System.Data.SqlClient flaged as dependency by SourceBuild, but not present in any project.assets.json files

[JanKrivanek]

Background

System.Data.SqlClient v4.8.3 is reported as dependency of MSBuild (https://devdiv.visualstudio.com/DevDiv/_componentGovernance/DotNet-msbuild-Trusted?_a=components&typeId=8799614&alerts-view-option=active)
Looking into a sample build run: https://devdiv.visualstudio.com/DevDiv/_build/results?buildId=7861261&view=results, th dependency shows only in the SourceBuild (binlog)

However it doesn't show in neither project.assets.json files that are part of the build:

Where does this happen

MSBuild pipeline: https://devdiv.visualstudio.com/DevDiv/_build?definitionId=9434&_a=summary, build of main branch

Possible Issue

While the dependency is part of the nuget cache, it doesn't seem to be pulled by the build. Rather I suspect it being pulled by some of the SourceBuild components/dependencies.
Is there a chance to make a snapshot before the build itself and then do a diff of those (in order to prevent accounting SourceBuild components as target build components)?

I couldn't figure out the best area label to add to this issue. If you have write-permissions please help me learn by adding exactly one area label.

[MichaelSimons]

The source of this packages comes from this dependency - https://github.com/dotnet/msbuild/blob/main/eng/Version.Details.xml#L4. MSBuild is referencing a very old version of this and should be upgraded to the latest 8.0 version and this issue will be resolved. I would recommend ensuring there is a darc subscription to keep this up-to-date.

The source-build-reference-packages repo contains all of the reference packages needed to build .NET from source. The SB infrastructure pulls in these packages implicitly via the source build metadata on the Version.Details.xml dependencies.