Microsoft.Data.SqlClient

This is the general availability release of Microsoft.Data.SqlClient 7.1. It closes out the 7.1 preview cycle with application identity reporting for telemetry, the deprecation of TransparentNetworkIPResolution, and a set of connection, transaction, and Named Pipes fixes.

Important — package version alignment: Starting with the 7.0.2 release, the Microsoft.Data.SqlClient driver and its companion packages share a single aligned version. The 7.1.0 GA release continues this alignment; the following packages ship together as 7.1.0:

• Microsoft.Data.SqlClient
• Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider
• Microsoft.Data.SqlClient.Extensions.Azure
• Microsoft.Data.SqlClient.Extensions.Abstractions
• Microsoft.Data.SqlClient.Internal.Logging

(Microsoft.SqlServer.Server continues to version independently and remains at 1.0.0.)

Applications must reference the same versions of Microsoft.Data.SqlClient and its extensions for best compatibility. In particular, applications that reference Microsoft.Data.SqlClient.Extensions.Azure must upgrade it to 7.1.0 when upgrading Microsoft.Data.SqlClient to 7.1.0.

Compatibility guarantee: All aligned assemblies ship with FileVersion 7.1.0.x and AssemblyVersion 7.0.0.0. The AssemblyVersion is unchanged from 7.0.2, so upgrading from 7.0.2, 7.0.3, or any 7.1 preview to 7.1.0 does not require any new .NET Framework strong-name binding redirects. Applications upgrading from 7.0.0 or 7.0.1 should note that Extensions.Azure, Extensions.Abstractions, and Internal.Logging raised their AssemblyVersion from 1.0.0.0 to 7.0.0.0 in 7.0.2; see those release notes for the one-time .NET Framework impact.

Companion package release notes

• Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider 7.1.0
• Microsoft.Data.SqlClient.Extensions.Azure 7.1.0
• Microsoft.Data.SqlClient.Extensions.Abstractions 7.1.0
• Microsoft.Data.SqlClient.Internal.Logging 7.1.0

Changes Since 7.1.0-preview3

Added

Application Identity in the USERAGENT Payload

What Changed:

• Added a RegisteredApplication enum and a matching SqlConnection.RegisteredApplication property that let a library or tool identify itself to SQL Server through version 2 of the TDS USERAGENT feature extension. The payload also carries a new driver-owned 64-bit Driver Properties flag field; bit 0 reports whether connection pool V2 is enabled for the process. Both fields are emitted as unpadded uppercase hexadecimal. (#3201, #4632)

Who Benefits:

• Middleware and tooling built on top of the driver — Entity Framework Core, Semantic Kernel, SQL Server Management Studio, SqlPackage, Data API Builder, and similar — can be distinguished in server-side telemetry without the driver accepting arbitrary user-supplied user-agent text. This originated as a request from the Entity Framework Core team.
• Service operators gain a more accurate picture of which client stacks are connecting, which helps when diagnosing workload-specific behavior.

Impact:

• Purely additive from the application's perspective: a newly created physical connection whose RegisteredApplication is unset reports Unknown (0). On the wire the field itself is new — USERAGENT payload v1 carried no application identifier, while v2 always emits one.
• Set the property before calling Open or OpenAsync. Assigning it while the connection is connecting or open throws InvalidOperationException.

using var connection = new SqlConnection(connectionString);
connection.RegisteredApplication = RegisteredApplication.EntityFrameworkCore;
await connection.OpenAsync();

• The enum is ushort-backed and marked [CLSCompliant(false)]. Values are partitioned by range: 0x0001–0x7FFF for Microsoft-defined large-scale applications, 0x8000–0xBFFF for small-scale use, and 0xC000–0xFFFF for public/developer use. Applications that are not yet registered can cast an unassigned value from the appropriate range.
• Application identity is client-supplied telemetry and must never be used for authorization or any other security decision.
• The value is not part of the connection pool key. A pooled physical connection reports the application that originally created it, and background Min Pool Size connections report Unknown. Cloned connections preserve the value.

Changed

TransparentNetworkIPResolution Is Now Obsolete

What Changed:

• SqlConnectionStringBuilder.TransparentNetworkIPResolution is now marked [Obsolete]. The obsoletion message directs callers to MultiSubnetFailover and notes that Transparent Network IP Resolution (TNIR) is a .NET Framework-only feature. (#4494, #4576)

Who Benefits:

• Applications still relying on TNIR get a compile-time signal to move to MultiSubnetFailover, which addresses the same "connect quickly across multiple DNS-resolved addresses" goal, works consistently on every supported target framework, and is the documented strategy for Always On availability group listeners.

Impact:

• No runtime behavior change. TNIR still defaults to true on .NET Framework, and MultiSubnetFailover still defaults to false. The property remains .NET Framework-only and is not exposed on modern .NET, where a connection string containing the Transparent Network IP Resolution keyword still throws NotSupportedException. No new AppContext switches were introduced.
• The only visible effect is a new CS0618 build warning for code that references the property. Suppress it, or migrate to MultiSubnetFailover, at your own pace. Flipping the TNIR and MultiSubnetFailover defaults is deferred to a future major version.

Other changes

• Updated Microsoft.Data.SqlClient.SNI and Microsoft.Data.SqlClient.SNI.runtime to v7.1.0 (was v7.1.0-preview3.26226.3). (#4698)
• Unified the exception message raised when conflicting token-based and SSPI authentication properties are set on the same SqlConnection, and documented the complete set of properties that conflict with AccessToken. (#4629)
• Documentation corrections:
  • Rewrote the SqlDataRecord and SqlMetaData documentation, which incorrectly described the SQL CLR-only SqlContext and SqlPipe types, and clarified whether SqlDataRecord instances can be reused. (#1805, #4440)
  • Corrected the LCID 1033 sample comment to use the official Windows locale name English (United States). (#4646)

Fixed

• Fixed a pooled connection being returned to the pool in a broken state after a TransactionScope rollback — for example, when distributed transaction promotion fails on .NET 8+ where implicit distributed transactions are disabled by default. A subsequent Open() succeeded but BeginTransaction() threw InvalidOperationException ("the connection has been broken"). Connection reset now preserves the transaction when the pooled connection is either a delegated transaction root or enlisted in a transaction, instead of only the latter. (#4001, #4557)
• Fixed GetSchema("DataTypes") never reporting the SQL Server 2025 json type against Azure SQL. The row was filtered by a string comparison against a minimum server version of 17.00.000.0, which Azure SQL can never satisfy because it always reports 12.00.xxxx. The decision now uses the json support flag negotiated through the TDS FEATUREEXTACK token, which is accurate on both Azure SQL and on-premises SQL Server 2025+. (#4592, #4682)
• Fixed a malformed UNC pipe path being composed for IPv6 literal server names over Named Pipes in managed SNI (for example Server=np:::1, Server=np:[::1], or Server=\\::1\pipe\sql\query). A UNC path component may not contain a colon, and handing such a path to the OS could trigger an access violation inside LSASS on Windows, forcing a reboot. IPv6 literals are now transcribed to their .ipv6-literal.net form as defined by MS-DTYP 2.2.57, and a colon-bearing host with no valid IPv6 interpretation now fails with the standard invalid-connection-string error. Colon-free host names, LocalDB, localhost, ., and IPv6 over TCP are unaffected. (net8.0/net9.0 only — this is the managed SNI counterpart to the native SNI fix) (#4523, #4558)
• Fixed configurable retry logic installing a permanent, process-wide assembly-resolution handler that could interfere with unrelated assembly loading. The handler is now installed only while an explicitly configured custom retry provider is being resolved and constructed, and it probes AppContext.BaseDirectory instead of the current working directory. Place custom retry assemblies in the application base directory; dependencies loaded after provider construction must be resolvable through normal application dependency resolution or an application-supplied handler. (net8.0/net9.0 only — the .NET Framework path does not use AssemblyLoadContext) (#2214, #4547)
• Fixed open/close throughput regressions in the opt-in connection pool V2 (Switch.Microsoft.Data.SqlClient.UseConnectionPoolV2). Acquiring an already-pooled connection no longer dispatches to the thread pool before attempting an inline, non-blocking acquisition, no longer allocates a timer-backed CancellationTokenSource before it is known that the caller will wait, and no longer allocates a Task on the synchronous completion path. The default pool is unaffected. (#4543)

Cumulative Changes Since 7.0.3

This section summarizes all changes across the 7.1 preview cycle for users upgrading from the latest 7.0 stable release. Changes that were also serviced into 7.0.1, 7.0.2, or 7.0.3 are omitted — they are already present for 7.0.x users.

Added

SqlBatch Support on .NET Framework (net462 only)

What Changed:

• SqlBatch, SqlBatchCommand, and the related execution methods are now available on the .NET Framework target, so the batching API spans the full supported platform matrix. (#3926)

Who Benefits:

• Libraries and applications that multi-target .NET Framework and modern .NET can use a single data-access surface instead of maintaining separate batching strategies.

Impact:

• Purely additive; existing SqlCommand code is unchanged.

SqlConnection.GetSchemaAsync

What Changed:

• Added asynchronous overloads of SqlConnection.GetSchema that mirror the existing synchronous shapes and honor a supplied CancellationToken. The .NET Framework schema code paths were unified with the .NET implementation in the process. (#3005)

Who Benefits:

• Applications that enumerate database metadata as part of a request pipeline no longer block a thread on synchronous I/O.

Impact:

• Additive; existing GetSchema(...) calls are unchanged.

Asynchronous Key Store Provider APIs for Always Encrypted

What Changed:

• Added four virtual asynchronous counterparts to the synchronous methods on SqlColumnEncryptionKeyStoreProvider: DecryptColumnEncryptionKeyAsync, EncryptColumnEncryptionKeyAsync, SignColumnMasterKeyMetadataAsync, and VerifyColumnMasterKeyMetadataAsync. Each accepts an optional CancellationToken, and the default implementations delegate to the existing synchronous methods. (#3672, #3673)

Who Benefits:

• Authors of custom key store providers backed by network-bound stores such as HSMs or cloud key vaults can implement genuinely asynchronous key operations.

Impact:

• Purely additive; existing providers compile and run unmodified.
• Introduced, but not yet consumed by the driver. The driver's own column encryption key resolution path still invokes the synchronous provider methods on both the synchronous and asynchronous command paths. A future release will enable their use from the driver's own asynchronous APIs.
• The in-box SqlColumnEncryptionAzureKeyVaultProvider overrides all four methods. See the AzureKeyVaultProvider 7.1.0 release notes. (#4540)

Configurable Idle Connection Timeout

What Changed:

• Added a Connection Idle Timeout connection-string keyword and matching SqlConnectionStringBuilder.IdleTimeout property that let the pool evict connections whose idle time exceeds the configured value. The default is 300 seconds; 0 disables idle expiration and negative values throw ArgumentException. Enforcement is gated on Switch.Microsoft.Data.SqlClient.UseLegacyIdleTimeoutBehavior, which defaults to true to preserve historical pooling behavior. (#4295)

Who Benefits:

• Applications running against Azure SQL Database and other elastic backends can bound connection idle time to align with server-side session recycling and reduce stale-connection failures.

Impact:

• Default behavior is unchanged: the keyword is parsed but not enforced until the legacy switch is set to false.

Connection Pool V2 Feature Completeness

What Changed:

• Substantially expanded ChannelDbConnectionPool, the opt-in pool behind Switch.Microsoft.Data.SqlClient.UseConnectionPoolV2, bringing it to parity with the default WaitHandleDbConnectionPool: transaction support, broken-connection replacement, background warmup and replenishment to Min Pool Size, idle pruning derived from Connection Idle Timeout, optional connection-creation rate limiting, leaked-connection reclamation, and metrics/tracing parity. (#4395, #4396, #4429, #4452, #4463, #4487, #4504, #4529, #4543)
• SqlConnection.ClearPool(SqlConnection) and SqlConnection.ClearAllPools() now work correctly under pool V2. (#4194)

Who Benefits:

• Applications evaluating the V2 pool can exercise transaction-enlisted workloads, broken-connection recovery, leaked-connection reclamation, and pool warmup, and can observe the pool through the existing performance counters and EventSource traces.

Impact:

• No change to default behavior. Connection pool V2 remains in evaluation and is used only when the AppContext switch is enabled.

Other additions

• Added application identity reporting through SqlConnection.RegisteredApplication and USERAGENT payload version 2 (see Changes Since 7.1.0-preview3 above). (#4632)
• SqlBulkCopy column mappings now accept the SQL Graph pseudo-column aliases $node_id, $edge_id, $from_id, and $to_id as destination column names. (#3677)
• SqlBatchCommand.CommandBehavior is now honored inside a SqlBatch, and SqlBatch.ExecuteReader respects the CommandBehavior passed to it. Batches that previously set the property and relied on it being ignored will now see it applied. (#4125)
• Added connection-string synonyms for better compatibility with other SQL Server drivers: ColumnEncryption, ConnectTimeout, FailoverPartner, PacketSize, and WorkstationId. (#4192)
• Added the SQL Server 2025 json data type to the DataTypes collection returned by SqlConnection.GetSchema. (#3858)

Changed

Connection Timeout Can Now Propagate Through the Pool

What Changed:

• Replaced raw TimeSpan timeouts with a shared TimeoutTimer across SqlConnection.Open[Async], pool acquisition, and physical connection creation, so the Connect Timeout budget can be deducted while a request waits in the pool. Enforcement is gated on Switch.Microsoft.Data.SqlClient.UseOverallConnectTimeoutForPoolWait, which defaults to false. Introduces a dependency on Microsoft.Bcl.TimeProvider. (#4270)

Who Benefits:

• Applications that observe pool contention can opt in to having the configured Connect Timeout respected end-to-end instead of the budget effectively restarting when a physical connection is eventually opened.

Impact:

• Default behavior is unchanged. When the switch is enabled, Open/OpenAsync under heavy pool contention may surface timeouts sooner than before; successful opens are unaffected.

TransparentNetworkIPResolution Is Now Obsolete

• See Changes Since 7.1.0-preview3 above. (#4494, #4576)

Other changes

• Windows-only native SNI types are now removed cleanly by the IL trimmer on Linux and macOS, and LocalAppContextSwitches.UseManagedNetworking is substituted for a constant. The driver builds a single OS-agnostic assembly for all platforms; NuGet package structure and contents are unchanged. (#4207, #4239, #4465, #4474)
• Performance and allocation improvements:
  • Restored reuse of PacketData linked-list nodes via a bounded free list on StateSnapshot, returning SqlCommand/ExecuteReaderAsync from +120.9% allocated against the 6.1.6 baseline to +0.1%. (#4536)
  • SqlBulkCopy no longer builds SQL Graph column alias mapping tables when neither the source nor destination table contains graph pseudo-columns. (#4535)
  • Reduced allocations when sending large string values to SQL Server, when reading SqlErrorCollection counters with no errors present, and on expected null-return paths that previously materialized stack traces. (#4072, #4157, #4099, #4102)
  • Use hardcoded LCID mappings when decoding strings, avoiding repeated culture lookups. (#4212)
• Internal hardening and refactoring:
  • SqlConnection internal state transitions now use Interlocked.CompareExchange guards. (#4267)
  • Removed legacy connection-options inheritance from internal APIs and refactored ForceNewConnection handling. (#4235, #4237, #4261, #4415)
  • Added async generic helpers to reduce duplication across sync/async code paths. (#4334)
• SqlVector<float> now serializes and deserializes little-endian multibyte values explicitly for consistent behavior across architectures. (#3861)
• Improved EnclaveDiffieHellmanInfo.Size accuracy. (#4346)
• Documentation corrections for SqlDataRecord, SqlMetaData, server certificate configuration, and the LCID 1033 locale name. (#4408, #4440, #4646)
• Updated Dependencies:
  • Updated Microsoft.Bcl.Cryptography, Microsoft.Extensions.Caching.Memory, System.Configuration.ConfigurationManager, and System.Security.Cryptography.Pkcs to v9.0.18 for the net9.0 target framework. Non-net9.0 targets keep their existing 8.0.x pins. (#4507)
  • Added System.Threading.RateLimiting and Microsoft.Bcl.TimeProvider to the packaged dependency metadata. (#4270, #4507)
  • Updated Microsoft.Data.SqlClient.SNI and Microsoft.Data.SqlClient.SNI.runtime to v7.1.0 (was v6.0.3). (#4564, #4698)

Fixed

• Fixed Always Encrypted reads of CekMdVersion and EkValueCount to align with the TDS specification. (#4240)
• Fixed an OverflowException when sending large decimal values (for example decimal.MaxValue) as a parameter with explicit Precision and Scale. This primarily affected Always Encrypted scenarios, where both must always be set. (#1655, #4443)
• Fixed a TDS stream error when passing a DateOnly value as a parameter with SqlDbType.Variant, and fixed DateOnly values written to a sql_variant column of a table-valued parameter being sent as datetime instead of date (which also caused overflows for values valid for date but out of range for datetime). Reading continues to return DateTime instances by default for backwards compatibility. (net8.0/net9.0 only — .NET Framework has no DateOnly type) (#3953, #3934, #4294, #4439)
• Fixed a SqlConnectionFactory timer that woke the process every 30 seconds for the lifetime of the application even when no connection pools existed — including with Pooling=False and after ClearAllPools(). The pruning timer is now armed on demand and disarmed once there is nothing left to prune. A missing .NET Framework unload hook was also added. (#1881, #4479)
• Fixed connection pool performance counter defects affecting the default pool as well as pool V2. active-soft-connects and number-of-active-connections could go negative after a failed connection activation, and active-soft-connects, active-hard-connections, and number-of-pooled-connections drifted upward permanently after a broken connection was replaced. (#4504)
• Fixed a pooled connection being returned to the pool in a broken state after a TransactionScope rollback, which caused a later BeginTransaction() to throw InvalidOperationException. (#4001, #4557)
• Fixed GetSchema("DataTypes") never reporting the json type against Azure SQL. (#4592, #4682)
• Fixed a malformed UNC pipe path being composed for IPv6 literal server names over Named Pipes in managed SNI, which could trigger an LSASS access violation and a forced reboot on Windows. (net8.0/net9.0 only) (#4523, #4558)
• Fixed several async entry points in SqlBulkCopy, SqlDataReader.InvokeAsyncCall, SqlCommand.Reader, and SqlCommand.Xml that captured fatal exceptions such as OutOfMemoryException into faulted Tasks instead of letting them propagate. (#4437)
• Fixed a SqlDataReader streaming bug where calling IsDBNull() before reading a streamed value could skip column data. (#4082)
• Fixed a race in SqlConnection.TryOpenInner that could surface as InvalidCastException; the same race now returns a deterministic InvalidOperationException. (#4179)
• Fixed LoginWithFailover to validate parser state before continuing, preventing null-reference failures during failover login. (#4140)
• Fixed the SPN used during login to use the resolved port instead of the instance name when Protocol=None or Protocol=Admin is specified. (#4180)
• Fixed several CancellationTokenSource leaks in SqlDataReader, SqlConnection, the SqlCommand reconnect paths, and the sequential-stream helpers. (#4009)

Removed

SQL Server 7.0 and 2000 Support

What Changed:

• Removed dead protocol-level code paths for SQL Server 7.0 and SQL Server 2000, along with the now-orphaned SQL Server 2000 type-system compatibility option. The TypeSystem.SQLServer2000 enum value and the Type System Version=SQL Server 2000 connection-string branch are gone. (#4015)

Who Benefits:

• The driver no longer carries dead legacy code, and the documented connection-string surface (Latest, SQL Server 2005, SQL Server 2008, SQL Server 2012) now matches the implementation exactly.

Impact:

• Breaking: A connection string that specifies Type System Version=SQL Server 2000 now throws ArgumentException when the connection is opened. Switch to a supported value such as Latest. There is no change to which servers the driver connects to — SQL Server 7.0 and 2000 were already rejected during login version negotiation.

Contributors

We thank the following public contributors. Their efforts toward this project are very much appreciated.

• edwardneal
• Mahdigln

Target Platform Support

• .NET Framework 4.6.2+ (Windows x86, Windows x64, Windows ARM64)
• .NET 8.0+ (Windows x86, Windows x64, Windows ARM, Windows ARM64, Linux, macOS)

Dependencies

.NET 9.0

• Microsoft.Bcl.Cryptography 9.0.18
• Microsoft.Data.SqlClient.Extensions.Abstractions 7.1.0
• Microsoft.Data.SqlClient.Internal.Logging 7.1.0
• Microsoft.Data.SqlClient.SNI.runtime 7.1.0
• Microsoft.Extensions.Caching.Memory 9.0.18
• Microsoft.IdentityModel.JsonWebTokens 8.16.0
• Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 9.0.18
• System.Security.Cryptography.Pkcs 9.0.18
• System.Threading.RateLimiting 9.0.18

.NET 8.0

• Microsoft.Bcl.Cryptography 8.0.0
• Microsoft.Data.SqlClient.Extensions.Abstractions 7.1.0
• Microsoft.Data.SqlClient.Internal.Logging 7.1.0
• Microsoft.Data.SqlClient.SNI.runtime 7.1.0
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.IdentityModel.JsonWebTokens 8.16.0
• Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 8.0.1
• System.Security.Cryptography.Pkcs 8.0.1
• System.Threading.RateLimiting 8.0.0

.NET Standard 2.0

• Microsoft.Bcl.Cryptography 8.0.0
• Microsoft.Bcl.TimeProvider 8.0.1
• Microsoft.Data.SqlClient.Extensions.Abstractions 7.1.0
• Microsoft.Data.SqlClient.Internal.Logging 7.1.0
• Microsoft.Data.SqlClient.SNI.runtime 7.1.0
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.IdentityModel.JsonWebTokens 8.16.0
• Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 8.0.1
• System.Security.Cryptography.Pkcs 8.0.1
• System.Text.Json 10.0.3
• System.Threading.Channels 10.0.3
• System.Threading.RateLimiting 8.0.0

.NET Framework 4.6.2+

• Microsoft.Bcl.Cryptography 8.0.0
• Microsoft.Bcl.TimeProvider 8.0.1
• Microsoft.Data.SqlClient.Extensions.Abstractions 7.1.0
• Microsoft.Data.SqlClient.Internal.Logging 7.1.0
• Microsoft.Data.SqlClient.SNI 7.1.0
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.IdentityModel.JsonWebTokens 8.16.0
• Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
• System.Buffers 4.6.1
• System.Data.Common 4.3.0
• System.Diagnostics.DiagnosticSource 10.0.3
• System.Memory 4.6.3
• System.Runtime.InteropServices.RuntimeInformation 4.3.0
• System.Security.Cryptography.Pkcs 8.0.1
• System.Text.Json 10.0.3
• System.Threading.Channels 10.0.3
• System.Threading.RateLimiting 8.0.0
• System.ValueTuple 4.6.2

This update brings the following changes since the 7.0.2 release:

The core driver and its companion packages ship together as version 7.0.3. Update the companion packages you use alongside the driver to 7.0.3. Assembly versions remain 7.0.0.0, unchanged from 7.0.2.

Companion package release notes

• Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider 7.0.3
• Microsoft.Data.SqlClient.Extensions.Azure 7.0.3 — includes the Entra ID authority parsing fix for Dataverse/Dynamics 365 connections.
• Microsoft.Data.SqlClient.Extensions.Abstractions 7.0.3
• Microsoft.Data.SqlClient.Internal.Logging 7.0.3

Changed

• Updated the Microsoft.Data.SqlClient.SNI and Microsoft.Data.SqlClient.SNI.runtime dependencies to 6.0.3 (was 6.0.2).
  (#4599)

Fixed

• Fixed a SqlBulkCopy regression in environments where the application login cannot read sys.all_columns. Bulk copy now falls back to the earlier column-discovery behavior when that permission is unavailable. Support for hidden columns and SQL Graph column aliases still requires access to the metadata view.
  (#4370, #4306, #4402)

• Fixed a memory-allocation regression in connection and command operations caused by formatting diagnostic strings even when tracing was disabled. Also corrected trace messages that reported an incorrect object ID or could throw FormatException when traced values contained braces.
  (#4528, #4533)

• Fixed ServerCertificate validation on the managed SNI path so the configured certificate is compared against the server certificate even when the server certificate passes chain and host-name validation. When certificate validation is enabled, a missing, unreadable, or invalid certificate file, a certificate mismatch, or a missing server certificate now causes the TLS handshake to fail instead of bypassing the configured certificate check. (net8.0/net9.0 only)
  (#4445, #4583)

• Fixed Always Encrypted VSM/HGS enclave attestation to verify that the enclave public key used to establish a session matches the key committed to by the signed attestation report. Missing, malformed, or mismatched key-binding data now causes attestation to fail before the session secret is derived.
  (#4532, #4553)

• Fixed SqlConnection.AccessTokenCallback not disabling Transparent Network IP Resolution by default, making it consistent with SqlConnection.AccessToken. An explicitly configured TransparentNetworkIPResolution connection-string value still takes precedence. (net462 only)
  (#4520, #4561)

• Fixed authentication state handling so clearing SqlConnection.AccessToken, AccessTokenCallback, or SspiContextProvider preserves the other authentication values in the connection pool key. Cloning a connection or updating its credential also preserves its SspiContextProvider. Combining a non-null SspiContextProvider with AccessToken or AccessTokenCallback now throws InvalidOperationException instead of silently discarding authentication state; applications must use one authentication mechanism at a time.
  (#4520, #4561, #4644)

• Fixed configurable retry logic installing a permanent, process-wide assembly-resolution handler that could interfere with unrelated assembly loading. The handler is now active only while an explicitly configured custom retry provider is resolved and constructed, and probes AppContext.BaseDirectory instead of the current working directory. Place custom retry assemblies in the application base directory; dependencies loaded after provider construction must be resolvable through normal application dependency resolution or an application-provided handler. (net8.0/net9.0 only)
  (#2214, #4547, #4663)

Contributors

We thank the following public contributors. Their efforts toward this project are very much appreciated.

• edwardneal

Target Platform Support

• .NET Framework 4.6.2+ (Windows x86, Windows x64, Windows ARM64)
• .NET 8.0+ (Windows x86, Windows x64, Windows ARM, Windows ARM64, Linux, macOS)

Full details: release-notes/7.0/7.0.3.md

This update brings the following changes since the 7.0.1 release:

Important — package version alignment: Starting with 7.0.2, the Microsoft.Data.SqlClient driver and its companion packages share a single aligned version. The following packages now ship together as 7.0.2:

• Microsoft.Data.SqlClient
• Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider
• Microsoft.Data.SqlClient.Extensions.Azure
• Microsoft.Data.SqlClient.Extensions.Abstractions
• Microsoft.Data.SqlClient.Internal.Logging

(Microsoft.SqlServer.Server continues to version independently and remains at 1.0.0.)

Applications must reference the same versions of Microsoft.Data.SqlClient and its extensions for best compatibility. In particular, applications that reference Microsoft.Data.SqlClient.Extensions.Azure must upgrade it to 7.0.2 when upgrading Microsoft.Data.SqlClient to 7.0.2.

Breaking change (.NET Framework only): As part of this alignment, the AssemblyVersion of Microsoft.Data.SqlClient.Extensions.Azure, Microsoft.Data.SqlClient.Extensions.Abstractions, and Microsoft.Data.SqlClient.Internal.Logging changed from 1.0.0.0 to 7.0.0.0 (the Microsoft.Data.SqlClient and Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider assembly versions are unchanged). On .NET Framework, AssemblyVersion is part of the strong-name identity, so applications that drop these assemblies into an existing deployment without rebuilding must rebuild against the 7.0.2 packages (or add binding redirects). Applications on .NET / .NET Core are not affected.

Companion package release notes

The following companion packages ship aligned as 7.0.2. See their individual release notes for package-specific changes (including the Microsoft.Data.SqlClient.Extensions.Azure WAM broker support):

• Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider 7.0.2
• Microsoft.Data.SqlClient.Extensions.Azure 7.0.2
• Microsoft.Data.SqlClient.Extensions.Abstractions 7.0.2
• Microsoft.Data.SqlClient.Internal.Logging 7.0.2

Fixed

• Fixed a NullReferenceException in SqlCommand.Cancel(). The diagnostic message built during cancellation dereferenced the active connection directly; it now uses a null-conditional access so cancellation no longer throws when the connection has already been torn down.
  (#4372,#4373)

• Fixed a NullReferenceException in SqlDataReader when calling GetBytes/GetChars with a null destination buffer. The argument-validation path that constructs the InvalidDestinationBufferIndex exception now guards against the null buffer so the correct ArgumentException is surfaced instead of an NRE.
  (#4159,#4206)

• Fixed Always Encrypted column master key signature verification incorrectly reusing cached results. The SignatureVerificationCache lookup logic was corrected so signature verification outcomes are cached and retrieved against the correct key, preventing stale or mismatched verification results.
  (#4339,#4343)

Changed

Hardened TDS token parsing with data-length bounds checks

What Changed:

• Added bounds checking when parsing TDS token and feature-extension-acknowledgment data lengths. The parser now validates the declared length of incoming token data against the available buffer before reading, rejecting malformed or out-of-range length values instead of reading past the intended boundary.
  (#4340,#4358)

Who Benefits:

• All consumers benefit from improved resilience against malformed or hostile TDS responses. A server (or man-in-the-middle) sending an invalid token length can no longer drive the parser to read beyond the declared payload.

Impact:

• Connections that previously parsed malformed token streams loosely will now fail fast with a clear protocol error. Well-behaved SQL Server responses are unaffected.

Contributors

We thank the following public contributors. Their efforts toward this project are very much appreciated.

• SimonCropp

Target Platform Support

• .NET Framework 4.6.2+ (Windows x86, Windows x64, Windows ARM64)
• .NET 8.0+ (Windows x86, Windows x64, Windows ARM, Windows ARM64, Linux, macOS)

Dependencies

.NET 9.0

• Microsoft.Bcl.Cryptography 9.0.13
• Microsoft.Data.SqlClient.Extensions.Abstractions 7.0.2
• Microsoft.Data.SqlClient.Internal.Logging 7.0.2
• Microsoft.Data.SqlClient.SNI.runtime 6.0.2
• Microsoft.Extensions.Caching.Memory 9.0.13
• Microsoft.IdentityModel.JsonWebTokens 8.16.0
• Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 9.0.13
• System.Security.Cryptography.Pkcs 9.0.13

.NET 8.0

• Microsoft.Bcl.Cryptography 8.0.0
• Microsoft.Data.SqlClient.Extensions.Abstractions 7.0.2
• Microsoft.Data.SqlClient.Internal.Logging 7.0.2
• Microsoft.Data.SqlClient.SNI.runtime 6.0.2
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.IdentityModel.JsonWebTokens 8.16.0
• Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 8.0.1
• System.Security.Cryptography.Pkcs 8.0.1

.NET Standard 2.0

• Microsoft.Bcl.Cryptography 8.0.0
• Microsoft.Data.SqlClient.Extensions.Abstractions 7.0.2
• Microsoft.Data.SqlClient.Internal.Logging 7.0.2
• Microsoft.Data.SqlClient.SNI.runtime 6.0.2
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.IdentityModel.JsonWebTokens 8.16.0
• Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 8.0.1
• System.Security.Cryptography.Pkcs 8.0.1
• System.Text.Json 10.0.3
• System.Threading.Channels 10.0.3

.NET Framework 4.6.2+

• Microsoft.Bcl.Cryptography 8.0.0
• Microsoft.Data.SqlClient.Extensions.Abstractions 7.0.2
• Microsoft.Data.SqlClient.Internal.Logging 7.0.2
• Microsoft.Data.SqlClient.SNI 6.0.2
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.IdentityModel.JsonWebTokens 8.16.0
• Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
• System.Buffers 4.6.1
• System.Data.Common 4.3.0
• System.Diagnostics.DiagnosticSource 10.0.3
• System.Memory 4.6.3
• System.Runtime.InteropServices.RuntimeInformation 4.3.0
• System.Security.Cryptography.Pkcs 8.0.1
• System.Text.Json 10.0.3
• System.Threading.Channels 10.0.3
• System.ValueTuple 4.6.2

This update brings the following changes since the 7.0.0 release:

Fixed

• Fixed SqlBulkCopy failing on SQL Server 2016 with Invalid column name 'graph_type' error. The column metadata query now uses dynamic SQL so that references to the graph_type column (introduced in SQL Server 2017) are not compiled on older versions that lack the column. (#3714, #4092, #4147)

• Fixed SqlBulkCopy failing on Azure Synapse Analytics dedicated SQL pools. The column-list query previously used a variable-assignment pattern that Synapse does not support; it now uses STRING_AGG when targeting Synapse (engine edition 6) and falls back to the variable-assignment approach for SQL Server 2016 compatibility. (#4149, #4176, #4182)

• Fixed SqlDataReader.GetFieldType() and GetProviderSpecificFieldType() returning typeof(byte[]) instead of typeof(SqlVector<float>) for vector float32 columns. The methods now follow the same type-determination logic as GetValue(). (#4104, #4105, #4152)

• Added missing System.Data.Common (v4.3.0) NuGet package dependency for .NET Framework consumers. The inbox System.Data.Common assembly on .NET Framework predates APIs such as IDbColumnSchemaGenerator; without the explicit NuGet dependency, consumers encountered CS0012 compilation errors when using these types through Microsoft.Data.SqlClient. (#4063, #4074)

Changed

• Enabled the User Agent TDS feature extension unconditionally. The Switch.Microsoft.Data.SqlClient.EnableUserAgent AppContext switch has been removed; the driver now always sends User Agent information during login. (#4124, #4154)

• Added type forwards from the core Microsoft.Data.SqlClient assembly to public types that were moved to the Microsoft.Data.SqlClient.Extensions.Abstractions package: SqlAuthenticationMethod, SqlAuthenticationParameters, SqlAuthenticationProvider, SqlAuthenticationProviderException, and SqlAuthenticationToken. This ensures binary compatibility for assemblies compiled against earlier versions of Microsoft.Data.SqlClient where these types lived in the core assembly. (#4067, #4117)

• Fixed API documentation include paths and duplicate doc snippets. (#4084, #4086, #4107, #4161)

Contributors

We thank the following public contributors. Their efforts toward this project are very much appreciated.

• edwardneal

Target Platform Support

• .NET Framework 4.6.2+ (Windows x86, Windows x64, Windows ARM64)
• .NET 8.0+ (Windows x86, Windows x64, Windows ARM, Windows ARM64, Linux, macOS)

Dependencies

.NET 9.0

• Microsoft.Bcl.Cryptography 9.0.13
• Microsoft.Data.SqlClient.Extensions.Abstractions 1.0.0
• Microsoft.Data.SqlClient.Internal.Logging 1.0.0
• Microsoft.Data.SqlClient.SNI.runtime 6.0.2
• Microsoft.Extensions.Caching.Memory 9.0.13
• Microsoft.IdentityModel.JsonWebTokens 8.16.0
• Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 9.0.13
• System.Security.Cryptography.Pkcs 9.0.13

.NET 8.0

• Microsoft.Bcl.Cryptography 8.0.0
• Microsoft.Data.SqlClient.Extensions.Abstractions 1.0.0
• Microsoft.Data.SqlClient.Internal.Logging 1.0.0
• Microsoft.Data.SqlClient.SNI.runtime 6.0.2
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.IdentityModel.JsonWebTokens 8.16.0
• Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 8.0.1
• System.Security.Cryptography.Pkcs 8.0.1

.NET Standard 2.0

• Microsoft.Bcl.Cryptography 8.0.0
• Microsoft.Data.SqlClient.Extensions.Abstractions 1.0.0
• Microsoft.Data.SqlClient.Internal.Logging 1.0.0
• Microsoft.Data.SqlClient.SNI.runtime 6.0.2
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.IdentityModel.JsonWebTokens 8.16.0
• Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 8.0.1
• System.Security.Cryptography.Pkcs 8.0.1
• System.Text.Json 10.0.3
• System.Threading.Channels 10.0.3

.NET Framework 4.6.2+

• Microsoft.Bcl.Cryptography 8.0.0
• Microsoft.Data.SqlClient.Extensions.Abstractions 1.0.0
• Microsoft.Data.SqlClient.Internal.Logging 1.0.0
• Microsoft.Data.SqlClient.SNI 6.0.2
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.IdentityModel.JsonWebTokens 8.16.0
• Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
• System.Buffers 4.6.1
• System.Data.Common 4.3.0
• System.Diagnostics.DiagnosticSource 10.0.3
• System.Memory 4.6.3
• System.Runtime.InteropServices.RuntimeInformation 4.3.0
• System.Security.Cryptography.Pkcs 8.0.1
• System.Text.Json 10.0.3
• System.Threading.Channels 10.0.3
• System.ValueTuple 4.6.2

This is the general availability release of Microsoft.Data.SqlClient 7.0, a major milestone for the .NET data provider for SQL Server. This release addresses the most upvoted issue in the repository's history — extracting Azure dependencies from the core package — introduces pluggable SSPI authentication, adds enhanced routing for Azure SQL Hyperscale, and delivers async read performance improvements.

Also released as part of this milestone:

• Released Microsoft.Data.SqlClient.Extensions.Abstractions 1.0.0. See release notes.
• Released Microsoft.Data.SqlClient.Extensions.Azure 1.0.0. See release notes.
• Released Microsoft.Data.SqlClient.Internal.Logging 1.0.0. See release notes.
• Released Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider 7.0.0. See release notes.

Changes Since 7.0.0-preview4

Added

• Added actionable error message when Entra ID authentication methods are used without the Microsoft.Data.SqlClient.Extensions.Azure package installed, guiding users to install the correct package. (#3962, #4046)
• Added Azure authentication sample application. (#3988)

Changed

Other changes

• Renamed the Microsoft.Data.SqlClient.Extensions.Logging package to Microsoft.Data.SqlClient.Internal.Logging to indicate it is for internal use only and should not be referenced directly by application code. (#4038)
• Fixed non-localized exception strings. (#4022)
• Codebase merge and cleanup: (#3997, #4052)
• Various test improvements: (#3891, #3996, #4002, #4034, #4041, #4044)
• Documentation improvements (including Entra ID branding updates): (#4021, #4047, #4049)
• Updated Dependencies (#4045):
  • Updated Azure.Core to v1.51.1
  • Updated Azure.Identity to v1.18.0
  • Updated Azure.Security.KeyVault.Keys to v4.9.0
  • Updated Microsoft.Extensions.Caching.Memory to v9.0.13 (.NET 9.0)
  • Updated Microsoft.IdentityModel.JsonWebTokens to v8.16.0
  • Updated Microsoft.IdentityModel.Protocols.OpenIdConnect to v8.16.0
  • Updated Microsoft.Bcl.Cryptography to v9.0.13 (.NET 9.0)
  • Updated System.Configuration.ConfigurationManager to v9.0.13 (.NET 9.0)
  • Updated System.Diagnostics.DiagnosticSource to v10.0.3
  • Updated System.Security.Cryptography.Pkcs to v9.0.13 (.NET 9.0)
  • Updated System.Text.Json to v10.0.3
  • Updated System.Threading.Channels to v10.0.3
  • Updated System.ValueTuple to v4.6.2

Cumulative Changes Since 6.1

This section summarizes all changes across the 7.0 preview cycle for users upgrading from the latest 6.1 stable release.

Changed

Azure Dependencies Removed from Core Package

What Changed:

• The core Microsoft.Data.SqlClient package no longer depends on Azure.Core, Azure.Identity, or their transitive dependencies (e.g., Microsoft.Identity.Client, Microsoft.Web.WebView2). Azure Active Directory / Entra ID authentication functionality (ActiveDirectoryAuthenticationProvider and related types) has been extracted into a new Microsoft.Data.SqlClient.Extensions.Azure package. (#1108, #3680, #3902, #3904, #3908, #3917, #3982, #3978, #3986)
• Two additional packages were introduced to support this separation: Microsoft.Data.SqlClient.Extensions.Abstractions (shared types between the core driver and extensions) and Microsoft.Data.SqlClient.Internal.Logging (shared ETW tracing infrastructure). (#3626, #3628, #3967, #4038)

Who Benefits:

• All users benefit from a significantly lighter core package. Previously, the Azure dependency chain pulled in numerous assemblies even for applications that only needed basic SQL Server connectivity. This was the most upvoted open issue in the repository.
• Users who do not use Entra ID authentication no longer carry Azure-related assemblies in their build output.
• Users who do use Entra ID authentication can now manage Azure dependency versions independently from the core driver.

Impact:

• Applications using Entra ID authentication (e.g., ActiveDirectoryInteractive, ActiveDirectoryDefault, ActiveDirectoryManagedIdentity, etc.) must now install the Microsoft.Data.SqlClient.Extensions.Azure NuGet package separately:

dotnet add package Microsoft.Data.SqlClient.Extensions.Azure

• No code changes are required beyond adding the package reference.
• If an Entra ID authentication method is used without the Azure package installed, the driver now provides an actionable error message guiding users to install the correct package.

Added

Pluggable Authentication with SspiContextProvider

What Changed:

• Added a public SspiContextProvider property on SqlConnection, completing the SSPI extensibility work begun in 6.1.0. Applications can now supply a custom SSPI context provider for integrated authentication, enabling custom Kerberos ticket negotiation and NTLM username/password authentication scenarios. (#2253, #2494)

Who Benefits:

• Users authenticating across untrusted domains, non-domain-joined machines, or cross-platform environments where configuring integrated authentication is difficult.
• Users running in containers who need manual Kerberos negotiation without deploying sidecars or external ticket-refresh mechanisms.
• Users who need NTLM username/password authentication to SQL Server, which the driver does not provide natively.

Impact:

• Applications can set a custom SspiContextProvider on SqlConnection before opening the connection:

var connection = new SqlConnection(connectionString);
connection.SspiContextProvider = new MyKerberosProvider();
connection.Open();

• The provider handles the authentication token exchange during integrated authentication. Existing authentication behavior is unchanged when no custom provider is set. See SspiContextProvider_CustomProvider.cs for a sample implementation.
• Note: The SspiContextProvider is part of the connection pool key. Care should be taken when using this property to ensure the implementation returns a stable identity per resource.

Async Read Performance: Packet Multiplexing (Preview)

What Changed:

• Continued refinement of packet multiplexing with bug fixes and stability improvements since 6.1.0, plus new app context switches for opt-in control. (#3534, #3537, #3605)

Who Benefits:

• Applications performing large async reads (ExecuteReaderAsync with big result sets, streaming scenarios, or bulk data retrieval).

Impact:

• Packet multiplexing ships behind two opt-in feature switches:

AppContext.SetSwitch("Switch.Microsoft.Data.SqlClient.UseCompatibilityAsyncBehaviour", false);
AppContext.SetSwitch("Switch.Microsoft.Data.SqlClient.UseCompatibilityProcessSni", false);

• Setting both switches to false enables the new async processing path. By default, the driver uses the existing (compatible) behavior.

Enhanced Routing Support

What Changed:

• Added support for enhanced routing, a TDS feature that allows the server to redirect connections to a specific server and database during login. (#3641, #3969, #3970, #3973)

Who Benefits:

• Users connecting to Azure SQL Hyperscale environments that use named read replicas and gateway-based load balancing.

Impact:

• Enhanced routing is negotiated automatically during login when the server supports it. No application code changes are required.

Support for .NET 10

What Changed:

• Updated pipelines and test suites to compile the driver using the .NET 10 SDK. (#3686)

Who Benefits:

• Developers targeting .NET 10 on day one.

Impact:

• SqlClient 7.0 compiles and tests against .NET 10, ensuring compatibility.

Strongly-Typed Diagnostic Events on .NET Framework

What Changed:

• Enabled SqlClientDiagnosticListener for SqlCommand on .NET Framework, closing a long-standing observability gap where diagnostic events were previously only emitted on .NET Core. (#3658)

• Brought the 15 strongly-typed diagnostic event classes in the Microsoft.Data.SqlClient.Diagnostics namespace — originally introduced for .NET Core in 6.0 — to .NET Framework as part of the codebase merge. Both platforms now use the same strongly-typed event model. The types cover command, connection, and transaction lifecycle events:

  • SqlClientCommandBefore, SqlClientCommandAfter, SqlClientCommandError
  • SqlClientConnectionOpenBefore, SqlClientConnectionOpenAfter, SqlClientConnectionOpenError
  • SqlClientConnectionCloseBefore, SqlClientConnectionCloseAfter, SqlClientConnectionCloseError
  • SqlClientTransactionCommitBefore, SqlClientTransactionCommitAfter, SqlClientTransactionCommitError
  • SqlClientTransactionRollbackBefore, SqlClientTransactionRollbackAfter, SqlClientTransactionRollbackError

  (#3493)

Who Benefits:

• .NET Framework users subscribing to SqlClientDiagnosticListener events for observability, distributed tracing, or custom telemetry. These users now have parity with .NET Core, gaining IntelliSense, compile-time safety, and eliminating the need to access diagnostic payloads via reflection or dictionary lookups.

Impact:

• On .NET Framework, SqlCommand now emits the same diagnostic events that were previously only available on .NET Core. Subscribers to DiagnosticListener events (e.g., Microsoft.Data.SqlClient.WriteCommandBefore) receive the strongly-typed objects:

listener.Subscribe(new Observer<KeyValuePair<string, object?>>(kvp =>
{
    if (kvp.Value is SqlClientCommandBefore before)
    {
        Console.WriteLine($"Executing: {before.Command.CommandText}");
    }
}));

• The types implement IReadOnlyList<KeyValuePair<string, object>> for backward compatibility with code that iterates properties generically.

Other Additions

• Added SqlConfigurableRetryFactory.BaselineTransientErrors static property exposing the default transient error codes list as a ReadOnlyCollection<int>, making it easier to extend the default list with application-specific error codes. (#3903)
• Added app context switch Switch.Microsoft.Data.SqlClient.EnableMultiSubnetFailoverByDefault to set MultiSubnetFailover=true globally without modifying connection strings. (#3841)
• Added app context switch Switch.Microsoft.Data.SqlClient.IgnoreServerProvidedFailoverPartner to let the client ignore server-provided failover partner info in Basic Availability Groups. (#3625)
• Enabled User Agent Feature Extension (opt-in via Switch.Microsoft.Data.SqlClient.EnableUserAgent). (#3606)

Changed

Deprecation of SqlAuthenticationMethod.ActiveDirectoryPassword

What Changed:

• SqlAuthenticationMethod.ActiveDirectoryPassword (the ROPC flow) is now marked [Obsolete] and will generate compiler warnings. This aligns with Microsoft's move toward mandatory multifactor authentication. (#3671)

Who Benefits:

• Teams moving toward stronger, passwordless or MFA-compliant authentication.

Impact:

• If you use Authentication=Active Directory Password, migrate to a supported alternative:

• See Connect to Azure SQL with Microsoft Entra authentication for more information.

Breaking Changes

• Reverted public visibility of internal interop enums (IoControlCodeAccess and IoControlTransferType) that were accidentally made public during the project merge. (#3900)

Other Changes

• Removed Constrained Execution Region error handling blocks and associated SqlConnection cleanup. (#3535)
• Performance improvements across SqlStatistics timing, Always Encrypted scenarios, and connection opening: (#3609, #3612, #3732, #3660, #3791, #3772, #3554)
• Allow SqlBulkCopy to operate on hidden columns. (#3590)
• Updated UserAgent feature to use a pipe-delimited format, replacing the previous JSON format. (#3826)
• Minor improvements to Managed SNI tracing to capture continuation events and errors. (#3859)

Fixed

• Fixed a connection performance regression where SPN generation was triggered for non-integrated authentication modes (e.g., SQL authentication) on the native SNI path. (#3929)
• Fixed ExecuteScalar to propagate errors when the server sends data followed by an error token. (#3912)
• Fixed NullReferenceException in SqlDataAdapter when processing batch scenarios. (#3857)
• Fixed reading of multiple app context switches from a single AppContextSwitchOverrides configuration field. (#3960)
• Fixed an edge case in TdsParserStateObject.TryReadPlpBytes where zero-length reads returned null instead of an empty array. (#3872)
• Fixed issue where extra connection deactivation was occurring. (#3758)
• Fixed debug assertion in connection pool (no impact to production code). (#3587)
• Prevented uninitialized performance counters escaping CreatePerformanceCounters. (#3623)
• Fixed SetProvider to return immediately if user-defined authentication provider found. (#3620)
• Fixed connection pool concurrency issue. (#3632)

Contributors

We thank the following public contributors. Their efforts toward this project are very much appreciated.

• edwardneal
• ErikEJ
• frankbuckley
• MatthiasHuygelen
• ShreyaLaxminarayan
• tetolv
• twsouthwick
• Wraith2

Target Platform Support

• .NET Framework 4.6.2+ (Windows x86, Windows x64, Windows ARM64)
• .NET 8.0+ (Windows x86, Windows x64, Windows ARM, Windows ARM64, Linux, macOS)

Dependencies

.NET 9.0

• Microsoft.Bcl.Cryptography 9.0.13
• Microsoft.Data.SqlClient.Extensions.Abstractions 1.0.0
• Microsoft.Data.SqlClient.Internal.Logging 1.0.0
• Microsoft.Data.SqlClient.SNI.runtime 6.0.2
• Microsoft.Extensions.Caching.Memory 9.0.13
• Microsoft.IdentityModel.JsonWebTokens 8.16.0
• Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 9.0.13
• System.Security.Cryptography.Pkcs 9.0.13

.NET 8.0

• Microsoft.Bcl.Cryptography 8.0.0
• Microsoft.Data.SqlClient.Extensions.Abstractions 1.0.0
• Microsoft.Data.SqlClient.Internal.Logging 1.0.0
• Microsoft.Data.SqlClient.SNI.runtime 6.0.2
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.IdentityModel.JsonWebTokens 8.16.0
• Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 8.0.1
• System.Security.Cryptography.Pkcs 8.0.1

.NET Standard 2.0

• Microsoft.Bcl.Cryptography 8.0.0
• Microsoft.Data.SqlClient.Extensions.Abstractions 1.0.0
• Microsoft.Data.SqlClient.Internal.Logging 1.0.0
• Microsoft.Data.SqlClient.SNI.runtime 6.0.2
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.IdentityModel.JsonWebTokens 8.16.0
• Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 8.0.1
• System.Security.Cryptography.Pkcs 8.0.1
• System.Text.Json 10.0.3
• System.Threading.Channels 10.0.3

.NET Framework 4.6.2+

• Microsoft.Bcl.Cryptography 8.0.0
• Microsoft.Data.SqlClient.Extensions.Abstractions 1.0.0
• Microsoft.Data.SqlClient.Internal.Logging 1.0.0
• Microsoft.Data.SqlClient.SNI 6.0.2
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.IdentityModel.JsonWebTokens 8.16.0
• Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
• System.Buffers 4.6.1
• System.Diagnostics.DiagnosticSource 10.0.3
• System.Memory 4.6.3
• System.Runtime.InteropServices.RuntimeInformation 4.3.0
• System.Security.Cryptography.Pkcs 8.0.1
• System.Text.Json 10.0.3
• System.Threading.Channels 10.0.3
• System.ValueTuple 4.6.2

This update brings the following changes since the 6.1.6 release:

Changed

• Updated the Microsoft.Data.SqlClient.SNI and Microsoft.Data.SqlClient.SNI.runtime dependencies to 6.0.3 (was 6.0.2).
  (#4598)

Fixed

• Fixed ServerCertificate validation on the managed SNI path so the configured certificate is compared against the server certificate even when the server certificate passes chain and host-name validation. When certificate validation is enabled, a missing, unreadable, or invalid certificate file, a certificate mismatch, or a missing server certificate now causes the TLS handshake to fail instead of bypassing the configured certificate check. (net8.0/net9.0 only)
  (#4445, #4584)

• Fixed Always Encrypted VSM/HGS enclave attestation to verify that the enclave public key used to establish a session matches the key committed to by the signed attestation report. Missing, malformed, or mismatched key-binding data now causes attestation to fail before the session secret is derived.
  (#4532, #4552)

• Fixed SqlConnection.AccessTokenCallback not disabling Transparent Network IP Resolution by default, making it consistent with SqlConnection.AccessToken. An explicitly configured TransparentNetworkIPResolution connection-string value still takes precedence. (net462 only)
  (#4520, #4560)

• Fixed token authentication state handling so clearing SqlConnection.AccessToken preserves an existing AccessTokenCallback in the connection pool key, and clearing AccessTokenCallback preserves an existing AccessToken. Callback-based authentication now also follows the same prelogin server-certificate validation rules as an explicitly supplied access token.
  (#4520, #4560)

• Fixed configurable retry logic installing a permanent, process-wide assembly-resolution handler that could interfere with unrelated assembly loading. The handler is now active only while an explicitly configured custom retry provider is resolved and constructed, and probes AppContext.BaseDirectory instead of the current working directory. Place custom retry assemblies in the application base directory; dependencies loaded after provider construction must be resolvable through normal application dependency resolution or an application-provided handler. (net8.0/net9.0 only)
  (#2214, #4547, #4664)

Target Platform Support

• .NET Framework 4.6.2+ (Windows x86, Windows x64, Windows ARM64)
• .NET 8.0+ (Windows x86, Windows x64, Windows ARM64, Linux, macOS)
• .NET Standard 2.0+ (Windows x86, Windows x64, Windows ARM64, Linux, macOS)

Full details: release-notes/6.1/6.1.7.md

This update brings the following changes since the 6.1.5 release:

Added

WAM broker support for the supported Entra ID authentication modes (Windows only)

What Changed:

• Added support for the Web Account Manager (WAM) broker for the supported Microsoft Entra ID authentication modes. A new ActiveDirectoryAuthenticationProviderOptions options bag and a corresponding ActiveDirectoryAuthenticationProvider(ActiveDirectoryAuthenticationProviderOptions options) constructor were introduced, exposing a UseWamBroker property (alongside ApplicationClientId and DeviceCodeFlowCallback).
  (#4288, #4387)
• Added a cross-platform SetParentActivityOrWindowFunc(Func<object> parentActivityOrWindowFunc) method so callers can supply a parent window handle on Windows or a parent Activity/UIViewController on Android/iOS/MAUI.

Who Benefits:

• Applications using ActiveDirectoryInteractive and other supported Entra ID authentication modes on Windows benefit from the WAM broker's improved security (tokens are brokered by the OS), single sign-on with the logged-in Windows account, and support for Conditional Access and Windows Hello.

Impact:

• When you supply your ApplicationClientId, WAM is opt-in via ActiveDirectoryAuthenticationProviderOptions.UseWamBroker. Consider enabling it when you want OS-brokered tokens, single sign-on with the signed-in Windows account, Windows Hello, and Conditional Access support.
• UseWamBroker is a Windows-only setting and has no effect on non-Windows platforms, where interactive Entra ID flows always use the system browser.
• Prefer the new options-bag constructor over the positional-argument overloads in new code.

var options = new ActiveDirectoryAuthenticationProviderOptions
{
    ApplicationClientId = "<your-app-client-id>",
    // Enable WAM (Windows only) for OS-brokered tokens, SSO, Windows Hello, and Conditional Access.
    UseWamBroker = true,
};
var provider = new ActiveDirectoryAuthenticationProvider(options);
// Supply the parent window/activity that owns the interactive sign-in prompt.
provider.SetParentActivityOrWindowFunc(() => parentWindowHandle);
SqlAuthenticationProvider.SetProvider(SqlAuthenticationMethod.ActiveDirectoryInteractive, provider);

Changed

Hardened TDS token parsing with data-length bounds checks

What Changed:

• Added bounds checking when parsing TDS token data lengths. The parser now validates the declared length of incoming token data against the available buffer before reading, rejecting malformed or out-of-range length values instead of reading past the intended boundary.
  (#4340, #4359)

Who Benefits:

• All consumers benefit from improved resilience against malformed or hostile TDS responses. A server (or man-in-the-middle) sending an invalid token length can no longer drive the parser to read beyond the declared payload.

Impact:

• Connections that previously parsed malformed token streams loosely will now fail fast with a clear protocol error. Well-behaved SQL Server responses are unaffected.

Other changes

• Updated dependencies (#4387):
  • Updated Microsoft.Identity.Client to 4.84.2 (was 4.80.0)
  • Added Microsoft.Identity.Client.Broker 4.84.2

Fixed

• Fixed a NullReferenceException in SqlDataReader.GetChars on the PLP + CommandBehavior.SequentialAccess path when a null buffer was passed together with a negative bufferIndex. The call now correctly throws ArgumentOutOfRangeException for the bufferIndex parameter.
  (#4159, #4205)

• Fixed column master key (CMK) signature verification caching where GetSignatureVerificationResult returned whether the cache key existed rather than the cached value itself. Once a signature verification failure was cached as false, subsequent lookups incorrectly returned true, causing the caller to skip re-verification and treat the column master key as having a valid signature.
  (#4339, #4356)

Target Platform Support

• .NET Framework 4.6.2+ (Windows x86, Windows x64, Windows ARM64)
• .NET 8.0+ (Windows x86, Windows x64, Windows ARM64, Linux, macOS)
• .NET Standard 2.0+ (Windows x86, Windows x64, Windows ARM64, Linux, macOS)

Dependencies

.NET Framework 4.6.2

• Azure.Core 1.50.0
• Azure.Identity 1.17.1
• Microsoft.Data.SqlClient.SNI 6.0.2
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.Identity.Client 4.84.2
• Microsoft.Identity.Client.Broker 4.84.2
• Microsoft.IdentityModel.JsonWebTokens 7.7.1
• Microsoft.IdentityModel.Protocols.OpenIdConnect 7.7.1
• System.Buffers 4.6.1
• System.Data.Common 4.3.0
• System.Diagnostics.DiagnosticSource 8.0.1
• System.IdentityModel.Tokens.Jwt 7.7.1
• System.Memory 4.6.3
• System.Security.Cryptography.Pkcs 8.0.1
• System.Text.Json 8.0.6
• System.Text.RegularExpressions 4.3.1

.NET 8.0

• Azure.Core 1.50.0
• Azure.Identity 1.17.1
• Microsoft.Data.SqlClient.SNI.runtime 6.0.2
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.Identity.Client 4.84.2
• Microsoft.Identity.Client.Broker 4.84.2
• Microsoft.IdentityModel.JsonWebTokens 7.7.1
• Microsoft.IdentityModel.Protocols.OpenIdConnect 7.7.1
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 8.0.1
• System.Diagnostics.DiagnosticSource 8.0.1
• System.IdentityModel.Tokens.Jwt 7.7.1
• System.Security.Cryptography.Pkcs 8.0.1

.NET 9.0

• Azure.Core 1.50.0
• Azure.Identity 1.17.1
• Microsoft.Data.SqlClient.SNI.runtime 6.0.2
• Microsoft.Extensions.Caching.Memory 9.0.11
• Microsoft.Identity.Client 4.84.2
• Microsoft.Identity.Client.Broker 4.84.2
• Microsoft.IdentityModel.JsonWebTokens 7.7.1
• Microsoft.IdentityModel.Protocols.OpenIdConnect 7.7.1
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 9.0.11
• System.Diagnostics.DiagnosticSource 9.0.11
• System.IdentityModel.Tokens.Jwt 7.7.1
• System.Security.Cryptography.Pkcs 9.0.11

.NET Standard 2.0

• Azure.Core 1.50.0
• Azure.Identity 1.17.1
• Microsoft.Data.SqlClient.SNI.runtime 6.0.2
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.Identity.Client 4.84.2
• Microsoft.Identity.Client.Broker 4.84.2
• Microsoft.IdentityModel.JsonWebTokens 7.7.1
• Microsoft.IdentityModel.Protocols.OpenIdConnect 7.7.1
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 8.0.1
• System.Diagnostics.DiagnosticSource 8.0.1
• System.IdentityModel.Tokens.Jwt 7.7.1
• System.Security.Cryptography.Pkcs 8.0.1
• System.Text.Json 8.0.6

This update brings the following changes since the 6.1.4 release:

Fixed

• Fixed a connection performance regression where SPN (Service Principal Name) generation was triggered for non-integrated authentication modes (e.g., SQL authentication) on the native SNI path, causing unnecessary DNS lookups and significantly slower connection times. Only affects .NET on Windows (not .NET Framework). (#3523, #3946)
• Fixed ExecuteScalar to properly propagate errors when the server sends data followed by an error token. Previously, errors such as conversion failures during WHERE clause evaluation were silently consumed during SqlDataReader.Close() instead of being thrown to the caller, which could result in transactions being unexpectedly zombied. (#3736, #3947)
• Fixed SqlDataReader.GetFieldType and SqlDataReader.GetProviderSpecificFieldType to return the correct type (SqlVector<float>) for vector float32 columns. Previously, these methods did not follow the same type-resolution logic as GetValue, returning an incorrect type for vector columns. (#4104, #4151)

Target Platform Support

• .NET Framework 4.6.2+ (Windows x86, Windows x64, Windows ARM64)
• .NET 8.0+ (Windows x86, Windows x64, Windows ARM64, Linux, macOS)
• .NET Standard 2.0+ (Windows x86, Windows x64, Windows ARM64, Linux, macOS)

Dependencies

.NET Framework 4.6.2

• Azure.Core 1.50.0
• Azure.Identity 1.17.1
• Microsoft.Data.SqlClient.SNI 6.0.2
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.Identity.Client 4.80.0
• Microsoft.IdentityModel.JsonWebTokens 7.7.1
• Microsoft.IdentityModel.Protocols.OpenIdConnect 7.7.1
• System.Buffers 4.6.1
• System.Data.Common 4.3.0
• System.Diagnostics.DiagnosticSource 8.0.1
• System.IdentityModel.Tokens.Jwt 7.7.1
• System.Memory 4.6.3
• System.Security.Cryptography.Pkcs 8.0.1
• System.Text.Json 8.0.6
• System.Text.RegularExpressions 4.3.1

.NET 8.0

• Azure.Core 1.50.0
• Azure.Identity 1.17.1
• Microsoft.Data.SqlClient.SNI.runtime 6.0.2
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.Identity.Client 4.80.0
• Microsoft.IdentityModel.JsonWebTokens 7.7.1
• Microsoft.IdentityModel.Protocols.OpenIdConnect 7.7.1
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 8.0.1
• System.Diagnostics.DiagnosticSource 8.0.1
• System.IdentityModel.Tokens.Jwt 7.7.1
• System.Security.Cryptography.Pkcs 8.0.1

.NET 9.0

• Azure.Core 1.50.0
• Azure.Identity 1.17.1
• Microsoft.Data.SqlClient.SNI.runtime 6.0.2
• Microsoft.Extensions.Caching.Memory 9.0.11
• Microsoft.Identity.Client 4.80.0
• Microsoft.IdentityModel.JsonWebTokens 7.7.1
• Microsoft.IdentityModel.Protocols.OpenIdConnect 7.7.1
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 9.0.11
• System.Diagnostics.DiagnosticSource 9.0.11
• System.IdentityModel.Tokens.Jwt 7.7.1
• System.Security.Cryptography.Pkcs 9.0.11

.NET Standard 2.0

• Azure.Core 1.50.0
• Azure.Identity 1.17.1
• Microsoft.Data.SqlClient.SNI.runtime 6.0.2
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.Identity.Client 4.80.0
• Microsoft.IdentityModel.JsonWebTokens 7.7.1
• Microsoft.IdentityModel.Protocols.OpenIdConnect 7.7.1
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 8.0.1
• System.Diagnostics.DiagnosticSource 8.0.1
• System.IdentityModel.Tokens.Jwt 7.7.1
• System.Security.Cryptography.Pkcs 8.0.1
• System.Text.Json 8.0.6

This update brings the following changes since the 6.1.3 release:

Fixed

• Fixed NullReferenceException issue with SqlDataAdapter when processing batch scenarios where certain SQL RPC calls may not include system parameters. (#3877)
• Fixed connection pooling issue where extra connection deactivation was causing active connection counts to go negative. (#3776)

Added

AppContext Switch for enabling MultiSubnetFailover

What Changed:

• Added new AppContext switch Switch.Microsoft.Data.SqlClient.EnableMultiSubnetFailoverByDefault to set MultiSubnetFailover=true by default in connection string. (#3851)

Who Benefits:

• Applications that need MultiSubnetFailover enabled globally without modifying connection strings.

Impact:

• Applications can now enable MultiSubnetFailover globally using one of the following methods:

// In application code
AppContext.SetSwitch("Switch.Microsoft.Data.SqlClient.EnableMultiSubnetFailoverByDefault", true);

// In runtimeconfig.json
{
  "configProperties": {
    "Switch.Microsoft.Data.SqlClient.EnableMultiSubnetFailoverByDefault": true
  }
}

<!-- In App.Config -->
<runtime>
  <AppContextSwitchOverrides value="Switch.Microsoft.Data.SqlClient.EnableMultiSubnetFailoverByDefault=true" />
</runtime>

Changed

• Optimized SqlStatistics execution timing by using Environment.TickCount instead of more expensive timing mechanisms. (#3830)
• Updated dependencies (#3843):
  • .NET Framework 4.6.2:
    • Azure.Core 1.47.1 -> 1.50.0
    • Azure.Identity 1.14.2 -> 1.17.1
    • Microsoft.Identity.Client 4.80.0 - Added
    • System.Buffers 4.5.1 -> 4.6.1
    • System.Diagnostics.DiagnosticSource 8.0.1 - Added
    • System.IdentityModel.Tokens.Jwt 7.7.1 - Added
    • System.Memory 4.6.3 - Added
    • System.Text.Json 8.0.5 -> 8.0.6
    • System.Text.RegularExpressions 4.3.1 - Added
    • Microsoft.Bcl.Cryptography - Removed
    • System.Text.Encodings.Web - Removed
  • .NET 8.0:
    • Azure.Core 1.47.1 -> 1.50.0
    • Azure.Identity 1.14.2 -> 1.17.1
    • Microsoft.Identity.Client 4.80.0 - Added
    • System.Diagnostics.DiagnosticSource 8.0.1 - Added
    • System.IdentityModel.Tokens.Jwt 7.7.1 - Added
    • Microsoft.Bcl.Cryptography - Removed
    • System.Text.Json - Removed
  • .NET 9.0:
    • Azure.Core 1.47.1 -> 1.50.0
    • Azure.Identity 1.14.2 -> 1.17.1
    • Microsoft.Extensions.Caching.Memory 9.0.4 -> 9.0.11
    • Microsoft.Identity.Client 4.80.0 - Added
    • System.Configuration.ConfigurationManager 9.0.4 -> 9.0.11
    • System.Diagnostics.DiagnosticSource 9.0.11 - Added
    • System.IdentityModel.Tokens.Jwt 7.7.1 - Added
    • System.Security.Cryptography.Pkcs 9.0.4 -> 9.0.11
    • Microsoft.Bcl.Cryptography - Removed
    • System.Text.Json - Removed
  • .NET Standard 2.0:
    • Azure.Core 1.47.1 -> 1.50.0
    • Azure.Identity 1.14.2 -> 1.17.1
    • Microsoft.Extensions.Caching.Memory 9.0.4 -> 8.0.1
    • Microsoft.Identity.Client 4.80.0 - Added
    • System.Configuration.ConfigurationManager 9.0.4 -> 8.0.1
    • System.Diagnostics.DiagnosticSource 8.0.1 - Added
    • System.IdentityModel.Tokens.Jwt 7.7.1 - Added
    • System.Security.Cryptography.Pkcs 9.0.4 -> 8.0.1
    • System.Text.Json 9.0.5 -> 8.0.6
    • Microsoft.Bcl.Cryptography - Removed

This update includes the following changes since the 6.1.2 release:

Added

App Context Switch for Ignoring Server-Provided Failover Partner

What Changed:

• A new app context switch Switch.Microsoft.Data.SqlClient.IgnoreServerProvidedFailoverPartner was introduced to let the client ignore server-provided failover partner info in Basic Availability Groups (BAGs). When the switch is enabled, only the failover partner specified in the connection string is used; server-supplied partner values are skipped. This context switch was introduced in PR #3702.

Who Benefits:

• Applications connecting to SQL Server BAGs using TCP and custom ports, especially where the server's provided partner name lacks the protocol, host, or port. This avoids connection failures when the server-provided partner is incompatible or incomplete.
• Teams who manage availability groups and rely on client-side control of failover behavior in heterogeneous networking environments.

Impact:

• If your environment might be affected (i.e., you operate a BAG with custom ports, or have experienced failures after failover), you can enable the new switch in your application:

AppContext.SetSwitch("Switch.Microsoft.Data.SqlClient.IgnoreServerProvidedFailoverPartner", true);

• Then, ensure your connection string includes your preferred failover partner (with correct tcp:host,port) so that the client uses that instead of the server's suggestion.
• Without enabling this, by default, the client continues to prefer the server-provided partner, maintaining backwards compatibility.

Fixed

• Fixed an issue to ensure reliable metrics initialization during startup, preventing missed telemetry when EventSource is enabled early. (#3718)

This update includes the following changes since the 6.1.1 release:

Fixed

• Fixed an issue where initializing PerformanceCounters would throw System.InvalidOperationException #3629
• Fixed an issue where a Custom SqlClientAuthenticationProvider was being overwritten by default implementation. #3651
• Fixed a concurrency issue in connection pooling where the number of active connections could be lower than the configured maximum pool size. #3653

This update includes the following changes since the 6.1.0 release:

Fixed

• Reverted changes related to improving partial packet detection, fixup, and replay functionality. This revert addresses regressions introduced in 6.1.0. (#3556)
• Applied reference assembly corrections supporting vector, fixed JSON tests, and ensured related tests are enabled. #3562
• Fixed SqlVector<T>.Null API signature in Reference assembly. #3521

Changed

• Upgraded Azure.Identity and other dependencies to newer versions. (#3538) (#3552)

This update brings the following changes since the 6.1.0-preview2 release:

Added

No new features were added.

Fixed

• Fixed missing socket error codes on non-Windows platforms. (#3475)
• Fixed primary/secondary server SPN handling during SSPI negotiation. (#3478)
• Fixed AzureKeyVaultProvider package key caching to serialize Azure key fetch operations. (#3477)
• Fixed a rare error related to multi-packet async text reads. (#3474)
• Fixed some spelling errors in the API docs. (#3500)
• Fixed a rare multi-packet string corruption bug. (#3513)

Changed

SqlDecimal type workarounds conversions

What Changed:

• Changed how SqlDecimal type workarounds perform conversions to meet compliance policies. (#3467)

Who Benefits:

• Microsoft products must not use undocumented APIs on other Microsoft products. This change removes calls to undocumented APIs and replaces them with compliant API use.

Impact:

• These changes impose an observed 5% decrease in performance on .NET Framework.

SqlVector API improvements

What Changed:

• Several changes were made to the SqlVector API published in the 6.1.0-preview2 release (#3472):
  • The SqlVector class was changed to a readonly struct.
  • The null value constructor was changed to a static CreateNull() method.
  • The Size property was removed.

Who Benefits:

• SqlVector instances gain the efficiencies of struct handling.

Impact:

• Early-adopter applications may require updates if they rely on the old APIs and any class-specific behaviour.

[Stable release 6.0.5] - 2026-01-15

This update brings the below changes over the previous stable release:

Fixed

• Fixed NullReferenceException issue with SqlDataAdapter when processing batch scenarios where certain SQL RPC calls may not include system parameters.
  (#3878)

Added

What Changed:

• Added new AppContext switch Switch.Microsoft.Data.SqlClient.EnableMultiSubnetFailoverByDefault to set MultiSubnetFailover=true by default in connection string.
  (#3852)

Who Benefits:

• Applications that need MultiSubnetFailover enabled globally without modifying connection strings.

Impact:

• Applications can now enable MultiSubnetFailover globally using one of the following methods:

// In application code
AppContext.SetSwitch("Switch.Microsoft.Data.SqlClient.EnableMultiSubnetFailoverByDefault", true);

// In runtimeconfig.json
{
  "configProperties": {
    "Switch.Microsoft.Data.SqlClient.EnableMultiSubnetFailoverByDefault": true
  }
}

<!-- In App.Config -->
<runtime>
  <AppContextSwitchOverrides value="Switch.Microsoft.Data.SqlClient.EnableMultiSubnetFailoverByDefault=true" />
</runtime>

Changed

• Updated dependencies (#3840):

  • .NET Framework 4.6.2:

    • Azure.Core 1.50.0 - Added
    • Azure.Identity 1.14.2 -> 1.17.1
    • Microsoft.Identity.Client 4.80.0 - Added
    • Microsoft.IdentityModel.JsonWebTokens 7.5.0 -> 7.7.1
    • Microsoft.IdentityModel.Protocols.OpenIdConnect 7.5.0 -> 7.7.1
    • System.Buffers 4.5.1 -> 4.6.1
    • System.Text.Json 8.0.5 -> 8.0.6
    • Microsoft.Bcl.Cryptography - Removed
    • System.Text.Encodings.Web - Removed

  • .NET 8.0:

    • Azure.Core 1.50.0 - Added
    • Azure.Identity 1.14.2 -> 1.17.1
    • Microsoft.Identity.Client 4.80.0 - Added
    • Microsoft.IdentityModel.JsonWebTokens 7.5.0 -> 7.7.1
    • Microsoft.IdentityModel.Protocols.OpenIdConnect 7.5.0 -> 7.7.1
    • Microsoft.Bcl.Cryptography - Removed
    • System.Text.Json - Removed

  • .NET 9.0:

    • Azure.Core 1.50.0 - Added
    • Azure.Identity 1.14.2 -> 1.17.1
    • Microsoft.Extensions.Caching.Memory 9.0.4 -> 9.0.11
    • Microsoft.Identity.Client 4.80.0 - Added
    • Microsoft.IdentityModel.JsonWebTokens 7.5.0 -> 7.7.1
    • Microsoft.IdentityModel.Protocols.OpenIdConnect 7.5.0 -> 7.7.1
    • Microsoft.Bcl.Cryptography - Removed
    • System.Text.Json - Removed

This update brings the below changes over the previous stable release:

Added

App Context Switch for Ignoring Server-Provided Failover Partner

What Changed:

• A new app context switch Switch.Microsoft.Data.SqlClient.IgnoreServerProvidedFailoverPartner was introduced to let the client ignore server-provided failover partner info in Basic Availability Groups (BAGs). When the switch is enabled, only the failover partner specified in the connection string is used; server-supplied partner values are skipped. This context switch was introduced in PR #3703.

Who Benefits:

• Applications connecting to SQL Server BAGs using TCP and custom ports, especially where the server's provided partner name lacks the protocol, host, or port. This avoids connection failures when the server-provided partner is incompatible or incomplete.
• Teams who manage availability groups and rely on client-side control of failover behavior in heterogeneous networking environments.

Impact:

• If your environment might be affected (i.e., you operate a BAG with custom ports, or have experienced failures after failover), you can enable the new switch in your application:

AppContext.SetSwitch("Switch.Microsoft.Data.SqlClient.IgnoreServerProvidedFailoverPartner", true);

• Then, ensure your connection string includes your preferred failover partner (with correct tcp:host,port) so that the client uses that instead of the server's suggestion.
• Without enabling this, by default, the client continues to prefer the server-provided partner, maintaining backwards compatibility.

This update brings the below changes over the previous stable release:

Fixed

• Fixed an issue where a Custom SqlClientAuthenticationProvider was being overwritten by default implementation. #3652
• Fixed a concurrency issue in connection pooling where the number of active connections could be lower than the configured maximum pool size. #3654

Changed

• Updated MSAL usage as per code compliance requirements #3360
• Updated SqlDecimal implementation to improve code compliance #3466
• Updated Azure.Identity and related dependencies #3553

This update brings the below changes over the previous release:

Fixed

• Fixed possible NullPointerException during socket receive #3283
• Fixed reference assembly definitions for SqlJson APIs #3169
• Fixed an error reading the output parameter of type JSON while executing stored procedure #3173

Changed

• Updated the below dependencies:
  • Updated Microsoft.Bcl.Cryptography from 9.0.0 to 9.0.4 for .NET 9 targeted dll. #3281
  • Updated Microsoft.Extensions.Caching.Memory from 9.0.0 to 9.0.4 for .NET 9 targeted dll. #3281
  • Updated System.Configuration.ConfigurationManager from 9.0.0 to 9.0.4 for .NET 9 targeted dll. #3281
  • Updated System.Security.Cryptography.Pkcs from 9.0.0 to 9.0.4 for .NET 9 targeted dll. #3281

This update brings the below changes over the previous release:

Fixed

• Fixed reference assembly definitions for SqlClientDiagnostic APIs #3097
• Fixed issue with down-level SSL/TLS version warnings #3126

Changed

• Dependency changes
  • Updated SNI dependency Microsoft.Data.SqlClient.SNI and Microsoft.Data.SqlClient.SNI.runtime to 6.0.2 #3116 #3117

No changes since the last preview release

This update brings the following changes since the 5.2.2 release:

Fixed

• Fixed possible NullPointerException during socket receive (PR #3284)
• Fixed inconsistencies between source and reference projects (PR #3124)
• Adjusted retry logic to allow errors with negative numbers to be considered transient (PR #3185)

Changed

• Updated the following dependencies:
  • System.Private.Uri 4.3.2 - Avoid transitive CVE-2019-0820 (PR #3076)
  • Microsoft.Extensions.Caching.Memory 6.0.1 to 6.0.3 - Avoid CVE-2024-43483 (PR #3280)

Fixed

• Fixed AcquireTokenAsync timeout handling for edge cases in ActiveDirectoryAuthenticationProvider. #2650
• Fixed issue with Socket.Connect in managed SNI. #2779
• Fixed path for AssemblyAttributes in obj folder causing NET 8.0 assembly to appear in NET 6.0 dll. #2789
• Fixed SSPI retry negotiation with default port in .NET. #2815
• Fixed ArgumentNullException on SqlDataRecord.GetValue when using user-defined data type on .NET. #2816
• Fixed pending data with SqlDataReader against an encrypted column. #2817

Changed

• Upgraded Azure.Identity version from 1.11.3 to 1.11.4 #2648 to address CVE-2024-35255.
• Upgraded Microsoft.Identity.Client version from 4.60.0 to 4.61.3 #2648 to address CVE-2024-35255.
• Added caching to TokenCredential objects to take advantage of token caching. #2775

This update brings the below changes over the previous release:

Fixed

• Fixed connection errors on Linux when Data Source property contains both named instance and port #2436
• Fixed SqlConnection.FireInfoMessageEventOnUserErrors when set to true throws an exception #2505
• Fixed exception when using DATETIMEOFFSET(n) in a TVP if n is 1, 2, 3, or 4 #2506
• Reverted PR #1983 which caused connection failure delays when using OpenAsync #2507
• Fixed SqlConnection.Clone() to include AccessTokenCallback #2527

Changed

• Upgraded Azure.Identity version from 1.10.3 to 1.11.3 #2492, #2528
• Upgraded Microsoft.Identity.Client version from 4.56.0 to 4.60.3 #2492
• Code Health improvements: #2467

Added

• Added a new AccessTokenCallBack API to SqlConnection. #1260
• Added SqlBatch support on .NET 6+ #1825, #2223,#2371, #2373
• Added support of SqlDiagnosticListener on .NET Standard. #1931
• Added new property RowsCopied64 to SqlBulkCopy. #2004
• Added support for the SuperSocketNetLib registry option for Encrypt on .NET on Windows. #2047
• Added the ability to generate debugging symbols in a separate package file #2137
• Added Workload Identity authentication support #2159, #2264
• Added support for Big Endian systems #2170
• Added support for Georgian collation #2194
• Added Localization support on .NET #2210
• Added .NET 8 support #2230
• Added explicit version for major .NET version dependencies on System.Runtime.Caching 8.0.0, System.Configuration.ConfigurationManager 8.0.0, and System.Diagnostics.
• DiagnosticSource 8.0.0 #2303

Fixed

• Fixed Always Encrypted secure enclave retry logic for async queries. #1988
• Fixed activity correlator to continue use of same GUID for connection activity. #1997
• Fixed behavior when error class is greater than 20 on connection retry. #1953
• Fixed error message when symmetric key decryption failed using Always Encrypted. #1948
• Fixed TransactionScope connection issue when Enlist is enable, Pooling is disabled and network connection type is Redirect. #1960
• Fixed TDS RPC error on large queries in SqlCommand.ExecuteReaderAsync. #1936
• Fixed throttling of token requests by calling AcquireTokenSilent. #1925
• Fixed Linux code coverage result in Build proj. #1950
• Fixed NullReferenceException in GetBytesAsync. #1906
• Fixed Transient fault handling issue with OpenAsync. #1983
• Fixed invariant mode checks. #1917
• Fixed GC behavior in TdsParser by adding array rental capability in TryReadPlpUnicodeChars. #1866
• Fixed socket synchronization issue during connect in managed SNI. #1029
• Fixed issue with SqlConnectionStringBuilder property indexer not supporting non-string values. #2018
• Fixed SqlDataAdapter.Fill and configurable retry logic issue on .NET Framework. #2084
• Fixed SqlConnectionEncryptOption type conversion by introducing the SqlConnectionEncryptOptionConverter attribute when using appsettings.json files. #2057
• Fixed th-TH culture info issue on Managed SNI. #2066
• Fixed an issue when using the Authentication option, but not encrypting on .NET Framework where the server certificate was being incorrectly validated #2224
• Fixed a deadlock problem for distributed transactions when on .NET #2161
• Fixed an issue with connecting to named instances on named pipes in managed SNI (Linux/macOS) #2142
• Fixed LocalDb connection issue with an invalid source when using managed SNI #2129
• Fixed an AccessViolationException when using a SQL Express user instance #2101
• Fixed a metadata query issue when connecting to Azure SQL Edge #2099
• Fixed file version information for .NET and .NET Standard binaries #2093
• Fixed the SPN sent for a named instance when using Kerberos authentication on Linux/macOS #2240
• Fixed connection to unsubscribe from transaction completion events before returning it to the connection pool #2301
• Fixed InvalidCastException when reading an Always Encrypted date or time column #2275
• Fixed token caching to prevent expired access tokens from being reused in a connection pool #2273

Changed

• Improved parsing buffered characters in TdsParser. #1544
• Added Microsoft.SqlServer.Types to verify support for SqlHierarchyId and Spatial for .NET Core. #1848
• Moved to new System.Data.SqlTypes APIs on .NET 7 and up. #1934 and #1981
• Removed reference to Microsoft.Win32.Registry since it's shipped starting with .NET 6.0. #1974
• Changed UseOneSecFloorInTimeoutCalculationDuringLogin App Context switch default to true and extended its effect to .NET and .NET Standard. #2012
• Updated Microsoft.Identity.Client version from 4.47.2 to 4.53.0. #2031, #2055
• Switched to the new .NET NegotiateAuthentication API on .NET 7.0 and above for SSPI token negotiation using Managed SNI. #2063
• Removed ignoreSniOpenTimeout in open connection process on Windows. #2067
• Enforce explicit ordinal for internal StringComparison operations. #2068
• Improved error messages when validating server certificates in managed SNI (Linux/macOS) #2060
• Improved CPU usage when AppContext switches are in use #2227
• Upgraded Azure.Identity dependency version to 1.10.3 to address CVE-2023-36414, #2189
• Changed Microsoft.IdentityModel.JsonWebTokens and Microsoft.IdentityModel.Protocols.OpenIdConnect version 6.24.0 to 6.35.0 #2290 to address CVE-2024-21319
• Updated Microsoft.Data.SqlClient.SNI (.NET Framework dependency) and Microsoft.Data.SqlClient.SNI.runtime (.NET/.NET Standard dependency) version to v5.2.0. #2363, which includes removing dead code and addressing static analysis warnings
• Code health improvements: #1198, #1829, #1943, #1949, #1959, #1985, #2071, #2073, #2088, #2091, #2098, #2121, #2122, #2132, #2136, #2144, #2147, #2157, #2164, #2166, #2168, #2186, #2254, #2288, #2305, #2317

This update brings the following changes since the 5.1.8 release:

Changed

• Use Environment.TickCount for SqlStatistics execution timing. (#3831)
• Updated dependencies (#3838):
  • .NET Standard 2.0:
    • Microsoft.Win32.Registry - Removed
    • System.Buffers 4.5.1 -> 4.6.1
    • System.IdentityModel.Tokens.Jwt 6.35.0 - Added
    • System.Text.Encodings.Web - Removed
  • .NET Standard 2.1:
    • Microsoft.Win32.Registry - Removed
    • System.IdentityModel.Tokens.Jwt 6.35.0 - Added
    • System.Text.Encodings.Web - Removed
  • .NET Framework 4.6.2:
    • System.Buffers 4.5.1 -> 4.6.1
    • System.IdentityModel.Tokens.Jwt 6.35.0 - Added
    • System.Text.Encodings.Web - Removed
    • System.Text.Json - Removed
  • .NET 6.0:
    • System.Diagnostics.DiagnosticSource - Removed
    • System.IdentityModel.Tokens.Jwt 6.35.0 - Added
    • System.Text.Encodings.Web - Removed

This update brings the following changes since the 5.1.7 release:

Added

App Context Switch for Ignoring Server-Provided Failover Partner

What Changed:

• A new app context switch Switch.Microsoft.Data.SqlClient.IgnoreServerProvidedFailoverPartner was introduced to let the client ignore server-provided failover partner info in Basic Availability Groups (BAGs). When the switch is enabled, only the failover partner specified in the connection string is used; server-supplied partner values are skipped. This context switch was introduced in PR #3704.

Who Benefits:

• Applications connecting to SQL Server BAGs using TCP and custom ports, especially where the server's provided partner name lacks the protocol, host, or port. This avoids connection failures when the server-provided partner is incompatible or incomplete.
• Teams who manage availability groups and rely on client-side control of failover behavior in heterogeneous networking environments.

Impact:

• If your environment might be affected (i.e., you operate a BAG with custom ports, or have experienced failures after failover), you can enable the new switch in your application:

AppContext.SetSwitch("Switch.Microsoft.Data.SqlClient.IgnoreServerProvidedFailoverPartner", true);

• Then, ensure your connection string includes your preferred failover partner (with correct tcp:host,port) so that the client uses that instead of the server's suggestion.
• Without enabling this, by default, the client continues to prefer the server-provided partner, maintaining backwards compatibility.

Fixed

• Fixed a bulk copy bug that incorrectly prepended a UTF-8 Byte-Order-Marker when processing row data. (#3617)

Changed

• Modernized creation of Microsoft.Identity.Client.PublicClientApplication instances to use its builder pattern. (#3367)
• Replaced use of undocumented .NET Framework internals when reading SqlDecimal values. (#3465)
• Updated the following dependencies (#3754):
  • Azure.Core 1.41.0 (Avoids transitive vulnerability)
  • Azure.Identity 1.12.1
  • Microsoft.Identity.Client 4.76.0

This update brings the following changes since the 5.1.6 release:

Fixed

• Fixed possible NullPointerException during socket receive (PR #3285)
• Fixed inconsistencies between source and reference projects (PR #3180)

Changed

• Updated the following dependencies:
  • Microsoft.Data.SqlClient.SNI 5.1.1 to 5.1.2 for .NET Framework on Windows (PR #3294)
  • Microsoft.Data.SqlClient.SNI.runtime 5.1.1 to 5.1.2 for .NET on Windows (PR #3294)
  • Microsoft.Extensions.Caching.Memory 6.0.1 to 6.0.3 - Avoid CVE-2024-43483 (PR #3068)
  • Microsoft.Extensions.Hosting 6.0.0 to 6.0.1 - Avoid transitive dependency on vulnerable System.Text.Json 6.0.0 (PR #3207)
  • System.Private.Uri 4.3.2 - Avoid transitive CVE-2019-0820 (PR #3077)
  • System.Text.Encodings.Web 6.0.0 to 6.0.1 - Avoid transitive downgrade for .NET Framework targets (PR #3279)
  • System.Text.Json 6.0.11 - Avoid transitive dependencies on older vulnerable versions for .NET Framework targets (PR #3279)

Fixed

• Fixed Transient fault handling issue with OpenAsync. #1983 #2508
• Fixed AcquireTokenAsync timeout handling for edge cases in ActiveDirectoryAuthenticationProvider. #2706
• Fixed pending data with SqlDataReader against an encrypted column. #2618 #2818

Changed

• Upgraded Azure.Identity version from 1.11.3 to 1.11.4 [#2649] (https://github.com/dotnet/SqlClient/pull/2649) [#2529] (https://github.com/dotnet/SqlClient/pull/2529) to address CVE-2024-35255.
• Upgraded Microsoft.Identity.Client version from 4.60.0 to 4.61.3 [#2649] (https://github.com/dotnet/SqlClient/pull/2649) [#2529] (https://github.com/dotnet/SqlClient/pull/2529) to address CVE-2024-35255.
• Added caching to TokenCredential objects to take advantage of token caching. #2776
• Code health improvements: [#2490] (https://github.com/dotnet/SqlClient/pull/2490)

This update brings the below changes over the previous release:

Fixed

• Fixed connection to unsubscribe from transaction completion events before returning it to the connection pool #2321
• Fixed InvalidCastException when reading an Always Encrypted date or time column #2324

Changed

• Changed Microsoft.IdentityModel.JsonWebTokens and Microsoft.IdentityModel.Protocols.OpenIdConnect version 6.24.0 to 6.35.0 #2320 to address CVE-2024-21319

This update brings the below changes over the previous release:

Fixed

• Fixed a deadlock problem for distributed transactions when on .NET.

Changed

• Upgraded Azure.Identity dependency version to 1.10.3 to address CVE-2023-36414.

This update brings the below changes over the previous release:

Fixed

• Fixed encryption downgrade issue. CVE-2024-0056
• Fixed certificate chain validation logic flow.

This update brings the below changes over the previous release:

Fixed

• Fixed access violation when using SQL Express user instance. #2101
• Fixed Always Encrypted secure enclave retry logic for async queries. #1988
• Fixed LocalDb and managed SNI by improving the error messages and avoid falling back to the local service. #2129
• Fixed .NET and .NET Standard file version. 2093
• Fixed non-string values and SqlConnectionStringBuilder property indexer issue. #2018
• Fixed SqlConnectionEncryptOption type conversion by introducing the SqlConnectionEncryptOptionConverter attribute when using appsettings.json files. #2057
• Fixed Transient fault handling issue with OpenAsync. #1983
• Fixed activity correlator to continue use of same GUID for connection activity. #1997

Changed

• Updated Microsoft.Data.SqlClient.SNI (.NET Framework dependency) and Microsoft.Data.SqlClient.SNI.runtime (.NET Core/Standard dependency) version to 5.1.1. #2123

This update brings the below changes over the previous release:

Fixed

• Fixed an incorrect exception when a symmetric key fails to decrypt a column using Always Encrypted. #1968
• Fixed TransactionScope connection issue when Enlist is enabled, Pooling is disabled, and Network Connection Type is set to Redirect. #1967
• Fixed throttling of token requests by calling AcquireTokenSilent. #1966
• Fixed TDS RPC error on large queries in SqlCommand.ExecuteReaderAsync. #1965
• Fixed NullReferenceException in GetBytesAsync. #1964

This update brings the below changes over the previous release:

Fixed

• Fixed thread safety of transient error list in configurable retry logic. #1882
• Fixed deadlock when using SinglePhaseCommit with distributed transactions. #1801
• Fixed Dedicated Admin Connections (DAC) to localhost in managed SNI. #1865

Changed

• Updated Microsoft.Data.SqlClient.SNI (.NET Framework dependency) and Microsoft.Data.SqlClient.SNI.runtime (.NET Core/Standard dependency) version to 5.1.0. #1889 which includes fix for AppDomain crash in issue #1418, TLS 1.3 Support, removal of ARM32 binaries, and support for the ServerCertificate option.
• Code health improvements #1867 #1849

Fixed

• Fixed memory leak regression from #1785 using a DisposableTemporaryOnStack struct. #1980
• Fixed TransactionScope connection issue when Enlist is enabled, Pooling is disabled, and Network Connection Type is set to Redirect. #1978
• Fixed an incorrect exception when a symmetric key fails to decrypt a column using Always Encrypted. #1977
• Fixed TDS RPC error on large queries in SqlCommand.ExecuteReaderAsync. #1976
• Fixed deadlock when using SinglePhaseCommit with distributed transactions. #1975

Fixed

• Fixed missing HostNameInCertificate connection string property in .NET Framework. #1782
• Fixed async deadlock issue when sending attention fails due to network failure. #1783
• Fixed Null Reference Exception on assigning null to SqlConnectionStringBuilder.Encrypt. #1784
• Fixed ReadAsync() behavior to register Cancellation token action before streaming results. #1785
• Fixed hang on infinite timeout and managed SNI. #1798
• Fixed Default UTF8 collation conflict. #1799

Changed

• Updated Microsoft.Data.SqlClient.SNI (.NET Framework dependency) and Microsoft.Data.SqlClient.SNI.runtime (.NET Core/Standard dependency) version to 5.0.1 #1795, which includes the fix for AppDomain crash introducing in issue #1418.

This update brings the below changes over the previous release:

Added

• Added support for TDS 8. To use TDS 8, users should specify Encrypt=Strict in the connection string. #1608
• Added TDS 8 version for TDSLogin. #1657

Fixed

• Fixed null SqlBinary as rowversion. #1688
• Fixed KeyNotFoundException for the FailoverPartner key on SQL servers with availability group configured. #1614
• Fixed small inconsistency between netcore and netfx for EncryptionOptions. #1672
• Fixed Microsoft.SqlServer.Server netcore project package reference. #1654

Changed

• Updated AuthProviderInfo struct to be matched the changes in native SNI for TDS 8 server certificate validation. #1680
• Updated default system protocol for TDS 8 on managed code. #1678
• Updated Microsoft.Data.SqlClient.SNI (.NET Framework dependency) and Microsoft.Data.SqlClient.SNI.runtime (.NET Core/Standard dependency) version to 5.0.0. #1680
• Updated IdentityModel dependency from 6.8.0 to 6.21.0 and IdentityClient from 4.32.2 to 4.45.0. #1646
• Changed from union overlay design to reflected interfaces for SqlTypes. 1647

Fixed

• Fixed connection failure by not requiring Certificate Revocation List (CRL) check during authentication. #1706
• Parallelize SSRP requests on Linux and macOS when MultiSubNetFailover is specified. #1708, #1746
• Added CommandText length validation when using stored procedure command types. #1709
• Fixed NullReferenceException during Azure Active Directory authentication. #1710
• Fixed null SqlBinary as rowversion. #1712
• Fixed table's collation overriding with default UTF8 collation. #1749

Added

• Added new Attestation Protocol None for VBS enclave types. This protocol will allow users to forgo enclave attestation for VBS enclaves. #1419 #1425

Fixed

• Fixed connection to unsubscribe from transaction completion events before returning it to the connection pool #2301 #2435
• Fixed AcquireTokenAsync timeout handling for edge cases in ActiveDirectoryAuthenticationProvider #2707

Changed

• Code health improvements: #2147, #2513, #2519

Fixed

• Fixed encryption downgrade issue. CVE-2024-0056
• Fixed certificate chain validation logic flow.

Fixed

• Fixed Always Encrypted secure enclave retry logic for async queries. #1988
• Fixed LocalDb and managed SNI by improving the error messages and avoid falling back to the local service. #2129
• Fixed .NET and .NET Standard file version. 2093
• Fixed activity correlator to continue use of same GUID for connection activity. #1997

Fixed

• Fixed throttling of token requests by calling AcquireTokenSilent in AAD Integrated/Password flows when the account is already cached.#1995
• Fixed TDS RPC error on large queries in SqlCommand.ExecuteReaderAsync.#1987

Fixed

• Fixed connection failure by not requiring Certificate Revocation List (CRL) check during authentication. #1718
• Parallelize SSRP requests on Linux and macOS when MultiSubNetFailover is specified. #1720, #1747
• Added CommandText length validation when using stored procedure command types. #1721
• Fixed NullReferenceException during Azure Active Directory authentication. #1722
• Fixed null SqlBinary as rowversion. #1724
• Fixed table's collation overriding with default UTF8 collation. #1750

Added

Added AppContext switch SuppressInsecureTLSWarning to allow suppression of TLS security warning when using Encrypt=false in the connection string. #1457

Fixed

• Fixed Kerberos authentication failure when using .NET 6. #1411
• Fixed connection failure when using SqlLocalDB instance pipe name. #1433
• Fixed a failure when executing concurrent queries requiring enclaves. #1451
• Updated obsolete API calls targeting .NET 6. #1401

Added

• Added missing SqlClientLogger class to .NET Core refs and missing SqlClientLogger.LogWarning method in .NET Framework refs #1392

Changed

• Avoid throwing unnecessary exception when an invalid SqlNotificationInfo value is received from SQL Server #1378
• Updated Microsoft.Data.SqlClient.SNI (.NET Framework dependency) and Microsoft.Data.SqlClient.SNI.runtime (.NET Core/Standard dependency) version to v4.0.0 #1391

Fixed

• Fixed connection to unsubscribe from transaction completion events before returning it to the connection pool. #2301 #2434
• Fixed AcquireTokenAsync timeout handling for edge cases in ActiveDirectoryAuthenticationProvider. #2709
• Fixed the signing issue with Microsoft.Data.SqlClient assembly. #2789

Changed

• Updated Microsoft.Data.SqlClient.SNI version 3.0.1 to 3.0.2 #2676 which includes the fix for AppDomain crashing in issue #1418 and various code refactors.
• Code health improvements: #2147, #2515, #2517 addresses CVE-2019-0545, #2539

Fixed

• Fixed encryption downgrade issue. CVE-2024-0056
• Fixed certificate chain validation logic flow.

Fixed

• Fixed Always Encrypted secure enclave retry logic for async queries. #1988
• Fixed LocalDb and managed SNI by improving the error messages and avoid falling back to the local service. #2129
• Fixed .NET and .NET Standard file version. 2093
• Fixed activity correlator to continue use of same GUID for connection activity. #1997
• Fixed FormatException when event source tracing is enabled. #1291

Fixed

• Fixed throttling of token requests by calling AcquireTokenSilent in AAD Integrated/Password flows when the account is already cached.#1926
• Fixed TDS RPC error on large queries in SqlCommand.ExecuteReaderAsync.#1939

Added

• Added Windows ARM64 support when targeting .NET Framework. #1908

Fixed

• Fixed thread safety of transient error list in configurable retry logic. #1911
• Fixed deadlock when using SinglePhaseCommit with distributed transactions. #1912
• Fixed Default UTF8 collation conflict. #1910
• Added CommandText length validation when using stored procedure command types. #1909

Fixed

• Fixed null SqlBinary as rowversion. #1700
• Fixed Kerberos authentication failure when using .NET 6. #1696
• Fixed NullReferenceException during Azure Active Directory authentication. #1695
• Removed union overlay design and use reflection in SqlTypeWorkarounds. #1699

Added

• Added new Attestation Protocol None for VBS enclave types. This protocol will allow users to forgo enclave attestation for VBS enclaves. #1539
• Included 42108 and 42109 error codes to retriable transient errors list. #1560

Fixed

• Changed EnclaveDelegate.Crypto GetEnclaveProvider to use a thread safe concurrent dictionary. [#1564](https://github.com/dotnet/SqlClient/pull/1564

Fixed

• Fixed async thread blocking issues on SqlConnection.Open() for active directory authentication modes. #1270
• Fixed unknown transaction state issues when prompting delegated transaction. 1247
• Fixed issue with connection encryption to ensure connections fail when encryption is required. #1233
• Fixed bug with LegacyRowVersionNullBehavior App Context switch. #1246
• Fixed recursive calls to RetryLogicProvider when calling SqlCommand.ExecuteScalarAsync. #1245
• Fixed async deadlock scenarios in web contexts with configurable retry logic provider. #1245
• Fixed deadlock in transaction using .NET Framework. #1243
• Fixed issue where connection goes to unusable state. #1238

Added

• Added support for column encryption key caching when the server supports retrying queries that require enclave computations #1062
• Added support for configurable retry logic configuration file in .NET Standard #1090

Changed

• Updated Microsoft.Data.SqlClient.SNI (.NET Framework dependency) and Microsoft.Data.SqlClient.SNI.runtime (.NET Core/Standard dependency) version to v3.0.0 #1102
• Improved event counter display information #1091

Breaking Changes

• Modified column encryption key store provider registrations to give built-in system providers precedence over providers registered on connection and command instances. #1101

Fixed

• Fixed encryption downgrade issue. CVE-2024-0056
• Fixed certificate chain validation logic flow.

Fixed

• Fixed TDS RPC error on large queries in SqlCommand.ExecuteReaderAsync.#1986
• Fixed Default UTF8 collation conflict. #1989
• Fixed async deadlock issue when sending attention fails due to network failure. #1767

Fixed

• Added CommandText length validation when using stored procedure command types. #1726
• Fixed Kerberos authentication failure when using .NET 6. #1727
• Removed union overlay design and use reflection in SqlTypeWorkarounds. #1729

Fixed

• Fixed issue with connection encryption to ensure connections fail when encryption is required. #1232
• Fixed issue where connection goes to unusable state. #1239