[mdaigle]

Description

Update Microsoft.Data.SqlClient.nuspec to match the dependency versions introduced by #4842, so the published package requires the serviced versions rather than the older dependency minimums.

• Update the five existing net9.0 dependency entries at 9.0.18 to 9.0.21: Microsoft.Bcl.Cryptography, Microsoft.Extensions.Caching.Memory, System.Configuration.ConfigurationManager, System.Security.Cryptography.Pkcs, and System.Threading.RateLimiting.
• Update System.Security.Cryptography.Pkcs from 8.0.1 to 8.0.2 for net462, net8.0, and netstandard2.0.
• Preserve all dependency groups, exclusions, package file mappings, and public APIs. No documentation or localization changes are needed.

Target: release/7.1. Backport to 7.0.4 and 6.1.8, matching #4842.

• Tests added or updated — not applicable; metadata-only change, validated below.
• Public API changes documented — not applicable; no public API changes.
• Verified against customer repro — not applicable; no customer repro supplied.
• Ensure no breaking changes introduced — only servicing dependency minimums already selected in Bump version to avoid CVE-2026-84008 #4842 are synchronized.

Issues

Follow-up to #4842.

Related advisory: GHSA-846f-f764-76mx

Testing

The PowerShell check below evaluates Directory.Packages.props with MSBuild for each nuspec target framework and compares every literal dependency version. Before the fix: failed with the eight expected mismatches. After the fix: passed, with all 39 literal dependency versions matching across all four framework groups. Placeholder-based sibling dependency ranges are unchanged and excluded from this check.

Exact dependency validation command (PowerShell)

$ErrorActionPreference = 'Stop'
[xml]$nuspec = Get-Content -Raw 'src\Microsoft.Data.SqlClient\src\Microsoft.Data.SqlClient.nuspec'
$mismatches = @()
$checked = 0
foreach ($group in $nuspec.package.metadata.dependencies.group) {
    $tfm = $group.targetFramework
    $output = dotnet msbuild Directory.Packages.props "-p:TargetFramework=$tfm" -getItem:PackageVersion -verbosity:quiet
    if ($LASTEXITCODE -ne 0) { throw "MSBuild evaluation failed for $tfm" }
    $versions = @{}
    ($output | ConvertFrom-Json).Items.PackageVersion | ForEach-Object { $versions[$_.Identity] = $_.Version }
    foreach ($dependency in $group.dependency) {
        if ($dependency.version.StartsWith('$')) { continue }
        $checked++
        if ($dependency.version -ne $versions[$dependency.id]) {
            $mismatches += "$tfm / $($dependency.id): nuspec=$($dependency.version), central=$($versions[$dependency.id])"
        }
    }
}
Write-Output "Checked $checked literal dependency versions across $($nuspec.package.metadata.dependencies.group.Count) framework groups."
if ($mismatches.Count -gt 0) { $mismatches | Write-Output; throw "$($mismatches.Count) dependency version mismatches." }
Write-Output 'PASS: All literal nuspec dependency versions match evaluated central package versions.'

git --no-pager diff --check — passed before commit.

Full build, pack, and driver unit/integration suites were not run: this change only aligns package metadata with the already-updated build dependencies and does not change driver code. No automated test files were added or modified.

Guidelines

Please review the contribution guidelines before submitting a pull request:

• Contributing
• Code of Conduct
• Best Practices
• Coding Style
• Review Process

[Copilot]

🔵 Needs a closer look

Required trusted review policies and current PR feedback remain unverified, preventing completion of approval checks.

No open issues 🎉

What changed in this PR

Aligns published SqlClient dependency minimums with the serviced versions introduced by #4842.

Changes:

• Raises five net9.0 dependencies from 9.0.18 to 9.0.21.
• Raises System.Security.Cryptography.Pkcs to 8.0.2 for the other three framework groups.
• Preserves dependency groups, exclusions, file mappings, and public APIs.

File	Description
src/​Microsoft.Data.SqlClient/​src/​Microsoft.Data.SqlClient.nuspec	Synchronizes eight dependency minimums with serviced build dependencies.

_{Review effort: Balanced}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 64.43%. Comparing base (ab3d40a) to head (6b801b1).
⚠️ Report is 3 commits behind head on release/7.1.

Additional details and impacted files

@@               Coverage Diff               @@
##           release/7.1    #4862      +/-   ##
===============================================
- Coverage        66.52%   64.43%   -2.10%     
===============================================
  Files              291      285       -6     
  Lines            45101    68065   +22964     
===============================================
+ Hits             30002    43855   +13853     
- Misses           15099    24210    +9111     

Flag	Coverage Δ
CI-SqlClient	?
PR-SqlClient-Project	64.43% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.