Update dependency Microsoft.Data.SqlClient to v7

[dependencyupdates]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
Microsoft.Data.SqlClient (source)	5.2.2 → 7.0.3

---

Release Notes

dotnet/sqlclient (Microsoft.Data.SqlClient)

v7.0.3

Changed

• Updated the Microsoft.Data.SqlClient.SNI and Microsoft.Data.SqlClient.SNI.runtime dependencies to 6.0.3 (was 6.0.2).
  (#​4599)

Fixed

• Fixed a SqlBulkCopy regression in environments where the application login cannot read sys.all_columns. Bulk copy now falls back to the earlier column-discovery behavior when that permission is unavailable. Support for hidden columns and SQL Graph column aliases still requires access to the metadata view.
  (#​4370, #​4306, #​4402)

• Fixed a memory-allocation regression in connection and command operations caused by formatting diagnostic strings even when tracing was disabled. Also corrected trace messages that reported an incorrect object ID or could throw FormatException when traced values contained braces.
  (#​4528, #​4533)

• Fixed ServerCertificate validation on the managed SNI path so the configured certificate is compared against the server certificate even when the server certificate passes chain and host-name validation. When certificate validation is enabled, a missing, unreadable, or invalid certificate file, a certificate mismatch, or a missing server certificate now causes the TLS handshake to fail instead of bypassing the configured certificate check. (net8.0/net9.0 only)
  (#​4445, #​4583)

• Fixed Always Encrypted VSM/HGS enclave attestation to verify that the enclave public key used to establish a session matches the key committed to by the signed attestation report. Missing, malformed, or mismatched key-binding data now causes attestation to fail before the session secret is derived.
  (#​4532, #​4553)

• Fixed SqlConnection.AccessTokenCallback not disabling Transparent Network IP Resolution by default, making it consistent with SqlConnection.AccessToken. An explicitly configured TransparentNetworkIPResolution connection-string value still takes precedence. (net462 only)
  (#​4520, #​4561)

• Fixed authentication state handling so clearing SqlConnection.AccessToken, AccessTokenCallback, or SspiContextProvider preserves the other authentication values in the connection pool key. Cloning a connection or updating its credential also preserves its SspiContextProvider. Combining a non-null SspiContextProvider with AccessToken or AccessTokenCallback now throws InvalidOperationException instead of silently discarding authentication state; applications must use one authentication mechanism at a time.
  (#​4520, #​4561, #​4644)

• Fixed configurable retry logic installing a permanent, process-wide assembly-resolution handler that could interfere with unrelated assembly loading. The handler is now active only while an explicitly configured custom retry provider is resolved and constructed, and probes AppContext.BaseDirectory instead of the current working directory. Place custom retry assemblies in the application base directory; dependencies loaded after provider construction must be resolvable through normal application dependency resolution or an application-provided handler. (net8.0/net9.0 only)
  (#​2214, #​4547, #​4663)

Companion packages

• Released Microsoft.Data.SqlClient.Extensions.Azure 7.0.3 with the Entra ID authority parsing fix for Dataverse/Dynamics 365 connections. See release notes.
• Released version-aligned Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider, Microsoft.Data.SqlClient.Extensions.Abstractions, and Microsoft.Data.SqlClient.Internal.Logging 7.0.3 with no functional or API changes. See the Azure Key Vault provider, Abstractions, and Logging release notes.

v7.0.2

This update brings the following changes since the 7.1.0-preview2 release.
See the full release notes for detailed descriptions.

Important — package version alignment: Starting with the 7.0.2 release, the Microsoft.Data.SqlClient driver and its companion packages share a single aligned version. Preview 3 of the 7.1 line continues this alignment; the following packages now ship together as 7.1.0-preview3:

• Microsoft.Data.SqlClient
• Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider
• Microsoft.Data.SqlClient.Extensions.Azure
• Microsoft.Data.SqlClient.Extensions.Abstractions
• Microsoft.Data.SqlClient.Internal.Logging

(Microsoft.SqlServer.Server continues to version independently and remains at 1.0.0.)

Applications that reference Microsoft.Data.SqlClient.Extensions.Azure must upgrade it to 7.1.0-preview3 when upgrading Microsoft.Data.SqlClient to 7.1.0-preview3.

Compatibility guarantee: All aligned assemblies ship with FileVersion 7.1.0.x and AssemblyVersion 7.0.0.0. The AssemblyVersion is unchanged from 7.0.2, so upgrading from 7.0.2 to 7.1.0-preview3 does not require any new .NET Framework strong-name binding redirects.

Added

• Added four virtual asynchronous counterparts to the synchronous methods on SqlColumnEncryptionKeyStoreProvider — DecryptColumnEncryptionKeyAsync, EncryptColumnEncryptionKeyAsync, SignColumnMasterKeyMetadataAsync, and VerifyColumnMasterKeyMetadataAsync — each accepting an optional CancellationToken. The default implementations delegate to the existing synchronous methods, so existing custom providers are unaffected. These APIs are introduced for provider authors but are not consumed by the driver yet; a future release will enable their use from the driver's own asynchronous APIs.
  (#​3673)

• Implemented those four asynchronous APIs in SqlColumnEncryptionAzureKeyVaultProvider, calling the Azure SDK's own asynchronous methods and flowing the supplied CancellationToken. Concurrent cache misses for the same key are gated so a burst of callers issues a single Key Vault request. See the AKV release notes for the VerifyColumnMasterKeyMetadata signature-validation behavior change and the 7.1 runtime requirement.
  (#​4540)

• Substantially expanded ChannelDbConnectionPool (the opt-in pool behind Switch.Microsoft.Data.SqlClient.UseConnectionPoolV2) to parity with the default pool: transaction support, broken-connection replacement, leaked-connection reclamation, background warmup and replenishment to Min Pool Size, idle pruning driven by Connection Idle Timeout, optional connection-creation rate limiting, and metrics/tracing parity. Default pooling behavior is unchanged.
  (#​4395,
  #​4396,
  #​4429,
  #​4452,
  #​4463,
  #​4487,
  #​4504,
  #​4529)

Changed

• The driver now builds a single cross-platform assembly. Package structure and contents are unchanged, and Windows-only native SNI types now trim cleanly on Linux and macOS.
  (#​4207,
  #​4465,
  #​4474)

• Reduced managed allocations in the async read path by restoring reuse of PacketData nodes via a bounded free list on StateSnapshot. This applies to the default async read path and is not gated behind any AppContext switch.
  (#​4536)

• Operations no longer allocate a formatted trace string when SqlClientEventSource tracing is disabled, recovering a memory regression against the 6.1.6 baseline. Trace output with tracing enabled is unchanged.
  (#​4528)

• Updated centrally managed dependency versions for the net9.0 target framework to 9.0.18, and added System.Threading.RateLimiting to the packaged dependency metadata. Non-net9.0 targets keep their existing 8.0.x pins.
  (#​4507)

• Updated the Microsoft.Data.SqlClient.SNI and Microsoft.Data.SqlClient.SNI.runtime dependencies to 7.1.0-preview3.26226.3.
  (#​4564)

• Bypassed SQL Graph column alias mapping in SqlBulkCopy when neither the source nor destination table contains graph pseudo-columns, recovering a bulk copy performance regression. Graph table bulk copy behavior is unchanged.
  (#​4535)

• Re-shipped Microsoft.Data.SqlClient.Extensions.Azure as 7.1.0-preview3, fixing Entra ID tenant parsing for multi-segment authorities. See release notes.

• Re-shipped Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider as 7.1.0-preview3 with new asynchronous key store provider APIs, and Microsoft.Data.SqlClient.Extensions.Abstractions and Microsoft.Data.SqlClient.Internal.Logging as 7.1.0-preview3 (version alignment only, no functional changes). See release notes for AKV, Abstractions, and Logging.

Fixed

• Fixed Always Encrypted VSM/HGS enclave attestation not verifying that the enclave public key used to establish the session matches the key committed to by the signed attestation report.
  (#​4532)

• Fixed a SqlConnectionFactory timer that woke the process every 30 seconds for the lifetime of the application even when no connection pools existed, including with Pooling=False and after ClearAllPools().
  (#​4479)

• Fixed connection pool performance counter defects affecting the default pool as well as pool V2. active-soft-connects and number-of-active-connections could go negative after a failed connection activation, and several gauges drifted upward permanently after a broken connection was replaced.
  (#​4504)

• Fixed OverflowException when sending large decimal values as a parameter with explicit Precision and Scale, which primarily affected Always Encrypted scenarios.
  (#​4443)

• Fixed a TDS stream error when passing a DateOnly value as a parameter with SqlDbType.Variant.
  (#​4294)

• Fixed DateOnly values written to a sql_variant column of a table-valued parameter being sent as datetime instead of date, which also caused an overflow for values out of datetime range.
  (#​4439)

• Fixed the ServerCertificate connection-string keyword not being honored when the platform reported no TLS policy errors, and made an unloadable certificate file fail closed instead of silently falling back to host-name validation.
  (#​4445)

• Fixed SqlConnection.AccessTokenCallback not disabling Transparent Network IP Resolution by default, unlike SqlConnection.AccessToken, along with a related connection pool key defect.
  (#​4520)

• Fixed several async entry points in SqlBulkCopy, SqlDataReader, and SqlCommand that captured fatal exceptions such as OutOfMemoryException into faulted Tasks instead of letting them propagate.
  (#​4437)

• Fixed Authentication=Active Directory Service Principal (and the other Entra ID flows) failing against endpoints that return a multi-segment authority such as the Dataverse / Dynamics 365 TDS endpoint; the tenant id is now taken from the first path segment of the STSURL authority instead of the last. Ships in Microsoft.Data.SqlClient.Extensions.Azure.
  (#​4521)

v7.0.1

This update brings the following changes since the 7.0.0 release.
See the full release notes for detailed descriptions.

Fixed

• Fixed SqlBulkCopy failing on SQL Server 2016 with Invalid column name 'graph_type' error by using dynamic SQL to extract column names.
  (#​3714,
  #​4092,
  #​4147)

• Fixed SqlBulkCopy failing on Azure Synapse Analytics dedicated SQL pools by using STRING_AGG for the column-list query when targeting Synapse.
  (#​4149,
  #​4176,
  #​4182)

• Fixed SqlDataReader.GetFieldType() and GetProviderSpecificFieldType() returning incorrect type for vector float32 columns.
  (#​4104,
  #​4105,
  #​4152)

• Added missing System.Data.Common (v4.3.0) NuGet package dependency for .NET Framework consumers to resolve CS0012 compilation errors.
  (#​4063,
  #​4074)

Changed

• Enabled the User Agent TDS feature extension unconditionally; removed the Switch.Microsoft.Data.SqlClient.EnableUserAgent AppContext switch.
  (#​4124,
  #​4154)

• Added type forwards from the core assembly to public types moved to Microsoft.Data.SqlClient.Extensions.Abstractions.
  (#​4067,
  #​4117)

• Fixed API documentation include paths and duplicate doc snippets.
  (#​4084,
  #​4086,
  #​4107,
  #​4161)

v7.0.0

This update brings the following changes since the 7.0.1 release.
See the full release notes for detailed descriptions.

Important — package version alignment: Starting with 7.0.2, the Microsoft.Data.SqlClient driver and its companion packages share a single aligned version. The following packages now ship together as 7.0.2:

• Microsoft.Data.SqlClient
• Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider
• Microsoft.Data.SqlClient.Extensions.Azure
• Microsoft.Data.SqlClient.Extensions.Abstractions
• Microsoft.Data.SqlClient.Internal.Logging

(Microsoft.SqlServer.Server continues to version independently and remains at 1.0.0.)

Applications must reference the same versions of Microsoft.Data.SqlClient and its extensions for best compatibility. In particular, applications that reference Microsoft.Data.SqlClient.Extensions.Azure must upgrade it to 7.0.2 when upgrading Microsoft.Data.SqlClient to 7.0.2.

Breaking change (.NET Framework only): As part of this alignment, the AssemblyVersion of Microsoft.Data.SqlClient.Extensions.Azure, Microsoft.Data.SqlClient.Extensions.Abstractions, and Microsoft.Data.SqlClient.Internal.Logging changed from 1.0.0.0 to 7.0.0.0. On .NET Framework, AssemblyVersion is part of the strong-name identity, so applications that drop these assemblies into an existing deployment without rebuilding must rebuild against the 7.0.2 packages (or add binding redirects). Applications on .NET / .NET Core are not affected. Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider already used a 7.x assembly version and is unaffected.

Fixed

• Fixed a NullReferenceException in SqlCommand.Cancel() when the active connection has already been torn down.
  (#​4372,
  #​4373)

• Fixed a NullReferenceException in SqlDataReader.GetBytes/GetChars when called with a null destination buffer.
  (#​4159,
  #​4206)

• Fixed Always Encrypted column master key signature verification incorrectly reusing cached results.
  (#​4339,
  #​4343)

Changed

• Hardened TDS token parsing by adding data-length bounds checks for token and feature-extension-acknowledgment data.
  (#​4340,
  #​4358)

• Released Microsoft.Data.SqlClient.Extensions.Azure 7.0.2, adding WAM broker support for Entra ID authentication modes on Windows. See release notes.
  (#​4288,
  #​4388)

• Re-shipped Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider, Microsoft.Data.SqlClient.Extensions.Abstractions, and Microsoft.Data.SqlClient.Internal.Logging as 7.0.2 (version alignment only, no functional changes). See release notes for AKV, Abstractions, and Logging.

v6.1.7

Changed

• Updated the Microsoft.Data.SqlClient.SNI and Microsoft.Data.SqlClient.SNI.runtime dependencies to 6.0.3 (was 6.0.2).
  (#​4598)

Fixed

• Fixed ServerCertificate validation on the managed SNI path so the configured certificate is compared against the server certificate even when the server certificate passes chain and host-name validation. When certificate validation is enabled, a missing, unreadable, or invalid certificate file, a certificate mismatch, or a missing server certificate now causes the TLS handshake to fail instead of bypassing the configured certificate check. (net8.0/net9.0 only)
  (#​4445, #​4584)

• Fixed Always Encrypted VSM/HGS enclave attestation to verify that the enclave public key used to establish a session matches the key committed to by the signed attestation report. Missing, malformed, or mismatched key-binding data now causes attestation to fail before the session secret is derived.
  (#​4532, #​4552)

• Fixed SqlConnection.AccessTokenCallback not disabling Transparent Network IP Resolution by default, making it consistent with SqlConnection.AccessToken. An explicitly configured TransparentNetworkIPResolution connection-string value still takes precedence. (net462 only)
  (#​4520, #​4560)

• Fixed token authentication state handling so clearing SqlConnection.AccessToken preserves an existing AccessTokenCallback in the connection pool key, and clearing AccessTokenCallback preserves an existing AccessToken. Callback-based authentication now also follows the same prelogin server-certificate validation rules as an explicitly supplied access token.
  (#​4520, #​4560)

• Fixed configurable retry logic installing a permanent, process-wide assembly-resolution handler that could interfere with unrelated assembly loading. The handler is now active only while an explicitly configured custom retry provider is resolved and constructed, and probes AppContext.BaseDirectory instead of the current working directory. Place custom retry assemblies in the application base directory; dependencies loaded after provider construction must be resolvable through normal application dependency resolution or an application-provided handler. (net8.0/net9.0 only)
  (#​2214, #​4547, #​4664)

v6.1.6

This update brings the following changes since the 6.1.5 release.
See the full release notes for detailed descriptions.

Added

• Added Web Account Manager (WAM) broker support for the supported Entra ID authentication modes (Windows only), including the new ActiveDirectoryAuthenticationProviderOptions type with a UseWamBroker property, an ActiveDirectoryAuthenticationProvider(ActiveDirectoryAuthenticationProviderOptions options) constructor overload, and a cross-platform SetParentActivityOrWindowFunc(Func<object>) method.
  (#​4288,
  #​4387)

Changed

• Hardened TDS token parsing with data-length bounds checks to prevent unbounded memory allocation from a server spoofing length fields.
  (#​4340,
  #​4359)

• Updated dependencies (#​4387):

  • Updated Microsoft.Identity.Client to 4.84.2 (was 4.80.0)
  • Added Microsoft.Identity.Client.Broker 4.84.2

Fixed

• Fixed a NullReferenceException in SqlDataReader.GetChars on the PLP + SequentialAccess path when a null buffer was passed with a negative bufferIndex; it now throws ArgumentOutOfRangeException.
  (#​4159,
  #​4205)

• Fixed column master key (CMK) signature verification caching where a cached verification failure could subsequently be reported as a valid signature.
  (#​4339,
  #​4356)

v6.1.5

This update brings the following changes since the 6.1.4 release.
See the full release notes for target platform support and dependency information.

Fixed

• Fixed a connection performance regression where SPN (Service Principal Name) generation was triggered for non-integrated authentication modes (e.g., SQL authentication) on the native SNI path, causing unnecessary DNS lookups and significantly slower connection times.
  (#​3523, #​3946)

• Fixed ExecuteScalar to properly propagate errors when the server sends data followed by an error token. Previously, errors such as conversion failures during WHERE clause evaluation were silently consumed during SqlDataReader.Close() instead of being thrown to the caller, which could result in transactions being unexpectedly zombied.
  (#​3736, #​3947)

• Fixed SqlDataReader.GetFieldType and SqlDataReader.GetProviderSpecificFieldType to return the correct type (SqlVector<float>) for vector float32 columns.
  (#​4104, #​4151)

v6.1.4

This update brings the following changes since the 6.1.3 release:

Fixed

• Fixed NullReferenceException issue with SqlDataAdapter when processing batch scenarios where certain SQL RPC calls may not include system parameters.
  (#​3877)
• Fixed connection pooling issue where extra connection deactivation was causing active connection counts to go negative.
  (#​3776)

Added

AppContext Switch for enabling MultiSubnetFailover

What Changed:

• Added new AppContext switch Switch.Microsoft.Data.SqlClient.EnableMultiSubnetFailoverByDefault to set MultiSubnetFailover=true by default in connection string.
  (#​3851)

Who Benefits:

• Applications that need MultiSubnetFailover enabled globally without modifying connection strings.

Impact:

• Applications can now enable MultiSubnetFailover globally using one of the following methods:

// In application code
AppContext.SetSwitch("Switch.Microsoft.Data.SqlClient.EnableMultiSubnetFailoverByDefault", true);

// In runtimeconfig.json
{
  "configProperties": {
    "Switch.Microsoft.Data.SqlClient.EnableMultiSubnetFailoverByDefault": true
  }
}

<!-- In App.Config -->
<runtime>
  <AppContextSwitchOverrides value="Switch.Microsoft.Data.SqlClient.EnableMultiSubnetFailoverByDefault=true" />
</runtime>

Changed

• Optimized SqlStatistics execution timing by using Environment.TickCount instead of more expensive timing mechanisms.
  (#​3830)
• Updated dependencies (#​3843):
  • .NET Framework 4.6.2:
    • Azure.Core 1.47.1 -> 1.50.0
    • Azure.Identity 1.14.2 -> 1.17.1
    • Microsoft.Identity.Client 4.80.0 - Added
    • System.Buffers 4.5.1 -> 4.6.1
    • System.Diagnostics.DiagnosticSource 8.0.1 - Added
    • System.IdentityModel.Tokens.Jwt 7.7.1 - Added
    • System.Memory 4.6.3 - Added
    • System.Text.Json 8.0.5 -> 8.0.6
    • System.Text.RegularExpressions 4.3.1 - Added
    • Microsoft.Bcl.Cryptography - Removed
    • System.Text.Encodings.Web - Removed
  • .NET 8.0:
    • Azure.Core 1.47.1 -> 1.50.0
    • Azure.Identity 1.14.2 -> 1.17.1
    • Microsoft.Identity.Client 4.80.0 - Added
    • System.Diagnostics.DiagnosticSource 8.0.1 - Added
    • System.IdentityModel.Tokens.Jwt 7.7.1 - Added
    • Microsoft.Bcl.Cryptography - Removed
    • System.Text.Json - Removed
  • .NET 9.0:
    • Azure.Core 1.47.1 -> 1.50.0
    • Azure.Identity 1.14.2 -> 1.17.1
    • Microsoft.Extensions.Caching.Memory 9.0.4 -> 9.0.11
    • Microsoft.Identity.Client 4.80.0 - Added
    • System.Configuration.ConfigurationManager 9.0.4 -> 9.0.11
    • System.Diagnostics.DiagnosticSource 9.0.11 - Added
    • System.IdentityModel.Tokens.Jwt 7.7.1 - Added
    • System.Security.Cryptography.Pkcs 9.0.4 -> 9.0.11
    • Microsoft.Bcl.Cryptography - Removed
    • System.Text.Json - Removed
  • .NET Standard 2.0:
    • Azure.Core 1.47.1 -> 1.50.0
    • Azure.Identity 1.14.2 -> 1.17.1
    • Microsoft.Extensions.Caching.Memory 9.0.4 -> 8.0.1
    • Microsoft.Identity.Client 4.80.0 - Added
    • System.Configuration.ConfigurationManager 9.0.4 -> 8.0.1
    • System.Diagnostics.DiagnosticSource 8.0.1 - Added
    • System.IdentityModel.Tokens.Jwt 7.7.1 - Added
    • System.Security.Cryptography.Pkcs 9.0.4 -> 8.0.1
    • System.Text.Json 9.0.5 -> 8.0.6
    • Microsoft.Bcl.Cryptography - Removed

v6.1.3

This update includes the following changes since the 6.1.2 release:

Added

App Context Switch for Ignoring Server-Provided Failover Partner

What Changed:

• A new app context switch Switch.Microsoft.Data.SqlClient.IgnoreServerProvidedFailoverPartner was introduced to let the client ignore server-provided failover partner info in Basic Availability Groups (BAGs). When the switch is enabled, only the failover partner specified in the connection string is used; server-supplied partner values are skipped. This context switch was introduced in PR #​3702.

Who Benefits:

• Applications connecting to SQL Server BAGs using TCP and custom ports, especially where the server's provided partner name lacks the protocol, host, or port. This avoids connection failures when the server-provided partner is incompatible or incomplete.
• Teams who manage availability groups and rely on client-side control of failover behavior in heterogeneous networking environments.

Impact:

• If your environment might be affected (i.e., you operate a BAG with custom ports, or have experienced failures after failover), you can enable the new switch in your application:

AppContext.SetSwitch("Switch.Microsoft.Data.SqlClient.IgnoreServerProvidedFailoverPartner", true);

• Then, ensure your connection string includes your preferred failover partner (with correct tcp:host,port) so that the client uses that instead of the server's suggestion.
• Without enabling this, by default, the client continues to prefer the server-provided partner, maintaining backwards compatibility.

Fixed

• Fixed an issue to ensure reliable metrics initialization during startup,
  preventing missed telemetry when EventSource is enabled early.
  (#​3718)

v6.1.2

This update includes the following changes since the 6.1.1 release:

Fixed

• Fixed an issue where initializing PerformanceCounters would throw System.InvalidOperationException #​3629
• Fixed an issue where a Custom SqlClientAuthenticationProvider was being overwritten by default implementation. #​3651
• Fixed a concurrency issue in connection pooling where the number of active connections could be lower than the configured maximum pool size. #​3653

v6.1.1

This update includes the following changes since the 6.1.0 release:

Fixed

• Reverted changes related to improving partial packet detection, fixup, and replay functionality. This revert addresses regressions introduced in 6.1.0. (#​3556)
• Applied reference assembly corrections supporting vector, fixed JSON tests, and ensured related tests are enabled. #​3562
• Fixed SqlVector<T>.Null API signature in Reference assembly. #​3521

Changed

• Upgraded Azure.Identity and other dependencies to newer versions. (#​3538) (#​3552)

v6.1.0

This update brings the following changes since the
6.1.0-preview2 release:

Added

No new features were added.

Fixed

• Fixed missing socket error codes on non-Windows platforms.
  (#​3475)
• Fixed primary/secondary server SPN handling during SSPI negotiation.
  (#​3478)
• Fixed AzureKeyVaultProvider package key caching to serialize Azure key fetch
  operations.
  (#​3477)
• Fixed a rare error related to multi-packet async text reads.
  (#​3474)
• Fixed some spelling errors in the API docs.
  (#​3500)
• Fixed a rare multi-packet string corruption bug.
  (#​3513)

Changed

SqlDecimal type workarounds conversions

What Changed:

• Changed how SqlDecimal type workarounds perform conversions to meet
  compliance policies.
  (#​3467)

Who Benefits:

• Microsoft products must not use undocumented APIs on other Microsoft products.
  This change removes calls to undocumented APIs and replaces them with
  compliant API use.

Impact:

• These changes impose an observed 5% decrease in performance on .NET Framework.

SqlVector API improvements

What Changed:

• Several changes were made to the SqlVector API published in the
  6.1.0-preview2 release
  (#​3472):
  • The SqlVector class was changed to a readonly struct.
  • The null value constructor was changed to a static CreateNull() method.
  • The Size property was removed.

Who Benefits:

• SqlVector instances gain the efficiencies of struct handling.

Impact:

• Early-adopter applications may require updates if they rely on the old APIs
  and any class-specific behaviour.

v6.0.5

This update brings the below changes over the previous stable release:

Fixed

• Fixed NullReferenceException issue with SqlDataAdapter when processing batch scenarios where certain SQL RPC calls may not include system parameters.
  (#​3878)

Added

What Changed:

• Added new AppContext switch Switch.Microsoft.Data.SqlClient.EnableMultiSubnetFailoverByDefault to set MultiSubnetFailover=true by default in connection string.
  (#​3852)

Who Benefits:

• Applications that need MultiSubnetFailover enabled globally without modifying connection strings.

Impact:

• Applications can now enable MultiSubnetFailover globally using one of the following methods:

// In application code
AppContext.SetSwitch("Switch.Microsoft.Data.SqlClient.EnableMultiSubnetFailoverByDefault", true);

// In runtimeconfig.json
{
  "configProperties": {
    "Switch.Microsoft.Data.SqlClient.EnableMultiSubnetFailoverByDefault": true
  }
}

<!-- In App.Config -->
<runtime>
  <AppContextSwitchOverrides value="Switch.Microsoft.Data.SqlClient.EnableMultiSubnetFailoverByDefault=true" />
</runtime>

Changed

• Updated dependencies (#​3840):

  • .NET Framework 4.6.2:

    • Azure.Core 1.50.0 - Added
    • Azure.Identity 1.14.2 -> 1.17.1
    • Microsoft.Identity.Client 4.80.0 - Added
    • Microsoft.IdentityModel.JsonWebTokens 7.5.0 -> 7.7.1
    • Microsoft.IdentityModel.Protocols.OpenIdConnect 7.5.0 -> 7.7.1
    • System.Buffers 4.5.1 -> 4.6.1
    • System.Text.Json 8.0.5 -> 8.0.6
    • Microsoft.Bcl.Cryptography - Removed
    • System.Text.Encodings.Web - Removed

  • .NET 8.0:

    • Azure.Core 1.50.0 - Added
    • Azure.Identity 1.14.2 -> 1.17.1
    • Microsoft.Identity.Client 4.80.0 - Added
    • Microsoft.IdentityModel.JsonWebTokens 7.5.0 -> 7.7.1
    • Microsoft.IdentityModel.Protocols.OpenIdConnect 7.5.0 -> 7.7.1
    • Microsoft.Bcl.Cryptography - Removed
    • System.Text.Json - Removed

  • .NET 9.0:

    • Azure.Core 1.50.0 - Added
    • Azure.Identity 1.14.2 -> 1.17.1
    • Microsoft.Extensions.Caching.Memory 9.0.4 -> 9.0.11
    • Microsoft.Identity.Client 4.80.0 - Added
    • Microsoft.IdentityModel.JsonWebTokens 7.5.0 -> 7.7.1
    • Microsoft.IdentityModel.Protocols.OpenIdConnect 7.5.0 -> 7.7.1
    • Microsoft.Bcl.Cryptography - Removed
    • System.Text.Json - Removed

v6.0.4

This update brings the below changes over the previous stable release:

Added

App Context Switch for Ignoring Server-Provided Failover Partner

What Changed:

• A new app context switch Switch.Microsoft.Data.SqlClient.IgnoreServerProvidedFailoverPartner was introduced to let the client ignore server-provided failover partner info in Basic Availability Groups (BAGs). When the switch is enabled, only the failover partner specified in the connection string is used; server-supplied partner values are skipped. This context switch was introduced in PR #​3703.

Who Benefits:

• Applications connecting to SQL Server BAGs using TCP and custom ports, especially where the server's provided partner name lacks the protocol, host, or port. This avoids connection failures when the server-provided partner is incompatible or incomplete.
• Teams who manage availability groups and rely on client-side control of failover behavior in heterogeneous networking environments.

Impact:

• If your environment might be affected (i.e., you operate a BAG with custom ports, or have experienced failures after failover), you can enable the new switch in your application:

AppContext.SetSwitch("Switch.Microsoft.Data.SqlClient.IgnoreServerProvidedFailoverPartner", true);

• Then, ensure your connection string includes your preferred failover partner (with correct tcp:host,port) so that the client uses that instead of the server's suggestion.
• Without enabling this, by default, the client continues to prefer the server-provided partner, maintaining backwards compatibility.

v6.0.3

Changed

• Updated the Microsoft.Data.SqlClient.SNI and Microsoft.Data.SqlClient.SNI.runtime dependencies to 6.0.3 (was 6.0.2).
  (#​4599)

Fixed

• Fixed a SqlBulkCopy regression in environments where the application login cannot read sys.all_columns. Bulk copy now falls back to the earlier column-discovery behavior when that permission is unavailable. Support for hidden columns and SQL Graph column aliases still requires access to the metadata view.
  (#​4370, #​4306, #​4402)

• Fixed a memory-allocation regression in connection and command operations caused by formatting diagnostic strings even when tracing was disabled. Also corrected trace messages that reported an incorrect object ID or could throw FormatException when traced values contained braces.
  (#​4528, #​4533)

• Fixed ServerCertificate validation on the managed SNI path so the configured certificate is compared against the server certificate even when the server certificate passes chain and host-name validation. When certificate validation is enabled, a missing, unreadable, or invalid certificate file, a certificate mismatch, or a missing server certificate now causes the TLS handshake to fail instead of bypassing the configured certificate check. (net8.0/net9.0 only)
  (#​4445, #​4583)

• Fixed Always Encrypted VSM/HGS enclave attestation to verify that the enclave public key used to establish a session matches the key committed to by the signed attestation report. Missing, malformed, or mismatched key-binding data now causes attestation to fail before the session secret is derived.
  (#​4532, #​4553)

• Fixed SqlConnection.AccessTokenCallback not disabling Transparent Network IP Resolution by default, making it consistent with SqlConnection.AccessToken. An explicitly configured TransparentNetworkIPResolution connection-string value still takes precedence. (net462 only)
  (#​4520, #​4561)

• Fixed authentication state handling so clearing SqlConnection.AccessToken, AccessTokenCallback, or SspiContextProvider preserves the other authentication values in the connection pool key. Cloning a connection or updating its credential also preserves its SspiContextProvider. Combining a non-null SspiContextProvider with AccessToken or AccessTokenCallback now throws InvalidOperationException instead of silently discarding authentication state; applications must use one authentication mechanism at a time.
  (#​4520, #​4561, #​4644)

• Fixed configurable retry logic installing a permanent, process-wide assembly-resolution handler that could interfere with unrelated assembly loading. The handler is now active only while an explicitly configured custom retry provider is resolved and constructed, and probes AppContext.BaseDirectory instead of the current working directory. Place custom retry assemblies in the application base directory; dependencies loaded after provider construction must be resolvable through normal application dependency resolution or an application-provided handler. (net8.0/net9.0 only)
  (#​2214, #​4547, #​4663)

Companion packages

• Released Microsoft.Data.SqlClient.Extensions.Azure 7.0.3 with the Entra ID authority parsing fix for Dataverse/Dynamics 365 connections. See release notes.
• Released version-aligned Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider, Microsoft.Data.SqlClient.Extensions.Abstractions, and Microsoft.Data.SqlClient.Internal.Logging 7.0.3 with no functional or API changes. See the Azure Key Vault provider, Abstractions, and Logging release notes.

v6.0.2

Changed

• Updated the Microsoft.Data.SqlClient.SNI and Microsoft.Data.SqlClient.SNI.runtime dependencies to 6.0.3 (was 6.0.2).
  (#​4599)

Fixed

• Fixed a SqlBulkCopy regression in environments where the application login cannot read sys.all_columns. Bulk copy now falls back to the earlier column-discovery behavior when that permission is unavailable. Support for hidden columns and SQL Graph column aliases still requires access to the metadata view.
  (#​4370, #​4306, #​4402)

• Fixed a memory-allocation regression in connection and command operations caused by formatting diagnostic strings even when tracing was disabled. Also corrected trace messages that reported an incorrect object ID or could throw FormatException when traced values contained braces.
  (#​4528, #​4533)

• Fixed ServerCertificate validation on the managed SNI path so the configured certificate is compared against the server certificate even when the server certificate passes chain and host-name validation. When certificate validation is enabled, a missing, unreadable, or invalid certificate file, a certificate mismatch, or a missing server certificate now causes the TLS handshake to fail instead of bypassing the configured certificate check. (net8.0/net9.0 only)
  (#​4445, #​4583)

• Fixed Always Encrypted VSM/HGS enclave attestation to verify that the enclave public key used to establish a session matches the key committed to by the signed attestation report. Missing, malformed, or mismatched key-binding data now causes attestation to fail before the session secret is derived.
  (#​4532, #​4553)

• Fixed SqlConnection.AccessTokenCallback not disabling Transparent Network IP Resolution by default, making it consistent with SqlConnection.AccessToken. An explicitly configured TransparentNetworkIPResolution connection-string value still takes precedence. (net462 only)
  (#​4520, #​4561)

• Fixed authentication state handling so clearing SqlConnection.AccessToken, AccessTokenCallback, or SspiContextProvider preserves the other authentication values in the connection pool key. Cloning a connection or updating its credential also preserves its SspiContextProvider. Combining a non-null SspiContextProvider with AccessToken or AccessTokenCallback now throws InvalidOperationException instead of silently discarding authentication state; applications must use one authentication mechanism at a time.
  (#​4520, #​4561, #​4644)

• Fixed configurable retry logic installing a permanent, process-wide assembly-resolution handler that could interfere with unrelated assembly loading. The handler is now active only while an explicitly configured custom retry provider is resolved and constructed, and probes AppContext.BaseDirectory instead of the current working directory. Place custom retry assemblies in the application base directory; dependencies loaded after provider construction must be resolvable through normal application dependency resolution or an application-provided handler. (net8.0/net9.0 only)
  (#​2214, #​4547, #​4663)

Companion packages

• Released Microsoft.Data.SqlClient.Extensions.Azure 7.0.3 with the Entra ID authority parsing fix for Dataverse/Dynamics 365 connections. See release notes.
• Released version-aligned Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider, Microsoft.Data.SqlClient.Extensions.Abstractions, and Microsoft.Data.SqlClient.Internal.Logging 7.0.3 with no functional or API changes. See the Azure Key Vault provider, Abstractions, and Logging release notes.

v6.0.1

This update brings the below changes over the previous release:

Fixed

• Fixed reference assembly definitions for SqlClientDiagnostic APIs #​3097
• Fixed issue with down-level SSL/TLS version warnings #​3126

Changed

• Dependency changes
  • Updated SNI dependency Microsoft.Data.SqlClient.SNI and Microsoft.Data.SqlClient.SNI.runtime to 6.0.2 #​3116 #​3117

v6.0.0

No changes since the last preview release

v5.2.3

This update brings the following changes since the 5.2.2 release:

Fixed

• Fixed possible NullPointerException during socket receive (PR #​3284)
• Fixed inconsistencies between source and reference projects (PR #​3124)
• Adjusted retry logic to allow errors with negative numbers to be considered transient (PR #​3185)

Changed

• Updated the following dependencies:
  • System.Private.Uri 4.3.2 - Avoid transitive CVE-2019-0820 (PR #​3076)
  • Microsoft.Extensions.Caching.Memory 6.0.1 to 6.0.3 - Avoid CVE-2024-43483 (PR #​3280)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

Commands to ignore dependencies

You can trigger dependency actions by commenting on this PR:

• @particularbot ignore this major version
• @particularbot ignore this minor version
• @particularbot ignore this dependency

[dependencyupdates]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.