Align nuspec dependency versions with #4842 - #4862

Description

Update Microsoft.Data.SqlClient.nuspec to match the dependency versions introduced by #4842, so the published package requires the serviced versions rather than the older dependency minimums.

• Update the five existing net9.0 dependency entries at 9.0.18 to 9.0.21: Microsoft.Bcl.Cryptography, Microsoft.Extensions.Caching.Memory, System.Configuration.ConfigurationManager, System.Security.Cryptography.Pkcs, and System.Threading.RateLimiting.
• Update System.Security.Cryptography.Pkcs from 8.0.1 to 8.0.2 for net462, net8.0, and netstandard2.0.
• Preserve all dependency groups, exclusions, package file mappings, and public APIs. No documentation or localization changes are needed.

Target: release/7.1. Backport to 7.0.4 and 6.1.8, matching #4842.

• Tests added or updated — not applicable; metadata-only change, validated below.
• Public API changes documented — not applicable; no public API changes.
• Verified against customer repro — not applicable; no customer repro supplied.
• Ensure no breaking changes introduced — only servicing dependency minimums already selected in Bump version to avoid CVE-2026-84008 #4842 are synchronized.

Issues

Follow-up to #4842.

Related advisory: GHSA-846f-f764-76mx

Testing

The PowerShell check below evaluates Directory.Packages.props with MSBuild for each nuspec target framework and compares every literal dependency version. Before the fix: failed with the eight expected mismatches. After the fix: passed, with all 39 literal dependency versions matching across all four framework groups. Placeholder-based sibling dependency ranges are unchanged and excluded from this check.

$ErrorActionPreference = 'Stop'
[xml]$nuspec = Get-Content -Raw 'src\Microsoft.Data.SqlClient\src\Microsoft.Data.SqlClient.nuspec'
$mismatches = @()
$checked = 0
foreach ($group in $nuspec.package.metadata.dependencies.group) {
    $tfm = $group.targetFramework
    $output = dotnet msbuild Directory.Packages.props "-p:TargetFramework=$tfm" -getItem:PackageVersion -verbosity:quiet
    if ($LASTEXITCODE -ne 0) { throw "MSBuild evaluation failed for $tfm" }
    $versions = @{}
    ($output | ConvertFrom-Json).Items.PackageVersion | ForEach-Object { $versions[$_.Identity] = $_.Version }
    foreach ($dependency in $group.dependency) {
        if ($dependency.version.StartsWith('$')) { continue }
        $checked++
        if ($dependency.version -ne $versions[$dependency.id]) {
            $mismatches += "$tfm / $($dependency.id): nuspec=$($dependency.version), central=$($versions[$dependency.id])"
        }
    }
}
Write-Output "Checked $checked literal dependency versions across $($nuspec.package.metadata.dependencies.group.Count) framework groups."
if ($mismatches.Count -gt 0) { $mismatches | Write-Output; throw "$($mismatches.Count) dependency version mismatches." }
Write-Output 'PASS: All literal nuspec dependency versions match evaluated central package versions.'

git --no-pager diff --check — passed before commit.

Full build, pack, and driver unit/integration suites were not run: this change only aligns package metadata with the already-updated build dependencies and does not change driver code. No automated test files were added or modified.

Guidelines

Please review the contribution guidelines before submitting a pull request:

• Contributing
• Code of Conduct
• Best Practices
• Coding Style
• Review Process