[7.1] Backport #4843 #4846

Activity

1. mdaigle

   added this to the 7.1.2 milestone on Oct 14, 2026
2. mdaigle

   added a parent issue on Oct 14, 2026

   • Using a vulnerable version of System.Security.Cryptography.Pkcs (CVE-2026-70162, CVE-2026-84008) #4843
3. mdaigle

   added

   🆕 Triage Needed

   on Oct 14, 2026
4. mdaigle

   added this to SqlClient Boardon Oct 14, 2026
5. github-project-automation

   moved this to To triage in SqlClient Boardon Oct 14, 2026
6. github-actions commented on Oct 14, 2026

   

   github-actionsBot

   on Oct 14, 2026 – with GitHub Actions

   More actions

   🔍 Triage Summary

   Check	Result
   Issue type	Task (backport sub-issue of #4843)
   Environment	All required environment details provided for investigation (not applicable: backport task, environment is covered by parent #4843)
   Area	Area\Engineering (dependency/package version update)
   Duplicates	Potentially related: #4843 (parent issue)
   Regression	Not indicated

   Analysis

   This is a maintainer-created backport task to the 7.1 servicing branch (milestone 7.1.2) for #4843, which tracks a vulnerable System.Security.Cryptography.Pkcs dependency (CVE-2026-70162, CVE-2026-84008). It likely involves bumping the package version in Directory.Packages.props and related package/nuspec dependency declarations. Severity is P1 because it is a security-driven dependency update.

   Next Steps

   • Apply the fix from Using a vulnerable version of System.Security.Cryptography.Pkcs (CVE-2026-70162, CVE-2026-84008) #4843 to the 7.1 release branch, following .github/instructions/3rd-party-package-versions.instructions.md.
   • Confirm that the patched System.Security.Cryptography.Pkcs version is reflected in all affected projects/nuspecs, and that no transitive references to the vulnerable version remain.
   • Verify build and tests pass on the release branch, and add a release-notes entry for 7.1.2 (not directly in CHANGELOG.md).

   Note: This triage summary is auto-generated by an AI agent. The analysis and suggestions above have not been verified by a human maintainer. Please treat as preliminary guidance only.

   Generated by SqlClient Issue Auto-Triage for #4846 · copilot · auto · 22.1 AIC · ⌖ 11.4 AIC · ⊞ 13.6K · ◷
7. mdaigle

   linked a pull request that will close this issueBump version to avoid CVE-2026-84008 #4842on Oct 15, 2026
8. github-project-automation

   moved this from To triage to In progress in SqlClient Boardon Oct 15, 2026
9. mdaigle

   linked a pull request that will close this issueAlign nuspec dependency versions with #4842 #4862on Oct 19, 2026
10. mdaigle

    closed this as completedon Oct 20, 2026
11. github-project-automation

    moved this from In progress to Done in SqlClient Boardon Oct 20, 2026