[6.1] Dependency Cleanup

src/Directory.Packages.props

@@ -1,69 +1,68 @@
 <Project>
-    <PropertyGroup>
-        <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
-        <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
-    </PropertyGroup>
-    <!-- NetFx project dependencies -->
-    <ItemGroup>
-        <PackageVersion Include="Microsoft.Data.SqlClient.SNI" Version="6.0.2" />
-        <PackageVersion Include="System.Buffers" Version="4.5.1" />
-        <PackageVersion Include="System.Memory" Version="4.5.5" />
-        <PackageVersion Include="System.Data.Common" Version="4.3.0" />
-        <PackageVersion Include="System.Text.Encodings.Web" Version="8.0.0" />
-    </ItemGroup>
-    <!-- NetFx and NetCore project dependencies -->
-    <ItemGroup>
-        <PackageVersion Include="Azure.Identity" Version="1.14.2" />
-        <PackageVersion Include="Microsoft.IdentityModel.JsonWebTokens" Version="7.7.1" />
-        <PackageVersion Include="Microsoft.IdentityModel.Protocols.OpenIdConnect" Version="7.7.1" />
-        <PackageVersion Include="System.Runtime.InteropServices.RuntimeInformation" Version="4.3.0" />
-    </ItemGroup>
-    <!-- NetCore project dependencies -->
-    <ItemGroup>
-        <PackageVersion Include="Microsoft.Data.SqlClient.SNI.runtime" Version="6.0.2" />
-        <PackageVersion Include="Microsoft.SqlServer.Server" Version="1.0.0" />
-    </ItemGroup>
-    <!-- AKV Provider project dependencies -->
-    <ItemGroup>
-        <PackageVersion Include="Azure.Core" Version="[1.47.1,2.0.0)" />
-        <PackageVersion Include="Azure.Security.KeyVault.Keys" Version="[4.7.0,5.0.0)" />
-    </ItemGroup>
-    <!-- Test Project Dependencies -->
-    <ItemGroup>
-        <PackageVersion Include="BenchmarkDotNet" Version="0.14.0" />
-        <PackageVersion Include="Microsoft.DotNet.PlatformAbstractions" Version="3.1.6" />
-        <PackageVersion Include="Microsoft.DotNet.RemoteExecutor" Version="10.0.0-beta.25164.6" />
-        <PackageVersion Include="Microsoft.DotNet.XUnitExtensions" Version="10.0.0-beta.25164.6" />
-        <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.11.1" />
-        <PackageVersion Include="Microsoft.SqlServer.SqlManagementObjects" Version="172.76.0" />
-        <PackageVersion Include="Microsoft.SqlServer.Types" Version="160.1000.6" />
-        <PackageVersion Include="Microsoft.VisualStudio.Azure.Containers.Tools.Targets" Version="1.19.5" />
-        <PackageVersion Include="Microsoft.Win32.Registry" Version="5.0.0" />
-        <PackageVersion Include="Newtonsoft.Json" Version="13.0.3" />
-        <PackageVersion Include="System.Data.Odbc" Version="8.0.1" />
-        <PackageVersion Include="System.Security.Principal.Windows" Version="5.0.0" />
-        <PackageVersion Include="System.ServiceProcess.ServiceController" Version="8.0.1" />
-        <PackageVersion Include="System.Text.Encoding.CodePages" Version="6.0.0" />
-        <PackageVersion Include="xunit" Version="2.9.2" />
-        <PackageVersion Include="xunit.runner.visualstudio" Version="2.8.2" />
-        <PackageVersion Include="xunit.runner.console" Version="2.9.2" />
-    </ItemGroup>
+  <PropertyGroup>
+    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
+    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
+  </PropertyGroup>
+  <!-- NetFx project dependencies -->
+  <ItemGroup>
+    <PackageVersion Include="Microsoft.Data.SqlClient.SNI" Version="6.0.2" />
+    <PackageVersion Include="System.Buffers" Version="4.6.1" />
+    <PackageVersion Include="System.Data.Common" Version="4.3.0" />
+    <PackageVersion Include="System.Text.Json" Version="8.0.6" />
+  </ItemGroup>
+  <!-- NetFx and NetCore project dependencies -->
+  <ItemGroup>
+    <PackageVersion Include="Azure.Identity" Version="1.17.0" />
+    <PackageVersion Include="Microsoft.IdentityModel.JsonWebTokens" Version="7.7.1" />
+    <PackageVersion Include="Microsoft.IdentityModel.Protocols.OpenIdConnect" Version="7.7.1" />
+    <PackageVersion Include="System.Runtime.InteropServices.RuntimeInformation" Version="4.3.0" />
+  </ItemGroup>
+  <!-- NetCore project dependencies -->
+  <ItemGroup>
+    <PackageVersion Include="Microsoft.Data.SqlClient.SNI.runtime" Version="6.0.2" />
+    <PackageVersion Include="Microsoft.SqlServer.Server" Version="1.0.0" />
+  </ItemGroup>
+  <!-- AKV Provider project dependencies -->
+  <ItemGroup>
+    <PackageVersion Include="Azure.Core" Version="1.50.0" />
+    <PackageVersion Include="Azure.Security.KeyVault.Keys" Version="4.8.0" />
+  </ItemGroup>
+  <!-- Test Project Dependencies -->
+  <ItemGroup>
+    <PackageVersion Include="BenchmarkDotNet" Version="0.14.0" />
+    <PackageVersion Include="Microsoft.DotNet.RemoteExecutor" Version="10.0.0-beta.25164.6" />
+    <PackageVersion Include="Microsoft.DotNet.XUnitExtensions" Version="10.0.0-beta.25164.6" />
+    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.12.0" />
+    <PackageVersion Include="Microsoft.SqlServer.SqlManagementObjects" Version="172.76.0" />
+    <PackageVersion Include="Microsoft.SqlServer.Types" Version="170.1000.7" />
+    <PackageVersion Include="Microsoft.Win32.Registry" Version="5.0.0" />
+    <PackageVersion Include="Newtonsoft.Json" Version="13.0.4" />
+    <PackageVersion Include="System.Security.Principal.Windows" Version="5.0.0" />
+    <PackageVersion Include="System.ServiceProcess.ServiceController" Version="8.0.1" />
+    <PackageVersion Include="xunit" Version="2.9.3" />
+    <PackageVersion Include="xunit.runner.visualstudio" Version="2.8.2" />
+    <PackageVersion Include="xunit.runner.console" Version="2.9.3" />
+  </ItemGroup>
 
-    <!-- Target framework specific dependencies -->
-    <ItemGroup Condition="'$(TargetFramework)' == 'net9.0'">
-        <PackageVersion Include="Microsoft.Bcl.Cryptography" Version="9.0.5" />
-        <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="9.0.5" />
-        <PackageVersion Include="Microsoft.Extensions.Hosting" Version="9.0.5" />
-        <PackageVersion Include="System.Configuration.ConfigurationManager" Version="9.0.5" />
-        <PackageVersion Include="System.Security.Cryptography.Pkcs" Version="9.0.5" />
-        <PackageVersion Include="System.Text.Json" Version="9.0.5" />
-    </ItemGroup>
-    <ItemGroup Condition="'$(TargetFramework)' != 'net9.0'">
-        <PackageVersion Include="Microsoft.Bcl.Cryptography" Version="8.0.0" />
-        <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="8.0.1" />
-        <PackageVersion Include="Microsoft.Extensions.Hosting" Version="8.0.1" />
-        <PackageVersion Include="System.Configuration.ConfigurationManager" Version="8.0.1" />
-        <PackageVersion Include="System.Security.Cryptography.Pkcs" Version="8.0.1" />
-        <PackageVersion Include="System.Text.Json" Version="8.0.5" />
-    </ItemGroup>
+  <!-- Target framework specific dependencies -->
+  <ItemGroup Condition="'$(TargetFramework)' == 'net9.0'">
+    <!-- Driver dependencies -->
+    <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="9.0.11" />
+    <PackageVersion Include="System.Configuration.ConfigurationManager" Version="9.0.11" />
+    <PackageVersion Include="System.Security.Cryptography.Pkcs" Version="9.0.11" />
+
+    <!-- Test dependencies -->
+    <PackageVersion Include="Microsoft.Extensions.Hosting" Version="9.0.11" />
+    <PackageVersion Include="System.Data.Odbc" Version="9.0.11" />
+  </ItemGroup>
+  <ItemGroup Condition="'$(TargetFramework)' != 'net9.0'">
+    <!-- Driver dependencies -->
+    <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="8.0.1" />
+    <PackageVersion Include="System.Configuration.ConfigurationManager" Version="8.0.1" />
+    <PackageVersion Include="System.Security.Cryptography.Pkcs" Version="8.0.1" />
+
+    <!-- Test dependencies -->
+    <PackageVersion Include="Microsoft.Extensions.Hosting" Version="8.0.1" />
+    <PackageVersion Include="System.Data.Odbc" Version="8.0.1" />
+  </ItemGroup>
 </Project>

src/Microsoft.Data.SqlClient/add-ons/AzureKeyVaultProvider/Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider.csproj

@@ -40,7 +40,6 @@
   </ItemGroup>
   <ItemGroup>
     <PackageReference Include="Azure.Core" />
-    <PackageReference Include="System.Text.Encodings.Web" />
     <PackageReference Include="Azure.Security.KeyVault.Keys" />
     <PackageReference Include="Microsoft.Extensions.Caching.Memory" />
   </ItemGroup>

src/Microsoft.Data.SqlClient/netcore/ref/Microsoft.Data.SqlClient.csproj

@@ -34,17 +34,13 @@
   <ItemGroup>
     <PackageReference Include="Azure.Core" />
     <PackageReference Include="Azure.Identity" />
-    <PackageReference Include="Microsoft.Bcl.Cryptography" />
     <PackageReference Include="Microsoft.Data.SqlClient.SNI.runtime" />
     <PackageReference Include="Microsoft.Extensions.Caching.Memory" />
     <PackageReference Include="Microsoft.IdentityModel.JsonWebTokens" />
     <PackageReference Include="Microsoft.IdentityModel.Protocols.OpenIdConnect" />
     <PackageReference Include="Microsoft.SqlServer.Server" />
     <PackageReference Include="System.Configuration.ConfigurationManager" />
     <PackageReference Include="System.Security.Cryptography.Pkcs" />
-
-    <!-- Transitive dependencies that would otherwise bring in older, vulnerable versions. -->
-    <PackageReference Include="System.Text.Json" />
   </ItemGroup>
 
   <Import Project="$(ToolsDir)targets\ResolveContract.targets" Condition="'$(OSGroup)' == 'AnyOS' AND '$(TargetGroup)' != 'netcoreapp'" />

src/Microsoft.Data.SqlClient/netcore/src/Microsoft.Data.SqlClient.csproj

@@ -1033,17 +1033,13 @@
   <ItemGroup>
     <PackageReference Include="Azure.Core" />
     <PackageReference Include="Azure.Identity" />
-    <PackageReference Include="Microsoft.Bcl.Cryptography" />
     <PackageReference Include="Microsoft.Data.SqlClient.SNI.runtime" />
     <PackageReference Include="Microsoft.Extensions.Caching.Memory" />
     <PackageReference Include="Microsoft.IdentityModel.JsonWebTokens" />
     <PackageReference Include="Microsoft.IdentityModel.Protocols.OpenIdConnect" />
     <PackageReference Include="Microsoft.SqlServer.Server" />
     <PackageReference Include="System.Configuration.ConfigurationManager" />
     <PackageReference Include="System.Security.Cryptography.Pkcs" />
-
-    <!-- Transitive dependencies that would otherwise bring in older, vulnerable versions. -->
-    <PackageReference Include="System.Text.Json" />
   </ItemGroup>
 
   <Import Project="$(ToolsDir)targets\GenerateThisAssemblyCs.targets" />

src/Microsoft.Data.SqlClient/netfx/ref/Microsoft.Data.SqlClient.csproj

@@ -34,7 +34,6 @@
   <ItemGroup>
     <PackageReference Include="Azure.Core" />
     <PackageReference Include="Azure.Identity" />
-    <PackageReference Include="Microsoft.Bcl.Cryptography" />
     <PackageReference Include="Microsoft.Data.SqlClient.SNI">
       <PrivateAssets>All</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
@@ -45,7 +44,6 @@
     <PackageReference Include="System.Buffers" />
     <PackageReference Include="System.Data.Common" />
     <PackageReference Include="System.Security.Cryptography.Pkcs" />
-    <PackageReference Include="System.Text.Encodings.Web" />
     <PackageReference Include="System.Text.Json" />
   </ItemGroup>
   <Import Project="$(ToolsDir)targets\TrimDocsForIntelliSense.targets" />

src/Microsoft.Data.SqlClient/netfx/src/Microsoft.Data.SqlClient.csproj

@@ -957,7 +957,6 @@
   <ItemGroup>
     <PackageReference Include="Azure.Core" />
     <PackageReference Include="Azure.Identity" />
-    <PackageReference Include="Microsoft.Bcl.Cryptography" />
     <PackageReference Include="Microsoft.Data.SqlClient.SNI">
       <PrivateAssets>All</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
@@ -967,7 +966,6 @@
     <PackageReference Include="Microsoft.IdentityModel.Protocols.OpenIdConnect" />
     <PackageReference Include="System.Buffers" />
     <PackageReference Include="System.Security.Cryptography.Pkcs" />
-    <PackageReference Include="System.Text.Encodings.Web" />
     <PackageReference Include="System.Text.Json" />
   </ItemGroup>
   <Import Project="$(CommonSourceRoot)tools\targets\GenerateResourceStringsSource.targets" />

src/Microsoft.Data.SqlClient/src/Microsoft.Data.SqlClient.csproj

@@ -10,13 +10,11 @@
     <!-- References that apply to all target frameworks -->
     <PackageReference Include="Azure.Core" />
     <PackageReference Include="Azure.Identity" />
-    <PackageReference Include="Microsoft.Bcl.Cryptography" />
     <PackageReference Include="Microsoft.Extensions.Caching.Memory" />
     <PackageReference Include="Microsoft.IdentityModel.JsonWebTokens" />
     <PackageReference Include="Microsoft.IdentityModel.Protocols.OpenIdConnect" />
     <PackageReference Include="System.Buffers" />
     <PackageReference Include="System.Configuration.ConfigurationManager" />
-    <PackageReference Include="System.Memory" />
     <PackageReference Include="System.Runtime.InteropServices.RuntimeInformation" />
     <PackageReference Include="System.Security.Cryptography.Pkcs"  />
   </ItemGroup>

src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/ActiveDirectoryAuthenticationProvider.cs

@@ -261,7 +261,9 @@ previousPw is byte[] previousPwBytes &&
 
                 if (result == null)
                 {
+                    #pragma warning disable CS0618 // Type or member is obsolete
                     result = await app.AcquireTokenByUsernamePassword(scopes, parameters.UserId, parameters.Password)
+                    #pragma warning restore CS0618 // Type or member is obsolete
                        .WithCorrelationId(parameters.ConnectionId)
                        .ExecuteAsync(cancellationToken: cts.Token)
                        .ConfigureAwait(false);
@@ -584,7 +586,9 @@ private static TokenCredentialData CreateTokenCredentialInstance(TokenCredential
                 if (tokenCredentialKey._clientId is not null)
                 {
                     defaultAzureCredentialOptions.ManagedIdentityClientId = tokenCredentialKey._clientId;
+                    #pragma warning disable CS0618 // Type or member is obsolete
                     defaultAzureCredentialOptions.SharedTokenCacheUsername = tokenCredentialKey._clientId;
+                    #pragma warning restore CS0618 // Type or member is obsolete
                     defaultAzureCredentialOptions.WorkloadIdentityClientId = tokenCredentialKey._clientId;
                 }
 

src/Microsoft.Data.SqlClient/tests/Directory.Packages.props

@@ -4,10 +4,12 @@
   <!-- Test Project Dependencies for all targets. -->
   <ItemGroup>
     <!--
-      Transitive dependencies with vulnerabilities, so we explicitly ask for
-      non-vulnerable versions.
+      Explicitly reference the latest published MDS 5.1.x version here to avoid
+      an older version (5.1.5) being included transitively by
+      SqlManagementObjects.  The older version brings in a vulnerable version of
+      System.Formats.Asn1
     -->
-    <PackageVersion Include="System.Formats.Asn1" Version="6.0.1" />
+    <PackageVersion Include="Microsoft.Data.SqlClient" Version="5.1.8" />
   </ItemGroup>
 
   <!-- Test Project Dependencies for NetFx only. -->

src/Microsoft.Data.SqlClient/tests/FunctionalTests/Microsoft.Data.SqlClient.FunctionalTests.csproj

@@ -87,7 +87,6 @@
   </ItemGroup>
   <ItemGroup>
     <PackageReference Include="Azure.Identity" />
-    <PackageReference Include="Microsoft.Bcl.Cryptography" />
     <PackageReference Include="Microsoft.Extensions.Hosting" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" />
     <PackageReference Include="Microsoft.SqlServer.Types" />

src/Microsoft.Data.SqlClient/tests/ManualTests/DataCommon/DataTestUtility.cs

@@ -280,7 +280,9 @@ private static Task<string> AcquireTokenAsync(string authorityURL, string userID
             SecureString securePassword = new SecureString();
 
             securePassword.MakeReadOnly();
+            #pragma warning disable CS0618 // Type or member is obsolete
             result = app.AcquireTokenByUsernamePassword(scopes, userID, password).ExecuteAsync().Result;
+            #pragma warning restore CS0618 // Type or member is obsolete
 
             return result.AccessToken;
         });

src/Microsoft.Data.SqlClient/tests/ManualTests/Microsoft.Data.SqlClient.ManualTesting.Tests.csproj

@@ -349,7 +349,6 @@
     <ProjectReference Include="$(AddOnsPath)AzureKeyVaultProvider\Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider.csproj" />
     <PackageReference Include="Azure.Identity" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" />
-    <PackageReference Include="Microsoft.Bcl.Cryptography" />
     <PackageReference Include="Microsoft.SqlServer.Types" />
     <PackageReference Include="System.Configuration.ConfigurationManager" />
     <PackageReference Include="System.Security.Cryptography.Pkcs" />

src/Microsoft.Data.SqlClient/tests/ManualTests/SQL/ConnectivityTests/AADConnectionTest.cs

@@ -40,11 +40,13 @@ public override async Task<SqlAuthenticationToken> AcquireTokenAsync(SqlAuthenti
                 string[] scopes = new string[] { scope };
                 SecureString password = new SecureString();
 
+                #pragma warning disable CS0618 // Type or member is obsolete
                 AuthenticationResult result = await PublicClientApplicationBuilder.Create(_appClientId)
                 .WithAuthority(parameters.Authority)
                 .Build().AcquireTokenByUsernamePassword(scopes, parameters.UserId, parameters.Password)
                     .WithCorrelationId(parameters.ConnectionId)
                     .ExecuteAsync(cancellationToken: cts.Token);
+                #pragma warning restore CS0618 // Type or member is obsolete
 
                 return new SqlAuthenticationToken(result.AccessToken, result.ExpiresOn);
             }

src/Microsoft.Data.SqlClient/tests/tools/Microsoft.Data.SqlClient.ExtUtilities/Microsoft.Data.SqlClient.ExtUtilities.csproj

@@ -6,12 +6,13 @@
   </PropertyGroup>
   <ItemGroup>
     <PackageReference Include="Microsoft.SqlServer.SqlManagementObjects" />
-
     <!--
-      Transitive dependencies with vulnerabilities, so we explicitly ask for
-      non-vulnerable versions.
+      Explicitly reference the latest published MDS 5.1.x version here to avoid
+      an older version (5.1.5) being included transitively by
+      SqlManagementObjects.  The older version brings in a vulnerable version of
+      System.Formats.Asn1
     -->
-    <PackageReference Include="System.Formats.Asn1" />
+    <PackageReference Include="Microsoft.Data.SqlClient" />
   </ItemGroup>
   <ItemGroup>
     <ProjectReference Include="../Microsoft.Data.SqlClient.TestUtilities/Microsoft.Data.SqlClient.TestUtilities.csproj" />

src/Microsoft.Data.SqlClient/tests/tools/Microsoft.Data.SqlClient.TestUtilities/Microsoft.Data.SqlClient.TestUtilities.csproj

@@ -18,6 +18,5 @@
     <PackageReference Include="Azure.Security.KeyVault.Keys" />
     <PackageReference Include="Newtonsoft.Json" />
     <PackageReference Include="System.Security.Cryptography.Pkcs" />
-    <PackageReference Include="Microsoft.Bcl.Cryptography" />
   </ItemGroup>
 </Project>