Skip to content

Update minimum SqlClient versions to avoid vulnerability #149

Closed

Description

@madelson

See GHSA-8g2p-5pqh-5jmc

Obviously app consumers can perform the update themselves since we just set a lower bound, but by updating we can be sure that we won't bring a bad version in transitively.

Activity

  1. jinghua395 commented on Apr 20, 2023

    @jinghua395

    Hi,

    I would like to upvote this issue.

    As I have tried to run this lib in Linux, and it crashed my app, as the current version Microsoft.Data.SqlClient 2.2.0 is not compatible with Linux.

  2. madelson commented on Apr 21, 2023

    @madelson
    OwnerAuthor

    @jinghua395 thanks for the feedback. The library specifies a lower bound so you can install a higher version of Microsoft.Data.SqlClient in your app just by adding a package reference.

    I wasn't aware that 2.2 didn't support Linux; do you know what version adds Linux support?

    I'm reluctant to require version 5+ given this issue.

  3. added this to the 2.3.3 milestone on Jul 17, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions