Bump the dotnet-runtime group with 10 updates

[dependabot]

Updated Microsoft.AspNetCore.Authentication.JwtBearer from 10.0.8 to 10.0.12.

Release notes

Sourced from Microsoft.AspNetCore.Authentication.JwtBearer's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Data.SqlClient from 6.1.1 to 6.1.6.

Release notes

Sourced from Microsoft.Data.SqlClient's releases.

6.1.6

This update brings the following changes since the 6.1.5 release:

Added

WAM broker support for the supported Entra ID authentication modes (Windows only)

What Changed:

• Added support for the Web Account Manager (WAM) broker for the supported Microsoft Entra ID authentication modes. A new ActiveDirectoryAuthenticationProviderOptions options bag and a corresponding ActiveDirectoryAuthenticationProvider(ActiveDirectoryAuthenticationProviderOptions options) constructor were introduced, exposing a UseWamBroker property (alongside ApplicationClientId and DeviceCodeFlowCallback).
  (#​4288, #​4387)
• Added a cross-platform SetParentActivityOrWindowFunc(Func<object> parentActivityOrWindowFunc) method so callers can supply a parent window handle on Windows or a parent Activity/UIViewController on Android/iOS/MAUI.

Who Benefits:

• Applications using ActiveDirectoryInteractive and other supported Entra ID authentication modes on Windows benefit from the WAM broker's improved security (tokens are brokered by the OS), single sign-on with the logged-in Windows account, and support for Conditional Access and Windows Hello.

Impact:

• When you supply your ApplicationClientId, WAM is opt-in via ActiveDirectoryAuthenticationProviderOptions.UseWamBroker. Consider enabling it when you want OS-brokered tokens, single sign-on with the signed-in Windows account, Windows Hello, and Conditional Access support.
• UseWamBroker is a Windows-only setting and has no effect on non-Windows platforms, where interactive Entra ID flows always use the system browser.
• Prefer the new options-bag constructor over the positional-argument overloads in new code.

var options = new ActiveDirectoryAuthenticationProviderOptions
{
    ApplicationClientId = "<your-app-client-id>",
    // Enable WAM (Windows only) for OS-brokered tokens, SSO, Windows Hello, and Conditional Access.
    UseWamBroker = true,
};
var provider = new ActiveDirectoryAuthenticationProvider(options);
// Supply the parent window/activity that owns the interactive sign-in prompt.
provider.SetParentActivityOrWindowFunc(() => parentWindowHandle);
SqlAuthenticationProvider.SetProvider(SqlAuthenticationMethod.ActiveDirectoryInteractive, provider);

Changed

Hardened TDS token parsing with data-length bounds checks

What Changed:

• Added bounds checking when parsing TDS token data lengths. The parser now validates the declared length of incoming token data against the available buffer before reading, rejecting malformed or out-of-range length values instead of reading past the intended boundary.
  (#​4340, #​4359)

Who Benefits:

• All consumers benefit from improved resilience against malformed or hostile TDS responses. A server (or man-in-the-middle) sending an invalid token length can no longer drive the parser to read beyond the declared payload.

Impact:
... (truncated)

6.1.5

This update brings the following changes since the 6.1.4 release:

Fixed

• Fixed a connection performance regression where SPN (Service Principal Name) generation was triggered for non-integrated authentication modes (e.g., SQL authentication) on the native SNI path, causing unnecessary DNS lookups and significantly slower connection times. Only affects .NET on Windows (not .NET Framework). (#​3523, #​3946)
• Fixed ExecuteScalar to properly propagate errors when the server sends data followed by an error token. Previously, errors such as conversion failures during WHERE clause evaluation were silently consumed during SqlDataReader.Close() instead of being thrown to the caller, which could result in transactions being unexpectedly zombied. (#​3736, #​3947)
• Fixed SqlDataReader.GetFieldType and SqlDataReader.GetProviderSpecificFieldType to return the correct type (SqlVector<float>) for vector float32 columns. Previously, these methods did not follow the same type-resolution logic as GetValue, returning an incorrect type for vector columns. (#​4104, #​4151)

Target Platform Support

• .NET Framework 4.6.2+ (Windows x86, Windows x64, Windows ARM64)
• .NET 8.0+ (Windows x86, Windows x64, Windows ARM64, Linux, macOS)
• .NET Standard 2.0+ (Windows x86, Windows x64, Windows ARM64, Linux, macOS)

Dependencies

.NET Framework 4.6.2

• Azure.Core 1.50.0
• Azure.Identity 1.17.1
• Microsoft.Data.SqlClient.SNI 6.0.2
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.Identity.Client 4.80.0
• Microsoft.IdentityModel.JsonWebTokens 7.7.1
• Microsoft.IdentityModel.Protocols.OpenIdConnect 7.7.1
• System.Buffers 4.6.1
• System.Data.Common 4.3.0
• System.Diagnostics.DiagnosticSource 8.0.1
• System.IdentityModel.Tokens.Jwt 7.7.1
• System.Memory 4.6.3
• System.Security.Cryptography.Pkcs 8.0.1
• System.Text.Json 8.0.6
• System.Text.RegularExpressions 4.3.1

.NET 8.0

• Azure.Core 1.50.0
• Azure.Identity 1.17.1
• Microsoft.Data.SqlClient.SNI.runtime 6.0.2
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.Identity.Client 4.80.0
• Microsoft.IdentityModel.JsonWebTokens 7.7.1
• Microsoft.IdentityModel.Protocols.OpenIdConnect 7.7.1
• Microsoft.SqlServer.Server 1.0.0
• System.Configuration.ConfigurationManager 8.0.1
• System.Diagnostics.DiagnosticSource 8.0.1
• System.IdentityModel.Tokens.Jwt 7.7.1
• System.Security.Cryptography.Pkcs 8.0.1

.NET 9.0

... (truncated)

6.1.4

This update brings the following changes since the 6.1.3 release:

Fixed

• Fixed NullReferenceException issue with SqlDataAdapter when processing batch scenarios where certain SQL RPC calls may not include system parameters.
  (#​3877)
• Fixed connection pooling issue where extra connection deactivation was causing active connection counts to go negative.
  (#​3776)

Added

AppContext Switch for enabling MultiSubnetFailover

What Changed:

• Added new AppContext switch Switch.Microsoft.Data.SqlClient.EnableMultiSubnetFailoverByDefault to set MultiSubnetFailover=true by default in connection string.
  (#​3851)

Who Benefits:

• Applications that need MultiSubnetFailover enabled globally without modifying connection strings.

Impact:

• Applications can now enable MultiSubnetFailover globally using one of the following methods:

// In application code
AppContext.SetSwitch("Switch.Microsoft.Data.SqlClient.EnableMultiSubnetFailoverByDefault", true);

// In runtimeconfig.json
{
  "configProperties": {
    "Switch.Microsoft.Data.SqlClient.EnableMultiSubnetFailoverByDefault": true
  }
}

<!-- In App.Config -->
<runtime>
  <AppContextSwitchOverrides value="Switch.Microsoft.Data.SqlClient.EnableMultiSubnetFailoverByDefault=true" />
</runtime>

Changed

• Optimized SqlStatistics execution timing by using Environment.TickCount instead of more expensive timing mechanisms.
  ... (truncated)

6.1.3

This update includes the following changes since the 6.1.2 release:

Added

App Context Switch for Ignoring Server-Provided Failover Partner

What Changed:

• A new app context switch Switch.Microsoft.Data.SqlClient.IgnoreServerProvidedFailoverPartner was introduced to let the client ignore server-provided failover partner info in Basic Availability Groups (BAGs). When the switch is enabled, only the failover partner specified in the connection string is used; server-supplied partner values are skipped. This context switch was introduced in PR #​3702.

Who Benefits:

• Applications connecting to SQL Server BAGs using TCP and custom ports, especially where the server's provided partner name lacks the protocol, host, or port. This avoids connection failures when the server-provided partner is incompatible or incomplete.
• Teams who manage availability groups and rely on client-side control of failover behavior in heterogeneous networking environments.

Impact:

• If your environment might be affected (i.e., you operate a BAG with custom ports, or have experienced failures after failover), you can enable the new switch in your application:

AppContext.SetSwitch("Switch.Microsoft.Data.SqlClient.IgnoreServerProvidedFailoverPartner", true);

• Then, ensure your connection string includes your preferred failover partner (with correct tcp:host,port) so that the client uses that instead of the server's suggestion.
• Without enabling this, by default, the client continues to prefer the server-provided partner, maintaining backwards compatibility.

Fixed

• Fixed an issue to ensure reliable metrics initialization during startup, preventing missed telemetry when EventSource is enabled early. (#​3718)

Target Platform Support

• .NET Framework 4.6.2+ (Windows ARM64, Windows x86, Windows x64)
• .NET 8.0+ (Windows x86, Windows x64, Windows ARM64, Windows ARM, Linux, macOS)

Dependencies

.NET Framework 4.6.2+

• Azure.Core 1.47.1
• Azure.Identity 1.14.2
• Microsoft.Bcl.Cryptography 8.0.0
• Microsoft.Data.SqlClient.SNI 6.0.2
• Microsoft.Extensions.Caching.Memory 8.0.1
• Microsoft.IdentityModel.JsonWebTokens 7.7.1
• Microsoft.IdentityModel.Protocols.OpenIdConnect 7.7.1
• System.Buffers 4.5.1
• System.Data.Common 4.3.0
• System.Security.Cryptography.Pkcs 8.0.1
• System.Text.Encodings.Web 8.0.0
  ... (truncated)

6.1.2

This update brings the below changes over the previous stable release:

Fixed

• Fixed an issue where initializing PerformanceCounters would throw System.InvalidOperationException #​3629
• Fixed an issue where a Custom SqlClientAuthenticationProvider was being overwritten by default implementation. #​3651
• Fixed a concurrency issue in connection pooling where the number of active connections could be lower than the configured maximum pool size. #​3653

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore from 10.0.8 to 10.0.12.

Release notes

Sourced from Microsoft.EntityFrameworkCore's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.Abstractions from 10.0.8 to 10.0.12.

Release notes

Sourced from Microsoft.EntityFrameworkCore.Abstractions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.InMemory from 10.0.8 to 10.0.12.

Release notes

Sourced from Microsoft.EntityFrameworkCore.InMemory's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.Proxies from 10.0.8 to 10.0.12.

Release notes

Sourced from Microsoft.EntityFrameworkCore.Proxies's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.Relational from 10.0.8 to 10.0.12.

Release notes

Sourced from Microsoft.EntityFrameworkCore.Relational's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.SqlServer from 10.0.8 to 10.0.12.

Release notes

Sourced from Microsoft.EntityFrameworkCore.SqlServer's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.EntityFrameworkCore.Tools from 10.0.8 to 10.0.12.

Release notes

Sourced from Microsoft.EntityFrameworkCore.Tools's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.Caching.Memory from 10.0.8 to 10.0.12.

Release notes

Sourced from Microsoft.Extensions.Caching.Memory's releases.

No release notes found for this version range.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml