From a98d790419a919a2492d7832290393e7aa37c4f1 Mon Sep 17 00:00:00 2001 From: Priyanka Tiwari Date: Fri, 21 Aug 2026 17:58:32 +0530 Subject: [PATCH 1/6] Add release notes for 7.1.0-preview3 Adds release notes for Microsoft.Data.SqlClient 7.1.0-preview3 and its four aligned companion packages, updates the per-version README index tables, and adds the corresponding CHANGELOG entry. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: c7425f3e-f6b8-439b-b74f-e25f8406fbf6 --- CHANGELOG.md | 84 +++++++++ release-notes/7.1/7.1.0-preview3.md | 173 ++++++++++++++++++ release-notes/7.1/README.md | 1 + .../Abstractions/7.1/7.1.0-preview3.md | 19 ++ .../Extensions/Abstractions/7.1/README.md | 1 + .../Extensions/Azure/7.1/7.1.0-preview3.md | 39 ++++ release-notes/Extensions/Azure/7.1/README.md | 1 + .../Internal/Logging/7.1/7.1.0-preview3.md | 22 +++ release-notes/Internal/Logging/7.1/README.md | 1 + .../7.1/7.1.0-preview3.md | 23 +++ .../AzureKeyVaultProvider/7.1/README.md | 1 + 11 files changed, 365 insertions(+) create mode 100644 release-notes/7.1/7.1.0-preview3.md create mode 100644 release-notes/Extensions/Abstractions/7.1/7.1.0-preview3.md create mode 100644 release-notes/Extensions/Azure/7.1/7.1.0-preview3.md create mode 100644 release-notes/Internal/Logging/7.1/7.1.0-preview3.md create mode 100644 release-notes/add-ons/AzureKeyVaultProvider/7.1/7.1.0-preview3.md diff --git a/CHANGELOG.md b/CHANGELOG.md index 4f15b44925..13eb37139d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,90 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) > **Note:** Releases are sorted in reverse chronological order (newest first). +## [Preview Release 7.1.0-preview3] - 2026-08-26 + +This update brings the following changes since the [7.1.0-preview2](release-notes/7.1/7.1.0-preview2.md) release. +See the [full release notes](release-notes/7.1/7.1.0-preview3.md) for detailed descriptions. + +> **Important — package version alignment:** Starting with the [7.0.2](release-notes/7.0/7.0.2.md) release, the `Microsoft.Data.SqlClient` driver and its companion packages share a single aligned version. Preview 3 of the `7.1` line continues this alignment; the following packages now ship together as `7.1.0-preview3`: +> +> - `Microsoft.Data.SqlClient` +> - `Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider` +> - `Microsoft.Data.SqlClient.Extensions.Azure` +> - `Microsoft.Data.SqlClient.Extensions.Abstractions` +> - `Microsoft.Data.SqlClient.Internal.Logging` +> +> (`Microsoft.SqlServer.Server` continues to version independently and remains at `1.0.0`.) +> +> Applications that reference `Microsoft.Data.SqlClient.Extensions.Azure` must upgrade it to `7.1.0-preview3` when upgrading `Microsoft.Data.SqlClient` to `7.1.0-preview3`. +> +> **Compatibility guarantee:** All aligned assemblies ship with `FileVersion 7.1.0.x` and `AssemblyVersion 7.0.0.0`. The `AssemblyVersion` is unchanged from [7.0.2](release-notes/7.0/7.0.2.md), so upgrading from `7.0.2` to `7.1.0-preview3` does **not** require any new .NET Framework strong-name binding redirects. + +### Added + +- Added four `virtual` asynchronous counterparts to the synchronous methods on `SqlColumnEncryptionKeyStoreProvider` — `DecryptColumnEncryptionKeyAsync`, `EncryptColumnEncryptionKeyAsync`, `SignColumnMasterKeyMetadataAsync`, and `VerifyColumnMasterKeyMetadataAsync` — each accepting an optional `CancellationToken`. The default implementations delegate to the existing synchronous methods, so existing custom providers are unaffected. + ([#3673](https://github.com/dotnet/SqlClient/pull/3673)) + +- Substantially expanded `ChannelDbConnectionPool` (the opt-in pool behind `Switch.Microsoft.Data.SqlClient.UseConnectionPoolV2`) toward parity with the default pool: transaction support, broken-connection replacement, background warmup and replenishment to `Min Pool Size`, idle pruning driven by `Connection Idle Timeout`, optional connection-creation rate limiting, and metrics/tracing parity. Default pooling behavior is unchanged. + ([#4395](https://github.com/dotnet/SqlClient/pull/4395), + [#4396](https://github.com/dotnet/SqlClient/pull/4396), + [#4429](https://github.com/dotnet/SqlClient/pull/4429), + [#4452](https://github.com/dotnet/SqlClient/pull/4452), + [#4463](https://github.com/dotnet/SqlClient/pull/4463), + [#4487](https://github.com/dotnet/SqlClient/pull/4487), + [#4504](https://github.com/dotnet/SqlClient/pull/4504)) + +### Changed + +- Completed the removal of OS-specific compilation from `Microsoft.Data.SqlClient`; the driver now builds a single cross-platform assembly and the `_WINDOWS`/`_UNIX` symbols have been removed. Package structure and contents are unchanged, and Windows-only native SNI types now trim cleanly on Linux and macOS. + ([#4207](https://github.com/dotnet/SqlClient/pull/4207), + [#4465](https://github.com/dotnet/SqlClient/pull/4465)) + +- Reduced managed allocations in the async read path by restoring reuse of `PacketData` nodes via a bounded free list on `StateSnapshot`. + ([#4536](https://github.com/dotnet/SqlClient/pull/4536)) + +- Converted 119 `SqlClientEventSource` trace call sites back to parameterized format strings so no formatted string is allocated when tracing is disabled. Trace output is unchanged. + ([#4528](https://github.com/dotnet/SqlClient/pull/4528)) + +- Consolidated server capability detection into a new internal `ConnectionCapabilities` type shared by the internal connection, `SqlMetaDataFactory`, and `TdsParser`. + ([#3862](https://github.com/dotnet/SqlClient/pull/3862)) + +- Added scaffolding for a managed SSRP client in the managed SNI layer. No SSRP parsing behavior changes yet. + ([#3741](https://github.com/dotnet/SqlClient/pull/3741)) + +- Updated centrally managed dependency versions for the `net9.0` target framework to `9.0.18`, and added `System.Threading.RateLimiting` to the packaged dependency metadata. Non-`net9.0` targets keep their existing `8.0.x` pins. + ([#4507](https://github.com/dotnet/SqlClient/pull/4507)) + +- Updated the `Microsoft.Data.SqlClient.SNI` and `Microsoft.Data.SqlClient.SNI.runtime` dependencies to `7.1.0-preview3.26226.3`. + ([#4564](https://github.com/dotnet/SqlClient/pull/4564)) + +- Re-shipped `Microsoft.Data.SqlClient.Extensions.Azure` as `7.1.0-preview3`, removing obsolete `Azure.Identity` API usage with no public API or behavior change. See [release notes](release-notes/Extensions/Azure/7.1/7.1.0-preview3.md). + +- Re-shipped `Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider`, `Microsoft.Data.SqlClient.Extensions.Abstractions`, and `Microsoft.Data.SqlClient.Internal.Logging` as `7.1.0-preview3` (version alignment only, no functional changes). See release notes for [AKV](release-notes/add-ons/AzureKeyVaultProvider/7.1/7.1.0-preview3.md), [Abstractions](release-notes/Extensions/Abstractions/7.1/7.1.0-preview3.md), and [Logging](release-notes/Internal/Logging/7.1/7.1.0-preview3.md). + +### Fixed + +- Fixed Always Encrypted VSM/HGS enclave attestation not verifying that the enclave public key used to establish the session matches the key committed to by the signed attestation report. + ([#4532](https://github.com/dotnet/SqlClient/pull/4532)) + +- Fixed a `SqlConnectionFactory` timer that woke the process every 30 seconds for the lifetime of the application even when no connection pools existed, including with `Pooling=False` and after `ClearAllPools()`. + ([#4479](https://github.com/dotnet/SqlClient/pull/4479)) + +- Fixed `OverflowException` when sending large `decimal` values as a parameter with explicit `Precision` and `Scale`, which primarily affected Always Encrypted scenarios. + ([#4443](https://github.com/dotnet/SqlClient/pull/4443)) + +- Fixed a TDS stream error when passing a `DateOnly` value as a parameter with `SqlDbType.Variant`. + ([#4294](https://github.com/dotnet/SqlClient/pull/4294)) + +- Fixed `SqlConnection.AccessTokenCallback` not disabling Transparent Network IP Resolution by default, unlike `SqlConnection.AccessToken`, along with a related connection pool key defect. + ([#4520](https://github.com/dotnet/SqlClient/pull/4520)) + +- Fixed several async entry points in `SqlBulkCopy`, `SqlDataReader`, and `SqlCommand` that captured fatal exceptions such as `OutOfMemoryException` into faulted `Task`s instead of letting them propagate. + ([#4437](https://github.com/dotnet/SqlClient/pull/4437)) + +- Addressed CodeQL findings by removing SHA-1 from the portable PDB checksum algorithm map and annotating the Always Encrypted RSA PKCS#1 v1.5 signature paths. + ([#4517](https://github.com/dotnet/SqlClient/pull/4517)) + ## [Preview Release 7.1.0-preview2] - 2026-07-09 This update brings the following changes since the [7.1.0-preview1](release-notes/7.1/7.1.0-preview1.md) release. diff --git a/release-notes/7.1/7.1.0-preview3.md b/release-notes/7.1/7.1.0-preview3.md new file mode 100644 index 0000000000..3b96990e3e --- /dev/null +++ b/release-notes/7.1/7.1.0-preview3.md @@ -0,0 +1,173 @@ +# Release Notes + +## Preview Release 7.1.0-preview3 - 2026-08-26 + +This update brings the following changes since the [7.1.0-preview2](7.1.0-preview2.md) release: + +> **Important — package version alignment:** Starting with the [7.0.2](../7.0/7.0.2.md) release, the `Microsoft.Data.SqlClient` driver and its companion packages share a single aligned version. Preview 3 of the `7.1` line continues this alignment; the following packages ship together as `7.1.0-preview3`: +> +> - `Microsoft.Data.SqlClient` +> - `Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider` +> - `Microsoft.Data.SqlClient.Extensions.Azure` +> - `Microsoft.Data.SqlClient.Extensions.Abstractions` +> - `Microsoft.Data.SqlClient.Internal.Logging` +> +> (`Microsoft.SqlServer.Server` continues to version independently and remains at `1.0.0`.) +> +> Applications must reference the same versions of `Microsoft.Data.SqlClient` and its extensions for best compatibility. In particular, applications that reference `Microsoft.Data.SqlClient.Extensions.Azure` must upgrade it to `7.1.0-preview3` when upgrading `Microsoft.Data.SqlClient` to `7.1.0-preview3`. +> +> **Compatibility guarantee:** All aligned assemblies ship with `FileVersion 7.1.0.x` and `AssemblyVersion 7.0.0.0`. The `AssemblyVersion` is unchanged from [7.0.2](../7.0/7.0.2.md), so upgrading from `7.0.2` to `7.1.0-preview3` does **not** require any new .NET Framework strong-name binding redirects. + +### Added + +#### Asynchronous Key Store Provider APIs for Always Encrypted + +*What Changed:* + +- Added four `virtual` asynchronous counterparts to the existing synchronous methods on the `SqlColumnEncryptionKeyStoreProvider` abstract base class: `DecryptColumnEncryptionKeyAsync`, `EncryptColumnEncryptionKeyAsync`, `SignColumnMasterKeyMetadataAsync`, and `VerifyColumnMasterKeyMetadataAsync`. Each takes an optional `CancellationToken`. The default implementations delegate to the existing synchronous methods, so providers that do not override them continue to work unchanged. + ([#3672](https://github.com/dotnet/SqlClient/issues/3672), [#3673](https://github.com/dotnet/SqlClient/pull/3673)) + +*Who Benefits:* + +- Authors of custom column encryption key store providers — particularly those backed by network-bound key stores such as HSMs or cloud key vaults — can now implement genuinely asynchronous key operations instead of blocking a thread on synchronous I/O during query execution. + +*Impact:* + +- Purely additive. Because the new methods are `virtual` with a synchronous fallback, existing providers compile and run without modification. + +#### Connection Pool V2 Feature Completeness + +*What Changed:* + +- Substantially expanded `ChannelDbConnectionPool`, the opt-in pool implementation gated behind the `Switch.Microsoft.Data.SqlClient.UseConnectionPoolV2` AppContext switch, bringing it closer to parity with the default `WaitHandleDbConnectionPool`: + - **Transaction support** — implemented `PutObjectFromTransactedPool` and `TransactionEnded` (previously `NotImplementedException`), and reworked connection return to mirror the reference pool's deactivate-then-route behavior. ([#4487](https://github.com/dotnet/SqlClient/pull/4487)) + - **Connection replacement** — implemented replacement of broken connections during command execution, with atomic slot replacement in `ConnectionPoolSlots`. ([#4429](https://github.com/dotnet/SqlClient/pull/4429)) + - **Background warmup and replenishment** — the pool now pre-creates connections up to `Min Pool Size` on startup and replenishes automatically whenever it drops below the minimum. ([#4452](https://github.com/dotnet/SqlClient/pull/4452)) + - **Idle pruning** — the pruning window is now derived from the `Connection Idle Timeout` value rather than a hard-coded interval. Defaults are unchanged. ([#4463](https://github.com/dotnet/SqlClient/pull/4463)) + - **Connection-creation rate limiting** — an optional `ConcurrencyLimiter` can throttle new physical connection creation; when a permit is denied the caller waits for an existing connection instead of forcing another open. ([#4395](https://github.com/dotnet/SqlClient/pull/4395), [#4396](https://github.com/dotnet/SqlClient/pull/4396)) + - **Metrics and tracing parity** — the pool now emits the same pooled/free connection and soft/hard connect/disconnect counters as the default pool, and traces at comparable fidelity. ([#4504](https://github.com/dotnet/SqlClient/pull/4504)) + +*Who Benefits:* + +- Applications evaluating the V2 connection pool can now exercise transaction-enlisted workloads, broken-connection recovery, and pool warmup, and can observe the pool through the existing performance counters and EventSource traces. + +*Impact:* + +- No change to default behavior. `ChannelDbConnectionPool` is used only when `Switch.Microsoft.Data.SqlClient.UseConnectionPoolV2` is enabled; the default pool remains `WaitHandleDbConnectionPool`. +- Two counter fixes surfaced by this work apply to **both** pools: `Count` now reflects connections that actually belong to the pool rather than including in-flight reservations. + +### Changed + +#### Single Cross-Platform Build of the Driver Assembly + +*What Changed:* + +- Completed the removal of OS-specific compilation from `Microsoft.Data.SqlClient`. The native SNI interop types, enums, structs, P/Invokes and the SNI layer itself now build identically for Windows and non-Windows targets, and the `_WINDOWS`/`_UNIX` conditional compilation symbols have been removed from the driver project. The structure and contents of the produced NuGet package are unchanged. + ([#4207](https://github.com/dotnet/SqlClient/pull/4207), [#4239](https://github.com/dotnet/SqlClient/issues/4239), [#4465](https://github.com/dotnet/SqlClient/pull/4465)) + +*Who Benefits:* + +- Trimming-sensitive applications: the Windows-only native SNI types are now removed cleanly by the IL trimmer on Linux and macOS. A `ILLink.Substitutions.xml` naming defect that previously prevented `LocalAppContextSwitches.UseManagedNetworking` from being substituted for a constant is also fixed. + +*Impact:* + +- No API or packaging change. The same assembly content ships as before; only the build configuration changed. + +#### Other changes + +- Reduced managed allocations in the async read path by restoring reuse of `PacketData` linked-list nodes via a bounded free list on `StateSnapshot`, recovering an allocation regression against the 6.1.6 baseline. ([#4536](https://github.com/dotnet/SqlClient/pull/4536)) +- Converted 119 `SqlClientEventSource` trace call sites back to parameterized format strings instead of C# interpolated strings, so no formatted string is allocated when tracing is disabled. Trace output is unchanged. ([#4528](https://github.com/dotnet/SqlClient/pull/4528)) +- Consolidated server capability detection into a new internal `ConnectionCapabilities` type shared by the internal connection, `SqlMetaDataFactory`, and `TdsParser`, so metadata decisions can be driven by negotiated feature flags rather than by server version alone. ([#3862](https://github.com/dotnet/SqlClient/pull/3862)) +- Added scaffolding for a managed SSRP client in the managed SNI layer, including `PacketBuffer` and sequence-reading helpers. No SSRP parsing behavior changes yet. ([#3700](https://github.com/dotnet/SqlClient/issues/3700), [#3741](https://github.com/dotnet/SqlClient/pull/3741)) +- Updated centrally managed dependency versions for the `net9.0` target framework to `9.0.18`, and added `System.Threading.RateLimiting` to the packaged dependency metadata. Non-`net9.0` targets keep their existing `8.0.x` pins. ([#4507](https://github.com/dotnet/SqlClient/pull/4507)) +- Updated the `Microsoft.Data.SqlClient.SNI` and `Microsoft.Data.SqlClient.SNI.runtime` dependencies to `7.1.0-preview3.26226.3`. ([#4564](https://github.com/dotnet/SqlClient/pull/4564)) + +### Fixed + +- Fixed Always Encrypted VSM/HGS enclave attestation not verifying that the enclave public key used to establish the session matches the key committed to by the signed attestation report. The provider now compares `SHA-256(enclave public key)` against the report's `EnclaveData` using a fixed-time comparison, and rejects attestation when the data is missing, malformed, or mismatched. ([#4532](https://github.com/dotnet/SqlClient/pull/4532)) +- Fixed a `SqlConnectionFactory` timer that woke the process every 30 seconds for the lifetime of the application even when no connection pools existed — including with `Pooling=False` and after `ClearAllPools()`. The pruning timer is now armed on demand and disarmed once there is nothing left to prune. A missing .NET Framework unload hook was also added. ([#1881](https://github.com/dotnet/SqlClient/issues/1881), [#4479](https://github.com/dotnet/SqlClient/pull/4479)) +- Fixed `OverflowException` when sending large `decimal` values (for example `decimal.MaxValue`) as a parameter with explicit `Precision` and `Scale`, which primarily affected Always Encrypted scenarios where both must always be set. ([#1655](https://github.com/dotnet/SqlClient/issues/1655), [#4443](https://github.com/dotnet/SqlClient/pull/4443)) +- Fixed a TDS stream error when passing a `DateOnly` value as a parameter with `SqlDbType.Variant`; the required `sql_variant` write paths were missing. (net8.0/net9.0 only) ([#3953](https://github.com/dotnet/SqlClient/issues/3953), [#4294](https://github.com/dotnet/SqlClient/pull/4294)) +- Fixed `SqlConnection.AccessTokenCallback` not disabling Transparent Network IP Resolution by default, unlike `SqlConnection.AccessToken`. Also fixed a related defect in how the authentication setters build the connection pool key, and made `SspiContextProvider` mutually exclusive with token-based authentication. (net462 only for the TNIR behavior) ([#4520](https://github.com/dotnet/SqlClient/pull/4520)) +- Fixed several async entry points in `SqlBulkCopy`, `SqlDataReader.InvokeAsyncCall`, `SqlCommand.Reader`, and `SqlCommand.Xml` that captured fatal exceptions such as `OutOfMemoryException` into faulted `Task`s instead of letting them propagate. ([#4437](https://github.com/dotnet/SqlClient/pull/4437)) +- Addressed CodeQL findings by removing SHA-1 from the portable PDB checksum algorithm map and annotating the Always Encrypted RSA PKCS#1 v1.5 signature paths, which are fixed by the Always Encrypted on-the-wire format and cannot be changed without breaking interoperability with SQL Server tooling and other drivers. ([#4517](https://github.com/dotnet/SqlClient/pull/4517)) + +### Companion package release notes + +- [Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider 7.1.0-preview3](../add-ons/AzureKeyVaultProvider/7.1/7.1.0-preview3.md) +- [Microsoft.Data.SqlClient.Extensions.Azure 7.1.0-preview3](../Extensions/Azure/7.1/7.1.0-preview3.md) +- [Microsoft.Data.SqlClient.Extensions.Abstractions 7.1.0-preview3](../Extensions/Abstractions/7.1/7.1.0-preview3.md) +- [Microsoft.Data.SqlClient.Internal.Logging 7.1.0-preview3](../Internal/Logging/7.1/7.1.0-preview3.md) + +## Target Platform Support + +- .NET Framework 4.6.2+ (Windows x86, Windows x64, Windows ARM64) +- .NET 8.0+ (Windows x86, Windows x64, Windows ARM, Windows ARM64, Linux, macOS) + +### Dependencies + +#### .NET 9.0 + +- Microsoft.Bcl.Cryptography 9.0.18 +- Microsoft.Data.SqlClient.Extensions.Abstractions 7.1.0-preview3 +- Microsoft.Data.SqlClient.Internal.Logging 7.1.0-preview3 +- Microsoft.Data.SqlClient.SNI.runtime 7.1.0-preview3.26226.3 +- Microsoft.Extensions.Caching.Memory 9.0.18 +- Microsoft.IdentityModel.JsonWebTokens 8.16.0 +- Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0 +- Microsoft.SqlServer.Server 1.0.0 +- System.Configuration.ConfigurationManager 9.0.18 +- System.Security.Cryptography.Pkcs 9.0.18 +- System.Threading.RateLimiting 9.0.18 + +#### .NET 8.0 + +- Microsoft.Bcl.Cryptography 8.0.0 +- Microsoft.Data.SqlClient.Extensions.Abstractions 7.1.0-preview3 +- Microsoft.Data.SqlClient.Internal.Logging 7.1.0-preview3 +- Microsoft.Data.SqlClient.SNI.runtime 7.1.0-preview3.26226.3 +- Microsoft.Extensions.Caching.Memory 8.0.1 +- Microsoft.IdentityModel.JsonWebTokens 8.16.0 +- Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0 +- Microsoft.SqlServer.Server 1.0.0 +- System.Configuration.ConfigurationManager 8.0.1 +- System.Security.Cryptography.Pkcs 8.0.1 +- System.Threading.RateLimiting 8.0.0 + +#### .NET Standard 2.0 + +- Microsoft.Bcl.Cryptography 8.0.0 +- Microsoft.Bcl.TimeProvider 8.0.1 +- Microsoft.Data.SqlClient.Extensions.Abstractions 7.1.0-preview3 +- Microsoft.Data.SqlClient.Internal.Logging 7.1.0-preview3 +- Microsoft.Data.SqlClient.SNI.runtime 7.1.0-preview3.26226.3 +- Microsoft.Extensions.Caching.Memory 8.0.1 +- Microsoft.IdentityModel.JsonWebTokens 8.16.0 +- Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0 +- Microsoft.SqlServer.Server 1.0.0 +- System.Configuration.ConfigurationManager 8.0.1 +- System.Security.Cryptography.Pkcs 8.0.1 +- System.Text.Json 10.0.3 +- System.Threading.Channels 10.0.3 +- System.Threading.RateLimiting 8.0.0 + +#### .NET Framework 4.6.2+ + +- Microsoft.Bcl.Cryptography 8.0.0 +- Microsoft.Bcl.TimeProvider 8.0.1 +- Microsoft.Data.SqlClient.Extensions.Abstractions 7.1.0-preview3 +- Microsoft.Data.SqlClient.Internal.Logging 7.1.0-preview3 +- Microsoft.Data.SqlClient.SNI 7.1.0-preview3.26226.3 +- Microsoft.Extensions.Caching.Memory 8.0.1 +- Microsoft.IdentityModel.JsonWebTokens 8.16.0 +- Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0 +- System.Buffers 4.6.1 +- System.Data.Common 4.3.0 +- System.Diagnostics.DiagnosticSource 10.0.3 +- System.Memory 4.6.3 +- System.Runtime.InteropServices.RuntimeInformation 4.3.0 +- System.Security.Cryptography.Pkcs 8.0.1 +- System.Text.Json 10.0.3 +- System.Threading.Channels 10.0.3 +- System.Threading.RateLimiting 8.0.0 +- System.ValueTuple 4.6.2 diff --git a/release-notes/7.1/README.md b/release-notes/7.1/README.md index 843ba62b36..0b7de8156d 100644 --- a/release-notes/7.1/README.md +++ b/release-notes/7.1/README.md @@ -6,3 +6,4 @@ The following Microsoft.Data.SqlClient 7.1 releases have been shipped: |:-------------|:---------------|:----------------------------------:| | 2026-04-29 | 7.1.0-preview1 | [Release Notes](7.1.0-preview1.md) | | 2026-07-09 | 7.1.0-preview2 | [Release Notes](7.1.0-preview2.md) | +| 2026-08-26 | 7.1.0-preview3 | [Release Notes](7.1.0-preview3.md) | diff --git a/release-notes/Extensions/Abstractions/7.1/7.1.0-preview3.md b/release-notes/Extensions/Abstractions/7.1/7.1.0-preview3.md new file mode 100644 index 0000000000..c76a2af5f7 --- /dev/null +++ b/release-notes/Extensions/Abstractions/7.1/7.1.0-preview3.md @@ -0,0 +1,19 @@ +# Release Notes + +## Preview Release 7.1.0-preview3 - 2026-08-26 + +This release continues version-alignment of `Microsoft.Data.SqlClient.Extensions.Abstractions` with the core `Microsoft.Data.SqlClient` driver version (`7.1.0-preview3`). The previous release of this package was [7.1.0-preview2](7.1.0-preview2.md). + +There are no functional or API changes in this release. See the core [Microsoft.Data.SqlClient 7.1.0-preview3](../../../7.1/7.1.0-preview3.md) release notes for the driver-family changes shipped alongside this version. + +> **Version alignment:** This package's version continues to track the core `Microsoft.Data.SqlClient` driver version. See the [7.0.2 release notes](../../../7.0/7.0.2.md) for the initial alignment announcement. This assembly ships with `FileVersion 7.1.0.x`. The `AssemblyVersion 7.0.0.0` remains unchanged from the `7.0.2` release. + +## Target Platform Support + +- .NET Standard 2.0 + +### Dependencies + +#### .NET Standard 2.0 + +- Microsoft.Data.SqlClient.Internal.Logging 7.1.0-preview3 diff --git a/release-notes/Extensions/Abstractions/7.1/README.md b/release-notes/Extensions/Abstractions/7.1/README.md index 133eb71b32..9d1374bdb6 100644 --- a/release-notes/Extensions/Abstractions/7.1/README.md +++ b/release-notes/Extensions/Abstractions/7.1/README.md @@ -6,3 +6,4 @@ The following `Microsoft.Data.SqlClient.Extensions.Abstractions` | Release Date | Description | Notes | | :-- | :-- | :--: | | 2026-07-09 | 7.1.0-preview2 | [Release Notes](7.1.0-preview2.md) | +| 2026-08-26 | 7.1.0-preview3 | [Release Notes](7.1.0-preview3.md) | diff --git a/release-notes/Extensions/Azure/7.1/7.1.0-preview3.md b/release-notes/Extensions/Azure/7.1/7.1.0-preview3.md new file mode 100644 index 0000000000..8e4ce08579 --- /dev/null +++ b/release-notes/Extensions/Azure/7.1/7.1.0-preview3.md @@ -0,0 +1,39 @@ +# Release Notes + +## Preview Release 7.1.0-preview3 - 2026-08-26 + +This release removes an obsolete Azure.Identity API usage and continues version-alignment of `Microsoft.Data.SqlClient.Extensions.Azure` with the core `Microsoft.Data.SqlClient` driver version (`7.1.0-preview3`). The previous release of this package was [7.1.0-preview2](7.1.0-preview2.md). See the core [Microsoft.Data.SqlClient 7.1.0-preview3](../../../7.1/7.1.0-preview3.md) release notes for the driver-family changes shipped alongside this version. + +> **Version alignment:** This package's version continues to track the core `Microsoft.Data.SqlClient` driver version. See the [7.0.2 release notes](../../../7.0/7.0.2.md) for the initial alignment announcement. This assembly ships with `FileVersion 7.1.0.x`. The `AssemblyVersion 7.0.0.0` remains unchanged from the `7.0.2` release. + +### Changed + +- Removed the assignment to the obsolete `DefaultAzureCredentialOptions.SharedTokenCacheUsername` property in `ActiveDirectoryAuthenticationProvider`, and migrated from the obsolete `ManagedIdentityCredential(string, TokenCredentialOptions)` constructor to `ManagedIdentityCredential(ManagedIdentityCredentialOptions)`. `SharedTokenCacheCredential` is no longer part of the `DefaultAzureCredential` chain, so the removed assignment was already a no-op; the client id continues to flow through `ManagedIdentityClientId` and `WorkloadIdentityClientId`. There are no public API changes and managed-identity behavior — including system-assigned versus user-assigned selection and `AuthorityHost` propagation — is preserved exactly. + ([#4421](https://github.com/dotnet/SqlClient/pull/4421)) + +## Target Platform Support + +- .NET Standard 2.0 +- .NET Framework 4.6.2+ + +### Dependencies + +#### .NET Standard 2.0 + +- Azure.Core 1.51.1 +- Azure.Identity 1.18.0 +- Microsoft.Data.SqlClient.Extensions.Abstractions 7.1.0-preview3 +- Microsoft.Data.SqlClient.Internal.Logging 7.1.0-preview3 +- Microsoft.Extensions.Caching.Memory 8.0.1 +- Microsoft.Identity.Client 4.84.2 +- Microsoft.Identity.Client.Broker 4.84.2 + +#### .NET Framework 4.6.2+ + +- Azure.Core 1.51.1 +- Azure.Identity 1.18.0 +- Microsoft.Data.SqlClient.Extensions.Abstractions 7.1.0-preview3 +- Microsoft.Data.SqlClient.Internal.Logging 7.1.0-preview3 +- Microsoft.Extensions.Caching.Memory 8.0.1 +- Microsoft.Identity.Client 4.84.2 +- Microsoft.Identity.Client.Broker 4.84.2 diff --git a/release-notes/Extensions/Azure/7.1/README.md b/release-notes/Extensions/Azure/7.1/README.md index 3acdf3d45c..b3f93b7931 100644 --- a/release-notes/Extensions/Azure/7.1/README.md +++ b/release-notes/Extensions/Azure/7.1/README.md @@ -6,3 +6,4 @@ The following `Microsoft.Data.SqlClient.Extensions.Azure` | Release Date | Description | Notes | | :-- | :-- | :--: | | 2026-07-09 | 7.1.0-preview2 | [Release Notes](7.1.0-preview2.md) | +| 2026-08-26 | 7.1.0-preview3 | [Release Notes](7.1.0-preview3.md) | diff --git a/release-notes/Internal/Logging/7.1/7.1.0-preview3.md b/release-notes/Internal/Logging/7.1/7.1.0-preview3.md new file mode 100644 index 0000000000..0c434cb632 --- /dev/null +++ b/release-notes/Internal/Logging/7.1/7.1.0-preview3.md @@ -0,0 +1,22 @@ +# Release Notes + +## Preview Release 7.1.0-preview3 - 2026-08-26 + +> **Note:** This package is for internal use by other Microsoft.Data.SqlClient packages only +> and should not be referenced directly by application code. + +This release continues version-alignment of `Microsoft.Data.SqlClient.Internal.Logging` with the core `Microsoft.Data.SqlClient` driver version (`7.1.0-preview3`). The previous release of this package was [7.1.0-preview2](7.1.0-preview2.md). + +There are no functional or API changes in this release. See the core [Microsoft.Data.SqlClient 7.1.0-preview3](../../../7.1/7.1.0-preview3.md) release notes for the driver-family changes shipped alongside this version. + +> **Version alignment:** This package's version continues to track the core `Microsoft.Data.SqlClient` driver version. See the [7.0.2 release notes](../../../7.0/7.0.2.md) for the initial alignment announcement. This assembly ships with `FileVersion 7.1.0.x`. The `AssemblyVersion 7.0.0.0` remains unchanged from the `7.0.2` release. + +## Target Platform Support + +- .NET Standard 2.0 + +### Dependencies + +#### .NET Standard 2.0 + +- None diff --git a/release-notes/Internal/Logging/7.1/README.md b/release-notes/Internal/Logging/7.1/README.md index f0c0f8c274..25caeccaba 100644 --- a/release-notes/Internal/Logging/7.1/README.md +++ b/release-notes/Internal/Logging/7.1/README.md @@ -9,3 +9,4 @@ The following `Microsoft.Data.SqlClient.Internal.Logging` | Release Date | Description | Notes | | :-- | :-- | :--: | | 2026-07-09 | 7.1.0-preview2 | [Release Notes](7.1.0-preview2.md) | +| 2026-08-26 | 7.1.0-preview3 | [Release Notes](7.1.0-preview3.md) | diff --git a/release-notes/add-ons/AzureKeyVaultProvider/7.1/7.1.0-preview3.md b/release-notes/add-ons/AzureKeyVaultProvider/7.1/7.1.0-preview3.md new file mode 100644 index 0000000000..8289dc174b --- /dev/null +++ b/release-notes/add-ons/AzureKeyVaultProvider/7.1/7.1.0-preview3.md @@ -0,0 +1,23 @@ +# Release Notes + +## Preview Release 7.1.0-preview3 - 2026-08-26 + +This release continues version-alignment of `Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider` with the core `Microsoft.Data.SqlClient` driver version (`7.1.0-preview3`). The previous release of this package was [7.1.0-preview2](7.1.0-preview2.md). + +There are no functional or API changes in this release. See the core [Microsoft.Data.SqlClient 7.1.0-preview3](../../../7.1/7.1.0-preview3.md) release notes for the driver-family changes shipped alongside this version. + +> **Version alignment:** This package's version continues to track the core `Microsoft.Data.SqlClient` driver version. See the [7.0.2 release notes](../../../7.0/7.0.2.md) for the initial alignment announcement. This assembly ships with `FileVersion 7.1.0.x`. The `AssemblyVersion 7.0.0.0` remains unchanged from the `7.0.2` release. + +## Target Platform Support + +- .NET Standard 2.0 + +### Dependencies + +#### .NET Standard 2.0 + +- Azure.Core 1.51.1 +- Azure.Security.KeyVault.Keys 4.9.0 +- Microsoft.Data.SqlClient 7.1.0-preview3 +- Microsoft.Data.SqlClient.Internal.Logging 7.1.0-preview3 +- Microsoft.Extensions.Caching.Memory 8.0.1 diff --git a/release-notes/add-ons/AzureKeyVaultProvider/7.1/README.md b/release-notes/add-ons/AzureKeyVaultProvider/7.1/README.md index 9fda87ae8f..07fffc069b 100644 --- a/release-notes/add-ons/AzureKeyVaultProvider/7.1/README.md +++ b/release-notes/add-ons/AzureKeyVaultProvider/7.1/README.md @@ -6,3 +6,4 @@ The following `Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider` | Release Date | Description | Notes | | :-- | :-- | :--: | | 2026-07-09 | 7.1.0-preview2 | [Release Notes](7.1.0-preview2.md) | +| 2026-08-26 | 7.1.0-preview3 | [Release Notes](7.1.0-preview3.md) | From c5c9e393c747d9b456a05365a21fb0be8df067e2 Mon Sep 17 00:00:00 2001 From: Priyanka Tiwari Date: Mon, 24 Aug 2026 13:30:30 +0530 Subject: [PATCH 2/6] Capture remaining closed 7.1.0-preview3 milestone items in release notes Adds coverage for milestone items that closed after the initial draft: - #4529 leaked-connection reclamation in ChannelDbConnectionPool - #4535 SqlBulkCopy graph column alias mapping bypass - #4521 / #4496 Entra ID tenant parsing for multi-segment STSURL authorities - #4540 async key store provider APIs in the AzureKeyVaultProvider Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: c485150e-f46e-4c55-8d06-e0491a10e7e8 --- CHANGELOG.md | 18 +++++++++--- release-notes/7.1/7.1.0-preview3.md | 6 +++- .../Extensions/Azure/7.1/7.1.0-preview3.md | 7 ++++- .../7.1/7.1.0-preview3.md | 29 +++++++++++++++++-- 4 files changed, 52 insertions(+), 8 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 13eb37139d..d820f44b78 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -30,14 +30,18 @@ See the [full release notes](release-notes/7.1/7.1.0-preview3.md) for detailed d - Added four `virtual` asynchronous counterparts to the synchronous methods on `SqlColumnEncryptionKeyStoreProvider` — `DecryptColumnEncryptionKeyAsync`, `EncryptColumnEncryptionKeyAsync`, `SignColumnMasterKeyMetadataAsync`, and `VerifyColumnMasterKeyMetadataAsync` — each accepting an optional `CancellationToken`. The default implementations delegate to the existing synchronous methods, so existing custom providers are unaffected. ([#3673](https://github.com/dotnet/SqlClient/pull/3673)) -- Substantially expanded `ChannelDbConnectionPool` (the opt-in pool behind `Switch.Microsoft.Data.SqlClient.UseConnectionPoolV2`) toward parity with the default pool: transaction support, broken-connection replacement, background warmup and replenishment to `Min Pool Size`, idle pruning driven by `Connection Idle Timeout`, optional connection-creation rate limiting, and metrics/tracing parity. Default pooling behavior is unchanged. +- Implemented those four asynchronous APIs in `SqlColumnEncryptionAzureKeyVaultProvider`, calling the Azure SDK's own asynchronous methods and flowing the supplied `CancellationToken`. Concurrent cache misses for the same key are gated so a burst of callers issues a single Key Vault request. See the [AKV release notes](release-notes/add-ons/AzureKeyVaultProvider/7.1/7.1.0-preview3.md) for the `VerifyColumnMasterKeyMetadata` signature-validation behavior change and the 7.1 runtime requirement. + ([#4540](https://github.com/dotnet/SqlClient/pull/4540)) + +- Substantially expanded `ChannelDbConnectionPool` (the opt-in pool behind `Switch.Microsoft.Data.SqlClient.UseConnectionPoolV2`) toward parity with the default pool: transaction support, broken-connection replacement, leaked-connection reclamation, background warmup and replenishment to `Min Pool Size`, idle pruning driven by `Connection Idle Timeout`, optional connection-creation rate limiting, and metrics/tracing parity. Default pooling behavior is unchanged. ([#4395](https://github.com/dotnet/SqlClient/pull/4395), [#4396](https://github.com/dotnet/SqlClient/pull/4396), [#4429](https://github.com/dotnet/SqlClient/pull/4429), [#4452](https://github.com/dotnet/SqlClient/pull/4452), [#4463](https://github.com/dotnet/SqlClient/pull/4463), [#4487](https://github.com/dotnet/SqlClient/pull/4487), - [#4504](https://github.com/dotnet/SqlClient/pull/4504)) + [#4504](https://github.com/dotnet/SqlClient/pull/4504), + [#4529](https://github.com/dotnet/SqlClient/pull/4529)) ### Changed @@ -63,9 +67,12 @@ See the [full release notes](release-notes/7.1/7.1.0-preview3.md) for detailed d - Updated the `Microsoft.Data.SqlClient.SNI` and `Microsoft.Data.SqlClient.SNI.runtime` dependencies to `7.1.0-preview3.26226.3`. ([#4564](https://github.com/dotnet/SqlClient/pull/4564)) -- Re-shipped `Microsoft.Data.SqlClient.Extensions.Azure` as `7.1.0-preview3`, removing obsolete `Azure.Identity` API usage with no public API or behavior change. See [release notes](release-notes/Extensions/Azure/7.1/7.1.0-preview3.md). +- Bypassed SQL Graph column alias mapping in `SqlBulkCopy` when neither the source nor destination table contains graph pseudo-columns, recovering a bulk copy performance regression. Graph table bulk copy behavior is unchanged. + ([#4535](https://github.com/dotnet/SqlClient/pull/4535)) + +- Re-shipped `Microsoft.Data.SqlClient.Extensions.Azure` as `7.1.0-preview3`, removing obsolete `Azure.Identity` API usage and fixing Entra ID tenant parsing for multi-segment authorities. See [release notes](release-notes/Extensions/Azure/7.1/7.1.0-preview3.md). -- Re-shipped `Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider`, `Microsoft.Data.SqlClient.Extensions.Abstractions`, and `Microsoft.Data.SqlClient.Internal.Logging` as `7.1.0-preview3` (version alignment only, no functional changes). See release notes for [AKV](release-notes/add-ons/AzureKeyVaultProvider/7.1/7.1.0-preview3.md), [Abstractions](release-notes/Extensions/Abstractions/7.1/7.1.0-preview3.md), and [Logging](release-notes/Internal/Logging/7.1/7.1.0-preview3.md). +- Re-shipped `Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider` as `7.1.0-preview3` with new asynchronous key store provider APIs, and `Microsoft.Data.SqlClient.Extensions.Abstractions` and `Microsoft.Data.SqlClient.Internal.Logging` as `7.1.0-preview3` (version alignment only, no functional changes). See release notes for [AKV](release-notes/add-ons/AzureKeyVaultProvider/7.1/7.1.0-preview3.md), [Abstractions](release-notes/Extensions/Abstractions/7.1/7.1.0-preview3.md), and [Logging](release-notes/Internal/Logging/7.1/7.1.0-preview3.md). ### Fixed @@ -87,6 +94,9 @@ See the [full release notes](release-notes/7.1/7.1.0-preview3.md) for detailed d - Fixed several async entry points in `SqlBulkCopy`, `SqlDataReader`, and `SqlCommand` that captured fatal exceptions such as `OutOfMemoryException` into faulted `Task`s instead of letting them propagate. ([#4437](https://github.com/dotnet/SqlClient/pull/4437)) +- Fixed `Authentication=Active Directory Service Principal` (and the other Entra ID flows) failing against endpoints that return a multi-segment authority such as the Dataverse / Dynamics 365 TDS endpoint; the tenant id is now taken from the first path segment of the STSURL authority instead of the last. Ships in `Microsoft.Data.SqlClient.Extensions.Azure`. + ([#4521](https://github.com/dotnet/SqlClient/pull/4521)) + - Addressed CodeQL findings by removing SHA-1 from the portable PDB checksum algorithm map and annotating the Always Encrypted RSA PKCS#1 v1.5 signature paths. ([#4517](https://github.com/dotnet/SqlClient/pull/4517)) diff --git a/release-notes/7.1/7.1.0-preview3.md b/release-notes/7.1/7.1.0-preview3.md index 3b96990e3e..36e067c342 100644 --- a/release-notes/7.1/7.1.0-preview3.md +++ b/release-notes/7.1/7.1.0-preview3.md @@ -34,6 +34,7 @@ This update brings the following changes since the [7.1.0-preview2](7.1.0-previe *Impact:* - Purely additive. Because the new methods are `virtual` with a synchronous fallback, existing providers compile and run without modification. +- The in-box `SqlColumnEncryptionAzureKeyVaultProvider` overrides all four methods in this release. See the [AzureKeyVaultProvider 7.1.0-preview3](../add-ons/AzureKeyVaultProvider/7.1/7.1.0-preview3.md) release notes. ([#4540](https://github.com/dotnet/SqlClient/pull/4540)) #### Connection Pool V2 Feature Completeness @@ -45,11 +46,12 @@ This update brings the following changes since the [7.1.0-preview2](7.1.0-previe - **Background warmup and replenishment** — the pool now pre-creates connections up to `Min Pool Size` on startup and replenishes automatically whenever it drops below the minimum. ([#4452](https://github.com/dotnet/SqlClient/pull/4452)) - **Idle pruning** — the pruning window is now derived from the `Connection Idle Timeout` value rather than a hard-coded interval. Defaults are unchanged. ([#4463](https://github.com/dotnet/SqlClient/pull/4463)) - **Connection-creation rate limiting** — an optional `ConcurrencyLimiter` can throttle new physical connection creation; when a permit is denied the caller waits for an existing connection instead of forcing another open. ([#4395](https://github.com/dotnet/SqlClient/pull/4395), [#4396](https://github.com/dotnet/SqlClient/pull/4396)) + - **Leaked connection reclamation** — the pool now reclaims emancipated connections (connections whose owning `SqlConnection` was garbage collected without being closed) both inline on the requesting thread and, while callers are waiting, from a demand-driven `PoolReclaimer` timer. The `number-of-reclaimed-connections` counter, which previously always read zero under pool V2, is now emitted. ([#4529](https://github.com/dotnet/SqlClient/pull/4529)) - **Metrics and tracing parity** — the pool now emits the same pooled/free connection and soft/hard connect/disconnect counters as the default pool, and traces at comparable fidelity. ([#4504](https://github.com/dotnet/SqlClient/pull/4504)) *Who Benefits:* -- Applications evaluating the V2 connection pool can now exercise transaction-enlisted workloads, broken-connection recovery, and pool warmup, and can observe the pool through the existing performance counters and EventSource traces. +- Applications evaluating the V2 connection pool can now exercise transaction-enlisted workloads, broken-connection recovery, leaked-connection reclamation, and pool warmup, and can observe the pool through the existing performance counters and EventSource traces. *Impact:* @@ -76,6 +78,7 @@ This update brings the following changes since the [7.1.0-preview2](7.1.0-previe #### Other changes - Reduced managed allocations in the async read path by restoring reuse of `PacketData` linked-list nodes via a bounded free list on `StateSnapshot`, recovering an allocation regression against the 6.1.6 baseline. ([#4536](https://github.com/dotnet/SqlClient/pull/4536)) +- `SqlBulkCopy` no longer builds SQL Graph column alias mapping tables when the source and destination tables contain no graph pseudo-columns (`$edge_id`, `$to_id`, `$from_id`, `$node_id`), recovering a bulk copy performance regression introduced with graph column alias support in [#3677](https://github.com/dotnet/SqlClient/pull/3677). Graph table bulk copy behavior is unchanged. ([#4535](https://github.com/dotnet/SqlClient/pull/4535)) - Converted 119 `SqlClientEventSource` trace call sites back to parameterized format strings instead of C# interpolated strings, so no formatted string is allocated when tracing is disabled. Trace output is unchanged. ([#4528](https://github.com/dotnet/SqlClient/pull/4528)) - Consolidated server capability detection into a new internal `ConnectionCapabilities` type shared by the internal connection, `SqlMetaDataFactory`, and `TdsParser`, so metadata decisions can be driven by negotiated feature flags rather than by server version alone. ([#3862](https://github.com/dotnet/SqlClient/pull/3862)) - Added scaffolding for a managed SSRP client in the managed SNI layer, including `PacketBuffer` and sequence-reading helpers. No SSRP parsing behavior changes yet. ([#3700](https://github.com/dotnet/SqlClient/issues/3700), [#3741](https://github.com/dotnet/SqlClient/pull/3741)) @@ -90,6 +93,7 @@ This update brings the following changes since the [7.1.0-preview2](7.1.0-previe - Fixed a TDS stream error when passing a `DateOnly` value as a parameter with `SqlDbType.Variant`; the required `sql_variant` write paths were missing. (net8.0/net9.0 only) ([#3953](https://github.com/dotnet/SqlClient/issues/3953), [#4294](https://github.com/dotnet/SqlClient/pull/4294)) - Fixed `SqlConnection.AccessTokenCallback` not disabling Transparent Network IP Resolution by default, unlike `SqlConnection.AccessToken`. Also fixed a related defect in how the authentication setters build the connection pool key, and made `SspiContextProvider` mutually exclusive with token-based authentication. (net462 only for the TNIR behavior) ([#4520](https://github.com/dotnet/SqlClient/pull/4520)) - Fixed several async entry points in `SqlBulkCopy`, `SqlDataReader.InvokeAsyncCall`, `SqlCommand.Reader`, and `SqlCommand.Xml` that captured fatal exceptions such as `OutOfMemoryException` into faulted `Task`s instead of letting them propagate. ([#4437](https://github.com/dotnet/SqlClient/pull/4437)) +- Fixed `Authentication=Active Directory Service Principal` (and the interactive, password, integrated, and device-code flows) failing against endpoints such as the Dataverse / Dynamics 365 TDS endpoint, which return a multi-segment Entra ID authority (`https://login.microsoftonline.com/{tenantId}/oauth2/authorize`) in the TDS `FEDAUTHINFO` token. The tenant id is now taken from the first path segment of the authority instead of the last. This fix ships in `Microsoft.Data.SqlClient.Extensions.Azure`; see its [7.1.0-preview3](../Extensions/Azure/7.1/7.1.0-preview3.md) release notes. ([#4496](https://github.com/dotnet/SqlClient/issues/4496), [#4521](https://github.com/dotnet/SqlClient/pull/4521)) - Addressed CodeQL findings by removing SHA-1 from the portable PDB checksum algorithm map and annotating the Always Encrypted RSA PKCS#1 v1.5 signature paths, which are fixed by the Always Encrypted on-the-wire format and cannot be changed without breaking interoperability with SQL Server tooling and other drivers. ([#4517](https://github.com/dotnet/SqlClient/pull/4517)) ### Companion package release notes diff --git a/release-notes/Extensions/Azure/7.1/7.1.0-preview3.md b/release-notes/Extensions/Azure/7.1/7.1.0-preview3.md index 8e4ce08579..277853905d 100644 --- a/release-notes/Extensions/Azure/7.1/7.1.0-preview3.md +++ b/release-notes/Extensions/Azure/7.1/7.1.0-preview3.md @@ -2,7 +2,7 @@ ## Preview Release 7.1.0-preview3 - 2026-08-26 -This release removes an obsolete Azure.Identity API usage and continues version-alignment of `Microsoft.Data.SqlClient.Extensions.Azure` with the core `Microsoft.Data.SqlClient` driver version (`7.1.0-preview3`). The previous release of this package was [7.1.0-preview2](7.1.0-preview2.md). See the core [Microsoft.Data.SqlClient 7.1.0-preview3](../../../7.1/7.1.0-preview3.md) release notes for the driver-family changes shipped alongside this version. +This release removes an obsolete Azure.Identity API usage, fixes Entra ID tenant parsing for multi-segment authorities, and continues version-alignment of `Microsoft.Data.SqlClient.Extensions.Azure` with the core `Microsoft.Data.SqlClient` driver version (`7.1.0-preview3`). The previous release of this package was [7.1.0-preview2](7.1.0-preview2.md). See the core [Microsoft.Data.SqlClient 7.1.0-preview3](../../../7.1/7.1.0-preview3.md) release notes for the driver-family changes shipped alongside this version. > **Version alignment:** This package's version continues to track the core `Microsoft.Data.SqlClient` driver version. See the [7.0.2 release notes](../../../7.0/7.0.2.md) for the initial alignment announcement. This assembly ships with `FileVersion 7.1.0.x`. The `AssemblyVersion 7.0.0.0` remains unchanged from the `7.0.2` release. @@ -11,6 +11,11 @@ This release removes an obsolete Azure.Identity API usage and continues version- - Removed the assignment to the obsolete `DefaultAzureCredentialOptions.SharedTokenCacheUsername` property in `ActiveDirectoryAuthenticationProvider`, and migrated from the obsolete `ManagedIdentityCredential(string, TokenCredentialOptions)` constructor to `ManagedIdentityCredential(ManagedIdentityCredentialOptions)`. `SharedTokenCacheCredential` is no longer part of the `DefaultAzureCredential` chain, so the removed assignment was already a no-op; the client id continues to flow through `ManagedIdentityClientId` and `WorkloadIdentityClientId`. There are no public API changes and managed-identity behavior — including system-assigned versus user-assigned selection and `AuthorityHost` propagation — is preserved exactly. ([#4421](https://github.com/dotnet/SqlClient/pull/4421)) +### Fixed + +- Fixed Entra ID tenant parsing for multi-segment STSURL authorities. Endpoints such as the Dataverse / Dynamics 365 TDS endpoint return an OAuth v1 style authority (`https://login.microsoftonline.com/{tenantId}/oauth2/authorize`) in the TDS `FEDAUTHINFO` token. `ActiveDirectoryAuthenticationProvider.AcquireTokenAsync` split that authority at the **last** `/`, so the credential received the literal string `"authorize"` as its tenant id and connections failed with `ClientSecretCredential authentication failed`. The tenant is now taken from the **first** path segment, so trailing endpoint suffixes (`/oauth2/authorize`, `/oauth2/v2.0/token`, ...) are ignored, and the normalized authority is used for the MSAL-based interactive, password, integrated, and device-code flows as well. An unparseable authority now raises a clear `AuthenticationException` naming the offending value, and provider-raised authentication errors are no longer re-wrapped as "Unexpected error". Behavior is unchanged for the bare `https://login.microsoftonline.com/{tenantId}` authority sent by Azure SQL, Fabric, and Synapse. There are no public API changes. + ([#4496](https://github.com/dotnet/SqlClient/issues/4496), [#4521](https://github.com/dotnet/SqlClient/pull/4521)) + ## Target Platform Support - .NET Standard 2.0 diff --git a/release-notes/add-ons/AzureKeyVaultProvider/7.1/7.1.0-preview3.md b/release-notes/add-ons/AzureKeyVaultProvider/7.1/7.1.0-preview3.md index 8289dc174b..9074b15fb5 100644 --- a/release-notes/add-ons/AzureKeyVaultProvider/7.1/7.1.0-preview3.md +++ b/release-notes/add-ons/AzureKeyVaultProvider/7.1/7.1.0-preview3.md @@ -2,12 +2,37 @@ ## Preview Release 7.1.0-preview3 - 2026-08-26 -This release continues version-alignment of `Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider` with the core `Microsoft.Data.SqlClient` driver version (`7.1.0-preview3`). The previous release of this package was [7.1.0-preview2](7.1.0-preview2.md). +This release adds asynchronous key store provider APIs and continues version-alignment of `Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider` with the core `Microsoft.Data.SqlClient` driver version (`7.1.0-preview3`). The previous release of this package was [7.1.0-preview2](7.1.0-preview2.md). -There are no functional or API changes in this release. See the core [Microsoft.Data.SqlClient 7.1.0-preview3](../../../7.1/7.1.0-preview3.md) release notes for the driver-family changes shipped alongside this version. +See the core [Microsoft.Data.SqlClient 7.1.0-preview3](../../../7.1/7.1.0-preview3.md) release notes for the driver-family changes shipped alongside this version. > **Version alignment:** This package's version continues to track the core `Microsoft.Data.SqlClient` driver version. See the [7.0.2 release notes](../../../7.0/7.0.2.md) for the initial alignment announcement. This assembly ships with `FileVersion 7.1.0.x`. The `AssemblyVersion 7.0.0.0` remains unchanged from the `7.0.2` release. +### Added + +#### Asynchronous key store provider APIs + +*What Changed:* + +- `SqlColumnEncryptionAzureKeyVaultProvider` now overrides the four asynchronous key store provider methods introduced on the base class in [#3673](https://github.com/dotnet/SqlClient/pull/3673): `EncryptColumnEncryptionKeyAsync`, `DecryptColumnEncryptionKeyAsync`, `SignColumnMasterKeyMetadataAsync`, and `VerifyColumnMasterKeyMetadataAsync`. These call the Azure SDK's own asynchronous methods and flow the supplied `CancellationToken` to them, rather than completing synchronous work on a returned task. +- Concurrent cache misses for the same key are gated so a burst of callers issues a single Key Vault request. The gate is only ever awaited, so no thread blocks, and misses for different keys still proceed in parallel. + ([#4540](https://github.com/dotnet/SqlClient/pull/4540)) + +*Who Benefits:* + +- Applications using Always Encrypted with Azure Key Vault can now perform column encryption key operations without blocking a thread pool thread on network-bound key vault I/O. + +*Impact:* + +- No public API was removed or changed. The column encryption key and signature caches are shared between the synchronous and asynchronous paths, so a key resolved by one is visible to the other. +- **Behavior change:** `VerifyColumnMasterKeyMetadata` and `VerifyColumnMasterKeyMetadataAsync` now reject a null or empty `signature` with `ArgumentNullException` / `ArgumentException` instead of passing it through to the Azure SDK. In-product callers are unaffected because `SqlSecurityUtility.VerifyColumnMasterKeySignature` already rejects those values upstream. +- **Runtime requirement:** this version requires `Microsoft.Data.SqlClient` 7.1.0-preview3 or later at runtime, because the overridden methods only exist on the 7.1 base class. The NuGet dependency floor covers restore, but downgrading the driver below 7.1 at runtime produces a `TypeLoadException`, since assembly versions unify at `major.0.0.0`. + +### Fixed + +- `LocalCache.GetOrCreate` now compacts on `Count >= maxSize` rather than `Count == maxSize`. Under concurrency the equality test could be stepped past, permanently disabling compaction of the 2000-entry signature cache. ([#4540](https://github.com/dotnet/SqlClient/pull/4540)) +- `GetCryptographyClient` now uses `GetOrAdd` instead of `TryGetValue` followed by `TryAdd`, so concurrent callers no longer end up using different `CryptographyClient` instances for the same key. ([#4540](https://github.com/dotnet/SqlClient/pull/4540)) + ## Target Platform Support - .NET Standard 2.0 From f4aedb2b6afba7b6b14111ed28fdd4e3dd4555bf Mon Sep 17 00:00:00 2001 From: priyankatiwari08 Date: Tue, 25 Aug 2026 12:33:48 +0530 Subject: [PATCH 3/6] Add #4439 and #4445 to 7.1.0-preview3 release notes Both are user-facing fixes merged into the preview3 milestone that were not yet captured in the release notes or CHANGELOG: - #4439: DateOnly values in sql_variant TVP columns were sent as datetime instead of date, overflowing for values outside the datetime range. - #4445: ServerCertificate pin validation was skipped when the platform reported no TLS policy errors, and an unloadable certificate file fell back to host-name validation instead of failing closed. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8c691319-4c66-40f6-a88e-b453937052f1 --- CHANGELOG.md | 6 ++++++ release-notes/7.1/7.1.0-preview3.md | 2 ++ 2 files changed, 8 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index d820f44b78..4b316ad013 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -88,6 +88,12 @@ See the [full release notes](release-notes/7.1/7.1.0-preview3.md) for detailed d - Fixed a TDS stream error when passing a `DateOnly` value as a parameter with `SqlDbType.Variant`. ([#4294](https://github.com/dotnet/SqlClient/pull/4294)) +- Fixed `DateOnly` values written to a `sql_variant` column of a table-valued parameter being sent as `datetime` instead of `date`, which also caused an overflow for values out of `datetime` range. + ([#4439](https://github.com/dotnet/SqlClient/pull/4439)) + +- Fixed the `ServerCertificate` connection-string keyword not being honored when the platform reported no TLS policy errors, and made an unloadable certificate file fail closed instead of silently falling back to host-name validation. + ([#4445](https://github.com/dotnet/SqlClient/pull/4445)) + - Fixed `SqlConnection.AccessTokenCallback` not disabling Transparent Network IP Resolution by default, unlike `SqlConnection.AccessToken`, along with a related connection pool key defect. ([#4520](https://github.com/dotnet/SqlClient/pull/4520)) diff --git a/release-notes/7.1/7.1.0-preview3.md b/release-notes/7.1/7.1.0-preview3.md index 36e067c342..df00a6121b 100644 --- a/release-notes/7.1/7.1.0-preview3.md +++ b/release-notes/7.1/7.1.0-preview3.md @@ -91,6 +91,8 @@ This update brings the following changes since the [7.1.0-preview2](7.1.0-previe - Fixed a `SqlConnectionFactory` timer that woke the process every 30 seconds for the lifetime of the application even when no connection pools existed — including with `Pooling=False` and after `ClearAllPools()`. The pruning timer is now armed on demand and disarmed once there is nothing left to prune. A missing .NET Framework unload hook was also added. ([#1881](https://github.com/dotnet/SqlClient/issues/1881), [#4479](https://github.com/dotnet/SqlClient/pull/4479)) - Fixed `OverflowException` when sending large `decimal` values (for example `decimal.MaxValue`) as a parameter with explicit `Precision` and `Scale`, which primarily affected Always Encrypted scenarios where both must always be set. ([#1655](https://github.com/dotnet/SqlClient/issues/1655), [#4443](https://github.com/dotnet/SqlClient/pull/4443)) - Fixed a TDS stream error when passing a `DateOnly` value as a parameter with `SqlDbType.Variant`; the required `sql_variant` write paths were missing. (net8.0/net9.0 only) ([#3953](https://github.com/dotnet/SqlClient/issues/3953), [#4294](https://github.com/dotnet/SqlClient/pull/4294)) +- Fixed `DateOnly` values written to a `sql_variant` column of a table-valued parameter being sent as `datetime` instead of `date`. Besides being incorrect, this caused an overflow for `DateOnly` values that are valid for `date` but out of range for `datetime`. Reading continues to return `DateTime` instances by default, for backwards compatibility. (net8.0/net9.0 only — .NET Framework has no `DateOnly` type) ([#3934](https://github.com/dotnet/SqlClient/issues/3934), [#4439](https://github.com/dotnet/SqlClient/pull/4439)) +- Fixed the `ServerCertificate` connection-string keyword not being honored when the platform reported no TLS policy errors. The configured certificate is now always compared against the certificate presented by the server, matching the documented exact-match semantic. If the configured file cannot be loaded or parsed, the connection now fails closed with an `SSLCertificateAuthenticationException` naming the path, rather than silently falling back to host-name validation. A null server certificate now throws `AuthenticationException` instead of `NullReferenceException`. Connections that do not set `ServerCertificate`, and those whose configured certificate matches, are unaffected. ([#4445](https://github.com/dotnet/SqlClient/pull/4445)) - Fixed `SqlConnection.AccessTokenCallback` not disabling Transparent Network IP Resolution by default, unlike `SqlConnection.AccessToken`. Also fixed a related defect in how the authentication setters build the connection pool key, and made `SspiContextProvider` mutually exclusive with token-based authentication. (net462 only for the TNIR behavior) ([#4520](https://github.com/dotnet/SqlClient/pull/4520)) - Fixed several async entry points in `SqlBulkCopy`, `SqlDataReader.InvokeAsyncCall`, `SqlCommand.Reader`, and `SqlCommand.Xml` that captured fatal exceptions such as `OutOfMemoryException` into faulted `Task`s instead of letting them propagate. ([#4437](https://github.com/dotnet/SqlClient/pull/4437)) - Fixed `Authentication=Active Directory Service Principal` (and the interactive, password, integrated, and device-code flows) failing against endpoints such as the Dataverse / Dynamics 365 TDS endpoint, which return a multi-segment Entra ID authority (`https://login.microsoftonline.com/{tenantId}/oauth2/authorize`) in the TDS `FEDAUTHINFO` token. The tenant id is now taken from the first path segment of the authority instead of the last. This fix ships in `Microsoft.Data.SqlClient.Extensions.Azure`; see its [7.1.0-preview3](../Extensions/Azure/7.1/7.1.0-preview3.md) release notes. ([#4496](https://github.com/dotnet/SqlClient/issues/4496), [#4521](https://github.com/dotnet/SqlClient/pull/4521)) From 5e6870dde711002bbe9768224b32c2b1ca3eef1a Mon Sep 17 00:00:00 2001 From: Priyanka Tiwari Date: Tue, 25 Aug 2026 13:56:02 +0530 Subject: [PATCH 4/6] Add #4474 to 7.1.0-preview3 cross-platform build notes PR #4474 (Remove OS-Specific Builds) removed OS-specific build targets and output paths, and rewrote the MDS nuspec to source a single OS-agnostic assembly for both the win and unix runtime folders. Verified the nuspec change is src-path-only: all 52 file entries have identical target= values before and after, so the produced package layout is unchanged. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8c691319-4c66-40f6-a88e-b453937052f1 --- CHANGELOG.md | 5 +++-- release-notes/7.1/7.1.0-preview3.md | 4 ++-- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 4b316ad013..c0a6898df6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -45,9 +45,10 @@ See the [full release notes](release-notes/7.1/7.1.0-preview3.md) for detailed d ### Changed -- Completed the removal of OS-specific compilation from `Microsoft.Data.SqlClient`; the driver now builds a single cross-platform assembly and the `_WINDOWS`/`_UNIX` symbols have been removed. Package structure and contents are unchanged, and Windows-only native SNI types now trim cleanly on Linux and macOS. +- Completed the removal of OS-specific compilation from `Microsoft.Data.SqlClient`; the driver now builds a single cross-platform assembly and the `_WINDOWS`/`_UNIX` symbols have been removed. OS-specific build targets and output paths were also removed. Package structure and contents are unchanged, and Windows-only native SNI types now trim cleanly on Linux and macOS. ([#4207](https://github.com/dotnet/SqlClient/pull/4207), - [#4465](https://github.com/dotnet/SqlClient/pull/4465)) + [#4465](https://github.com/dotnet/SqlClient/pull/4465), + [#4474](https://github.com/dotnet/SqlClient/pull/4474)) - Reduced managed allocations in the async read path by restoring reuse of `PacketData` nodes via a bounded free list on `StateSnapshot`. ([#4536](https://github.com/dotnet/SqlClient/pull/4536)) diff --git a/release-notes/7.1/7.1.0-preview3.md b/release-notes/7.1/7.1.0-preview3.md index df00a6121b..496bc73426 100644 --- a/release-notes/7.1/7.1.0-preview3.md +++ b/release-notes/7.1/7.1.0-preview3.md @@ -64,8 +64,8 @@ This update brings the following changes since the [7.1.0-preview2](7.1.0-previe *What Changed:* -- Completed the removal of OS-specific compilation from `Microsoft.Data.SqlClient`. The native SNI interop types, enums, structs, P/Invokes and the SNI layer itself now build identically for Windows and non-Windows targets, and the `_WINDOWS`/`_UNIX` conditional compilation symbols have been removed from the driver project. The structure and contents of the produced NuGet package are unchanged. - ([#4207](https://github.com/dotnet/SqlClient/pull/4207), [#4239](https://github.com/dotnet/SqlClient/issues/4239), [#4465](https://github.com/dotnet/SqlClient/pull/4465)) +- Completed the removal of OS-specific compilation from `Microsoft.Data.SqlClient`. The native SNI interop types, enums, structs, P/Invokes and the SNI layer itself now build identically for Windows and non-Windows targets, and the `_WINDOWS`/`_UNIX` conditional compilation symbols have been removed from the driver project. OS-specific build targets and output paths have also been removed from the build, so a single OS-agnostic assembly now feeds both the `runtimes\win` and `runtimes\unix` folders of the package. The structure and contents of the produced NuGet package are unchanged. + ([#4207](https://github.com/dotnet/SqlClient/pull/4207), [#4239](https://github.com/dotnet/SqlClient/issues/4239), [#4465](https://github.com/dotnet/SqlClient/pull/4465), [#4474](https://github.com/dotnet/SqlClient/pull/4474)) *Who Benefits:* From f2db2fadef223c4cedf327dc1e5360d7972a6bf7 Mon Sep 17 00:00:00 2001 From: Priyanka Tiwari Date: Tue, 25 Aug 2026 14:21:48 +0530 Subject: [PATCH 5/6] Clarify #4536 allocation fix applies to the default async read path Addresses review feedback on PR #4565: the PacketData node-reuse fix is not gated behind UseCompatibilityAsyncBehaviour or any other AppContext switch, and the perf validation was measured on the default path. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8c691319-4c66-40f6-a88e-b453937052f1 --- CHANGELOG.md | 2 +- release-notes/7.1/7.1.0-preview3.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c0a6898df6..4b92ed6c2b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -50,7 +50,7 @@ See the [full release notes](release-notes/7.1/7.1.0-preview3.md) for detailed d [#4465](https://github.com/dotnet/SqlClient/pull/4465), [#4474](https://github.com/dotnet/SqlClient/pull/4474)) -- Reduced managed allocations in the async read path by restoring reuse of `PacketData` nodes via a bounded free list on `StateSnapshot`. +- Reduced managed allocations in the async read path by restoring reuse of `PacketData` nodes via a bounded free list on `StateSnapshot`. This applies to the default async read path and is not gated behind any AppContext switch. ([#4536](https://github.com/dotnet/SqlClient/pull/4536)) - Converted 119 `SqlClientEventSource` trace call sites back to parameterized format strings so no formatted string is allocated when tracing is disabled. Trace output is unchanged. diff --git a/release-notes/7.1/7.1.0-preview3.md b/release-notes/7.1/7.1.0-preview3.md index 496bc73426..f1d39a3e19 100644 --- a/release-notes/7.1/7.1.0-preview3.md +++ b/release-notes/7.1/7.1.0-preview3.md @@ -77,7 +77,7 @@ This update brings the following changes since the [7.1.0-preview2](7.1.0-previe #### Other changes -- Reduced managed allocations in the async read path by restoring reuse of `PacketData` linked-list nodes via a bounded free list on `StateSnapshot`, recovering an allocation regression against the 6.1.6 baseline. ([#4536](https://github.com/dotnet/SqlClient/pull/4536)) +- Reduced managed allocations in the async read path by restoring reuse of `PacketData` linked-list nodes via a bounded free list on `StateSnapshot`, recovering an allocation regression against the 6.1.6 baseline. This applies to the default async read path and is not gated behind any AppContext switch; `SqlCommand/ExecuteReaderAsync` returns from +120.9% allocated against the 6.1.6 baseline to +0.1%. ([#4536](https://github.com/dotnet/SqlClient/pull/4536)) - `SqlBulkCopy` no longer builds SQL Graph column alias mapping tables when the source and destination tables contain no graph pseudo-columns (`$edge_id`, `$to_id`, `$from_id`, `$node_id`), recovering a bulk copy performance regression introduced with graph column alias support in [#3677](https://github.com/dotnet/SqlClient/pull/3677). Graph table bulk copy behavior is unchanged. ([#4535](https://github.com/dotnet/SqlClient/pull/4535)) - Converted 119 `SqlClientEventSource` trace call sites back to parameterized format strings instead of C# interpolated strings, so no formatted string is allocated when tracing is disabled. Trace output is unchanged. ([#4528](https://github.com/dotnet/SqlClient/pull/4528)) - Consolidated server capability detection into a new internal `ConnectionCapabilities` type shared by the internal connection, `SqlMetaDataFactory`, and `TdsParser`, so metadata decisions can be driven by negotiated feature flags rather than by server version alone. ([#3862](https://github.com/dotnet/SqlClient/pull/3862)) From 1f7347fe8f5cdcde4bdd7e3114230b28812d7cad Mon Sep 17 00:00:00 2001 From: Priyanka Tiwari Date: Wed, 26 Aug 2026 16:05:52 +0530 Subject: [PATCH 6/6] Scope preview3 release notes to customer-facing changes Remove entries with no customer-visible effect, and reframe entries that led with implementation detail rather than customer impact. Removed: - #3862 ConnectionCapabilities consolidation - internal refactor; the GetSchema("DataTypes") fix it enables is deferred to a later PR. - #3700/#3741 SSRP scaffolding - adds no parsing code and no behavior change. - #4517 CodeQL findings - PKCS#1 half is suppression comments for declared false positives; the SHA-1 removal is a no-op in practice. - #4421 Extensions.Azure APIScan remediation - no public API change and managed-identity behavior preserved exactly; the removed assignment was already a no-op. Extensions.Azure now has no Changed section. Promoted: - #4504 counter fixes moved from a pool V2 sub-bullet into Fixed. These affect the default pool that customers use without opting in, and the previous text understated them as two fixes limited to Count. Reframed: - Cross-platform build collapsed to the one customer-visible outcome (trimming on Linux/macOS); package contents were always unchanged. - #4528 now leads with the allocation regression rather than call-site count. - AKV cache fixes now lead with symptoms (unbounded signature cache growth, duplicate CryptographyClient per key) rather than GetOrCreate/GetOrAdd. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8c691319-4c66-40f6-a88e-b453937052f1 --- CHANGELOG.md | 18 +++++-------- release-notes/7.1/7.1.0-preview3.md | 27 +++---------------- .../Extensions/Azure/7.1/7.1.0-preview3.md | 7 +---- .../7.1/7.1.0-preview3.md | 4 +-- 4 files changed, 13 insertions(+), 43 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 4b92ed6c2b..7868a893a0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -45,7 +45,7 @@ See the [full release notes](release-notes/7.1/7.1.0-preview3.md) for detailed d ### Changed -- Completed the removal of OS-specific compilation from `Microsoft.Data.SqlClient`; the driver now builds a single cross-platform assembly and the `_WINDOWS`/`_UNIX` symbols have been removed. OS-specific build targets and output paths were also removed. Package structure and contents are unchanged, and Windows-only native SNI types now trim cleanly on Linux and macOS. +- The driver now builds a single cross-platform assembly. Package structure and contents are unchanged, and Windows-only native SNI types now trim cleanly on Linux and macOS. ([#4207](https://github.com/dotnet/SqlClient/pull/4207), [#4465](https://github.com/dotnet/SqlClient/pull/4465), [#4474](https://github.com/dotnet/SqlClient/pull/4474)) @@ -53,15 +53,9 @@ See the [full release notes](release-notes/7.1/7.1.0-preview3.md) for detailed d - Reduced managed allocations in the async read path by restoring reuse of `PacketData` nodes via a bounded free list on `StateSnapshot`. This applies to the default async read path and is not gated behind any AppContext switch. ([#4536](https://github.com/dotnet/SqlClient/pull/4536)) -- Converted 119 `SqlClientEventSource` trace call sites back to parameterized format strings so no formatted string is allocated when tracing is disabled. Trace output is unchanged. +- Operations no longer allocate a formatted trace string when `SqlClientEventSource` tracing is disabled, recovering a memory regression against the 6.1.6 baseline. Trace output with tracing enabled is unchanged. ([#4528](https://github.com/dotnet/SqlClient/pull/4528)) -- Consolidated server capability detection into a new internal `ConnectionCapabilities` type shared by the internal connection, `SqlMetaDataFactory`, and `TdsParser`. - ([#3862](https://github.com/dotnet/SqlClient/pull/3862)) - -- Added scaffolding for a managed SSRP client in the managed SNI layer. No SSRP parsing behavior changes yet. - ([#3741](https://github.com/dotnet/SqlClient/pull/3741)) - - Updated centrally managed dependency versions for the `net9.0` target framework to `9.0.18`, and added `System.Threading.RateLimiting` to the packaged dependency metadata. Non-`net9.0` targets keep their existing `8.0.x` pins. ([#4507](https://github.com/dotnet/SqlClient/pull/4507)) @@ -71,7 +65,7 @@ See the [full release notes](release-notes/7.1/7.1.0-preview3.md) for detailed d - Bypassed SQL Graph column alias mapping in `SqlBulkCopy` when neither the source nor destination table contains graph pseudo-columns, recovering a bulk copy performance regression. Graph table bulk copy behavior is unchanged. ([#4535](https://github.com/dotnet/SqlClient/pull/4535)) -- Re-shipped `Microsoft.Data.SqlClient.Extensions.Azure` as `7.1.0-preview3`, removing obsolete `Azure.Identity` API usage and fixing Entra ID tenant parsing for multi-segment authorities. See [release notes](release-notes/Extensions/Azure/7.1/7.1.0-preview3.md). +- Re-shipped `Microsoft.Data.SqlClient.Extensions.Azure` as `7.1.0-preview3`, fixing Entra ID tenant parsing for multi-segment authorities. See [release notes](release-notes/Extensions/Azure/7.1/7.1.0-preview3.md). - Re-shipped `Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider` as `7.1.0-preview3` with new asynchronous key store provider APIs, and `Microsoft.Data.SqlClient.Extensions.Abstractions` and `Microsoft.Data.SqlClient.Internal.Logging` as `7.1.0-preview3` (version alignment only, no functional changes). See release notes for [AKV](release-notes/add-ons/AzureKeyVaultProvider/7.1/7.1.0-preview3.md), [Abstractions](release-notes/Extensions/Abstractions/7.1/7.1.0-preview3.md), and [Logging](release-notes/Internal/Logging/7.1/7.1.0-preview3.md). @@ -83,6 +77,9 @@ See the [full release notes](release-notes/7.1/7.1.0-preview3.md) for detailed d - Fixed a `SqlConnectionFactory` timer that woke the process every 30 seconds for the lifetime of the application even when no connection pools existed, including with `Pooling=False` and after `ClearAllPools()`. ([#4479](https://github.com/dotnet/SqlClient/pull/4479)) +- Fixed connection pool performance counter defects affecting the default pool as well as pool V2. `active-soft-connects` and `number-of-active-connections` could go negative after a failed connection activation, and several gauges drifted upward permanently after a broken connection was replaced. + ([#4504](https://github.com/dotnet/SqlClient/pull/4504)) + - Fixed `OverflowException` when sending large `decimal` values as a parameter with explicit `Precision` and `Scale`, which primarily affected Always Encrypted scenarios. ([#4443](https://github.com/dotnet/SqlClient/pull/4443)) @@ -104,9 +101,6 @@ See the [full release notes](release-notes/7.1/7.1.0-preview3.md) for detailed d - Fixed `Authentication=Active Directory Service Principal` (and the other Entra ID flows) failing against endpoints that return a multi-segment authority such as the Dataverse / Dynamics 365 TDS endpoint; the tenant id is now taken from the first path segment of the STSURL authority instead of the last. Ships in `Microsoft.Data.SqlClient.Extensions.Azure`. ([#4521](https://github.com/dotnet/SqlClient/pull/4521)) -- Addressed CodeQL findings by removing SHA-1 from the portable PDB checksum algorithm map and annotating the Always Encrypted RSA PKCS#1 v1.5 signature paths. - ([#4517](https://github.com/dotnet/SqlClient/pull/4517)) - ## [Preview Release 7.1.0-preview2] - 2026-07-09 This update brings the following changes since the [7.1.0-preview1](release-notes/7.1/7.1.0-preview1.md) release. diff --git a/release-notes/7.1/7.1.0-preview3.md b/release-notes/7.1/7.1.0-preview3.md index f1d39a3e19..5ce782c7a7 100644 --- a/release-notes/7.1/7.1.0-preview3.md +++ b/release-notes/7.1/7.1.0-preview3.md @@ -56,32 +56,14 @@ This update brings the following changes since the [7.1.0-preview2](7.1.0-previe *Impact:* - No change to default behavior. `ChannelDbConnectionPool` is used only when `Switch.Microsoft.Data.SqlClient.UseConnectionPoolV2` is enabled; the default pool remains `WaitHandleDbConnectionPool`. -- Two counter fixes surfaced by this work apply to **both** pools: `Count` now reflects connections that actually belong to the pool rather than including in-flight reservations. +- This work also surfaced connection pool performance counter defects that affect the **default** pool, which are listed under *Fixed* below. ### Changed -#### Single Cross-Platform Build of the Driver Assembly - -*What Changed:* - -- Completed the removal of OS-specific compilation from `Microsoft.Data.SqlClient`. The native SNI interop types, enums, structs, P/Invokes and the SNI layer itself now build identically for Windows and non-Windows targets, and the `_WINDOWS`/`_UNIX` conditional compilation symbols have been removed from the driver project. OS-specific build targets and output paths have also been removed from the build, so a single OS-agnostic assembly now feeds both the `runtimes\win` and `runtimes\unix` folders of the package. The structure and contents of the produced NuGet package are unchanged. - ([#4207](https://github.com/dotnet/SqlClient/pull/4207), [#4239](https://github.com/dotnet/SqlClient/issues/4239), [#4465](https://github.com/dotnet/SqlClient/pull/4465), [#4474](https://github.com/dotnet/SqlClient/pull/4474)) - -*Who Benefits:* - -- Trimming-sensitive applications: the Windows-only native SNI types are now removed cleanly by the IL trimmer on Linux and macOS. A `ILLink.Substitutions.xml` naming defect that previously prevented `LocalAppContextSwitches.UseManagedNetworking` from being substituted for a constant is also fixed. - -*Impact:* - -- No API or packaging change. The same assembly content ships as before; only the build configuration changed. - -#### Other changes - +- Windows-only native SNI types are now removed cleanly by the IL trimmer on Linux and macOS, and `LocalAppContextSwitches.UseManagedNetworking` is now substituted for a constant (an `ILLink.Substitutions.xml` naming defect previously prevented this). The driver now builds a single OS-agnostic assembly for all platforms; the structure and contents of the NuGet package are unchanged. ([#4207](https://github.com/dotnet/SqlClient/pull/4207), [#4239](https://github.com/dotnet/SqlClient/issues/4239), [#4465](https://github.com/dotnet/SqlClient/pull/4465), [#4474](https://github.com/dotnet/SqlClient/pull/4474)) - Reduced managed allocations in the async read path by restoring reuse of `PacketData` linked-list nodes via a bounded free list on `StateSnapshot`, recovering an allocation regression against the 6.1.6 baseline. This applies to the default async read path and is not gated behind any AppContext switch; `SqlCommand/ExecuteReaderAsync` returns from +120.9% allocated against the 6.1.6 baseline to +0.1%. ([#4536](https://github.com/dotnet/SqlClient/pull/4536)) - `SqlBulkCopy` no longer builds SQL Graph column alias mapping tables when the source and destination tables contain no graph pseudo-columns (`$edge_id`, `$to_id`, `$from_id`, `$node_id`), recovering a bulk copy performance regression introduced with graph column alias support in [#3677](https://github.com/dotnet/SqlClient/pull/3677). Graph table bulk copy behavior is unchanged. ([#4535](https://github.com/dotnet/SqlClient/pull/4535)) -- Converted 119 `SqlClientEventSource` trace call sites back to parameterized format strings instead of C# interpolated strings, so no formatted string is allocated when tracing is disabled. Trace output is unchanged. ([#4528](https://github.com/dotnet/SqlClient/pull/4528)) -- Consolidated server capability detection into a new internal `ConnectionCapabilities` type shared by the internal connection, `SqlMetaDataFactory`, and `TdsParser`, so metadata decisions can be driven by negotiated feature flags rather than by server version alone. ([#3862](https://github.com/dotnet/SqlClient/pull/3862)) -- Added scaffolding for a managed SSRP client in the managed SNI layer, including `PacketBuffer` and sequence-reading helpers. No SSRP parsing behavior changes yet. ([#3700](https://github.com/dotnet/SqlClient/issues/3700), [#3741](https://github.com/dotnet/SqlClient/pull/3741)) +- Operations no longer allocate a formatted trace string when `SqlClientEventSource` tracing is disabled, recovering a memory regression against the 6.1.6 baseline. Trace output with tracing enabled is unchanged. ([#4528](https://github.com/dotnet/SqlClient/pull/4528)) - Updated centrally managed dependency versions for the `net9.0` target framework to `9.0.18`, and added `System.Threading.RateLimiting` to the packaged dependency metadata. Non-`net9.0` targets keep their existing `8.0.x` pins. ([#4507](https://github.com/dotnet/SqlClient/pull/4507)) - Updated the `Microsoft.Data.SqlClient.SNI` and `Microsoft.Data.SqlClient.SNI.runtime` dependencies to `7.1.0-preview3.26226.3`. ([#4564](https://github.com/dotnet/SqlClient/pull/4564)) @@ -89,6 +71,7 @@ This update brings the following changes since the [7.1.0-preview2](7.1.0-previe - Fixed Always Encrypted VSM/HGS enclave attestation not verifying that the enclave public key used to establish the session matches the key committed to by the signed attestation report. The provider now compares `SHA-256(enclave public key)` against the report's `EnclaveData` using a fixed-time comparison, and rejects attestation when the data is missing, malformed, or mismatched. ([#4532](https://github.com/dotnet/SqlClient/pull/4532)) - Fixed a `SqlConnectionFactory` timer that woke the process every 30 seconds for the lifetime of the application even when no connection pools existed — including with `Pooling=False` and after `ClearAllPools()`. The pruning timer is now armed on demand and disarmed once there is nothing left to prune. A missing .NET Framework unload hook was also added. ([#1881](https://github.com/dotnet/SqlClient/issues/1881), [#4479](https://github.com/dotnet/SqlClient/pull/4479)) +- Fixed connection pool performance counter defects affecting the **default** pool as well as pool V2. `active-soft-connects` and `number-of-active-connections` could go negative after a failed connection activation, and `active-soft-connects`, `active-hard-connections`, and `number-of-pooled-connections` drifted upward permanently after a broken connection was replaced. Because these are gauges, an unmatched increment or decrement never recovered for the lifetime of the process. ([#4504](https://github.com/dotnet/SqlClient/pull/4504)) - Fixed `OverflowException` when sending large `decimal` values (for example `decimal.MaxValue`) as a parameter with explicit `Precision` and `Scale`, which primarily affected Always Encrypted scenarios where both must always be set. ([#1655](https://github.com/dotnet/SqlClient/issues/1655), [#4443](https://github.com/dotnet/SqlClient/pull/4443)) - Fixed a TDS stream error when passing a `DateOnly` value as a parameter with `SqlDbType.Variant`; the required `sql_variant` write paths were missing. (net8.0/net9.0 only) ([#3953](https://github.com/dotnet/SqlClient/issues/3953), [#4294](https://github.com/dotnet/SqlClient/pull/4294)) - Fixed `DateOnly` values written to a `sql_variant` column of a table-valued parameter being sent as `datetime` instead of `date`. Besides being incorrect, this caused an overflow for `DateOnly` values that are valid for `date` but out of range for `datetime`. Reading continues to return `DateTime` instances by default, for backwards compatibility. (net8.0/net9.0 only — .NET Framework has no `DateOnly` type) ([#3934](https://github.com/dotnet/SqlClient/issues/3934), [#4439](https://github.com/dotnet/SqlClient/pull/4439)) @@ -96,8 +79,6 @@ This update brings the following changes since the [7.1.0-preview2](7.1.0-previe - Fixed `SqlConnection.AccessTokenCallback` not disabling Transparent Network IP Resolution by default, unlike `SqlConnection.AccessToken`. Also fixed a related defect in how the authentication setters build the connection pool key, and made `SspiContextProvider` mutually exclusive with token-based authentication. (net462 only for the TNIR behavior) ([#4520](https://github.com/dotnet/SqlClient/pull/4520)) - Fixed several async entry points in `SqlBulkCopy`, `SqlDataReader.InvokeAsyncCall`, `SqlCommand.Reader`, and `SqlCommand.Xml` that captured fatal exceptions such as `OutOfMemoryException` into faulted `Task`s instead of letting them propagate. ([#4437](https://github.com/dotnet/SqlClient/pull/4437)) - Fixed `Authentication=Active Directory Service Principal` (and the interactive, password, integrated, and device-code flows) failing against endpoints such as the Dataverse / Dynamics 365 TDS endpoint, which return a multi-segment Entra ID authority (`https://login.microsoftonline.com/{tenantId}/oauth2/authorize`) in the TDS `FEDAUTHINFO` token. The tenant id is now taken from the first path segment of the authority instead of the last. This fix ships in `Microsoft.Data.SqlClient.Extensions.Azure`; see its [7.1.0-preview3](../Extensions/Azure/7.1/7.1.0-preview3.md) release notes. ([#4496](https://github.com/dotnet/SqlClient/issues/4496), [#4521](https://github.com/dotnet/SqlClient/pull/4521)) -- Addressed CodeQL findings by removing SHA-1 from the portable PDB checksum algorithm map and annotating the Always Encrypted RSA PKCS#1 v1.5 signature paths, which are fixed by the Always Encrypted on-the-wire format and cannot be changed without breaking interoperability with SQL Server tooling and other drivers. ([#4517](https://github.com/dotnet/SqlClient/pull/4517)) - ### Companion package release notes - [Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider 7.1.0-preview3](../add-ons/AzureKeyVaultProvider/7.1/7.1.0-preview3.md) diff --git a/release-notes/Extensions/Azure/7.1/7.1.0-preview3.md b/release-notes/Extensions/Azure/7.1/7.1.0-preview3.md index 277853905d..c7fb0b952f 100644 --- a/release-notes/Extensions/Azure/7.1/7.1.0-preview3.md +++ b/release-notes/Extensions/Azure/7.1/7.1.0-preview3.md @@ -2,15 +2,10 @@ ## Preview Release 7.1.0-preview3 - 2026-08-26 -This release removes an obsolete Azure.Identity API usage, fixes Entra ID tenant parsing for multi-segment authorities, and continues version-alignment of `Microsoft.Data.SqlClient.Extensions.Azure` with the core `Microsoft.Data.SqlClient` driver version (`7.1.0-preview3`). The previous release of this package was [7.1.0-preview2](7.1.0-preview2.md). See the core [Microsoft.Data.SqlClient 7.1.0-preview3](../../../7.1/7.1.0-preview3.md) release notes for the driver-family changes shipped alongside this version. +This release fixes Entra ID tenant parsing for multi-segment authorities, and continues version-alignment of `Microsoft.Data.SqlClient.Extensions.Azure` with the core `Microsoft.Data.SqlClient` driver version (`7.1.0-preview3`). The previous release of this package was [7.1.0-preview2](7.1.0-preview2.md). See the core [Microsoft.Data.SqlClient 7.1.0-preview3](../../../7.1/7.1.0-preview3.md) release notes for the driver-family changes shipped alongside this version. > **Version alignment:** This package's version continues to track the core `Microsoft.Data.SqlClient` driver version. See the [7.0.2 release notes](../../../7.0/7.0.2.md) for the initial alignment announcement. This assembly ships with `FileVersion 7.1.0.x`. The `AssemblyVersion 7.0.0.0` remains unchanged from the `7.0.2` release. -### Changed - -- Removed the assignment to the obsolete `DefaultAzureCredentialOptions.SharedTokenCacheUsername` property in `ActiveDirectoryAuthenticationProvider`, and migrated from the obsolete `ManagedIdentityCredential(string, TokenCredentialOptions)` constructor to `ManagedIdentityCredential(ManagedIdentityCredentialOptions)`. `SharedTokenCacheCredential` is no longer part of the `DefaultAzureCredential` chain, so the removed assignment was already a no-op; the client id continues to flow through `ManagedIdentityClientId` and `WorkloadIdentityClientId`. There are no public API changes and managed-identity behavior — including system-assigned versus user-assigned selection and `AuthorityHost` propagation — is preserved exactly. - ([#4421](https://github.com/dotnet/SqlClient/pull/4421)) - ### Fixed - Fixed Entra ID tenant parsing for multi-segment STSURL authorities. Endpoints such as the Dataverse / Dynamics 365 TDS endpoint return an OAuth v1 style authority (`https://login.microsoftonline.com/{tenantId}/oauth2/authorize`) in the TDS `FEDAUTHINFO` token. `ActiveDirectoryAuthenticationProvider.AcquireTokenAsync` split that authority at the **last** `/`, so the credential received the literal string `"authorize"` as its tenant id and connections failed with `ClientSecretCredential authentication failed`. The tenant is now taken from the **first** path segment, so trailing endpoint suffixes (`/oauth2/authorize`, `/oauth2/v2.0/token`, ...) are ignored, and the normalized authority is used for the MSAL-based interactive, password, integrated, and device-code flows as well. An unparseable authority now raises a clear `AuthenticationException` naming the offending value, and provider-raised authentication errors are no longer re-wrapped as "Unexpected error". Behavior is unchanged for the bare `https://login.microsoftonline.com/{tenantId}` authority sent by Azure SQL, Fabric, and Synapse. There are no public API changes. diff --git a/release-notes/add-ons/AzureKeyVaultProvider/7.1/7.1.0-preview3.md b/release-notes/add-ons/AzureKeyVaultProvider/7.1/7.1.0-preview3.md index 9074b15fb5..d27c19a432 100644 --- a/release-notes/add-ons/AzureKeyVaultProvider/7.1/7.1.0-preview3.md +++ b/release-notes/add-ons/AzureKeyVaultProvider/7.1/7.1.0-preview3.md @@ -30,8 +30,8 @@ See the core [Microsoft.Data.SqlClient 7.1.0-preview3](../../../7.1/7.1.0-previe ### Fixed -- `LocalCache.GetOrCreate` now compacts on `Count >= maxSize` rather than `Count == maxSize`. Under concurrency the equality test could be stepped past, permanently disabling compaction of the 2000-entry signature cache. ([#4540](https://github.com/dotnet/SqlClient/pull/4540)) -- `GetCryptographyClient` now uses `GetOrAdd` instead of `TryGetValue` followed by `TryAdd`, so concurrent callers no longer end up using different `CryptographyClient` instances for the same key. ([#4540](https://github.com/dotnet/SqlClient/pull/4540)) +- Fixed the 2000-entry column master key signature cache being able to stop compacting and grow unbounded. `LocalCache.GetOrCreate` compacted only when `Count == maxSize`, and under concurrency that equality test could be stepped past, permanently disabling compaction. It now compacts on `Count >= maxSize`. ([#4540](https://github.com/dotnet/SqlClient/pull/4540)) +- Fixed concurrent callers ending up with different `CryptographyClient` instances for the same key, which produced redundant clients and duplicated Key Vault handshakes. `GetCryptographyClient` now uses `GetOrAdd` instead of `TryGetValue` followed by `TryAdd`. ([#4540](https://github.com/dotnet/SqlClient/pull/4540)) ## Target Platform Support