[6.1] Dependency Cleanup #3843

paulmedynski · 2025-12-12T14:06:12Z

Description

Removed unused dependencies across all driver and test projects.
Updated some dependencies, avoiding transitive vulnerabilities.
Updated nuspec files to remove/update dependencies accordingly.

Details

MDS

Package	Target Framework	Previous Dependency Type	Previous Version	Current Dependency Type	Current Version
Azure.Core	net462, net8.0, net9.0	Direct	1.47.1	Direct	1.50.0
Azure.Identity	net462, net8.0, net9.0	Direct	1.14.2	Direct	1.17.0
Microsoft.Bcl.Cryptography	net8.0, net9.0	Direct	8.0.0	None
Microsoft.Extensions.Caching.Memory	net9.0	Direct	9.0.5	Direct	9.0.11
System.Buffers	net462	Direct	4.5.1	Direct	4.6.1
System.Configuration.ConfigurationManager	net9.0	Direct	9.0.5	Direct	9.0.11
System.Security.Cryptography.Pkcs	net9.0	Direct	9.0.5	Direct	9.0.11
System.Text.Json	net462	Direct	8.0.5	Direct	8.0.6
System.Text.Json	net8.0, net9.0	Direct	8.0.5	None

AKV

Package	Target Framework	Previous Dependency Type	Previous Version	Current Dependency Type	Current Version
Azure.Core	net462, net8.0, net9.0	Direct	1.47.1	Direct	1.50.0
Azure.Security.KeyVault.Keys	net462, net8.0, net9.0	Direct	4.7.0	Direct	4.8.0
Microsoft.Extensions.Caching.Memory	net9.0	Direct	9.0.5	Direct	9.0.11
System.Text.Encodings.Web	net462	Direct	8.0.0	Transitive	8.0.0
System.Text.Encodings.Web	net8.0, net9.0	Direct	8.0.0	None

Issues

Resolves #3807.

Testing

CI will validate the changes.
Manually inspected the full package dependency tree for the driver projects to ensure no major version increments.
Manuall inspected CI runs to observe that tests are being executed for the expected target frameworks and architectures.

- Updated some dependencies, avoiding transitive vulnerabilities. - Updated nuspec files to remove/update dependencies accordingly.

Copilot

Pull request overview

This PR performs a dependency cleanup across the Microsoft.Data.SqlClient driver and related test projects. The changes update several dependencies to address transitive vulnerabilities, remove unused dependencies (Microsoft.Bcl.Cryptography, System.Memory, System.Text.Encodings.Web), and update nuspec files to reflect the new dependency structure. The code changes suppress warnings for deliberately used obsolete APIs in Azure Active Directory authentication methods.

Removed unused dependencies: Microsoft.Bcl.Cryptography, System.Memory, and System.Text.Encodings.Web across driver and test projects
Updated Azure and identity-related packages to newer versions (Azure.Core 1.50.0, Azure.Identity 1.17.0, Azure.Security.KeyVault.Keys 4.8.0)
Updated System.Buffers from 4.5.1 to 4.6.1 and System.Text.Json from 8.0.5 to 8.0.6 for net462
Added pragma warning suppressions for obsolete APIs in authentication code

Reviewed changes

Copilot reviewed 17 out of 17 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
tools/specs/add-ons/Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider.nuspec	Updated Azure package dependencies and Microsoft.Extensions.Caching.Memory for net9.0 to 9.0.11
tools/specs/Microsoft.Data.SqlClient.nuspec	Updated multiple dependencies across all target frameworks; removed Microsoft.Bcl.Cryptography, System.Text.Encodings.Web, and System.Text.Json from various targets
src/Microsoft.Data.SqlClient/tests/tools/Microsoft.Data.SqlClient.TestUtilities/Microsoft.Data.SqlClient.TestUtilities.csproj	Removed unused Microsoft.Bcl.Cryptography dependency
src/Microsoft.Data.SqlClient/tests/tools/Microsoft.Data.SqlClient.ExtUtilities/Microsoft.Data.SqlClient.ExtUtilities.csproj	Changed approach from pinning System.Formats.Asn1 to referencing MDS 5.1.8 to avoid transitive vulnerability
src/Microsoft.Data.SqlClient/tests/ManualTests/SQL/ConnectivityTests/AADConnectionTest.cs	Added pragma warning suppressions for obsolete AcquireTokenByUsernamePassword API
src/Microsoft.Data.SqlClient/tests/ManualTests/Microsoft.Data.SqlClient.ManualTesting.Tests.csproj	Removed unused Microsoft.Bcl.Cryptography dependency
src/Microsoft.Data.SqlClient/tests/ManualTests/DataCommon/DataTestUtility.cs	Added pragma warning suppressions for obsolete AcquireTokenByUsernamePassword API
src/Microsoft.Data.SqlClient/tests/FunctionalTests/Microsoft.Data.SqlClient.FunctionalTests.csproj	Removed unused Microsoft.Bcl.Cryptography dependency
src/Microsoft.Data.SqlClient/tests/Directory.Packages.props	Changed approach to reference MDS 5.1.8 instead of pinning System.Formats.Asn1
src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/ActiveDirectoryAuthenticationProvider.cs	Added pragma warning suppressions for obsolete APIs (AcquireTokenByUsernamePassword and SharedTokenCacheUsername)
src/Microsoft.Data.SqlClient/src/Microsoft.Data.SqlClient.csproj	Removed unused Microsoft.Bcl.Cryptography and System.Memory dependencies
src/Microsoft.Data.SqlClient/netfx/src/Microsoft.Data.SqlClient.csproj	Removed unused Microsoft.Bcl.Cryptography and System.Text.Encodings.Web dependencies
src/Microsoft.Data.SqlClient/netfx/ref/Microsoft.Data.SqlClient.csproj	Removed unused Microsoft.Bcl.Cryptography and System.Text.Encodings.Web dependencies
src/Microsoft.Data.SqlClient/netcore/src/Microsoft.Data.SqlClient.csproj	Removed unused Microsoft.Bcl.Cryptography dependency and System.Text.Json reference (provided by framework)
src/Microsoft.Data.SqlClient/netcore/ref/Microsoft.Data.SqlClient.csproj	Removed unused Microsoft.Bcl.Cryptography dependency and System.Text.Json reference (provided by framework)
src/Microsoft.Data.SqlClient/add-ons/AzureKeyVaultProvider/Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider.csproj	Removed unused System.Text.Encodings.Web dependency
src/Directory.Packages.props	Updated package versions and reorganized framework-specific dependencies; removed System.Memory and some test dependencies; updated Microsoft.NET.Test.Sdk, xunit, and other test packages

tools/specs/Microsoft.Data.SqlClient.nuspec

tools/specs/add-ons/Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider.nuspec

tools/specs/Microsoft.Data.SqlClient.nuspec

paulmedynski

Commentary for reviewers.

paulmedynski · 2025-12-12T14:56:08Z

tools/specs/Microsoft.Data.SqlClient.nuspec

+        <dependency id="Azure.Identity" version="1.17.0" />
        <dependency id="Microsoft.Data.SqlClient.SNI.runtime" version="6.0.2" exclude="Compile" />
-        <dependency id="Microsoft.Extensions.Caching.Memory" version="9.0.4" exclude="Compile" />
+        <dependency id="Microsoft.Extensions.Caching.Memory" version="8.0.1" exclude="Compile" />


These 9.0.4 versions were incorrect. The .NET Standard 2.0 target shares the .NET 8.0 package versions.

…to avoid strong-name errors. - Added System.Text.Json back for .NET Standard 2.0.

paulmedynski · 2025-12-12T16:10:41Z

.../AzureKeyVaultProvider/Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider.csproj

  </ItemGroup>
  <ItemGroup>
    <PackageReference Include="Azure.Core" />
-    <PackageReference Include="System.Text.Encodings.Web" />


Not used directly, likely an old transient vulnerability fix.

Were you thinking of doing an akv release for this?

I don't think it should be necessary. This is a dependency that will be included via Azure.Core

paulmedynski · 2025-12-12T16:10:50Z

src/Microsoft.Data.SqlClient/netcore/ref/Microsoft.Data.SqlClient.csproj

  <ItemGroup>
    <PackageReference Include="Azure.Core" />
    <PackageReference Include="Azure.Identity" />
-    <PackageReference Include="Microsoft.Bcl.Cryptography" />


Not used directly, likely an old transient vulnerability fix.

paulmedynski · 2025-12-12T16:11:41Z

src/Microsoft.Data.SqlClient/netfx/ref/Microsoft.Data.SqlClient.csproj

    <Reference Include="System.Data" />
    <Reference Include="System.Xml" />
    <Reference Include="System.Runtime.Caching" />
-    <Reference Include="System.EnterpriseServices" />


Re-ordered to match the sibling src project.

paulmedynski · 2025-12-12T16:16:42Z

src/Microsoft.Data.SqlClient/netfx/ref/Microsoft.Data.SqlClient.csproj

    <PackageReference Include="Microsoft.Extensions.Caching.Memory" />
    <PackageReference Include="Microsoft.IdentityModel.JsonWebTokens" />
    <PackageReference Include="Microsoft.IdentityModel.Protocols.OpenIdConnect" />
+    <PackageReference Include="Microsoft.SqlServer.Server" />


Hmmm... was this omitted previously because the Microsoft.SqlServer.Server namespace and all its types already exist within .NET Framework already? I see a TypeForwards.cs file that is used only for .NET Framework, but it isn't clear where this type's forward to.

paulmedynski · 2025-12-12T16:20:21Z

src/Microsoft.Data.SqlClient/netfx/ref/Microsoft.Data.SqlClient.csproj

    <PackageReference Include="Microsoft.IdentityModel.Protocols.OpenIdConnect" />
+    <PackageReference Include="Microsoft.SqlServer.Server" />
    <PackageReference Include="System.Buffers" />
-    <PackageReference Include="System.Data.Common" />


Not used directly, likely an old transient vulnerability fix.

It was added with PR: https://github.com/dotnet/SqlClient/pull/2967/files#diff-d6cdac7c9f92790e995dce24e966c09119385fdc076757b8f70b08bd14dde23fR47 since in .NET Framework v4.6.2 the type referenced by us from this namespace (IDbColumnSchemaGenerator) is not available directly in BCL and downloading this package with NuGet is required for applications to work. I would not recommend removing this dependency due to that reason.

Is this a case where testing using .NET Framework Runtime 4.6.2 would have produced an error? But testing with .NET Framework Runtime 4.8.1 (which is what we do) doesn't?

paulmedynski · 2025-12-12T16:21:11Z

src/Microsoft.Data.SqlClient/netfx/src/Microsoft.Data.SqlClient.csproj

  <PropertyGroup>
    <DefineConstants>$(DefineConstants);NETFRAMEWORK;</DefineConstants>
  </PropertyGroup>
-  <ItemGroup>


Moved below to match the sibling ref project grouping.

…T Framework project. - Inhibiting dependency on Microsoft.SqlServer.Server in UDT test projects for .NET Framework. - Fixed duplicate MDS package version in test utilities.

Copilot

Pull request overview

Copilot reviewed 22 out of 22 changed files in this pull request and generated 1 comment.

src/Directory.Packages.props

codecov · 2025-12-12T18:17:54Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.82%. Comparing base (8291391) to head (b3dae93).

Additional details and impacted files

@@               Coverage Diff                @@
##           release/6.1    #3843       +/-   ##
================================================
+ Coverage        62.83%   90.82%   +27.99%     
================================================
  Files              279        6      -273     
  Lines            53293      316    -52977     
================================================
- Hits             33484      287    -33197     
+ Misses           19809       29    -19780

Flag	Coverage Δ
addons	`90.82% <ø> (ø)`
netcore	`?`
netfx	`?`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

paulmedynski · 2025-12-12T17:34:50Z

...crosoft.Data.SqlClient/tests/FunctionalTests/Microsoft.Data.SqlClient.FunctionalTests.csproj

    <ProjectReference Include="$(AddOnsPath)AzureKeyVaultProvider\Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider.csproj" />
    <ProjectReference Condition="'$(TargetGroup)'=='netcoreapp' AND $(ReferenceType)=='Project'" Include="$(NetCoreSource)src\Microsoft.Data.SqlClient.csproj" />
    <ProjectReference Condition="'$(TargetGroup)'=='netfx' AND $(ReferenceType)=='Project'" Include="$(NetFxSource)src\Microsoft.Data.SqlClient.csproj" />
-    <ProjectReference Condition="!$(ReferenceType.Contains('Package'))" Include="$(SqlServerSource)Microsoft.SqlServer.Server.csproj" />


Not used by this project.

paulmedynski · 2025-12-12T17:36:04Z

src/Microsoft.Data.SqlClient/tests/ManualTests/SQL/UdtTest/UDTs/Address/Address.csproj

  <ItemGroup>
    <ProjectReference Condition="'$(TargetGroup)'=='netcoreapp' AND $(ReferenceType)=='Project'" Include="$(NetCoreSource)src\Microsoft.Data.SqlClient.csproj" />
    <ProjectReference Condition="'$(TargetGroup)'=='netfx' AND $(ReferenceType)=='Project'" Include="$(NetFxSource)src\Microsoft.Data.SqlClient.csproj" />
-    <ProjectReference Condition="!$(ReferenceType.Contains('Package'))" Include="$(SqlServerSource)Microsoft.SqlServer.Server.csproj" />


These project refs were polluting the artifacts with un-signed Microsoft.SqlServer.Server DLLs that .NET Framework was refusing to load. I changed them to package refs to avoid this. We never need a project ref for MSS here.

paulmedynski · 2025-12-12T17:36:35Z

...s/tools/Microsoft.Data.SqlClient.TestUtilities/Microsoft.Data.SqlClient.TestUtilities.csproj

    <None Update="config.json">
      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
    </None>
-    <PackageReference Include="Azure.Identity" />


Not used by this project.

paulmedynski · 2025-12-12T17:36:49Z

src/Microsoft.Data.SqlClient/tests/UnitTests/Microsoft.Data.SqlClient.UnitTests.csproj

      <PrivateAssets>all</PrivateAssets>
    </PackageReference>
    <PackageReference Include="Microsoft.DotNet.XUnitExtensions" />
-    <PackageReference Include="Microsoft.SqlServer.Server" />


Not used by this project.

mdaigle · 2025-12-15T19:23:28Z

.../AzureKeyVaultProvider/Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider.csproj

  </ItemGroup>
  <ItemGroup>
    <PackageReference Include="Azure.Core" />
-    <PackageReference Include="System.Text.Encodings.Web" />


Were you thinking of doing an akv release for this?

cheenamalhotra · 2025-12-16T01:59:33Z

src/Microsoft.Data.SqlClient/netfx/ref/Microsoft.Data.SqlClient.csproj

    <PackageReference Include="Microsoft.IdentityModel.Protocols.OpenIdConnect" />
    <PackageReference Include="System.Buffers" />
-    <PackageReference Include="System.Data.Common" />
-    <PackageReference Include="System.Security.Cryptography.Pkcs" />


This package is referenced in

SqlClient/src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/VirtualSecureModeEnclaveProviderBase.cs

Line 9 in deb8c31

using System.Security.Cryptography.Pkcs;

I would recommend we keep this explicit reference included.

cheenamalhotra · 2025-12-16T02:19:09Z

src/Microsoft.Data.SqlClient/netfx/src/Microsoft.Data.SqlClient.csproj

+    <Reference Include="System.Xml" />
+    <Reference Include="System.Runtime.Caching" />
+    <Reference Include="System.Transactions" />
+    <Reference Include="System.EnterpriseServices" />


If you need EnterpriseServices here, might as well keep them in ref as well?

It's there - line 32.

cheenamalhotra · 2025-12-16T02:21:41Z

src/Microsoft.Data.SqlClient/netfx/src/Microsoft.Data.SqlClient.csproj

    <PackageReference Include="Microsoft.IdentityModel.Protocols.OpenIdConnect" />
    <PackageReference Include="System.Buffers" />
-    <PackageReference Include="System.Security.Cryptography.Pkcs" />
-    <PackageReference Include="System.Text.Encodings.Web" />


Removing System.Text.Encodings.Web seems fine, however we should be including "System.IdentityModel.Tokens.Jwt" NuGet package as we have a direct usage of it here:

SqlClient/src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/AzureAttestationBasedEnclaveProvider.cs

Line 8 in deb8c31

using System.IdentityModel.Tokens.Jwt;

- Removed unused dependencies across all driver and test projects.

b1eb044

- Updated some dependencies, avoiding transitive vulnerabilities. - Updated nuspec files to remove/update dependencies accordingly.

Copilot AI review requested due to automatic review settings December 12, 2025 14:06

Copilot started reviewing on behalf of paulmedynski December 12, 2025 14:06 View session

Copilot AI reviewed Dec 12, 2025

View reviewed changes

paulmedynski commented Dec 12, 2025

View reviewed changes

- Replaced Microsoft.SqlServer.Server project refs with package refs …

e942a0b

…to avoid strong-name errors. - Added System.Text.Json back for .NET Standard 2.0.

paulmedynski commented Dec 12, 2025

View reviewed changes

- Reverting the addition of Microsoft.SqlServer.Server to the MDS .NE…

bfaef22

…T Framework project. - Inhibiting dependency on Microsoft.SqlServer.Server in UDT test projects for .NET Framework. - Fixed duplicate MDS package version in test utilities.

Copilot AI review requested due to automatic review settings December 12, 2025 16:46

Copilot started reviewing on behalf of paulmedynski December 12, 2025 16:47 View session

Copilot AI reviewed Dec 12, 2025

View reviewed changes

src/Directory.Packages.props Show resolved Hide resolved

paulmedynski marked this pull request as ready for review December 12, 2025 19:26

paulmedynski requested a review from a team as a code owner December 12, 2025 19:26

paulmedynski commented Dec 12, 2025

View reviewed changes

- Removed Pkcs from .NET Framework.

b3dae93

paulmedynski linked an issue Dec 12, 2025 that may be closed by this pull request

[6.1] Remove unused dependencies #3807

Open

mdaigle approved these changes Dec 15, 2025

View reviewed changes

cheenamalhotra reviewed Dec 16, 2025

View reviewed changes

[6.1] Dependency Cleanup #3843

Are you sure you want to change the base?

[6.1] Dependency Cleanup #3843

Uh oh!

Conversation

paulmedynski commented Dec 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Details

MDS

AKV

Issues

Testing

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

paulmedynski left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cheenamalhotra Dec 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

codecov bot commented Dec 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cheenamalhotra Dec 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

paulmedynski commented Dec 12, 2025 •

edited

Loading

cheenamalhotra Dec 16, 2025 •

edited

Loading

codecov bot commented Dec 12, 2025 •

edited

Loading

cheenamalhotra Dec 16, 2025 •

edited

Loading