From cb9b7ba81a0a9e567db856490d27a96414148f95 Mon Sep 17 00:00:00 2001
From: Sadeq Abu-Hattem <sadegabuhattem@gmail.com>
Date: Thu, 5 Nov 2026 18:46:21 +0200
Subject: [PATCH] Move SqlClient to 6.1.8, and drop the Pkcs pin it no longer
 needs

6.1.8 brings in System.Security.Cryptography.Pkcs 9.0.21, past both
advisories the pin was there for, so NuGet audit stays clean without it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 Directory.Packages.props | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index 6e31645..f9dcd17 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -147,7 +147,7 @@
     <PackageVersion Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.3" />
     <!-- The raw ADO.NET drivers for the Dapper store's integration tests, on the versions the EF
          providers beside them resolve, so each is restored once. -->
-    <PackageVersion Include="Microsoft.Data.SqlClient" Version="6.1.6" />
+    <PackageVersion Include="Microsoft.Data.SqlClient" Version="6.1.8" />
     <PackageVersion Include="Npgsql" Version="10.0.3" />
   </ItemGroup>
 
@@ -158,11 +158,6 @@
     <PackageVersion Include="SQLitePCLRaw.lib.e_sqlite3" Version="2.1.13" />
     <PackageVersion Include="SQLitePCLRaw.provider.e_sqlite3" Version="2.1.13" />
     <PackageVersion Include="SQLitePCLRaw.core" Version="2.1.13" />
-    <!-- Microsoft.Data.SqlClient 6.1.6 -> System.Security.Cryptography.Pkcs 9.0.11
-         (GHSA-846f-f764-76mx, GHSA-2fmv-rv2c-59x7). Pinned forward for the integration suite,
-         which is the only project that references SqlClient; transitive pinning is on for
-         everything that is not a shipped library, so this lifts it there and nowhere else. -->
-    <PackageVersion Include="System.Security.Cryptography.Pkcs" Version="10.0.13" />
   </ItemGroup>
 
   <!--