Skip to content

Update Microsoft.Data.SqlClient to avoid CVE #273

Closed
Closed
Update Microsoft.Data.SqlClient to avoid CVE#273
Labels
dependenciesPull requests that update a dependency filesql-server
Milestone
2.8.1

Description

@ggros-septeo
ggros-septeo
opened on Feb 6, 2026

Hi there,

I'm using DistributedLock.SqlServer in a project. I'm also using Snyk to check my project CVE.

The tool is flagging a vulnerability (SNYK-DOTNET-SYSTEMRUNTIMECACHING-8168846) in the System.Runtime.Caching package.

Would it be possible to update the package Microsoft.Data.SqlClient to the latest version (6.1.4) ? I would be pleased to open a pull request.

Activity

  1. madelson commented on Feb 10, 2026

    @madelson
    madelson
    on Feb 10, 2026
    Owner

    @ggros-septeo thanks for flagging. I am happy to update.

    In the meantime for your use please just override the version of sqlclient for your project. DistributedLock does not bound the upper version specifically to support things like this.

    Happy to take a PR if you’d like to send. (fixed it)

  2. madelson
    added this to the 2.8.1 milestone on Feb 11, 2026
  3. madelson
    added a commit that references this issue on Feb 12, 2026

    Update Microsoft.Data.SqlClient

    f2420fd
  4. madelson
    added
    sql-server
    dependenciesPull requests that update a dependency file
    on Feb 14, 2026
  5. madelson
    closed this as completedin f2420fdon Feb 14, 2026

  6. ggros-septeo commented on Feb 18, 2026

    @ggros-septeo
    ggros-septeo
    on Feb 18, 2026
    Author

    Thank you.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    dependenciesPull requests that update a dependency filesql-server

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions