From 2cfd358d4882a589a4ef5fa08e3cd39f5c49ccea Mon Sep 17 00:00:00 2001
From: Simon Cropp <simon.cropp@gmail.com>
Date: Thu, 22 Aug 2024 10:42:59 +1000
Subject: [PATCH] fix azure transitive CVE

---
 .../Microsoft.Data.SqlClient.ExtUtilities.csproj     |  1 +
 tools/props/Versions.props                           |  6 +++---
 tools/specs/Microsoft.Data.SqlClient.nuspec          |  6 +++---
 ...ient.AlwaysEncrypted.AzureKeyVaultProvider.nuspec | 12 ++++++------
 4 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/src/Microsoft.Data.SqlClient/tests/tools/Microsoft.Data.SqlClient.ExtUtilities/Microsoft.Data.SqlClient.ExtUtilities.csproj b/src/Microsoft.Data.SqlClient/tests/tools/Microsoft.Data.SqlClient.ExtUtilities/Microsoft.Data.SqlClient.ExtUtilities.csproj
index 9f170f2c5b..5c81614169 100644
--- a/src/Microsoft.Data.SqlClient/tests/tools/Microsoft.Data.SqlClient.ExtUtilities/Microsoft.Data.SqlClient.ExtUtilities.csproj
+++ b/src/Microsoft.Data.SqlClient/tests/tools/Microsoft.Data.SqlClient.ExtUtilities/Microsoft.Data.SqlClient.ExtUtilities.csproj
@@ -5,6 +5,7 @@
     <StartupObject>Microsoft.Data.SqlClient.ExtUtilities.Runner</StartupObject>
   </PropertyGroup>
   <ItemGroup>
+    <PackageReference Include="Azure.Identity" Version="$(AzureIdentityVersion)" />
     <PackageReference Include="Newtonsoft.Json" Version="$(NewtonsoftJsonVersion)" />
     <PackageReference Include="Microsoft.SqlServer.SqlManagementObjects" Version="$(MicrosoftSqlServerSqlManagementObjectsVersion)" />
     <ProjectReference Include="../Microsoft.Data.SqlClient.TestUtilities/Microsoft.Data.SqlClient.TestUtilities.csproj" />
diff --git a/tools/props/Versions.props b/tools/props/Versions.props
index 3e85dd49d0..562e605b99 100644
--- a/tools/props/Versions.props
+++ b/tools/props/Versions.props
@@ -27,7 +27,7 @@
   </PropertyGroup>
   <!-- NetFx and NetCore project dependencies -->
   <PropertyGroup>
-    <AzureIdentityVersion>1.11.4</AzureIdentityVersion>
+    <AzureIdentityVersion>1.12.0</AzureIdentityVersion>
     <MicrosoftIdentityModelProtocolsOpenIdConnectVersion>7.5.0</MicrosoftIdentityModelProtocolsOpenIdConnectVersion>
     <MicrosoftIdentityModelJsonWebTokensVersion>7.5.0</MicrosoftIdentityModelJsonWebTokensVersion>
     <SystemBuffersVersion>4.5.1</SystemBuffersVersion>
@@ -47,8 +47,8 @@
   </PropertyGroup>
   <!-- AKV Provider project dependencies -->
   <PropertyGroup>
-    <AzureCoreVersion>[1.38.0,2.0.0)</AzureCoreVersion>
-    <AzureSecurityKeyVaultKeysVersion>[4.5.0,5.0.0)</AzureSecurityKeyVaultKeysVersion>
+    <AzureCoreVersion>[1.42.0,2.0.0)</AzureCoreVersion>
+    <AzureSecurityKeyVaultKeysVersion>[4.6.0,5.0.0)</AzureSecurityKeyVaultKeysVersion>
     <MicrosoftExtensionsCachingMemoryVersion>6.0.1</MicrosoftExtensionsCachingMemoryVersion>
   </PropertyGroup>
   <!-- Test Project Dependencies -->
diff --git a/tools/specs/Microsoft.Data.SqlClient.nuspec b/tools/specs/Microsoft.Data.SqlClient.nuspec
index e54a6e7674..266a55c1e4 100644
--- a/tools/specs/Microsoft.Data.SqlClient.nuspec
+++ b/tools/specs/Microsoft.Data.SqlClient.nuspec
@@ -29,7 +29,7 @@ When using NuGet 3.x this package requires at least version 3.4.</description>
     <dependencies>
       <group targetFramework="net462">
         <dependency id="Microsoft.Data.SqlClient.SNI" version="6.0.0-preview1.24226.4" />
-        <dependency id="Azure.Identity" version="1.11.4" />
+        <dependency id="Azure.Identity" version="1.12.0" />
         <dependency id="Microsoft.IdentityModel.JsonWebTokens" version="7.5.0" />
         <dependency id="Microsoft.IdentityModel.Protocols.OpenIdConnect" version="7.5.0" />
         <dependency id="System.Buffers" version="4.5.1" />
@@ -39,7 +39,7 @@ When using NuGet 3.x this package requires at least version 3.4.</description>
       </group>
       <group targetFramework="net8.0">
         <dependency id="Microsoft.Data.SqlClient.SNI.runtime" version="6.0.0-preview1.24226.4" exclude="Compile" />
-        <dependency id="Azure.Identity" version="1.11.4" />
+        <dependency id="Azure.Identity" version="1.12.0" />
         <dependency id="Microsoft.IdentityModel.Protocols.OpenIdConnect" version="7.5.0" />
         <dependency id="Microsoft.IdentityModel.JsonWebTokens" version="7.5.0" />
         <dependency id="Microsoft.SqlServer.Server" version="1.0.0"/>
@@ -48,7 +48,7 @@ When using NuGet 3.x this package requires at least version 3.4.</description>
       </group>
       <group targetFramework="net6.0">
         <dependency id="Microsoft.Data.SqlClient.SNI.runtime" version="6.0.0-preview1.24226.4" exclude="Compile" />
-        <dependency id="Azure.Identity" version="1.11.4" />
+        <dependency id="Azure.Identity" version="1.12.0" />
         <dependency id="Microsoft.IdentityModel.Protocols.OpenIdConnect" version="7.5.0" />
         <dependency id="Microsoft.IdentityModel.JsonWebTokens" version="7.5.0" />
         <dependency id="Microsoft.SqlServer.Server" version="1.0.0"/>
diff --git a/tools/specs/add-ons/Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider.nuspec b/tools/specs/add-ons/Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider.nuspec
index 5c89d24276..74baa8a599 100644
--- a/tools/specs/add-ons/Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider.nuspec
+++ b/tools/specs/add-ons/Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider.nuspec
@@ -26,20 +26,20 @@ Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyStoreProvider.SqlColumnEncrypti
     <dependencies>
       <group targetFramework="net462">
         <dependency id="Microsoft.Data.SqlClient" version="5.1.5" />
-        <dependency id="Azure.Core" version="[1.38.0,2.0.0)" />
-        <dependency id="Azure.Security.KeyVault.Keys" version="[4.5.0,5.0.0)" />
+        <dependency id="Azure.Core" version="[1.42.0,2.0.0)" />
+        <dependency id="Azure.Security.KeyVault.Keys" version="[4.6.0,5.0.0)" />
         <dependency id="Microsoft.Extensions.Caching.Memory" version="6.0.1" />
       </group>
       <group targetFramework="net8.0">
         <dependency id="Microsoft.Data.SqlClient" version="5.1.5" />
-        <dependency id="Azure.Core" version="[1.38.0,2.0.0)" />
-        <dependency id="Azure.Security.KeyVault.Keys" version="[4.5.0,5.0.0)" />
+        <dependency id="Azure.Core" version="[1.42.0,2.0.0)" />
+        <dependency id="Azure.Security.KeyVault.Keys" version="[4.6.0,5.0.0)" />
         <dependency id="Microsoft.Extensions.Caching.Memory" version="8.0.0" />
       </group>
       <group targetFramework="net6.0">
         <dependency id="Microsoft.Data.SqlClient" version="5.1.5" />
-        <dependency id="Azure.Core" version="[1.38.0,2.0.0)" />
-        <dependency id="Azure.Security.KeyVault.Keys" version="[4.5.0,5.0.0)" />
+        <dependency id="Azure.Core" version="[1.42.0,2.0.0)" />
+        <dependency id="Azure.Security.KeyVault.Keys" version="[4.6.0,5.0.0)" />
         <dependency id="Microsoft.Extensions.Caching.Memory" version="6.0.1" />
       </group>
     </dependencies>