Repository navigation
Bump dependency versions for 8.0.0 #4879
Description
Update dependency versions for the Microsoft.Data.SqlClient 8.0.0 release.
Scope:
- Review direct dependencies and update applicable package versions in the centralized version files and project-specific declarations.
- Verify compatibility with supported target frameworks and platforms.
- Build and run relevant tests to catch dependency-related regressions.
Acceptance criteria:
- Applicable dependency versions are updated for 8.0.0-preview1.
- Relevant builds and tests pass.
- Any compatibility concerns or deferred updates are documented.
Reacted by Frulfump and Cheena Malhotra
Activity
Frulfump commentedon Oct 25, 2026
I guess this ended up in the 8.0.0 milestone so you can do any last minute bumps but I hope you can get most of the patching done for preview1?
mdaigle commentedon Oct 26, 2026
Yes, #4880 bumped dependencies for preview 1. We'll catch any further updates in this issue for 8.0.0.
snakefoot commentedon Oct 29, 2026
Think SqlClient ver. 8 would be perfect candidate for upgrading from net462 to net471/net472, and remove dependency to obsolete/unmaintained System.Data.Common-nuget-package ver. 4.3.0 that contains CVE-2020-1147 Remote Code Execution (RCE)
P.S. .NET Framework 4.6.2 reaches End of Support on January 12, 2027 (So I guess it could be a Christmas/NewYear present)
See also: #4939
Frulfump commentedon Oct 29, 2026
Why 4.7.1? 4.7 is still supported (and 4.7.2 is also supported and would be my preference)
https://dotnet.microsoft.com/en-us/platform/support/policy/dotnet-framework
mdaigle commentedon Oct 29, 2026
@snakefoot we were planning on keeping 4.6.2 at the advice of the dotnet team since that target is highly compatible with newer versions, the idea being to reduce disruptions. But a CVE would be a compelling reason to switch. If we do bump, it will be to 4.7.2.