.IdentityModel.Protocols.OpenIdConnect" version="7.7.1" />
+        <dependency id="System.Buffers" version="4.6.1" />
        <dependency id="System.Security.Cryptography.Pkcs" version="8.0.1"/>


I think we get System.Security.Cryptography.Pkcs for free in net462: https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.pkcs?view=netframework-4.6.2

- Cleaned up MSS project and package refs.

Copilot

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated no new comments.

- Removed unused dependencies across all driver and test projects.

06268d1

- Updated some dependencies, avoiding transitive vulnerabilities. - Updated nuspec files to remove/update dependencies accordingly.

Copilot AI review requested due to automatic review settings December 10, 2025 23:32

paulmedynski added this to the 6.0.5 milestone Dec 10, 2025

Copilot started reviewing on behalf of paulmedynski December 10, 2025 23:32 View session

paulmedynski commented Dec 10, 2025

View reviewed changes

Copilot AI reviewed Dec 10, 2025

View reviewed changes

paulmedynski linked an issue Dec 11, 2025 that may be closed by this pull request

[6.0] Remove unused dependencies #3808

Open

paulmedynski marked this pull request as ready for review December 11, 2025 15:27

paulmedynski requested a review from a team as a code owner December 11, 2025 15:27

- Backpedaled on the AKV package upgrades since they bring in Syatem.…

609e8e9

…Text.Json 8.

mdaigle reviewed Dec 11, 2025

View reviewed changes

- Removed Pkcs package from .NET Framework.

a3b7550

- Cleaned up MSS project and package refs.

Copilot AI review requested due to automatic review settings December 12, 2025 20:02

Copilot started reviewing on behalf of paulmedynski December 12, 2025 20:02 View session

Copilot AI reviewed Dec 12, 2025

View reviewed changes

mdaigle approved these changes Dec 15, 2025

View reviewed changes

apoorvdeshmukh approved these changes Dec 16, 2025

View reviewed changes

[6.0] Dependency Cleanup #3840

Are you sure you want to change the base?

[6.0] Dependency Cleanup #3840

Uh oh!

Conversation

paulmedynski commented Dec 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Details

MDS

AKV

Issues

Testing

Uh oh!

paulmedynski Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

paulmedynski commented Dec 11, 2025

Uh oh!

azure-pipelines bot commented Dec 11, 2025

Uh oh!

codecov bot commented Dec 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

mdaigle Dec 11, 2025

Choose a reason for hiding this comment

Uh oh!

paulmedynski Dec 12, 2025

Choose a reason for hiding this comment

Uh oh!

mdaigle Dec 11, 2025

Choose a reason for hiding this comment

Uh oh!

paulmedynski Dec 12, 2025

Choose a reason for hiding this comment

Uh oh!

mdaigle Dec 11, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

paulmedynski commented Dec 10, 2025 •

edited

Loading

codecov bot commented Dec 11, 2025 •

edited

Loading