[dependabot]

Updated Microsoft.Data.SqlClient from 6.1.4 to 6.1.7.

Release notes

Sourced from Microsoft.Data.SqlClient's releases.

6.1.7

This update brings the following changes since the 6.1.6 release:

Changed

• Updated the Microsoft.Data.SqlClient.SNI and Microsoft.Data.SqlClient.SNI.runtime dependencies to 6.0.3 (was 6.0.2).
  (#​4598)

Fixed

• Fixed ServerCertificate validation on the managed SNI path so the configured certificate is compared against the server certificate even when the server certificate passes chain and host-name validation. When certificate validation is enabled, a missing, unreadable, or invalid certificate file, a certificate mismatch, or a missing server certificate now causes the TLS handshake to fail instead of bypassing the configured certificate check. (net8.0/net9.0 only)
  (#​4445, #​4584)

• Fixed Always Encrypted VSM/HGS enclave attestation to verify that the enclave public key used to establish a session matches the key committed to by the signed attestation report. Missing, malformed, or mismatched key-binding data now causes attestation to fail before the session secret is derived.
  (#​4532, #​4552)

• Fixed SqlConnection.AccessTokenCallback not disabling Transparent Network IP Resolution by default, making it consistent with SqlConnection.AccessToken. An explicitly configured TransparentNetworkIPResolution connection-string value still takes precedence. (net462 only)
  (#​4520, #​4560)

• Fixed token authentication state handling so clearing SqlConnection.AccessToken preserves an existing AccessTokenCallback in the connection pool key, and clearing AccessTokenCallback preserves an existing AccessToken. Callback-based authentication now also follows the same prelogin server-certificate validation rules as an explicitly supplied access token.
  (#​4520, #​4560)

• Fixed configurable retry logic installing a permanent, process-wide assembly-resolution handler that could interfere with unrelated assembly loading. The handler is now active only while an explicitly configured custom retry provider is resolved and constructed, and probes AppContext.BaseDirectory instead of the current working directory. Place custom retry assemblies in the application base directory; dependencies loaded after provider construction must be resolvable through normal application dependency resolution or an application-provided handler. (net8.0/net9.0 only)
  (#​2214, #​4547, #​4664)

Target Platform Support

• .NET Framework 4.6.2+ (Windows x86, Windows x64, Windows ARM64)
• .NET 8.0+ (Windows x86, Windows x64, Windows ARM64, Linux, macOS)
• .NET Standard 2.0+ (Windows x86, Windows x64, Windows ARM64, Linux, macOS)

Full details: release-notes/6.1/6.1.7.md

6.1.6

This update brings the following changes since the 6.1.5 release:

Added

WAM broker support for the supported Entra ID authentication modes (Windows only)

What Changed:

• Added support for the Web Account Manager (WAM) broker for the supported Microsoft Entra ID authentication modes. A new ActiveDirectoryAuthenticationProviderOptions options bag and a corresponding ActiveDirectoryAuthenticationProvider(ActiveDirectoryAuthenticationProviderOptions options) constructor were introduced, exposing a UseWamBroker property (alongside ApplicationClientId and DeviceCodeFlowCallback).
  (#​4288, #​4387)
• Added a cross-platform SetParentActivityOrWindowFunc(Func<object> parentActivityOrWindowFunc) method so callers can supply a parent window handle on Windows or a parent Activity/UIViewController on Android/iOS/MAUI.

Who Benefits:

• Applications using ActiveDirectoryInteractive and other supported Entra ID authentication modes on Windows benefit from the WAM broker's improved security (tokens are brokered by the OS), single sign-on with the logged-in Windows account, and support for Conditional Access and Windows Hello.

Impact:

• When you supply your ApplicationClientId, WAM is opt-in via ActiveDirectoryAuthenticationProviderOptions.UseWamBroker. Consider enabling it when you want OS-brokered tokens, single sign-on with the signed-in Windows account, Windows Hello, and Conditional Access support.
• UseWamBroker is a Windows-only setting and has no effect on non-Windows platforms, where interactive Entra ID flows always use the system browser.
• Prefer the new options-bag constructor over the positional-argument overloads in new code.

var options = new ActiveDirectoryAuthenticationProviderOptions
{
    ApplicationClientId = "<your-app-client-id>",
    // Enable WAM (Windows only) for OS-brokered tokens, SSO, Windows Hello, and Conditional Access.
    UseWamBroker = true,
};
var provider = new ActiveDirectoryAuthenticationProvider(options);
// Supply the parent window/activity that owns the interactive sign-in prompt.
provider.SetParentActivityOrWindowFunc(() => parentWindowHandle);
SqlAuthenticationProvider.SetProvider(SqlAuthenticationMethod.ActiveDirectoryInteractive, provider);

Changed

Hardened TDS token parsing with data-length bounds checks

What Changed:

• Added bounds checking when parsing TDS token data lengths. The parser now validates the declared length of incoming token data against the available buffer before reading, rejecting malformed or out-of-range length values instead of reading past the intended boundary.
  (#​4340, #​4359)

Who Benefits:

• All consumers benefit from improved resilience against malformed or hostile TDS responses. A server (or man-in-the-middle) sending an invalid token length can no longer drive the parser to read beyond the declared payload.

Impact:
... (truncated)

6.1.5

This update brings the following changes since the 6.1.4 release:

Fixed

• Fixed a connection performance regression where SPN (Service Principal Name) generation was triggered for non-integrated authentication modes (e.g., SQL authentication) on the native SNI path, causing unnecessary DNS lookups and significantly slower connection times. Only affects .NET on Windows (not .NET Framework). (#​3523, #​3946)
• Fixed ExecuteScalar to properly propagate errors when the server sends data followed by an error token. Previously, errors such as conversion failures during WHERE clause evaluation were silently consumed during SqlDataReader.Close() instead of being thrown to the caller, which could result in transactions being unexpectedly zombied. (#​3736, #​3947)
• Fixed SqlDataReader.GetFieldType and SqlDataReader.GetProviderSpecificFieldType to return the correct type (SqlVector<float>) for vector float32 columns. Previously, these methods did not follow the same type-resolution logic as GetValue, returning an incorrect type for vector columns. (#​4104, #​4151)

Target Platform Support

• .NET Framework 4.6.2+ (Windows x86, Windows x64, Windows ARM64)
• .NET 8.0+ (Windows x86, Windows x64, Windows ARM64, Linux, macOS)
• .NET Standard 2.0+ (Windows x86, Windows x64, Windows ARM64, Linux, macOS)

Dependencies

.NET Framework 4.6.2

• Azure.Core 1.50.0
• Azure.Identity 1.17.1
• Microsoft.Data.SqlClient.SNI 6.0.2
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.Identity.Client 4.80.0
• Microsoft.IdentityModel.JsonWebTokens 7.7.1
• Microsoft.IdentityModel.Protocols.OpenIdConnect 7.7.1
• System.Buffers 4.6.1
• System.Data.Common 4.3.0
• System.Diagnostics.DiagnosticSource 8.0.1
• System.IdentityModel.Tokens.Jwt 7.7.1
• System.Memory 4.6.3
• System.Security.Cryptography.Pkcs 8.0.1
• System.Text.Json 8.0.6
• System.Text.RegularExpressions 4.3.1

.NET 8.0

• Azure.Core 1.50.0
• Azure.Identity 1.17.1
• Microsoft.Data.SqlClient.SNI.runtime 6.0.2
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.Identity.Client 4.80.0
• Microsoft.IdentityModel.JsonWebTokens 7.7.1
• Microsoft.IdentityModel.Protocols.OpenIdConnect 7.7.1
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 8.0.1
• System.Diagnostics.DiagnosticSource 8.0.1
• System.IdentityModel.Tokens.Jwt 7.7.1
• System.Security.Cryptography.Pkcs 8.0.1

.NET 9.0

... (truncated)

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore from 10.0.3 to 10.0.13.

Release notes

Sourced from Microsoft.EntityFrameworkCore's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.Relational from 10.0.3 to 10.0.13.

Release notes

Sourced from Microsoft.EntityFrameworkCore.Relational's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.SqlServer from 10.0.3 to 10.0.13.

Release notes

Sourced from Microsoft.EntityFrameworkCore.SqlServer's releases.

No release notes found for this version range.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)