[5.1] Dependency Cleanup #3838

paulmedynski · 2025-12-10T11:46:37Z

Description

Removed unused dependencies across all driver and test projects.
Updated some dependencies, avoiding transitive vulnerabilities.
Updated nuspec files to remove/update dependencies accordingly.

NOTE: Some packages have DOWNGRADED major versions due to migrating from Direct dependencies to Transitive dependencies. This will have no effect on downstream apps, since the intermediate packages were already compatible with the previous Direct dependency versions. If apps were directly using those packages at-or-above the previous versions, NuGet will automatically resolve the transitive dependencies as it was doing before.

Details

MDS

Package	Target Framework	Previous Dependency Type	Previous Version	Current Dependency Type	Current Version
Microsoft.Bcl.AsyncInterfaces	net462	Transitive	6.0.0	Transitive	1.1.1
System.Buffers	net462	Direct	4.5.1	Direct	4.6.1
System.Buffers	netstandard2.0	Direct	4.5.1	Direct	4.6.1
System.Diagnostics.DiagnosticSource	net6.0	Direct	6.0.1	Transitive	6.0.1
System.Text.Encodings.Web	net462	Direct	6.0.1	Transitive	4.7.2
System.Text.Encodings.Web	net6.0	Direct	6.0.1	Transitive	4.7.2
System.Text.Encodings.Web	netstandard2.0	Direct	6.0.1	Transitive	4.7.2
System.Text.Encodings.Web	netstandard2.1	Direct	6.0.1	Transitive	4.7.2
System.Text.Json	net462	Direct	6.0.11	Transitive	4.7.2

AKV

Package	Target Framework	Previous Dependency Type	Previous Version	Current Dependency Type	Current Version
System.Buffers	net462	Direct	4.5.1	Direct	4.6.1
System.Buffers	netstandard2.0	Direct	4.5.1	Direct	4.6.1
System.Text.Encodings.Web	net462	Direct	6.0.1	Transitive	4.7.2
System.Text.Encodings.Web	net6.0	Direct	6.0.1	Transitive	4.7.2
System.Text.Encodings.Web	netstandard2.0	Direct	6.0.1	Transitive	4.7.2

Issues

Resolves #3809.

Testing

CI will validate the changes.
Manually inspected the full package dependency tree for the driver projects to ensure no major version increments.
Manuall inspected CI runs to observe that tests are being executed for the expected target frameworks and architectures.

- Updated some dependencies to avoid transitive vulnerabilities.

Copilot

Pull request overview

This PR removes unused dependencies and updates some dependency versions across the Microsoft.Data.SqlClient driver and test projects to eliminate transitive vulnerabilities without introducing breaking changes.

Key Changes:

Removed unused dependencies (System.Text.Encodings.Web, System.Text.Json, System.Diagnostics.DiagnosticSource, System.Private.Uri, Microsoft.Win32.Registry)
Updated test and common dependency versions (e.g., Microsoft.NET.Test.Sdk, Newtonsoft.Json, System.Buffers, Microsoft.Extensions.Hosting)
Reorganized and improved comments in Versions.props for better clarity

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
tools/specs/add-ons/Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider.nuspec	Removed `System.Text.Encodings.Web` dependency from all target frameworks
tools/specs/Microsoft.Data.SqlClient.nuspec	Removed multiple unused dependencies across all target frameworks
tools/props/Versions.props	Updated dependency versions, removed obsolete version properties, and reorganized comments for clarity
src/Microsoft.Data.SqlClient/tests/ManualTests/Microsoft.Data.SqlClient.ManualTesting.Tests.csproj	Removed unused package references
src/Microsoft.Data.SqlClient/tests/FunctionalTests/Microsoft.Data.SqlClient.Tests.csproj	Removed unused package references
src/Microsoft.Data.SqlClient/netfx/src/Microsoft.Data.SqlClient.csproj	Removed unused package references
src/Microsoft.Data.SqlClient/netfx/ref/Microsoft.Data.SqlClient.csproj	Removed unused package references
src/Microsoft.Data.SqlClient/netcore/src/Microsoft.Data.SqlClient.csproj	Removed unused package references
src/Microsoft.Data.SqlClient/netcore/ref/Microsoft.Data.SqlClient.csproj	Removed unused package references and conditional ItemGroup
src/Microsoft.Data.SqlClient/add-ons/AzureKeyVaultProvider/Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider.csproj	Removed unused package reference

paulmedynski

Commentary for reviewers.

paulmedynski · 2025-12-10T12:00:24Z

tools/props/Versions.props

-    <SystemTextEncodingsWebVersion>6.0.1</SystemTextEncodingsWebVersion>
-    <SystemTextJsonVersion>6.0.11</SystemTextJsonVersion>
+    <MicrosoftIdentityModelProtocolsOpenIdConnectVersion>6.35.0</MicrosoftIdentityModelProtocolsOpenIdConnectVersion>
+    <SystemBuffersVersion>4.6.1</SystemBuffersVersion>


Updated from 4.5.1 -> 4.6.1

paulmedynski · 2025-12-10T12:01:12Z

tools/props/Versions.props

+
+  <!-- MDS NetFx project dependencies -->
+  <PropertyGroup>
+    <MicrosoftDataSqlClientSniVersion>5.1.2</MicrosoftDataSqlClientSniVersion>


Moved from line 26 unchanged.

paulmedynski · 2025-12-10T12:01:30Z

tools/props/Versions.props

-    <SystemBuffersVersion>4.5.1</SystemBuffersVersion>
-    <SystemTextEncodingsWebVersion>6.0.1</SystemTextEncodingsWebVersion>
-    <SystemTextJsonVersion>6.0.11</SystemTextJsonVersion>
+    <MicrosoftIdentityModelProtocolsOpenIdConnectVersion>6.35.0</MicrosoftIdentityModelProtocolsOpenIdConnectVersion>


Moved from line 32 unchanged.

paulmedynski · 2025-12-10T12:01:51Z

tools/props/Versions.props

+
+  <!-- MDS NetStandard project dependencies -->
  <PropertyGroup>
+    <MicrosoftWin32RegistryVersion>5.0.0</MicrosoftWin32RegistryVersion>


Moved from line 40 unchanged.

paulmedynski · 2025-12-10T12:02:01Z

tools/props/Versions.props

  <PropertyGroup>
+    <MicrosoftWin32RegistryVersion>5.0.0</MicrosoftWin32RegistryVersion>
    <SystemRuntimeLoaderVersion>4.3.0</SystemRuntimeLoaderVersion>
+    <SystemSecurityCryptographyCngVersion>5.0.0</SystemSecurityCryptographyCngVersion>


Moved from line 47 unchanged.

paulmedynski · 2025-12-10T12:02:22Z

tools/props/Versions.props

    <MicrosoftSqlServerServerVersion>1.0.0</MicrosoftSqlServerServerVersion>
-    <SystemDiagnosticsDiagnosticSourceVersion>6.0.1</SystemDiagnosticsDiagnosticSourceVersion>
-    <SystemDiagnosticsPerformanceCounterVersion>6.0.1</SystemDiagnosticsPerformanceCounterVersion>
+    <SystemConfigurationConfigurationManagerVersion>6.0.1</SystemConfigurationConfigurationManagerVersion>


Moved from line 42 unchanged.

paulmedynski · 2025-12-10T12:03:01Z

tools/props/Versions.props

+
+  <!-- Common Dependencies - Shared by multiple driver or test projects-->
  <PropertyGroup>
+    <AzureCoreVersion>1.41.0</AzureCoreVersion>


Moved from line 58 unchanged.

…sions don't work with xUnit.

codecov · 2025-12-10T14:27:44Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 70.23%. Comparing base (cc5c81a) to head (945a69a).
⚠️ Report is 1 commits behind head on release/5.1.

Additional details and impacted files

@@               Coverage Diff               @@
##           release/5.1    #3838      +/-   ##
===============================================
- Coverage        71.51%   70.23%   -1.29%     
===============================================
  Files              293      293              
  Lines            61928    61931       +3     
===============================================
- Hits             44289    43498     -791     
- Misses           17639    18433     +794

Flag	Coverage Δ
addons	`92.38% <ø> (ø)`
netcore	`74.37% <ø> (-0.66%)`	⬇️
netfx	`68.55% <ø> (-1.36%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Copilot

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated no new comments.

mdaigle

It seems like System.Text.Json and System.Text.Encodings.Web were included to override vulnerable versions that were coming in transitively. If we make that type of change in the future, I feel we should add a comment and make the reference TF specific so that it's not accidentally carried forward to other targets. That's most applicable for .NET Framework because most things we need are now included in .NET.

- Removed unnecessary Asn1 package dependency.

- Fixed incorrectly cased filenames. - Added CodeQL GitHub workflow.

Copilot

Pull request overview

Copilot reviewed 18 out of 21 changed files in this pull request and generated 1 comment.

src/Microsoft.Data.SqlClient/netcore/src/Microsoft.Data.SqlClient.csproj

paulmedynski · 2025-12-15T19:15:14Z

/azp run

azure-pipelines · 2025-12-15T19:15:25Z

Azure Pipelines successfully started running 1 pipeline(s).

paulmedynski · 2025-12-15T19:20:07Z

.github/workflows/codeql.yml

I brought this over from the newer branches to satisfy our GitHub ruleset config.

paulmedynski · 2025-12-15T19:21:12Z

src/Microsoft.Data.SqlClient/netcore/src/Microsoft.Data.SqlClient.csproj

    </Compile>
-    <Compile Include="..\..\src\Microsoft\Data\SqlClient\SqlMetadataFactory.cs">
-      <Link>Microsoft\Data\SqlClient\SqlMetadataFactory.cs</Link>
+    <Compile Include="..\..\src\Microsoft\Data\SqlClient\SqlMetaDataFactory.cs">


A few case-sensitivity changes so the CodeQL workflow can build and scan on Ubuntu.

paulmedynski · 2025-12-15T19:22:31Z

src/Microsoft.Data.SqlClient/netfx/tools/targets/GenerateResourceStringsSource.targets

-        <Compile Include="$(IntermediateOutputPath)$(GeneratedSourceFileName)" />
-      </ItemGroup>
+  <PropertyGroup>
+    <PowerShellExe>pwsh</PowerShellExe>


More changes for CodeQL on Ubuntu. The GitHub Actions runners have pwsh installed by default.

paulmedynski · 2025-12-15T19:26:29Z

global.json

@@ -0,0 +1,5 @@
+{
+  "sdk": {
+    "version": "8.0.416"


The .NET 6 SDK is EOL and difficult to install locally for devs, so I chose the nearest supported one. Note that some parts of the CI pipeline are already using .NET 10 SDK to build, so this is actually closer to .NET 6 than some of our existing jobs.

paulmedynski · 2025-12-15T19:40:28Z

/azp run

azure-pipelines · 2025-12-15T19:40:40Z

Azure Pipelines successfully started running 1 pipeline(s).

paulmedynski · 2025-12-16T10:16:06Z

/azp run

azure-pipelines · 2025-12-16T10:16:19Z

Azure Pipelines successfully started running 1 pipeline(s).

Copilot

Pull request overview

Copilot reviewed 23 out of 26 changed files in this pull request and generated 3 comments.

Copilot · 2025-12-16T11:24:31Z

src/Microsoft.Data.SqlClient/netfx/ref/Microsoft.Data.SqlClient.cs

        System.Data.IDataReader System.Data.IDataRecord.GetData(int i) { throw null; }
    }
-    /// <include file='../../../../doc/snippets/Microsoft.Data.SqlClient/SQLDebugging.xml' path='docs/members[@name="SQLDebugging"]/SQLDebugging/*'/>
+    /// <include file='../../../../doc/snippets/Microsoft.Data.SqlClient/SqlDebugging.xml' path='docs/members[@name="SqlDebugging"]/SqlDebugging/*'/>


The XPath reference uses 'SqlDebugging' but the XML documentation file defines the members with name='SQLDebugging' (all caps SQL). The path should be docs/members[@name="SQLDebugging"]/SQLDebugging/* to match the actual element name in the XML file.

Copilot · 2025-12-16T11:24:32Z

src/Microsoft.Data.SqlClient/netfx/ref/Microsoft.Data.SqlClient.cs

    public sealed partial class SQLDebugging
    {
-        /// <include file='../../../../doc/snippets/Microsoft.Data.SqlClient/SQLDebugging.xml' path='docs/members[@name="SQLDebugging"]/ctor/*'/>
+        /// <include file='../../../../doc/snippets/Microsoft.Data.SqlClient/SqlDebugging.xml' path='docs/members[@name="SqlDebugging"]/ctor/*'/>


The XPath reference uses 'SqlDebugging' but the XML documentation file defines the members with name='SQLDebugging' (all caps SQL). The path should be docs/members[@name="SQLDebugging"]/ctor/* to match the actual element name in the XML file.

Copilot · 2025-12-16T11:24:32Z

src/Microsoft.Data.SqlClient/netfx/src/Microsoft/Data/SqlClient/SqlConnection.cs

    // or the iid for the ISQLDebug interface
    //
-    /// <include file='../../../../../../../doc/snippets/Microsoft.Data.SqlClient/SqlDebugging.xml' path='docs/members[@name="SQLDebugging"]/SQLDebugging/*'/>
+    /// <include file='../../../../../../../doc/snippets/Microsoft.Data.SqlClient/SqlDebugging.xml' path='docs/members[@name="SqlDebugging"]/SqlDebugging/*'/>


The XPath reference uses 'SqlDebugging' but the XML documentation file defines the members with name='SQLDebugging' (all caps SQL). The path should be docs/members[@name="SQLDebugging"]/SQLDebugging/* to match the actual element name in the XML file.

- Removed unused dependencies across all driver and test projects.

4e6e2f7

- Updated some dependencies to avoid transitive vulnerabilities.

Copilot AI review requested due to automatic review settings December 10, 2025 11:46

paulmedynski added this to the 5.1.9 milestone Dec 10, 2025

paulmedynski linked an issue Dec 10, 2025 that may be closed by this pull request

[5.1] Remove unused dependencies #3809

Open

Copilot started reviewing on behalf of paulmedynski December 10, 2025 11:47 View session

Copilot AI reviewed Dec 10, 2025

View reviewed changes

paulmedynski commented Dec 10, 2025

View reviewed changes

- Reverted the Microsoft.NET.Test.SDK package version since newer ver…

a55bdcf

…sions don't work with xUnit.

paulmedynski marked this pull request as ready for review December 10, 2025 20:27

paulmedynski requested a review from a team as a code owner December 10, 2025 20:27

Copilot AI review requested due to automatic review settings December 10, 2025 20:27

Copilot started reviewing on behalf of paulmedynski December 10, 2025 20:27 View session

Copilot AI reviewed Dec 10, 2025

View reviewed changes

mdaigle previously approved these changes Dec 11, 2025

View reviewed changes

- Removed unnecessary MSS references.

7e82d4e

- Removed unnecessary Asn1 package dependency.

paulmedynski dismissed mdaigle’s stale review via 7e82d4e December 15, 2025 14:10

mdaigle previously approved these changes Dec 15, 2025

View reviewed changes

- Fixed resource strings generation to work on Unix.

222f16c

- Fixed incorrectly cased filenames. - Added CodeQL GitHub workflow.

Copilot AI review requested due to automatic review settings December 15, 2025 18:32

paulmedynski dismissed mdaigle’s stale review via 222f16c December 15, 2025 18:32

Copilot AI reviewed Dec 15, 2025

View reviewed changes

src/Microsoft.Data.SqlClient/netcore/src/Microsoft.Data.SqlClient.csproj Show resolved Hide resolved

- Added global.json for .NET SDK 8.0.

945a69a

mdaigle previously approved these changes Dec 15, 2025

View reviewed changes

paulmedynski commented Dec 15, 2025

View reviewed changes

benrr101 previously approved these changes Dec 15, 2025

View reviewed changes

- Enhanced logging of TDS Server to see client/server endpoint details.

e64eed9

Copilot AI review requested due to automatic review settings December 16, 2025 11:18

paulmedynski dismissed stale reviews from benrr101 and mdaigle via e64eed9 December 16, 2025 11:18

Copilot started reviewing on behalf of paulmedynski December 16, 2025 11:19 View session

Copilot AI reviewed Dec 16, 2025

View reviewed changes

[5.1] Dependency Cleanup #3838

Are you sure you want to change the base?

[5.1] Dependency Cleanup #3838

Uh oh!

Conversation

paulmedynski commented Dec 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Details

MDS

AKV

Issues

Testing

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

paulmedynski left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

codecov bot commented Dec 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

mdaigle left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

paulmedynski commented Dec 15, 2025

Uh oh!

azure-pipelines bot commented Dec 15, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

paulmedynski commented Dec 15, 2025

Uh oh!

azure-pipelines bot commented Dec 15, 2025

Uh oh!

paulmedynski commented Dec 16, 2025

Uh oh!

azure-pipelines bot commented Dec 16, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Dec 16, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 16, 2025

paulmedynski commented Dec 10, 2025 •

edited

Loading

codecov bot commented Dec 10, 2025 •

edited

Loading