CODEWITHSUNDEEP
asp.net-mvcentity-framework-corenuget-package.net-8.0.net-4.7.1
user3497702
user3497702

Reputation: 851

How to update Microsoft.Data.SqlClient 1.1.3 to 3.1.7 referred indirectly Microsoft.EntityFrameworkCore.SqlServer without updatiing this Nuget

I have a .NET Framework web app that has service and data layer targeting both .NET 4.7.1 and .NET Core 8.0.

The blackduck identifies a vulnerability in Microsoft.Data.SqlClient 1.1.3. Updates Microsoft.Data.SqlClient from v1.1.3 to v3.7.1 which works with both .NET 4.7.1, and .NET Core 8.0.

But some project where Microsoft.EntityFrameworkCore.SqlServer is referenced has a dependency on Microsoft.Data.SqlClient v1.1.3 which cannot be updated without updating the main library but if I update Microsoft.EntityFrameworkCore.SqlServer to latest, it won't work with .NET 4.7.1.

I tried adding Microsoft.Data.SqlClient v3.7.1 this to those project where it referred indirectly but even then project.asset.json has reference of Microsoft.Data.SqlClient v1.1.3

Please advise best way to overcome this issue.

Upvotes: 0

Views: 60

Answers (1)

David Browne - Microsoft
David Browne - Microsoft

Reputation: 89396

Add a direct package dependency to the version of Microsoft.Data.SqlClient you need.

Then Nuget will apply the "Direct Dependency Wins" rule to load right version.

Upvotes: 0

Related Questions