Bump the dotnet-dependencies group with 11 updates by dependabot[bot] · Pull Request #397 · Chris-Wolfgang/ETL-SqlBulkCopy

This is the general availability release of Microsoft.Data.SqlClient 7.1. It closes out the 7.1 preview cycle with application identity reporting for telemetry, the deprecation of TransparentNetworkIPResolution, and a set of connection, transaction, and Named Pipes fixes.

Important — package version alignment: Starting with the 7.0.2 release, the Microsoft.Data.SqlClient driver and its companion packages share a single aligned version. The 7.1.0 GA release continues this alignment; the following packages ship together as 7.1.0:

Microsoft.Data.SqlClient

Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider

Microsoft.Data.SqlClient.Extensions.Azure

Microsoft.Data.SqlClient.Extensions.Abstractions

Microsoft.Data.SqlClient.Internal.Logging

(Microsoft.SqlServer.Server continues to version independently and remains at 1.0.0.)

Applications must reference the same versions of Microsoft.Data.SqlClient and its extensions for best compatibility. In particular, applications that reference Microsoft.Data.SqlClient.Extensions.Azure must upgrade it to 7.1.0 when upgrading Microsoft.Data.SqlClient to 7.1.0.

Compatibility guarantee: All aligned assemblies ship with FileVersion 7.1.0.x and AssemblyVersion 7.0.0.0. The AssemblyVersion is unchanged from 7.0.2, so upgrading from 7.0.2, 7.0.3, or any 7.1 preview to 7.1.0 does not require any new .NET Framework strong-name binding redirects. Applications upgrading from 7.0.0 or 7.0.1 should note that Extensions.Azure, Extensions.Abstractions, and Internal.Logging raised their AssemblyVersion from 1.0.0.0 to 7.0.0.0 in 7.0.2; see those release notes for the one-time .NET Framework impact.

Companion package release notes

Changes Since 7.1.0-preview3

Added

Application Identity in the USERAGENT Payload

What Changed:

Added a RegisteredApplication enum and a matching SqlConnection.RegisteredApplication property that let a library or tool identify itself to SQL Server through version 2 of the TDS USERAGENT feature extension. The payload also carries a new driver-owned 64-bit Driver Properties flag field; bit 0 reports whether connection pool V2 is enabled for the process. Both fields are emitted as unpadded uppercase hexadecimal. (#3201, #4632)

Who Benefits:

Middleware and tooling built on top of the driver — Entity Framework Core, Semantic Kernel, SQL Server Management Studio, SqlPackage, Data API Builder, and similar — can be distinguished in server-side telemetry without the driver accepting arbitrary user-supplied user-agent text. This originated as a request from the Entity Framework Core team.
Service operators gain a more accurate picture of which client stacks are connecting, which helps when diagnosing workload-specific behavior.

Impact:

Purely additive from the application's perspective: a newly created physical connection whose RegisteredApplication is unset reports Unknown (0). On the wire the field itself is new — USERAGENT payload v1 carried no application identifier, while v2 always emits one.
Set the property before calling Open or OpenAsync. Assigning it while the connection is connecting or open throws InvalidOperationException.

using var connection = new SqlConnection(connectionString);
connection.RegisteredApplication = RegisteredApplication.EntityFrameworkCore;
await connection.OpenAsync();

The enum is ushort-backed and marked [CLSCompliant(false)]. Values are partitioned by range: 0x0001–0x7FFF for Microsoft-defined large-scale applications, 0x8000–0xBFFF for small-scale use, and 0xC000–0xFFFF for public/developer use. Applications that are not yet registered can cast an unassigned value from the appropriate range.
... (truncated)

7.1.0-preview3

This update brings the following changes since the 7.1.0-preview2 release.

Package version alignment: The Microsoft.Data.SqlClient driver and its companion packages continue the aligned versioning introduced in 7.0.2. All five packages listed below ship together as 7.1.0-preview3. (Microsoft.SqlServer.Server continues to version independently and remains at 1.0.0.) Applications that reference Microsoft.Data.SqlClient.Extensions.Azure must upgrade it to 7.1.0-preview3 when upgrading Microsoft.Data.SqlClient.

Compatibility guarantee: All aligned assemblies ship with FileVersion 7.1.0.x and AssemblyVersion 7.0.0.0 — unchanged from 7.0.2 — so upgrading from 7.0.2 to 7.1.0-preview3 does not require any new .NET Framework strong-name binding redirects.

Packages in this release

`Microsoft.Data.SqlClient` 7.1.0-preview3

Added

Asynchronous key store provider APIs for Always Encrypted — four virtual methods on SqlColumnEncryptionKeyStoreProvider with CancellationToken support. Purely additive; defaults delegate to the synchronous methods, so existing providers are unaffected (#3672, #3673)
Connection Pool V2 nears parity with the default pool (opt-in via Switch.Microsoft.Data.SqlClient.UseConnectionPoolV2):
- Transaction support (#4487)
- Broken-connection replacement during command execution (#4429)
- Background warmup to Min Pool Size and automatic replenishment (#4452)
- Idle pruning driven by Connection Idle Timeout (#4463)
- Optional ConcurrencyLimiter rate limiting for new physical connections (#4395, #4396)
- Leaked connection reclamation, including the previously always-zero number-of-reclaimed-connections counter (#4529)
- Metrics and tracing parity with the default pool (#4504)

Changed

Single cross-platform build — Windows-only native SNI types now trim cleanly on Linux and macOS. Package structure and contents unchanged (#4207, #4239, #4465, #4474)
Async read-path allocations restored to baseline via PacketData node reuse — ExecuteReaderAsync goes from +120.9% to +0.1% against 6.1.6 (#4536)
SqlBulkCopy skips graph alias mapping when no graph pseudo-columns are present, recovering a regression from #3677 (#4535)
No formatted trace string is allocated when SqlClientEventSource tracing is disabled, recovering a memory regression against 6.1.6. Trace output unchanged (#4528)
net9.0 dependencies moved to 9.0.18; System.Threading.RateLimiting added to packaged metadata. Other targets keep their 8.0.x pins (#4507)
Microsoft.Data.SqlClient.SNI and .SNI.runtime updated to 7.1.0-preview3.26226.3 (#4564)

Fixed

Always Encrypted VSM/HGS attestation now verifies the enclave public key is bound to the signed report, using a fixed-time SHA-256 comparison against EnclaveData (#4532)
SqlConnectionFactory no longer wakes the process every 30 seconds when no pools exist — including with Pooling=False and after ClearAllPools() (#1881, #4479)
Connection pool performance counters affecting the default pool as well as pool V2 — active-soft-connects and number-of-active-connections could go negative after a failed activation, and several gauges drifted upward permanently after a broken connection was replaced (#4504)
OverflowException when sending large decimal values with explicit Precision and Scale, which primarily affected Always Encrypted (#1655, #4443)
TDS stream error when passing a DateOnly value with SqlDbType.Variant (net8.0/net9.0) (#3953, #4294)
DateOnly in table-valued parameter sql_variant columns sent as datetime instead of date, which overflowed for values valid as date (net8.0/net9.0) (#3934, #4439)
ServerCertificate keyword ignored when the platform reported no TLS policy errors. It is now always compared, and an unloadable certificate fails closed with SSLCertificateAuthenticationException instead of silently falling back to host-name validation (#4445)
SqlConnection.AccessTokenCallback not disabling TNIR by default, plus pool-key construction and SspiContextProvider exclusivity with token auth (net462 for the TNIR behavior) (#4520)
Fatal exceptions such as OutOfMemoryException captured into faulted Tasks across several SqlBulkCopy, SqlDataReader, and SqlCommand async entry points (#4437)
Entra ID authentication failing against multi-segment authorities such as the Dataverse / Dynamics 365 TDS end...

Description has been truncated

Bumps CsCheck from 4.8.0 to 4.9.1 Bumps Meziantou.Analyzer from 3.0.167 to 3.0.283 Bumps Microsoft.Bcl.AsyncInterfaces from 10.0.11 to 10.0.12 Bumps Microsoft.Data.SqlClient from 7.0.2 to 7.1.0 Bumps Microsoft.Extensions.Logging.Abstractions from 10.0.11 to 10.0.12 Bumps Microsoft.SourceLink.GitHub from 10.0.400 to 10.0.401 Bumps nuget-license from 4.0.17 to 4.0.18 Bumps Roslynator.Analyzers from 4.16.1 to 5.0.0 Bumps SonarAnalyzer.CSharp from 10.32.0.713 to 10.34.0.3385 Bumps Testcontainers.MsSql from 4.14.0 to 4.15.0 Bumps Xunit.SkippableFact from 1.5.61 to 1.5.85 --- updated-dependencies: - dependency-name: CsCheck dependency-version: 4.9.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dotnet-dependencies - dependency-name: Meziantou.Analyzer dependency-version: 3.0.283 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dotnet-dependencies - dependency-name: Microsoft.Bcl.AsyncInterfaces dependency-version: 10.0.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dotnet-dependencies - dependency-name: Microsoft.Data.SqlClient dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dotnet-dependencies - dependency-name: Microsoft.Extensions.Logging.Abstractions dependency-version: 10.0.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dotnet-dependencies - dependency-name: Microsoft.SourceLink.GitHub dependency-version: 10.0.401 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dotnet-dependencies - dependency-name: nuget-license dependency-version: 4.0.18 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dotnet-dependencies - dependency-name: Roslynator.Analyzers dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: dotnet-dependencies - dependency-name: SonarAnalyzer.CSharp dependency-version: 10.34.0.3385 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dotnet-dependencies - dependency-name: Testcontainers.MsSql dependency-version: 4.15.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dotnet-dependencies - dependency-name: Testcontainers.MsSql dependency-version: 4.15.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dotnet-dependencies - dependency-name: Xunit.SkippableFact dependency-version: 1.5.85 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dotnet-dependencies - dependency-name: Xunit.SkippableFact dependency-version: 1.5.85 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dotnet-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-09-23T12:33:57Z

PR benchmark delta

Benchmark	Base mean	HEAD mean	Δ mean	Base alloc	HEAD alloc	Δ alloc
Compiled_Reference	0.7 ns	0.8 ns	+16.0%	0 B	0 B	—
Compiled_Value_Boxed	7.7 ns	8.8 ns	+14.2%	24 B	24 B	+0.0%
Reflection_Reference	7.5 ns	7.5 ns	+0.1%	0 B	0 B	—
Reflection_Value_Boxed	13.3 ns	13.7 ns	+2.8%	24 B	24 B	+0.0%
FullSpan_FastPath(Size: 10000)	2.1 ns	2.1 ns	+1.3%	0 B	0 B	—
PartialSlice_Copy(Size: 10000)	11.81 µs	11.78 µs	-0.3%	39.09 KB	39.09 KB	+0.0%

Job: Short (~5% variance). Filter: *PropertyGetter*|*SliceList* — DB-free micro-benchmarks. Gate mode: informational; see #106 for threshold-gate follow-up.

…ies-0f924b508d

dependabot · 2026-09-23T14:25:17Z

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

Stage 1 fails restore on this PR: error NU1605: Warning As Error: Detected package downgrade: Microsoft.Data.SqlClient from 7.1.0 to 7.0.2 tools/GcProfileWorkload is not in the PR's file list. The group bump raised Microsoft.Data.SqlClient to 7.1.0 in src/, tests/ and samples/, but this project references the library by ProjectReference AND pins SqlClient 7.0.2 directly, so its direct reference is now lower than what it gets transitively. That is a downgrade, TreatWarningsAsErrors makes NU1605 an error, and restore fails for the whole build rather than just this project. The same file also raised the SSH.NET advisories - NU1903 for GHSA-q939-rpr3-3284 and GHSA-mggc-4xg6-vcxf - because Testcontainers pulls SSH.NET 2025.1.0 transitively and this is the one project that never received the forward pin its two siblings carry. So: SqlClient to 7.1.0, Testcontainers.MsSql to 4.15.0 to match the rest of the repository, and the SSH.NET 2026.0.0 security pin with the same rationale and the same removal condition as Tests.Integration and ShadowWorkloads. Verified locally rather than by inference: restoring this project before the change reproduces error NU1605 and NU1903 and exits 1; after it, restore is clean and exits 0. Note this commit ends Dependabot's management of this branch - it will not rebase or update the PR again, which is fine if it merges from here. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Chris-Wolfgang · 2026-09-23T14:54:07Z

Why Stage 1 was failing

error NU1605: Warning As Error: Detected package downgrade:
              Microsoft.Data.SqlClient from 7.1.0 to 7.0.2
  GcProfileWorkload -> Microsoft.Data.SqlClient (>= 7.0.2)
  GcProfileWorkload -> Wolfgang.Etl.SqlBulkCopy -> Microsoft.Data.SqlClient (>= 7.1.0)

tools/GcProfileWorkload is not in this PR's file list. The group bump raised Microsoft.Data.SqlClient to 7.1.0 across src/, tests/ and samples/, but that project references the library by ProjectReference and pins SqlClient 7.0.2 directly — so its direct reference is now lower than what it gets transitively. TreatWarningsAsErrors turns NU1605 into an error, and restore fails for the whole build, not just that project.

The same file was also the source of the SSH.NET advisories in the log — NU1903 for GHSA-q939-rpr3-3284 and GHSA-mggc-4xg6-vcxf. Testcontainers pulls SSH.NET 2025.1.0 transitively, and GcProfileWorkload is the one project that never received the forward pin its two siblings (Tests.Integration, ShadowWorkloads) already carry, with a documented rationale.

The fix

Microsoft.Data.SqlClient → 7.1.0, matching the library it references
Testcontainers.MsSql → 4.15.0, matching the rest of the repository
SSH.NET 2026.0.0 security pin, with the same rationale and the same removal condition as the sibling projects

Verified locally, not inferred

	result
restore before the change	`error NU1605` + `NU1903`, exit 1
restore after	clean, exit 0

Two things worth knowing

This commit ends Dependabot's management of this branch — it will not rebase or update the PR again. That is fine if it merges from here; if it sits, close it and let Dependabot raise a fresh one.

Worth a follow-up: Dependabot's nuget entry uses directory: "/", yet it bumped seven files and left tools/GcProfileWorkload untouched, which is what created the downgrade. If that project is outside whatever solution Dependabot discovers, the same gap will recur on the next group bump. I have not changed dependabot.yml here — that is a separate concern from unblocking this PR.

🤖 Generated with Claude Code

…on too *** TEST-CODE CHANGE - flagged for review per the house rule. *** With restore fixed, Stage 1 got as far as running tests and 10 failed on the net5.0 leg with: System.PlatformNotSupportedException : Microsoft.Data.SqlClient is not supported on this platform. at Microsoft.Data.SqlClient.SqlConnection..ctor() Both test classes already have a guard whose stated purpose is exactly this - "the facts that need a real SqlConnection skip instead of fail there" - but it catches only TypeInitializationException, the SqlPerformanceCounters cctor failure. Microsoft.Data.SqlClient ships lib/ assets for net462, net8.0, net9.0 and netstandard2.0 only, so the net5.0-net7.0 legs bind netstandard2.0, whose members throw PlatformNotSupportedException outright. That escapes the catch, propagates out of the Lazy, and fails every test calling NewConnection(). The guard now treats it the same way, for the same reason: no real SqlConnection is available on that leg. This is NOT caused by the version bump. 7.0.2 and 7.1.0 ship identical target frameworks - verified against both packages in the local NuGet cache - so the net5.0 leg binds netstandard2.0 either way. The failures were latent and only became visible once the NU1605 downgrade stopped failing the build at restore. No assertion is weakened and nothing is suppressed: on every leg where SqlClient works (net8.0/9.0/10.0, and the .NET Framework legs) these tests run exactly as before. Verified locally on net10.0: 338 passed, 0 skipped. What I could NOT verify locally: the skip itself. The PlatformNotSupportedException only occurs on the Linux net5.0-net7.0 legs, and this machine is Windows, where SqlClient loads. CI is the real check. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Chris-Wolfgang · 2026-09-23T15:05:15Z

Second failure, different cause — and ⚠️ this one changes test code

With restore fixed, Stage 1 got as far as running tests. 10 failed on the net5.0 leg:

System.PlatformNotSupportedException : Microsoft.Data.SqlClient is not supported on this platform.
  at Microsoft.Data.SqlClient.SqlConnection..ctor()

This is not caused by the bump

Microsoft.Data.SqlClient ships lib/ assets for net462, net8.0, net9.0 and netstandard2.0 only — verified against both packages in the local NuGet cache:

version	lib/
7.0.2	net462, net8.0, net9.0, netstandard2.0
7.1.0	net462, net8.0, net9.0, netstandard2.0

Identical. The net5.0–net7.0 legs bind netstandard2.0 either way, and its members throw PlatformNotSupportedException outright. These failures were latent — they only became visible once the NU1605 downgrade stopped failing the build at restore, before tests ever ran.

The fix, and why it is not "shrinking a failing test"

Both test classes already carry a guard whose stated purpose is exactly this — "the facts that need a real SqlConnection skip instead of fail there" — but it catches only TypeInitializationException, the SqlPerformanceCounters cctor failure mode. The netstandard2.0 asset does not fail that way; it throws PlatformNotSupportedException, which escapes the catch, propagates out of the Lazy, and fails every test calling NewConnection().

The guard now treats it identically, for the identical reason: no real SqlConnection exists on that leg. No assertion is weakened and nothing is suppressed — on every leg where SqlClient works (net8.0/9.0/10.0 and the .NET Framework legs) these tests run exactly as before.

Verification, including what I could not verify

	result
restore, before the earlier fix	`error NU1605` + `NU1903`, exit 1
restore, after	clean, exit 0
`dotnet test -f net10.0`, after the guard change	338 passed, 0 skipped
the skip itself on net5.0	not verified locally

That last row matters: PlatformNotSupportedException only occurs on the Linux net5.0–net7.0 legs, and this machine is Windows, where SqlClient loads. CI is the real check for that one.

Flagged for review

Two files under tests/ changed. Per the house rule I am surfacing that rather than folding it in quietly — it is the one part of this PR that is not a dependency bump, and if you would rather hold the group bump and file a migration issue instead, say so and I will revert it.

🤖 Generated with Claude Code

dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 23, 2026

dependabot Bot requested a review from Chris-Wolfgang as a code owner September 23, 2026 12:26

dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 23, 2026

Merge branch 'main' into dependabot/nuget/dot-config/dotnet-dependenc…

7535a09

…ies-0f924b508d

Chris-Wolfgang merged commit cd91466 into main Sep 23, 2026
30 checks passed

Chris-Wolfgang deleted the dependabot/nuget/dot-config/dotnet-dependencies-0f924b508d branch September 23, 2026 15:32

Navigation Menu

Bump the dotnet-dependencies group with 11 updates - #397

Bump the dotnet-dependencies group with 11 updates#397
Chris-Wolfgang merged 4 commits into
mainfrom
dependabot/nuget/dot-config/dotnet-dependencies-0f924b508d

dependabot Bot commented on behalf of github Sep 23, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 23, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Sep 23, 2026

Uh oh!

Chris-Wolfgang commented Sep 23, 2026

Uh oh!

Chris-Wolfgang commented Sep 23, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

3.0.283

What's Changed

3.0.282

What's Changed

3.0.281

What's Changed

3.0.280

What's Changed

3.0.279

What's Changed

3.0.278

What's Changed

3.0.277

What's Changed

3.0.276

What's Changed

3.0.275

What's Changed

3.0.274

What's Changed

3.0.273

What's Changed

3.0.272

What's Changed

3.0.271

What's Changed

3.0.270

What's Changed

3.0.269

What's Changed

3.0.268

What's Changed

3.0.267

What's Changed

3.0.266

What's Changed

3.0.265

What's Changed

3.0.264

What's Changed

3.0.263

What's Changed

3.0.262

What's Changed

3.0.261

What's Changed

3.0.260

What's Changed

3.0.259

What's Changed

3.0.258

What's Changed

3.0.257

What's Changed

3.0.256

What's Changed

3.0.255

What's Changed

3.0.254

What's Changed

3.0.253

What's Changed

3.0.252

What's Changed

3.0.251

What's Changed

3.0.250

What's Changed

3.0.249

What's Changed

3.0.248

What's Changed

3.0.247

What's Changed

3.0.246

What's Changed

3.0.245

dependabot Bot commented on behalf of github Sep 23, 2026 •

edited

Loading