[6.0] Dependency Cleanup

[paulmedynski]

Description

• Removed unused dependencies across all driver and test projects.
• Updated some dependencies, avoiding transitive vulnerabilities.
• Updated nuspec files to remove/update dependencies accordingly.

Details

MDS

Package	Target Framework	Previous Dependency Type	Previous Version	Current Dependency Type	Current Version
Microsoft.Bcl.Cryptography	net462, net8.0, net9.0	Direct	8.0.0	None
Microsoft.Extensions.Caching.Memory	net9.0	Direct	9.0.4	Direct	9.0.11
Microsoft.IdentityModel.JsonWebTokens	net462, net8.0, net9.0	Direct	7.5.0	Direct	7.7.1
Microsoft.IdentityModel.Protocols.OpenIdConnect	net462, net8.0, net9.0	Direct	7.5.0	Direct	7.7.1
System.Buffers	net462	Direct	4.5.1	Direct	4.6.1
System.Text.Encodings.Web	net462	Direct	8.0.0	Transitive	8.0.0
System.Text.Json	net462	Direct	8.0.5	Direct	8.0.6

AKV

Package	Target Framework	Previous Dependency Type	Previous Version	Current Dependency Type	Current Version
Microsoft.Extensions.Caching.Memory	net9.0	Direct	9.0.4	Direct	9.0.11
System.Text.Encodings.Web	net462	Direct	8.0.0	Transitive	8.0.0
System.Text.Encodings.Web	net8.0, net9.0	Direct	8.0.0	None

Issues

Resolves #3808.

Testing

• CI will validate the changes.
• Manually inspected the full package dependency tree for the driver projects to ensure no major version increments.
• Manuall inspected CI runs to observe that tests are being executed for the expected target frameworks and architectures.

[paulmedynski]

This took a long time to figure out.

[Copilot]

Pull request overview

This pull request performs a comprehensive dependency cleanup for the 6.0 branch, removing unused dependencies and updating others to address security vulnerabilities. The changes ensure consistency across NuGet package specifications, version property files, and project references for both the main SqlClient driver and the AlwaysEncrypted AzureKeyVaultProvider add-on.

Key changes include:

• Removal of unused dependencies (Microsoft.Bcl.Cryptography, System.Text.Encodings.Web, and several test-only packages)
• Updates to identity and security-related packages (Microsoft.IdentityModel.* from 7.5.0 to 7.7.1, Azure.* packages, System.Buffers, System.Text.Json)
• Addition of an explicit MDS 5.1.8 reference in ExtUtilities to mitigate vulnerable transitive dependencies
• Change from version ranges to fixed versions for Azure.Core and Azure.Security.KeyVault.Keys in the AKV provider

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tools/specs/add-ons/Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider.nuspec	Updated Azure.Core and Azure.Security.KeyVault.Keys from version ranges to fixed versions; updated Microsoft.Extensions.Caching.Memory for net9.0
tools/specs/Microsoft.Data.SqlClient.nuspec	Removed Microsoft.Bcl.Cryptography and System.Text.Encodings.Web; updated Microsoft.IdentityModel.*, System.Buffers, System.Text.Json, and Microsoft.Extensions.Caching.Memory versions
tools/props/VersionsNet9OrLater.props	Removed Microsoft.Bcl.Cryptography version property; updated Microsoft.Extensions.Caching.Memory to 9.0.11
tools/props/Versions.props	Removed properties for unused dependencies (Microsoft.Bcl.Cryptography, System.Text.Encodings.Web, test dependencies); updated versions for IdentityModel, System.Buffers, System.Text.Json, Azure packages, and test SDKs
src/Microsoft.Data.SqlClient/tests/tools/Microsoft.Data.SqlClient.TestUtilities/Microsoft.Data.SqlClient.TestUtilities.csproj	Removed unused System.Formats.Asn1 and System.Security.Cryptography.Cng package references
src/Microsoft.Data.SqlClient/tests/tools/Microsoft.Data.SqlClient.ExtUtilities/Microsoft.Data.SqlClient.ExtUtilities.csproj	Added explicit MDS 5.1.8 reference with explanatory comment to avoid vulnerable transitive dependency
src/Microsoft.Data.SqlClient/tests/ManualTests/Microsoft.Data.SqlClient.ManualTesting.Tests.csproj	Removed Microsoft.Bcl.Cryptography package reference
src/Microsoft.Data.SqlClient/tests/FunctionalTests/Microsoft.Data.SqlClient.Tests.csproj	Removed Microsoft.Bcl.Cryptography package reference
src/Microsoft.Data.SqlClient/netfx/src/Microsoft.Data.SqlClient.csproj	Removed System.Text.Encodings.Web and Microsoft.Bcl.Cryptography package references
src/Microsoft.Data.SqlClient/netfx/ref/Microsoft.Data.SqlClient.csproj	Removed System.Text.Encodings.Web and Microsoft.Bcl.Cryptography package references
src/Microsoft.Data.SqlClient/netcore/src/Microsoft.Data.SqlClient.csproj	Removed Microsoft.Bcl.Cryptography package reference
src/Microsoft.Data.SqlClient/netcore/ref/Microsoft.Data.SqlClient.csproj	Removed Microsoft.Bcl.Cryptography package reference
src/Microsoft.Data.SqlClient/add-ons/AzureKeyVaultProvider/Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider.csproj	Removed System.Text.Encodings.Web package reference

[paulmedynski]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 2 pipeline(s).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 62.59%. Comparing base (fd34d5e) to head (a3b7550).

Additional details and impacted files

@@             Coverage Diff              @@
##           release/6.0    #3840   +/-   ##
============================================
  Coverage        62.58%   62.59%           
============================================
  Files              285      285           
  Lines            59152    59152           
============================================
+ Hits             37019    37024    +5     
+ Misses           22133    22128    -5     

Flag	Coverage Δ
addons	92.58% <ø> (ø)
netcore	67.94% <ø> (+0.01%)	⬆️
netfx	63.66% <ø> (+0.02%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[mdaigle]

This is supposed to provide the System.Security.Cryptography.X509Certificates.X509CertificateLoader type, which became required in .NET 9. But because we ended up only making the change conditionally for .NET 9, Framework code was unchanged and didn't need this type: https://github.com/dotnet/SqlClient/blob/main/src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/VirtualSecureModeEnclaveProvider.cs#L172

[paulmedynski]

Yes, saw the #if NET_9_0_Or_Greater conditionals and was able to remove this package without incident.

[mdaigle]

👀 note to self to double check that tests still run

[paulmedynski]

Please do - I eyeballed a bunch of the jobs, and tests are running. I didn't do an exhaustive comparison with a previous run.

[mdaigle]

I think we get System.Security.Cryptography.Pkcs for free in net462: https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.pkcs?view=netframework-4.6.2

[Copilot]

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated no new comments.