[mdaigle]

Description

Manually backport #4842 and the matching nuspec synchronization from #4862 to release/7.0 for hotfix 7.0.4, addressing CVE-2026-84008 without changing the release branch's framework or dependency layout.

In Directory.Packages.props and tools/specs/Microsoft.Data.SqlClient.nuspec:

• Update the four existing .NET 9 dependencies from 9.0.13 to 9.0.21: Microsoft.Extensions.Caching.Memory, Microsoft.Bcl.Cryptography, System.Configuration.ConfigurationManager, and System.Security.Cryptography.Pkcs.
• Update System.Security.Cryptography.Pkcs from 8.0.1 to 8.0.2 for the other central-version group and the net462, net8.0, and netstandard2.0 nuspec groups.
• Preserve all unrelated dependencies, exclusions, package-range placeholders, framework groups, and package file mappings.

Microsoft.Bcl.TimeProvider and System.Threading.RateLimiting are absent from this release branch and are not introduced. The AKV provider is SDK-packed, targets only netstandard2.0, and retains Microsoft.Extensions.Caching.Memory 8.0.1; there is no separate AKV nuspec to update.

No public API, documentation, localization, or driver implementation changes.

Suggested release note: Update dependency servicing versions and synchronize packaged dependency minimums to address CVE-2026-84008.

Issues

• Manual backport of Bump version to avoid CVE-2026-84008 #4842.
• Includes the applicable nuspec synchronization from Align nuspec dependency versions with #4842 #4862.
• Advisory: GHSA-846f-f764-76mx
• Milestone: 7.0.4 (milestone 106).

Testing

This is a manifest-only servicing change. No driver unit or integration tests were changed. The implementation session ran a session-local PowerShell regression check that verifies the exact servicing-only delta against release base da03d4b21f9a22742add630af12f872416655c19, evaluates the release projects with MSBuild, and compares every fixed-version nuspec dependency with the evaluated central version. Its validated commit 994c8dad4e9492749259c036b962a582dc75175e is published unchanged.

Commands and results from the implementation session:

& 'C:\Users\mdaigle\.copilot\session-state\2ef61515-131a-4057-8497-18c13b7eef0a\files\Validate-Backport.ps1'

Passed after the change: all 33 fixed-version dependencies across net462, net8.0, net9.0, and netstandard2.0 match. The same check failed on the unchanged release branch, as expected. The script also verifies that TimeProvider and RateLimiting remain absent and that the two files contain no changes beyond the 12 intended version replacements.

dotnet "C:\Program Files\dotnet\sdk\10.0.402\MSBuild.dll" build.proj -t:BuildSqlClient -p:Configuration=Release -nologo -v:minimal

Passed: restored and built the Windows driver for net462, net8.0, and net9.0, the corresponding reference assemblies, the netstandard2.0 unsupported-platform assembly, and sibling projects.

Publication verification:

git diff origin/release/7.0...HEAD --check

Passed. The diff against live origin/release/7.0 contains exactly the two intended files, with 12 version replacements.

Validation limits: the repository pins SDK 10.0.109, which is not installed. The initial dotnet msbuild invocation failed SDK selection; the successful build and evaluations explicitly used installed SDK 10.0.402 without changing global.json. Full NuGet packing and driver unit/integration tests were not run. nuget.exe, required by GenerateMdsPackage, is not installed. The build was not repeated during publication.

• Tests added or updated: session-local dependency regression check added; no driver tests changed.
• Public API changes documented: not applicable; no public API changes.
• Verified against customer repro: not applicable; upstream dependency-servicing backport.
• Ensure no breaking changes introduced: existing dependency majors, framework groups, exclusions, and package layout preserved.

Guidelines

Please review the contribution guidelines before submitting a pull request:

• Contributing
• Code of Conduct
• Best Practices
• Coding Style
• Review Process

[Copilot]

🔵 Needs a closer look

The manifest changes are consistent, but final package validation and successful CI remain unverified.

No open issues 🎉

What changed in this PR

Backports dependency servicing for SqlClient 7.0.4 to address CVE-2026-84008 while preserving the release branch’s framework and package layout.

Changes:

• Updates four .NET 9 dependencies to 9.0.21 and other PKCS references to 8.0.2.
• Synchronizes published dependency minimums with central versions.

File	Description
tools/​specs/​Microsoft.Data.SqlClient.nuspec	Updates packaged dependency minimums.
Directory.Packages.props	Updates central dependency servicing versions.

_{Review effort: Balanced}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 65.86%. Comparing base (daadd38) to head (994c8da).
⚠️ Report is 3 commits behind head on release/7.0.

❗ There is a different number of reports uploaded between BASE (daadd38) and HEAD (994c8da). Click for more details.

HEAD has 1 upload less than BASE

Flag	BASE (daadd38)	HEAD (994c8da)
CI-SqlClient	1	0

Additional details and impacted files

@@               Coverage Diff               @@
##           release/7.0    #4869      +/-   ##
===============================================
- Coverage        72.60%   65.86%   -6.75%     
===============================================
  Files              280      275       -5     
  Lines            43416    66303   +22887     
===============================================
+ Hits             31523    43670   +12147     
- Misses           11893    22633   +10740     

Flag	Coverage Δ
CI-SqlClient	?
PR-SqlClient-Project	65.86% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.