Bump the all-dependencies group with 13 updates by dependabot[bot] · Pull Request #730 · sebastienros/yessql

The core driver and its companion packages ship together as version 7.0.3. Update the companion packages you use alongside the driver to 7.0.3. Assembly versions remain 7.0.0.0, unchanged from 7.0.2.

Companion package release notes

Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider 7.0.3
Microsoft.Data.SqlClient.Extensions.Azure 7.0.3 — includes the Entra ID authority parsing fix for Dataverse/Dynamics 365 connections.
Microsoft.Data.SqlClient.Extensions.Abstractions 7.0.3
Microsoft.Data.SqlClient.Internal.Logging 7.0.3

Changed

Updated the Microsoft.Data.SqlClient.SNI and Microsoft.Data.SqlClient.SNI.runtime dependencies to 6.0.3 (was 6.0.2).
(#4599)

Fixed

Fixed a SqlBulkCopy regression in environments where the application login cannot read sys.all_columns. Bulk copy now falls back to the earlier column-discovery behavior when that permission is unavailable. Support for hidden columns and SQL Graph column aliases still requires access to the metadata view.
(#4370, #4306, #4402)
Fixed a memory-allocation regression in connection and command operations caused by formatting diagnostic strings even when tracing was disabled. Also corrected trace messages that reported an incorrect object ID or could throw FormatException when traced values contained braces.
(#4528, #4533)
Fixed ServerCertificate validation on the managed SNI path so the configured certificate is compared against the server certificate even when the server certificate passes chain and host-name validation. When certificate validation is enabled, a missing, unreadable, or invalid certificate file, a certificate mismatch, or a missing server certificate now causes the TLS handshake to fail instead of bypassing the configured certificate check. (net8.0/net9.0 only)
(#4445, #4583)
Fixed Always Encrypted VSM/HGS enclave attestation to verify that the enclave public key used to establish a session matches the key committed to by the signed attestation report. Missing, malformed, or mismatched key-binding data now causes attestation to fail before the session secret is derived.
(#4532, #4553)
Fixed SqlConnection.AccessTokenCallback not disabling Transparent Network IP Resolution by default, making it consistent with SqlConnection.AccessToken. An explicitly configured TransparentNetworkIPResolution connection-string value still takes precedence. (net462 only)
(#4520, #4561)
Fixed authentication state handling so clearing SqlConnection.AccessToken, AccessTokenCallback, or SspiContextProvider preserves the other authentication values in the connection pool key. Cloning a connection or updating its credential also preserves its SspiContextProvider. Combining a non-null SspiContextProvider with AccessToken or AccessTokenCallback now throws InvalidOperationException instead of silently discarding authentication state; applications must use one authentication mechanism at a time.
(#4520, #4561, #4644)
Fixed configurable retry logic installing a permanent, process-wide assembly-resolution handler that could interfere with unrelated assembly loading. The handler is now active only while an explicitly configured custom retry provider is resolved and constructed, and probes AppContext.BaseDirectory instead of the current working directory. Place custom retry assemblies in the application base directory; dependencies loaded after provider construction must be resolvable through normal application dependency resolution or an application-provided handler. (net8.0/net9.0 only)
(#2214, #4547, #4663)

Contributors

We thank the following public contributors. Their efforts toward this project are very much appreciated.

edwardneal

Target Platform Support

.NET Framework 4.6.2+ (Windows x86, Windows x64, Windows ARM64)
.NET 8.0+ (Windows x86, Windows x64, Windows ARM, Windows ARM64, Linux, macOS)

... (truncated)

7.0.2

This update brings the following changes since the 7.0.1 release:

Important — package version alignment: Starting with 7.0.2, the Microsoft.Data.SqlClient driver and its companion packages share a single aligned version. The following packages now ship together as 7.0.2:

Microsoft.Data.SqlClient

Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider

Microsoft.Data.SqlClient.Extensions.Azure

Microsoft.Data.SqlClient.Extensions.Abstractions

Microsoft.Data.SqlClient.Internal.Logging

(Microsoft.SqlServer.Server continues to version independently and remains at 1.0.0.)

Applications must reference the same versions of Microsoft.Data.SqlClient and its extensions for best compatibility. In particular, applications that reference Microsoft.Data.SqlClient.Extensions.Azure must upgrade it to 7.0.2 when upgrading Microsoft.Data.SqlClient to 7.0.2.

Breaking change (.NET Framework only): As part of this alignment, the AssemblyVersion of Microsoft.Data.SqlClient.Extensions.Azure, Microsoft.Data.SqlClient.Extensions.Abstractions, and Microsoft.Data.SqlClient.Internal.Logging changed from 1.0.0.0 to 7.0.0.0 (the Microsoft.Data.SqlClient and Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider assembly versions are unchanged). On .NET Framework, AssemblyVersion is part of the strong-name identity, so applications that drop these assemblies into an existing deployment without rebuilding must rebuild against the 7.0.2 packages (or add binding redirects). Applications on .NET / .NET Core are not affected.

Companion package release notes

The following companion packages ship aligned as 7.0.2. See their individual release notes for package-specific changes (including the Microsoft.Data.SqlClient.Extensions.Azure WAM broker support):

Fixed

Fixed a NullReferenceException in SqlCommand.Cancel(). The diagnostic message built during cancellation dereferenced the active connection directly; it now uses a null-conditional access so cancellation no longer throws when the connection has already been torn down.
(#4372,#4373)
Fixed a NullReferenceException in SqlDataReader when calling GetBytes/GetChars with a null destination buffer. The argument-validation path that constructs the InvalidDestinationBufferIndex exception now guards against the null buffer so the correct ArgumentException is surfaced instead of an NRE.
(#4159,#4206)
Fixed Always Encrypted column master key signature verification incorrectly reusing cached results. The SignatureVerificationCache lookup logic was corrected so signature verification outcomes are cached and retrieved against the correct key, preventing stale or mismatched verification results.
(#4339,#4343)

Changed

Hardened TDS token parsing with data-length bounds checks

What Changed:

Added bounds checking when parsing TDS token and feature-extension-acknowledgment data lengths. The parser now validates the declared length of incoming token data against the available buffer before reading, rejecting malformed or out-of-range length values instead of reading past the intended boundary.
(#4340,#4358)

Who Benefits:

All consumers benefit from improved resilience against malformed or hostile TDS responses. A server (or man-in-the-middle) ...

Description has been truncated

Bumps Dapper.StrongName from 2.1.79 to 2.1.86 Bumps Meziantou.Analyzer from 3.0.109 to 3.0.257 Bumps Microsoft.AspNetCore.TestHost from 8.0.28 to 8.0.31 Bumps Microsoft.Data.SqlClient from 7.0.1 to 7.0.3 Bumps Microsoft.Data.Sqlite.Core from 10.0.9 to 10.0.12 Bumps Microsoft.SourceLink.GitHub from 10.0.300 to 10.0.401 Bumps MySqlConnector from 2.5.0 to 2.6.2 Bumps Parlot from 1.5.7 to 1.5.9 Bumps SQLitePCLRaw.bundle_e_sqlite3 from 3.0.3 to 3.0.5 Bumps Testcontainers.MsSql from 4.12.0 to 4.15.0 Bumps Testcontainers.MySql from 4.12.0 to 4.15.0 Bumps Testcontainers.PostgreSql from 4.12.0 to 4.15.0 Bumps xunit.v3.mtp-v2 from 3.2.2 to 4.0.1 --- updated-dependencies: - dependency-name: Dapper.StrongName dependency-version: 2.1.86 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: Meziantou.Analyzer dependency-version: 3.0.257 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: Microsoft.AspNetCore.TestHost dependency-version: 8.0.31 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: Microsoft.Data.SqlClient dependency-version: 7.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: Microsoft.Data.Sqlite.Core dependency-version: 10.0.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: Microsoft.SourceLink.GitHub dependency-version: 10.0.401 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: MySqlConnector dependency-version: 2.6.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: Parlot dependency-version: 1.5.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: SQLitePCLRaw.bundle_e_sqlite3 dependency-version: 3.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: Testcontainers.MsSql dependency-version: 4.15.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: Testcontainers.MySql dependency-version: 4.15.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: Testcontainers.PostgreSql dependency-version: 4.15.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: xunit.v3.mtp-v2 dependency-version: 4.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: all-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Sep 14, 2026

dependabot Bot mentioned this pull request Sep 14, 2026

Bump the all-dependencies group with 12 updates #729

Closed

sebastienros merged commit 937fa70 into main Sep 14, 2026
11 checks passed

sebastienros deleted the dependabot/nuget/src/all-dependencies-a1f1392d63 branch September 14, 2026 21:27

Navigation Menu

Uh oh!

Bump the all-dependencies group with 13 updates - #730

Bump the all-dependencies group with 13 updates#730
sebastienros merged 1 commit into
mainfrom
dependabot/nuget/src/all-dependencies-a1f1392d63

dependabot Bot commented on behalf of github Sep 14, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 14, 2026

2.1.86

What's Changed

3.0.257

What's Changed

3.0.256

What's Changed

3.0.255

What's Changed

3.0.254

What's Changed

3.0.253

What's Changed

3.0.252

What's Changed

3.0.251

What's Changed

3.0.250

What's Changed

3.0.249

What's Changed

3.0.248

What's Changed

3.0.247

What's Changed

3.0.246

What's Changed

3.0.245

What's Changed

3.0.244

What's Changed

3.0.243

What's Changed

3.0.242

What's Changed

3.0.241

What's Changed

3.0.240

What's Changed

3.0.239

What's Changed

3.0.238

What's Changed

3.0.237

What's Changed

3.0.236

What's Changed

3.0.235

What's Changed

3.0.234

What's Changed

3.0.233

What's Changed

3.0.232

What's Changed

3.0.231

What's Changed

3.0.230

What's Changed

3.0.229

What's Changed

3.0.228

What's Changed

3.0.227

What's Changed

3.0.226

What's Changed

3.0.225

What's Changed

3.0.224

What's Changed

3.0.223

What's Changed

3.0.222

What's Changed

3.0.221

What's Changed

3.0.220