Upgrading Microsoft.Data.SqlClient 1 to 2
Breaking1.1.4 → 2.1.7Breaking8Security3New27Changed36Fixed61Other5
SecurityHigh · CVSS 8.7Fixes an encryption downgrade issue tracked as CVE-2024-0056.GHSA-98g6-xh36-x2p7 · CVE-2024-0056 ↗
BreakingUpgrade verdict
8 breaking changes and 3 security fixes.
In plain terms
- Some constant names in this class were removed and new ones added, so code referencing removed constants will not compile.
- The native SQL Server helper DLLs have new names and a new location, so apps that reference the old files or folders must be updated.
- Connections to servers that require encryption now validate the server certificate, so untrusted certificates will cause connection failures.
- Decimal values are now rounded to their declared scale the same way SQL Server does, which can change returned values.
Must act Top 5 of 11 that need code or config changes
Target frameworks requirement changed in 2.1.0-preview1.20235.1: .NETCoreApp2.1, .NETFramework4.6, .NETStandard2.0 → .NETCoreApp2.1, .NETCoreApp3.1, .NETFramework4.6, .NETStandard2.0, .NETStandard2.1.
Adds microsoft.data.sqlclient.sni.runtime 2.1.1.
Drops runtime.native.system.data.sqlclient.sni, system.data.common.
What you must change
Breaking8
Updates SqlClientMetaDataCollectionNames exposed constants by removing non-existing constants and adding new ones to the metadata collection.
SqlClientMetaDataCollectionNamesOn .NET Framework, SNI.dll files are renamed Microsoft.Data.SqlClient.SNI.x64.dll and Microsoft.Data.SqlClient.SNI.x86.dll and moved to the bin directory.
SNI.dllMicrosoft.Data.SqlClient.SNI.x64.dllMicrosoft.Data.SqlClient.SNI.x86.dllThe driver now performs Server Certificate validation when TLS encryption is enforced by the target Server, the default for Azure connections.
Updates driver to perform decimal scale rounding to match SQL Server behavior.
Standardizes the App Context switch name that enables Managed SNI on Windows for .NET Core and .NET Standard, breaking only 2.0 preview releases that introduced the switch.
SqlDataReader.GetSchemaTable() now returns an empty DataTable instead of returning null.SqlDataReader.GetSchemaTable()DataTableChanges EnclaveProviderBase caching implementation to support async scenarios, introducing breaking changes.
EnclaveProviderBaseMakes the SqlColumnEncryptionEnclaveProvider enclave provider interface internal.
SqlColumnEncryptionEnclaveProviderSecurity3
Fixes an encryption downgrade issue tracked as CVE-2024-0056.
High · CVSS 8.7Fixes a vulnerability by prohibiting DtdProcessing on XmlTextReader instances in .NET Core.
DtdProcessingXmlTextReader.NET Information Disclosure Vulnerability
Moderate · CVSS 5.8