Preview Release v8.0.0-preview1

This first 8.0 preview includes changes since the release/7.1 branch point, 92f220956b07328054701a869f452cade51830c1 (2026-09-15), through b87ca6e7643611ddc3273324de346d09e8ff2c43. Changes already shipped in 7.1.1 are identified below because the branch-cut baseline predates that release.

The driver and its four companion packages use package version 8.0.0-preview1. The family AssemblyVersion changes from 7.0.0.0 to 8.0.0.0; .NET Framework applications should review strong-name binding redirects when upgrading. Native SNI and Microsoft.SqlServer.Server remain independently versioned.

Companion package release notes

• Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider 8.0.0-preview1
• Microsoft.Data.SqlClient.Extensions.Azure 8.0.0-preview1
• Microsoft.Data.SqlClient.Extensions.Abstractions 8.0.0-preview1
• Microsoft.Data.SqlClient.Internal.Logging 8.0.0-preview1

Added

Vector float16 support and per-connection version negotiation

What Changed:

• Added support for SQL Server vector(N, float16), including reader values, parameters, output parameters, column schema, and bulk copy. On modern .NET, use SqlVector<Half>; the existing SqlVector<float> API remains supported. (#4501)
• Added the Vector Type Support connection-string keyword and SqlConnectionStringBuilder.VectorTypeSupport, of type SqlVectorTypeSupport. Values are Off, V1, and V2; the default is V2.

Who Benefits:

• Applications storing embeddings can use float16 vectors with smaller element payloads, while choosing the result-type contract independently for each connection.

Impact:

• Result-type change: when the server negotiates V2, modern .NET returns native SqlVector<Half> values for float16 columns instead of JSON strings. Set Vector Type Support=v1 to preserve float16 JSON-string results, or off to receive all vector columns as text. Different settings use separate connection pools.
• .NET Framework has no System.Half. Float16 columns remain available as JSON strings or through GetSqlVector<float>, which widens their elements exactly. Prefer the latter when reading many values, to avoid the additional JSON serialization.
• GetColumnSchema() exposes VectorBaseType and VectorDimensions through the column indexer when native vector metadata is negotiated.
• SQL Server performs cross-base conversion for native vector parameters and bulk-copy inputs. Typed vectors are not automatically serialized for text destinations; supply JSON strings or an explicit SQL cast instead. Vector TVPs are not added by this change.
• Float16 requires a server that supports it; enable PREVIEW_FEATURES while the server feature is in preview. See the float16 sample.

var builder = new SqlConnectionStringBuilder(connectionString)
{
    VectorTypeSupport = SqlVectorTypeSupport.V1
};

Opt-in reset of pooled transaction isolation levels

What Changed:

• Added Switch.Microsoft.Data.SqlClient.EnableTransactionIsolationLevelReset, default false. When enabled, a SqlClient-tracked isolation-level change is reset to READ COMMITTED before pooled reuse when no existing enlistment or active delegated transaction root remains. (#96, #4330)

Who Benefits:

• Applications that otherwise inherit an isolation level left by a previous user of a pooled connection.

Impact:

• Enable the switch before opening connections. A necessary reset adds a round trip and uses the remaining open-timeout budget. Known Azure Synapse dedicated SQL pool endpoints are excluded; the default preserves existing behavior.
• A user-issued SET TRANSACTION ISOLATION LEVEL alone does not mark the connection for this reset. The switch is not general cleanup for arbitrary T-SQL session changes.

Additional TimeOnly write paths (net10.0 only)

What Changed:

• Added TimeOnly support for SqlBulkCopy DataRow/DataTable sources and SqlParameter values with SqlDbType.Variant, writing SQL time values. (#4604)

Who Benefits:

• Applications using modern .NET time-only values in bulk-copy and variant workflows.

Impact:

• These paths no longer require conversion to TimeSpan. This does not add TimeOnly to .NET Framework.

Authentication diagnostics

What Changed:

• The Azure extension forwards MSAL, allowlisted Azure.Identity, and SqlClient token acquisition events to Microsoft.Data.SqlClient.EventSource using the new AuthenticationTrace keyword (0x2000). (#1846, #4872)

Who Benefits:

• Support teams can diagnose built-in Entra ID authentication without implementing a custom provider or logging callback.

Impact:

• Collect authentication events with 0x2000, or authentication plus ordinary trace with 0x2002. On modern .NET:

  dotnet-trace collect --process-id <pid> --providers Microsoft.Data.SqlClient.EventSource:0x2000:5 --rundown false
  

• On .NET Framework, use ETW or an in-process EventListener. PII logging remains disabled for extension-owned requests. Correlation is best effort; some Azure.Identity events have an empty connection ID and can originate from application-owned credentials. Treat captures as sensitive operational data.

• See the Azure extension notes for limitations and the logging sample.

Changed

Breaking change: minimum modern runtime is .NET 10

What Changed:

• Replaced the net8.0 and net9.0 driver implementation targets with net10.0. .NET Framework 4.6.2 support is retained. (#4779)

Who Benefits:

• Applications moving to the .NET 10 runtime and dependency servicing band.

Impact:

• Upgrade modern applications to .NET 10, or remain on a compatible earlier driver. Retained netstandard2.0 reference/unsupported-platform assets do not extend driver runtime support to .NET 8 or .NET 9.

Breaking change: TCP MultiSubnetFailover is enabled by default

What Changed:

• When omitted from the connection string, MultiSubnetFailover now defaults to true for TCP connections. TransparentNetworkIPResolution defaults to false on .NET Framework. (#4876, #4927)

Who Benefits:

• Applications connecting to multi-address hosts try resolved IP addresses in parallel, without needing an explicit opt-in.

Impact:

• Explicit values remain authoritative. The automatic default is disabled for non-TCP protocols, LocalDB, database mirroring partners, admin:/via:, and unprefixed local servers using native SNI. Explicit true still fails with unsupported protocols or failover partners. MSF retains its 64-address limit.
• With native SNI on Windows, an unprefixed remote host now uses TCP only, without Named Pipes fallback. Use np: or MultiSubnetFailover=false when needed.
• With MSF enabled, IPAddressPreference and TNIR are ignored. The builder reports the keyword default, not the routing decision for a particular connection.
• Restore the old MSF default with Switch.Microsoft.Data.SqlClient.EnableMultiSubnetFailoverByDefault=false. On .NET Framework, also set Switch.Microsoft.Data.SqlClient.DisableTNIRByDefaultInConnectionString=false to restore the previous TNIR default. Set switches before using SqlClient. See networking migration guidance.

Breaking change: Azure Attestation requires the Azure extension

What Changed:

• Moved Azure Attestation token validation and the IdentityModel dependencies from the core driver to Microsoft.Data.SqlClient.Extensions.Azure. (#4017, #4790)

Who Benefits:

• Applications not using Azure Attestation no longer receive these dependencies from core.

Impact:

• Applications using Attestation Protocol=AAS must explicitly reference the matching Azure extension. Without it, enclave session setup throws InvalidOperationException.
• The Azure extension now depends on Azure.Core rather than Azure.Identity. Credential namespaces are unchanged. Remove direct Azure.Identity references older than 1.21.0, or upgrade to 1.21.0 or later; Azure.Identity.Broker users need 1.6.0 or later. (#4749)

Breaking changes: reference API and argument validation corrections

What Changed:

• Reference APIs now match implementation accessibility and sealing, and no longer expose the nonexistent SqlBatchCommand.CanCreateParameter setter on .NET Framework. ([#4832](https://github.c...

Stable Release v6.1.8

This update brings the following changes since the 6.1.7 release:

Changed

• Updated the System.Security.Cryptography.Pkcs dependency to 8.0.2 (was 8.0.1) for .NET Framework 4.6.2, .NET 8.0, and .NET Standard 2.0, and updated the Microsoft.Extensions.Caching.Memory, System.Configuration.ConfigurationManager, and System.Security.Cryptography.Pkcs dependencies to 9.0.21 (was 9.0.11) for .NET 9.0.
  (#4842, #4862, #4870)

• Improved the error reported when Active Directory Interactive authentication through the Windows Web Account Manager (WAM) broker fails because the host has no parent window, such as a service or Azure Functions host. The resulting error now explains the supported alternatives: supply a parent window with SetParentActivityOrWindowFunc, use Active Directory Default with a configured non-interactive credential, or supply a custom ApplicationClientId with UseWamBroker disabled. The original MSAL error code and inner exception are preserved, and authentication selection, retry behavior, and other failures are unchanged. (Windows only)
  (#4854, #4858, #4918)

Fixed

• Fixed the managed SNI path ignoring HostNameInCertificate during server certificate validation. When HostNameInCertificate is set, it is now the only host name the server certificate is validated against, and certificates that do not match it are rejected. Default host-name selection when the property is not set, certificate chain validation, ServerCertificate matching, and the connection destination are unchanged. (net8.0/net9.0 only)
  (#4905, #4909)

• Fixed Always Encrypted enclave session caching so that cached enclave sessions are isolated by attestation protocol. A session established with one Attestation Protocol setting is no longer reused by a connection to the same server, database, and attestation URL that uses a different protocol.
  (#4829, #4868)

• Fixed SqlDataReader.HasRows returning false when a result set contains rows but the server sends multiple informational messages, or an informational message before an ORDER token, ahead of the first row. Empty results still report false, and InfoMessage delivery is unchanged.
  (#3018, #4773, #4898)

• Fixed an intermittent InvalidOperationException ("Nullable object must have a value") from statistics bookkeeping when commands complete concurrently on a MARS connection. This issue was reported as a regression starting with 6.1.4.
  (#4778, #4875, #4896)

• Fixed Entra ID authentication when the server supplies an authority URL with an OAuth endpoint suffix, such as https://login.microsoftonline.com/<tenant>/oauth2/authorize returned by the Dataverse/Dynamics 365 TDS endpoint. The provider now extracts the tenant from the first path segment and uses the normalized authority for Azure.Identity credentials, MSAL, and their cache keys. An authority URL that cannot be parsed now fails with a clear, localized ArgumentException naming the authority. Bare tenant authority URLs used by Azure SQL and Fabric retain their existing behavior.
  (#4496, #4521, #4791, #4807)

Target Platform Support

• .NET Framework 4.6.2+ (Windows x86, Windows x64, Windows ARM64)
• .NET 8.0+ (Windows x86, Windows x64, Windows ARM64, Linux, macOS)
• .NET Standard 2.0+ (Windows x86, Windows x64, Windows ARM64, Linux, macOS)

Full details: release-notes/6.1/6.1.8.md

Stable Release v7.1.1

This servicing release fixes decimal parameter validation, token expiry handling in connection pool V2, and connection opens that are in progress when a pool is cleared.

Package version alignment: The SqlClient family packages share the 7.1.1 version:

• Microsoft.Data.SqlClient
• Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider
• Microsoft.Data.SqlClient.Extensions.Azure
• Microsoft.Data.SqlClient.Extensions.Abstractions
• Microsoft.Data.SqlClient.Internal.Logging

Microsoft.SqlServer.Server is versioned independently and is not part of this release. Applications should use matching 7.1.1 versions of the driver and its companion packages. The aligned assemblies retain AssemblyVersion 7.0.0.0; upgrading from 7.1.0 does not require new .NET Framework strong-name binding redirects.

Companion package release notes

• Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider 7.1.1
• Microsoft.Data.SqlClient.Extensions.Azure 7.1.1
• Microsoft.Data.SqlClient.Extensions.Abstractions 7.1.1
• Microsoft.Data.SqlClient.Internal.Logging 7.1.1

Changes Since 7.1.0

Fixed

• Fixed an ArgumentException when sending zero-valued decimal or SqlDecimal parameters whose precision equals their scale. Nonzero precision validation and support for large decimal values are unchanged. (#4715, #4721, #4732)

• Fixed connection pool V2 handing out pooled connections with expired or nearly expired access tokens. The pool now checks token expiry before reuse, matching the default pool's behavior while preserving transaction-affine reuse. This affects only applications that opt in to connection pool V2. (#4734, #4739)

• Fixed connection opens failing when ClearPool or ClearAllPools races with an in-flight open. Requests already admitted to the cleared pool can finish, and connections returned to the retired pool are discarded rather than reused. (#4714, #4718, #4740)

Target Platform Support

• .NET Framework 4.6.2+ (Windows x86, Windows x64, Windows ARM64)
• .NET 8.0+ (Windows x86, Windows x64, Windows ARM, Windows ARM64, Linux, macOS)

Dependencies

.NET 9.0

• Microsoft.Bcl.Cryptography 9.0.18
• Microsoft.Data.SqlClient.Extensions.Abstractions 7.1.1
• Microsoft.Data.SqlClient.Internal.Logging 7.1.1
• Microsoft.Data.SqlClient.SNI.runtime 7.1.0
• Microsoft.Extensions.Caching.Memory 9.0.18
• Microsoft.IdentityModel.JsonWebTokens 8.16.0
• Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 9.0.18
• System.Security.Cryptography.Pkcs 9.0.18
• System.Threading.RateLimiting 9.0.18

.NET 8.0

• Microsoft.Bcl.Cryptography 8.0.0
• Microsoft.Data.SqlClient.Extensions.Abstractions 7.1.1
• Microsoft.Data.SqlClient.Internal.Logging 7.1.1
• Microsoft.Data.SqlClient.SNI.runtime 7.1.0
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.IdentityModel.JsonWebTokens 8.16.0
• Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 8.0.1
• System.Security.Cryptography.Pkcs 8.0.1
• System.Threading.RateLimiting 8.0.0

.NET Standard 2.0

• Microsoft.Bcl.Cryptography 8.0.0
• Microsoft.Bcl.TimeProvider 8.0.1
• Microsoft.Data.SqlClient.Extensions.Abstractions 7.1.1
• Microsoft.Data.SqlClient.Internal.Logging 7.1.1
• Microsoft.Data.SqlClient.SNI.runtime 7.1.0
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.IdentityModel.JsonWebTokens 8.16.0
• Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 8.0.1
• System.Security.Cryptography.Pkcs 8.0.1
• System.Text.Json 10.0.3
• System.Threading.Channels 10.0.3
• System.Threading.RateLimiting 8.0.0

.NET Framework 4.6.2+

• Microsoft.Bcl.Cryptography 8.0.0
• Microsoft.Bcl.TimeProvider 8.0.1
• Microsoft.Data.SqlClient.Extensions.Abstractions 7.1.1
• Microsoft.Data.SqlClient.Internal.Logging 7.1.1
• Microsoft.Data.SqlClient.SNI 7.1.0
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.IdentityModel.JsonWebTokens 8.16.0
• Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
• System.Buffers 4.6.1
• System.Data.Common 4.3.0
• System.Diagnostics.DiagnosticSource 10.0.3
• System.Memory 4.6.3
• System.Runtime.InteropServices.RuntimeInformation 4.3.0
• System.Security.Cryptography.Pkcs 8.0.1
• System.Text.Json 10.0.3
• System.Threading.Channels 10.0.3
• System.Threading.RateLimiting 8.0.0
• System.ValueTuple 4.6.2

Stable Release v7.1.0

This is the general availability release of Microsoft.Data.SqlClient 7.1. It closes out the 7.1 preview cycle with application identity reporting for telemetry, the deprecation of TransparentNetworkIPResolution, and a set of connection, transaction, and Named Pipes fixes.

Important — package version alignment: Starting with the 7.0.2 release, the Microsoft.Data.SqlClient driver and its companion packages share a single aligned version. The 7.1.0 GA release continues this alignment; the following packages ship together as 7.1.0:

• Microsoft.Data.SqlClient
• Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider
• Microsoft.Data.SqlClient.Extensions.Azure
• Microsoft.Data.SqlClient.Extensions.Abstractions
• Microsoft.Data.SqlClient.Internal.Logging

(Microsoft.SqlServer.Server continues to version independently and remains at 1.0.0.)

Applications must reference the same versions of Microsoft.Data.SqlClient and its extensions for best compatibility. In particular, applications that reference Microsoft.Data.SqlClient.Extensions.Azure must upgrade it to 7.1.0 when upgrading Microsoft.Data.SqlClient to 7.1.0.

Compatibility guarantee: All aligned assemblies ship with FileVersion 7.1.0.x and AssemblyVersion 7.0.0.0. The AssemblyVersion is unchanged from 7.0.2, so upgrading from 7.0.2, 7.0.3, or any 7.1 preview to 7.1.0 does not require any new .NET Framework strong-name binding redirects. Applications upgrading from 7.0.0 or 7.0.1 should note that Extensions.Azure, Extensions.Abstractions, and Internal.Logging raised their AssemblyVersion from 1.0.0.0 to 7.0.0.0 in 7.0.2; see those release notes for the one-time .NET Framework impact.

Companion package release notes

• Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider 7.1.0
• Microsoft.Data.SqlClient.Extensions.Azure 7.1.0
• Microsoft.Data.SqlClient.Extensions.Abstractions 7.1.0
• Microsoft.Data.SqlClient.Internal.Logging 7.1.0

Changes Since 7.1.0-preview3

Added

Application Identity in the USERAGENT Payload

What Changed:

• Added a RegisteredApplication enum and a matching SqlConnection.RegisteredApplication property that let a library or tool identify itself to SQL Server through version 2 of the TDS USERAGENT feature extension. The payload also carries a new driver-owned 64-bit Driver Properties flag field; bit 0 reports whether connection pool V2 is enabled for the process. Both fields are emitted as unpadded uppercase hexadecimal. (#3201, #4632)

Who Benefits:

• Middleware and tooling built on top of the driver — Entity Framework Core, Semantic Kernel, SQL Server Management Studio, SqlPackage, Data API Builder, and similar — can be distinguished in server-side telemetry without the driver accepting arbitrary user-supplied user-agent text. This originated as a request from the Entity Framework Core team.
• Service operators gain a more accurate picture of which client stacks are connecting, which helps when diagnosing workload-specific behavior.

Impact:

• Purely additive from the application's perspective: a newly created physical connection whose RegisteredApplication is unset reports Unknown (0). On the wire the field itself is new — USERAGENT payload v1 carried no application identifier, while v2 always emits one.
• Set the property before calling Open or OpenAsync. Assigning it while the connection is connecting or open throws InvalidOperationException.

using var connection = new SqlConnection(connectionString);
connection.RegisteredApplication = RegisteredApplication.EntityFrameworkCore;
await connection.OpenAsync();

• The enum is ushort-backed and marked [CLSCompliant(false)]. Values are partitioned by range: 0x0001–0x7FFF for Microsoft-defined large-scale applications, 0x8000–0xBFFF for small-scale use, and 0xC000–0xFFFF for public/developer use. Applications that are not yet registered can cast an unassigned value from the appropriate range.
• Application identity is client-supplied telemetry and must never be used for authorization or any other security decision.
• The value is not part of the connection pool key. A pooled physical connection reports the application that originally created it, and background Min Pool Size connections report Unknown. Cloned connections preserve the value.

Changed

TransparentNetworkIPResolution Is Now Obsolete

What Changed:

• SqlConnectionStringBuilder.TransparentNetworkIPResolution is now marked [Obsolete]. The obsoletion message directs callers to MultiSubnetFailover and notes that Transparent Network IP Resolution (TNIR) is a .NET Framework-only feature. (#4494, #4576)

Who Benefits:

• Applications still relying on TNIR get a compile-time signal to move to MultiSubnetFailover, which addresses the same "connect quickly across multiple DNS-resolved addresses" goal, works consistently on every supported target framework, and is the documented strategy for Always On availability group listeners.

Impact:

• No runtime behavior change. TNIR still defaults to true on .NET Framework, and MultiSubnetFailover still defaults to false. The property remains .NET Framework-only and is not exposed on modern .NET, where a connection string containing the Transparent Network IP Resolution keyword still throws NotSupportedException. No new AppContext switches were introduced.
• The only visible effect is a new CS0618 build warning for code that references the property. Suppress it, or migrate to MultiSubnetFailover, at your own pace. Flipping the TNIR and MultiSubnetFailover defaults is deferred to a future major version.

Other changes

• Updated Microsoft.Data.SqlClient.SNI and Microsoft.Data.SqlClient.SNI.runtime to v7.1.0 (was v7.1.0-preview3.26226.3). (#4698)
• Unified the exception message raised when conflicting token-based and SSPI authentication properties are set on the same SqlConnection, and documented the complete set of properties that conflict with AccessToken. (#4629)
• Documentation corrections:
  • Rewrote the SqlDataRecord and SqlMetaData documentation, which incorrectly described the SQL CLR-only SqlContext and SqlPipe types, and clarified whether SqlDataRecord instances can be reused. (#1805, #4440)
  • Corrected the LCID 1033 sample comment to use the official Windows locale name English (United States). (#4646)

Fixed

• Fixed a pooled connection being returned to the pool in a broken state after a TransactionScope rollback — for example, when distributed transaction promotion fails on .NET 8+ where implicit distributed transactions are disabled by default. A subsequent Open() succeeded but BeginTransaction() threw InvalidOperationException ("the connection has been broken"). Connection reset now preserves the transaction when the pooled connection is either a delegated transaction root or enlisted in a transaction, instead of only the latter. (#4001, #4557)
• Fixed GetSchema("DataTypes") never reporting the SQL Server 2025 json type against Azure SQL. The row was filtered by a string comparison against a minimum server version of 17.00.000.0, which Azure SQL can never satisfy because it always reports 12.00.xxxx. The decision now uses the json support flag negotiated through the TDS FEATUREEXTACK token, which is accurate on both Azure SQL and on-premises SQL Server 2025+. (#4592, #4682)
• Fixed a malformed UNC pipe path being composed for IPv6 literal server names over Named Pipes in managed SNI (for example Server=np:::1, Server=np:[::1], or Server=\\::1\pipe\sql\query). A UNC path component may not contain a colon, and handing such a path to the OS could trigger an access violation inside LSASS on Windows, forcing a reboot. IPv6 literals are now transcribed to their .ipv6-literal.net form as defined by MS-DTYP 2.2.57, and a colon-bearing host with no valid IPv6 interpretation now fails with the standard invalid-connection-string error. Colon-free host names, LocalDB, localhost, ., and IPv6 over TCP are unaffected. (net8.0/net9.0 only — this is the managed SNI counterpart to the native SNI fix) (#4523, #4558)
• Fixed configurable retry logic installing a permanent, process-wide assem...

Stable Release v7.0.3

This update brings the following changes since the 7.0.2 release:

The core driver and its companion packages ship together as version 7.0.3. Update the companion packages you use alongside the driver to 7.0.3. Assembly versions remain 7.0.0.0, unchanged from 7.0.2.

Companion package release notes

• Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider 7.0.3
• Microsoft.Data.SqlClient.Extensions.Azure 7.0.3 — includes the Entra ID authority parsing fix for Dataverse/Dynamics 365 connections.
• Microsoft.Data.SqlClient.Extensions.Abstractions 7.0.3
• Microsoft.Data.SqlClient.Internal.Logging 7.0.3

Changed

• Updated the Microsoft.Data.SqlClient.SNI and Microsoft.Data.SqlClient.SNI.runtime dependencies to 6.0.3 (was 6.0.2).
  (#4599)

Fixed

• Fixed a SqlBulkCopy regression in environments where the application login cannot read sys.all_columns. Bulk copy now falls back to the earlier column-discovery behavior when that permission is unavailable. Support for hidden columns and SQL Graph column aliases still requires access to the metadata view.
  (#4370, #4306, #4402)

• Fixed a memory-allocation regression in connection and command operations caused by formatting diagnostic strings even when tracing was disabled. Also corrected trace messages that reported an incorrect object ID or could throw FormatException when traced values contained braces.
  (#4528, #4533)

• Fixed ServerCertificate validation on the managed SNI path so the configured certificate is compared against the server certificate even when the server certificate passes chain and host-name validation. When certificate validation is enabled, a missing, unreadable, or invalid certificate file, a certificate mismatch, or a missing server certificate now causes the TLS handshake to fail instead of bypassing the configured certificate check. (net8.0/net9.0 only)
  (#4445, #4583)

• Fixed Always Encrypted VSM/HGS enclave attestation to verify that the enclave public key used to establish a session matches the key committed to by the signed attestation report. Missing, malformed, or mismatched key-binding data now causes attestation to fail before the session secret is derived.
  (#4532, #4553)

• Fixed SqlConnection.AccessTokenCallback not disabling Transparent Network IP Resolution by default, making it consistent with SqlConnection.AccessToken. An explicitly configured TransparentNetworkIPResolution connection-string value still takes precedence. (net462 only)
  (#4520, #4561)

• Fixed authentication state handling so clearing SqlConnection.AccessToken, AccessTokenCallback, or SspiContextProvider preserves the other authentication values in the connection pool key. Cloning a connection or updating its credential also preserves its SspiContextProvider. Combining a non-null SspiContextProvider with AccessToken or AccessTokenCallback now throws InvalidOperationException instead of silently discarding authentication state; applications must use one authentication mechanism at a time.
  (#4520, #4561, #4644)

• Fixed configurable retry logic installing a permanent, process-wide assembly-resolution handler that could interfere with unrelated assembly loading. The handler is now active only while an explicitly configured custom retry provider is resolved and constructed, and probes AppContext.BaseDirectory instead of the current working directory. Place custom retry assemblies in the application base directory; dependencies loaded after provider construction must be resolvable through normal application dependency resolution or an application-provided handler. (net8.0/net9.0 only)
  (#2214, #4547, #4663)

Contributors

We thank the following public contributors. Their efforts toward this project are very much appreciated.

• edwardneal

Target Platform Support

• .NET Framework 4.6.2+ (Windows x86, Windows x64, Windows ARM64)
• .NET 8.0+ (Windows x86, Windows x64, Windows ARM, Windows ARM64, Linux, macOS)

Full details: release-notes/7.0/7.0.3.md

Stable Release v6.1.7

This update brings the following changes since the 6.1.6 release:

Changed

• Updated the Microsoft.Data.SqlClient.SNI and Microsoft.Data.SqlClient.SNI.runtime dependencies to 6.0.3 (was 6.0.2).
  (#4598)

Fixed

• Fixed ServerCertificate validation on the managed SNI path so the configured certificate is compared against the server certificate even when the server certificate passes chain and host-name validation. When certificate validation is enabled, a missing, unreadable, or invalid certificate file, a certificate mismatch, or a missing server certificate now causes the TLS handshake to fail instead of bypassing the configured certificate check. (net8.0/net9.0 only)
  (#4445, #4584)

• Fixed Always Encrypted VSM/HGS enclave attestation to verify that the enclave public key used to establish a session matches the key committed to by the signed attestation report. Missing, malformed, or mismatched key-binding data now causes attestation to fail before the session secret is derived.
  (#4532, #4552)

• Fixed SqlConnection.AccessTokenCallback not disabling Transparent Network IP Resolution by default, making it consistent with SqlConnection.AccessToken. An explicitly configured TransparentNetworkIPResolution connection-string value still takes precedence. (net462 only)
  (#4520, #4560)

• Fixed token authentication state handling so clearing SqlConnection.AccessToken preserves an existing AccessTokenCallback in the connection pool key, and clearing AccessTokenCallback preserves an existing AccessToken. Callback-based authentication now also follows the same prelogin server-certificate validation rules as an explicitly supplied access token.
  (#4520, #4560)

• Fixed configurable retry logic installing a permanent, process-wide assembly-resolution handler that could interfere with unrelated assembly loading. The handler is now active only while an explicitly configured custom retry provider is resolved and constructed, and probes AppContext.BaseDirectory instead of the current working directory. Place custom retry assemblies in the application base directory; dependencies loaded after provider construction must be resolvable through normal application dependency resolution or an application-provided handler. (net8.0/net9.0 only)
  (#2214, #4547, #4664)

Target Platform Support

• .NET Framework 4.6.2+ (Windows x86, Windows x64, Windows ARM64)
• .NET 8.0+ (Windows x86, Windows x64, Windows ARM64, Linux, macOS)
• .NET Standard 2.0+ (Windows x86, Windows x64, Windows ARM64, Linux, macOS)

Full details: release-notes/6.1/6.1.7.md

Preview Release v7.1.0-preview3

This update brings the following changes since the 7.1.0-preview2 release.

Package version alignment: The Microsoft.Data.SqlClient driver and its companion packages continue the aligned versioning introduced in 7.0.2. All five packages listed below ship together as 7.1.0-preview3. (Microsoft.SqlServer.Server continues to version independently and remains at 1.0.0.) Applications that reference Microsoft.Data.SqlClient.Extensions.Azure must upgrade it to 7.1.0-preview3 when upgrading Microsoft.Data.SqlClient.

Compatibility guarantee: All aligned assemblies ship with FileVersion 7.1.0.x and AssemblyVersion 7.0.0.0 — unchanged from 7.0.2 — so upgrading from 7.0.2 to 7.1.0-preview3 does not require any new .NET Framework strong-name binding redirects.

Packages in this release

Microsoft.Data.SqlClient 7.1.0-preview3

Added

• Asynchronous key store provider APIs for Always Encrypted — four virtual methods on SqlColumnEncryptionKeyStoreProvider with CancellationToken support. Purely additive; defaults delegate to the synchronous methods, so existing providers are unaffected (#3672, #3673)
• Connection Pool V2 nears parity with the default pool (opt-in via Switch.Microsoft.Data.SqlClient.UseConnectionPoolV2):
  • Transaction support (#4487)
  • Broken-connection replacement during command execution (#4429)
  • Background warmup to Min Pool Size and automatic replenishment (#4452)
  • Idle pruning driven by Connection Idle Timeout (#4463)
  • Optional ConcurrencyLimiter rate limiting for new physical connections (#4395, #4396)
  • Leaked connection reclamation, including the previously always-zero number-of-reclaimed-connections counter (#4529)
  • Metrics and tracing parity with the default pool (#4504)

Changed

• Single cross-platform build — Windows-only native SNI types now trim cleanly on Linux and macOS. Package structure and contents unchanged (#4207, #4239, #4465, #4474)
• Async read-path allocations restored to baseline via PacketData node reuse — ExecuteReaderAsync goes from +120.9% to +0.1% against 6.1.6 (#4536)
• SqlBulkCopy skips graph alias mapping when no graph pseudo-columns are present, recovering a regression from #3677 (#4535)
• No formatted trace string is allocated when SqlClientEventSource tracing is disabled, recovering a memory regression against 6.1.6. Trace output unchanged (#4528)
• net9.0 dependencies moved to 9.0.18; System.Threading.RateLimiting added to packaged metadata. Other targets keep their 8.0.x pins (#4507)
• Microsoft.Data.SqlClient.SNI and .SNI.runtime updated to 7.1.0-preview3.26226.3 (#4564)

Fixed

• Always Encrypted VSM/HGS attestation now verifies the enclave public key is bound to the signed report, using a fixed-time SHA-256 comparison against EnclaveData (#4532)
• SqlConnectionFactory no longer wakes the process every 30 seconds when no pools exist — including with Pooling=False and after ClearAllPools() (#1881, #4479)
• Connection pool performance counters affecting the default pool as well as pool V2 — active-soft-connects and number-of-active-connections could go negative after a failed activation, and several gauges drifted upward permanently after a broken connection was replaced (#4504)
• OverflowException when sending large decimal values with explicit Precision and Scale, which primarily affected Always Encrypted (#1655, #4443)
• TDS stream error when passing a DateOnly value with SqlDbType.Variant (net8.0/net9.0) (#3953, #4294)
• DateOnly in table-valued parameter sql_variant columns sent as datetime instead of date, which overflowed for values valid as date (net8.0/net9.0) (#3934, #4439)
• ServerCertificate keyword ignored when the platform reported no TLS policy errors. It is now always compared, and an unloadable certificate fails closed with SSLCertificateAuthenticationException instead of silently falling back to host-name validation (#4445)
• SqlConnection.AccessTokenCallback not disabling TNIR by default, plus pool-key construction and SspiContextProvider exclusivity with token auth (net462 for the TNIR behavior) (#4520)
• Fatal exceptions such as OutOfMemoryException captured into faulted Tasks across several SqlBulkCopy, SqlDataReader, and SqlCommand async entry points (#4437)
• Entra ID authentication failing against multi-segment authorities such as the Dataverse / Dynamics 365 TDS endpoint. Ships in Microsoft.Data.SqlClient.Extensions.Azure (#4496, #4521)

Full details: release-notes/7.1/7.1.0-preview3.md

---

Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider 7.1.0-preview3

Added

• SqlColumnEncryptionAzureKeyVaultProvider overrides the four asynchronous key store provider methods introduced in #3673, calling the Azure SDK's own async APIs and flowing the supplied CancellationToken (#4540)
• Concurrent cache misses for the same key collapse into a single Key Vault request. The gate is only awaited, so no thread blocks, and misses for different keys still proceed in parallel (#4540)

Fixed

• The 2000-entry column master key signature cache could stop compacting and grow unbounded — LocalCache.GetOrCreate compacted only on Count == maxSize, an equality test that concurrency could step past. It now compacts on Count >= maxSize (#4540)
• Concurrent callers no longer create duplicate CryptographyClient instances for the same key (#4540)

Behavior change: VerifyColumnMasterKeyMetadata and VerifyColumnMasterKeyMetadataAsync now reject a null or empty signature with ArgumentNullException / ArgumentException instead of passing it through to the Azure SDK. In-product callers are unaffected.

Runtime requirement: this version requires Microsoft.Data.SqlClient 7.1.0-preview3 or later at runtime, because the overridden methods only exist on the 7.1 base class. The NuGet dependency floor covers restore, but downgrading the driver below 7.1 at runtime produces a TypeLoadException.

Full details: release-notes/add-ons/AzureKeyVaultProvider/7.1/7.1.0-preview3.md

---

Microsoft.Data.SqlClient.Extensions.Azure 7.1.0-preview3

Fixed

• Entra ID tenant parsing for multi-segment authorities — the tenant is now taken from the first path segment rather than the last, so an OAuth v1 style authority such as .../{tenantId}/oauth2/authorize no longer yields the literal tenant id "authorize". Unparseable authorities raise a clear AuthenticationException, and provider errors are no longer re-wrapped as "Unexpected error". Bare authorities from Azure SQL, Fabric, and Synapse are unaffected (#4496, #4521)

Full details: release-notes/Extensions/Azure/7.1/7.1.0-preview3.md

---

Microsoft.Data.SqlClient.Extensions.Abstractions 7.1.0-preview3

• No functional or API changes; aligned version bump only.

Full details: release-notes/Extensions/Abstractions/7.1/7.1.0-preview3.md

---

Microsoft.Data.SqlClient.Internal.Logging 7.1.0-preview3

• Internal-use-only package. No functional or API changes; aligned version bump only.

Full details: [release-notes/Internal/Logging/7.1/7.1.0-preview3.md](https://github.com/dotnet/SqlClient/blob/main/release-notes/I...

Preview Release v7.1.0-preview2

This update brings the following changes since the 7.1.0-preview1 release.

Package version alignment: The Microsoft.Data.SqlClient driver and its companion packages continue the aligned versioning introduced in 7.0.2. All five packages listed below ship together as 7.1.0-preview2. (Microsoft.SqlServer.Server continues to version independently and remains at 1.0.0.) Applications that reference Microsoft.Data.SqlClient.Extensions.Azure must upgrade it to 7.1.0-preview2 when upgrading Microsoft.Data.SqlClient.

Compatibility guarantee: All aligned assemblies ship with FileVersion 7.1.0.x and AssemblyVersion 7.0.0.0 — unchanged from 7.0.2 — so upgrading from 7.0.2 to 7.1.0-preview2 does not require any new .NET Framework strong-name binding redirects.

Packages in this release

Microsoft.Data.SqlClient 7.1.0-preview2

Added

• SqlConnection.GetSchemaAsync overloads with CancellationToken support (#3005)
• SQL Graph pseudo-column aliases ($node_id, $edge_id, $from_id, $to_id) accepted in SqlBulkCopy mappings (#3677)
• SqlBatchCommand.CommandBehavior and SqlBatch.ExecuteReader(CommandBehavior) are now honored (#4125)
• Configurable idle connection timeout via Connection Idle Timeout / SqlConnectionStringBuilder.IdleTimeout (opt-in via Switch.Microsoft.Data.SqlClient.UseLegacyIdleTimeoutBehavior=false) (#4295)

Changed

• Connect Timeout now propagates through the pool when Switch.Microsoft.Data.SqlClient.UseOverallConnectTimeoutForPoolWait=true is set (default off; introduces a Microsoft.Bcl.TimeProvider dependency) (#4270)
• SQL Server 2025 json type added to the DataTypes collection returned by SqlConnection.GetSchema (#3858)
• Internal state-machine hardening via Interlocked.CompareExchange guards (#4267)
• Internal cleanup of connection-options inheritance and related pool interfaces (#4237, #4261, #4235, #4415, #4334)
• LCID hardcoded mappings to avoid repeated culture lookups (#4212)
• Allocation reductions on SqlErrorCollection and null-return paths (#4157, #4099, #4102)
• Improved EnclaveDiffieHellmanInfo.Size accuracy (#4346)
• SqlVector<float> serialization is now explicitly little-endian for cross-architecture consistency (#3861)
• Bundled .NET 10 SDK updated to 10.0.300 (#4287)

Fixed

• NullReferenceException in SqlCommand.Cancel() when the connection has already been torn down (#4372)
• Always Encrypted CMK signature verification incorrectly reusing cached results after a prior failure (#4339)
• Missing TDS token / feature-ack length bounds checks (spoofing server could trigger unbounded allocations) (#4340)
• SqlBulkCopy failing in least-privilege environments (#4306)
• Always Encrypted CekMdVersion / EkValueCount reads aligned with the TDS specification (#4240)
• LoginWithFailover parser-state validation (#4140)
• SPN during login now uses the resolved port instead of instance name for Protocol=None / Protocol=Admin (#4180)
• Race in SqlConnection.TryOpenInner that could surface as InvalidCastException now returns a deterministic InvalidOperationException (#4179)
• Multiple CancellationTokenSource leaks in SqlDataReader, SqlConnection, SqlCommand reconnect paths, and sequential-stream helpers (#4009)
• Docs fix for server certificate configuration (#4408)

Removed (breaking)

• SQL Server 7.0 / 2000 code paths removed; Type System Version=SQL Server 2000 now throws ArgumentException at open. Applications should switch to Latest (or another supported value). No change to server-version support — 7.0 / 2000 were already rejected during login version negotiation. (#4015)

Full details: release-notes/7.1/7.1.0-preview2.md

---

Microsoft.Data.SqlClient.Extensions.Azure 7.1.0-preview2

Added — WAM (Windows Account Manager) broker support for Entra ID authentication (Windows only) (#4288, #4388)

• Covers ActiveDirectoryIntegrated, ActiveDirectoryInteractive, ActiveDirectoryDeviceCodeFlow, and the deprecated ActiveDirectoryPassword modes.
• New ActiveDirectoryAuthenticationProviderOptions type (UseWamBroker, ApplicationClientId, DeviceCodeFlowCallback) and a new ActiveDirectoryAuthenticationProvider(ActiveDirectoryAuthenticationProviderOptions) constructor overload.
• New cross-platform SetParentActivityOrWindowFunc(Func<object>?) (supersedes the .NET-Framework-only SetIWin32WindowFunc).
• New useWamBroker attribute on the <SqlClientAuthenticationProviders> configuration section.
• Device Code Flow now uses its own token-lifetime timeout instead of inheriting Connect Timeout, fixing spurious "The operation was canceled." failures when users take longer to enter the code.
• WAM is enabled by default when the driver's built-in client id is used; opt-in via UseWamBroker / the config attribute when a custom client id is supplied. Non-Windows platforms never invoke the broker.
• Footprint note: WAM materially increases the on-disk footprint of Microsoft.Data.SqlClient.Extensions.Azure because it pulls in Microsoft.Identity.Client.Broker and its native OS-broker components. Tracking: #4410.
• Sample: new AzureSqlConnector app under doc/apps/AzureSqlConnector.

Changed

• Dependencies: added Microsoft.Identity.Client.Broker 4.84.2; updated Microsoft.Identity.Client to 4.84.2.

Full details: release-notes/Extensions/Azure/7.1/7.1.0-preview2.md

---

Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider 7.1.0-preview2

• No functional or API changes; aligned version bump only.

Full details: release-notes/add-ons/AzureKeyVaultProvider/7.1/7.1.0-preview2.md

---

Microsoft.Data.SqlClient.Extensions.Abstractions 7.1.0-preview2

• No functional or API changes; aligned version bump only.

Full details: release-notes/Extensions/Abstractions/7.1/7.1.0-preview2.md

---

Microsoft.Data.SqlClient.Internal.Logging 7.1.0-preview2

• Internal-use-only package. No functional or API changes; aligned version bump only.

Full details: release-notes/Internal/Logging/7.1/7.1.0-preview2.md

---

Target Platforms

• .NET Framework 4.6.2+ (Windows x86, x64, ARM64)
• .NET 8.0+ (Windows x86, x64, ARM, ARM64; Linux; macOS)

Per-TFM dependency lists are in the linked release-notes files above.

Contributors

A huge thank you to our community contributors for this release:

• @edwardneal — SqlConnection.GetSchemaAsync (#3005), SQL Graph column aliases (#3677), least-privilege SqlBulkCopy (#4306), Always Encrypted TDS alignment (#4240), LCID mapping (#4212), SqlVector little-endian (#3861), DataTypes + json type (#3858), test reliability (#4262, #4305)
• @SimonCropp — SQL Server 7.0 / 2000 removal (#4015), CancellationTokenSource cleanup (#4009), error/warning fast path (#4157), additional code-health (#4099, #4102, #4158)
• @campersau — SqlBatchCommand.CommandBehavior (#4125)
• @jnyrup — EnclaveDiffieHellmanInfo.Size (#4346)
• @shreyarao4 — Kerberos SSPI + SequentialAccess test fixes (#4146, #4224)

Stable Release - v7.0.2

This update brings the following changes since the 7.0.1 release:

Important — package version alignment: Starting with 7.0.2, the Microsoft.Data.SqlClient driver and its companion packages share a single aligned version. The following packages now ship together as 7.0.2:

• Microsoft.Data.SqlClient
• Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider
• Microsoft.Data.SqlClient.Extensions.Azure
• Microsoft.Data.SqlClient.Extensions.Abstractions
• Microsoft.Data.SqlClient.Internal.Logging

(Microsoft.SqlServer.Server continues to version independently and remains at 1.0.0.)

Applications must reference the same versions of Microsoft.Data.SqlClient and its extensions for best compatibility. In particular, applications that reference Microsoft.Data.SqlClient.Extensions.Azure must upgrade it to 7.0.2 when upgrading Microsoft.Data.SqlClient to 7.0.2.

Breaking change (.NET Framework only): As part of this alignment, the AssemblyVersion of Microsoft.Data.SqlClient.Extensions.Azure, Microsoft.Data.SqlClient.Extensions.Abstractions, and Microsoft.Data.SqlClient.Internal.Logging changed from 1.0.0.0 to 7.0.0.0 (the Microsoft.Data.SqlClient and Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider assembly versions are unchanged). On .NET Framework, AssemblyVersion is part of the strong-name identity, so applications that drop these assemblies into an existing deployment without rebuilding must rebuild against the 7.0.2 packages (or add binding redirects). Applications on .NET / .NET Core are not affected.

Companion package release notes

The following companion packages ship aligned as 7.0.2. See their individual release notes for package-specific changes (including the Microsoft.Data.SqlClient.Extensions.Azure WAM broker support):

• Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider 7.0.2
• Microsoft.Data.SqlClient.Extensions.Azure 7.0.2
• Microsoft.Data.SqlClient.Extensions.Abstractions 7.0.2
• Microsoft.Data.SqlClient.Internal.Logging 7.0.2

Fixed

• Fixed a NullReferenceException in SqlCommand.Cancel(). The diagnostic message built during cancellation dereferenced the active connection directly; it now uses a null-conditional access so cancellation no longer throws when the connection has already been torn down.
  (#4372,#4373)

• Fixed a NullReferenceException in SqlDataReader when calling GetBytes/GetChars with a null destination buffer. The argument-validation path that constructs the InvalidDestinationBufferIndex exception now guards against the null buffer so the correct ArgumentException is surfaced instead of an NRE.
  (#4159,#4206)

• Fixed Always Encrypted column master key signature verification incorrectly reusing cached results. The SignatureVerificationCache lookup logic was corrected so signature verification outcomes are cached and retrieved against the correct key, preventing stale or mismatched verification results.
  (#4339,#4343)

Changed

Hardened TDS token parsing with data-length bounds checks

What Changed:

• Added bounds checking when parsing TDS token and feature-extension-acknowledgment data lengths. The parser now validates the declared length of incoming token data against the available buffer before reading, rejecting malformed or out-of-range length values instead of reading past the intended boundary.
  (#4340,#4358)

Who Benefits:

• All consumers benefit from improved resilience against malformed or hostile TDS responses. A server (or man-in-the-middle) sending an invalid token length can no longer drive the parser to read beyond the declared payload.

Impact:

• Connections that previously parsed malformed token streams loosely will now fail fast with a clear protocol error. Well-behaved SQL Server responses are unaffected.

Contributors

We thank the following public contributors. Their efforts toward this project are very much appreciated.

• SimonCropp

Target Platform Support

• .NET Framework 4.6.2+ (Windows x86, Windows x64, Windows ARM64)
• .NET 8.0+ (Windows x86, Windows x64, Windows ARM, Windows ARM64, Linux, macOS)

Dependencies

.NET 9.0

• Microsoft.Bcl.Cryptography 9.0.13
• Microsoft.Data.SqlClient.Extensions.Abstractions 7.0.2
• Microsoft.Data.SqlClient.Internal.Logging 7.0.2
• Microsoft.Data.SqlClient.SNI.runtime 6.0.2
• Microsoft.Extensions.Caching.Memory 9.0.13
• Microsoft.IdentityModel.JsonWebTokens 8.16.0
• Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 9.0.13
• System.Security.Cryptography.Pkcs 9.0.13

.NET 8.0

• Microsoft.Bcl.Cryptography 8.0.0
• Microsoft.Data.SqlClient.Extensions.Abstractions 7.0.2
• Microsoft.Data.SqlClient.Internal.Logging 7.0.2
• Microsoft.Data.SqlClient.SNI.runtime 6.0.2
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.IdentityModel.JsonWebTokens 8.16.0
• Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 8.0.1
• System.Security.Cryptography.Pkcs 8.0.1

.NET Standard 2.0

• Microsoft.Bcl.Cryptography 8.0.0
• Microsoft.Data.SqlClient.Extensions.Abstractions 7.0.2
• Microsoft.Data.SqlClient.Internal.Logging 7.0.2
• Microsoft.Data.SqlClient.SNI.runtime 6.0.2
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.IdentityModel.JsonWebTokens 8.16.0
• Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 8.0.1
• System.Security.Cryptography.Pkcs 8.0.1
• System.Text.Json 10.0.3
• System.Threading.Channels 10.0.3

.NET Framework 4.6.2+

• Microsoft.Bcl.Cryptography 8.0.0
• Microsoft.Data.SqlClient.Extensions.Abstractions 7.0.2
• Microsoft.Data.SqlClient.Internal.Logging 7.0.2
• Microsoft.Data.SqlClient.SNI 6.0.2
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.IdentityModel.JsonWebTokens 8.16.0
• Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
• System.Buffers 4.6.1
• System.Data.Common 4.3.0
• System.Diagnostics.DiagnosticSource 10.0.3
• System.Memory 4.6.3
• System.Runtime.InteropServices.RuntimeInformation 4.3.0
• System.Security.Cryptography.Pkcs 8.0.1
• System.Text.Json 10.0.3
• System.Threading.Channels 10.0.3
• System.ValueTuple 4.6.2

Stable Release v6.1.6

This update brings the following changes since the 6.1.5 release:

Added

WAM broker support for the supported Entra ID authentication modes (Windows only)

What Changed:

• Added support for the Web Account Manager (WAM) broker for the supported Microsoft Entra ID authentication modes. A new ActiveDirectoryAuthenticationProviderOptions options bag and a corresponding ActiveDirectoryAuthenticationProvider(ActiveDirectoryAuthenticationProviderOptions options) constructor were introduced, exposing a UseWamBroker property (alongside ApplicationClientId and DeviceCodeFlowCallback).
  (#4288, #4387)
• Added a cross-platform SetParentActivityOrWindowFunc(Func<object> parentActivityOrWindowFunc) method so callers can supply a parent window handle on Windows or a parent Activity/UIViewController on Android/iOS/MAUI.

Who Benefits:

• Applications using ActiveDirectoryInteractive and other supported Entra ID authentication modes on Windows benefit from the WAM broker's improved security (tokens are brokered by the OS), single sign-on with the logged-in Windows account, and support for Conditional Access and Windows Hello.

Impact:

• When you supply your ApplicationClientId, WAM is opt-in via ActiveDirectoryAuthenticationProviderOptions.UseWamBroker. Consider enabling it when you want OS-brokered tokens, single sign-on with the signed-in Windows account, Windows Hello, and Conditional Access support.
• UseWamBroker is a Windows-only setting and has no effect on non-Windows platforms, where interactive Entra ID flows always use the system browser.
• Prefer the new options-bag constructor over the positional-argument overloads in new code.

var options = new ActiveDirectoryAuthenticationProviderOptions
{
    ApplicationClientId = "<your-app-client-id>",
    // Enable WAM (Windows only) for OS-brokered tokens, SSO, Windows Hello, and Conditional Access.
    UseWamBroker = true,
};
var provider = new ActiveDirectoryAuthenticationProvider(options);
// Supply the parent window/activity that owns the interactive sign-in prompt.
provider.SetParentActivityOrWindowFunc(() => parentWindowHandle);
SqlAuthenticationProvider.SetProvider(SqlAuthenticationMethod.ActiveDirectoryInteractive, provider);

Changed

Hardened TDS token parsing with data-length bounds checks

What Changed:

• Added bounds checking when parsing TDS token data lengths. The parser now validates the declared length of incoming token data against the available buffer before reading, rejecting malformed or out-of-range length values instead of reading past the intended boundary.
  (#4340, #4359)

Who Benefits:

• All consumers benefit from improved resilience against malformed or hostile TDS responses. A server (or man-in-the-middle) sending an invalid token length can no longer drive the parser to read beyond the declared payload.

Impact:

• Connections that previously parsed malformed token streams loosely will now fail fast with a clear protocol error. Well-behaved SQL Server responses are unaffected.

Other changes

• Updated dependencies (#4387):
  • Updated Microsoft.Identity.Client to 4.84.2 (was 4.80.0)
  • Added Microsoft.Identity.Client.Broker 4.84.2

Fixed

• Fixed a NullReferenceException in SqlDataReader.GetChars on the PLP + CommandBehavior.SequentialAccess path when a null buffer was passed together with a negative bufferIndex. The call now correctly throws ArgumentOutOfRangeException for the bufferIndex parameter.
  (#4159, #4205)

• Fixed column master key (CMK) signature verification caching where GetSignatureVerificationResult returned whether the cache key existed rather than the cached value itself. Once a signature verification failure was cached as false, subsequent lookups incorrectly returned true, causing the caller to skip re-verification and treat the column master key as having a valid signature.
  (#4339, #4356)

Target Platform Support

• .NET Framework 4.6.2+ (Windows x86, Windows x64, Windows ARM64)
• .NET 8.0+ (Windows x86, Windows x64, Windows ARM64, Linux, macOS)
• .NET Standard 2.0+ (Windows x86, Windows x64, Windows ARM64, Linux, macOS)

Dependencies

.NET Framework 4.6.2

• Azure.Core 1.50.0
• Azure.Identity 1.17.1
• Microsoft.Data.SqlClient.SNI 6.0.2
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.Identity.Client 4.84.2
• Microsoft.Identity.Client.Broker 4.84.2
• Microsoft.IdentityModel.JsonWebTokens 7.7.1
• Microsoft.IdentityModel.Protocols.OpenIdConnect 7.7.1
• System.Buffers 4.6.1
• System.Data.Common 4.3.0
• System.Diagnostics.DiagnosticSource 8.0.1
• System.IdentityModel.Tokens.Jwt 7.7.1
• System.Memory 4.6.3
• System.Security.Cryptography.Pkcs 8.0.1
• System.Text.Json 8.0.6
• System.Text.RegularExpressions 4.3.1

.NET 8.0

• Azure.Core 1.50.0
• Azure.Identity 1.17.1
• Microsoft.Data.SqlClient.SNI.runtime 6.0.2
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.Identity.Client 4.84.2
• Microsoft.Identity.Client.Broker 4.84.2
• Microsoft.IdentityModel.JsonWebTokens 7.7.1
• Microsoft.IdentityModel.Protocols.OpenIdConnect 7.7.1
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 8.0.1
• System.Diagnostics.DiagnosticSource 8.0.1
• System.IdentityModel.Tokens.Jwt 7.7.1
• System.Security.Cryptography.Pkcs 8.0.1

.NET 9.0

• Azure.Core 1.50.0
• Azure.Identity 1.17.1
• Microsoft.Data.SqlClient.SNI.runtime 6.0.2
• Microsoft.Extensions.Caching.Memory 9.0.11
• Microsoft.Identity.Client 4.84.2
• Microsoft.Identity.Client.Broker 4.84.2
• Microsoft.IdentityModel.JsonWebTokens 7.7.1
• Microsoft.IdentityModel.Protocols.OpenIdConnect 7.7.1
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 9.0.11
• System.Diagnostics.DiagnosticSource 9.0.11
• System.IdentityModel.Tokens.Jwt 7.7.1
• System.Security.Cryptography.Pkcs 9.0.11

.NET Standard 2.0

• Azure.Core 1.50.0
• Azure.Identity 1.17.1
• Microsoft.Data.SqlClient.SNI.runtime 6.0.2
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.Identity.Client 4.84.2
• Microsoft.Identity.Client.Broker 4.84.2
• Microsoft.IdentityModel.JsonWebTokens 7.7.1
• Microsoft.IdentityModel.Protocols.OpenIdConnect 7.7.1
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 8.0.1
• System.Diagnostics.DiagnosticSource 8.0.1
• System.IdentityModel.Tokens.Jwt 7.7.1
• System.Security.Cryptography.Pkcs 8.0.1
• System.Text.Json 8.0.6