Preview Release v7.1.0-preview3

This update brings the following changes since the 7.1.0-preview2 release.

Package version alignment: The Microsoft.Data.SqlClient driver and its companion packages continue the aligned versioning introduced in 7.0.2. All five packages listed below ship together as 7.1.0-preview3. (Microsoft.SqlServer.Server continues to version independently and remains at 1.0.0.) Applications that reference Microsoft.Data.SqlClient.Extensions.Azure must upgrade it to 7.1.0-preview3 when upgrading Microsoft.Data.SqlClient.

Compatibility guarantee: All aligned assemblies ship with FileVersion 7.1.0.x and AssemblyVersion 7.0.0.0 — unchanged from 7.0.2 — so upgrading from 7.0.2 to 7.1.0-preview3 does not require any new .NET Framework strong-name binding redirects.

Packages in this release

Microsoft.Data.SqlClient 7.1.0-preview3

Added

• Asynchronous key store provider APIs for Always Encrypted — four virtual methods on SqlColumnEncryptionKeyStoreProvider with CancellationToken support. Purely additive; defaults delegate to the synchronous methods, so existing providers are unaffected (#3672, #3673)
• Connection Pool V2 nears parity with the default pool (opt-in via Switch.Microsoft.Data.SqlClient.UseConnectionPoolV2):
  • Transaction support (#4487)
  • Broken-connection replacement during command execution (#4429)
  • Background warmup to Min Pool Size and automatic replenishment (#4452)
  • Idle pruning driven by Connection Idle Timeout (#4463)
  • Optional ConcurrencyLimiter rate limiting for new physical connections (#4395, #4396)
  • Leaked connection reclamation, including the previously always-zero number-of-reclaimed-connections counter (#4529)
  • Metrics and tracing parity with the default pool (#4504)

Changed

• Single cross-platform build — Windows-only native SNI types now trim cleanly on Linux and macOS. Package structure and contents unchanged (#4207, #4239, #4465, #4474)
• Async read-path allocations restored to baseline via PacketData node reuse — ExecuteReaderAsync goes from +120.9% to +0.1% against 6.1.6 (#4536)
• SqlBulkCopy skips graph alias mapping when no graph pseudo-columns are present, recovering a regression from #3677 (#4535)
• No formatted trace string is allocated when SqlClientEventSource tracing is disabled, recovering a memory regression against 6.1.6. Trace output unchanged (#4528)
• net9.0 dependencies moved to 9.0.18; System.Threading.RateLimiting added to packaged metadata. Other targets keep their 8.0.x pins (#4507)
• Microsoft.Data.SqlClient.SNI and .SNI.runtime updated to 7.1.0-preview3.26226.3 (#4564)

Fixed

• Always Encrypted VSM/HGS attestation now verifies the enclave public key is bound to the signed report, using a fixed-time SHA-256 comparison against EnclaveData (#4532)
• SqlConnectionFactory no longer wakes the process every 30 seconds when no pools exist — including with Pooling=False and after ClearAllPools() (#1881, #4479)
• Connection pool performance counters affecting the default pool as well as pool V2 — active-soft-connects and number-of-active-connections could go negative after a failed activation, and several gauges drifted upward permanently after a broken connection was replaced (#4504)
• OverflowException when sending large decimal values with explicit Precision and Scale, which primarily affected Always Encrypted (#1655, #4443)
• TDS stream error when passing a DateOnly value with SqlDbType.Variant (net8.0/net9.0) (#3953, #4294)
• DateOnly in table-valued parameter sql_variant columns sent as datetime instead of date, which overflowed for values valid as date (net8.0/net9.0) (#3934, #4439)
• ServerCertificate keyword ignored when the platform reported no TLS policy errors. It is now always compared, and an unloadable certificate fails closed with SSLCertificateAuthenticationException instead of silently falling back to host-name validation (#4445)
• SqlConnection.AccessTokenCallback not disabling TNIR by default, plus pool-key construction and SspiContextProvider exclusivity with token auth (net462 for the TNIR behavior) (#4520)
• Fatal exceptions such as OutOfMemoryException captured into faulted Tasks across several SqlBulkCopy, SqlDataReader, and SqlCommand async entry points (#4437)
• Entra ID authentication failing against multi-segment authorities such as the Dataverse / Dynamics 365 TDS endpoint. Ships in Microsoft.Data.SqlClient.Extensions.Azure (#4496, #4521)

Full details: release-notes/7.1/7.1.0-preview3.md

---

Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider 7.1.0-preview3

Added

• SqlColumnEncryptionAzureKeyVaultProvider overrides the four asynchronous key store provider methods introduced in #3673, calling the Azure SDK's own async APIs and flowing the supplied CancellationToken (#4540)
• Concurrent cache misses for the same key collapse into a single Key Vault request. The gate is only awaited, so no thread blocks, and misses for different keys still proceed in parallel (#4540)

Fixed

• The 2000-entry column master key signature cache could stop compacting and grow unbounded — LocalCache.GetOrCreate compacted only on Count == maxSize, an equality test that concurrency could step past. It now compacts on Count >= maxSize (#4540)
• Concurrent callers no longer create duplicate CryptographyClient instances for the same key (#4540)

Behavior change: VerifyColumnMasterKeyMetadata and VerifyColumnMasterKeyMetadataAsync now reject a null or empty signature with ArgumentNullException / ArgumentException instead of passing it through to the Azure SDK. In-product callers are unaffected.

Runtime requirement: this version requires Microsoft.Data.SqlClient 7.1.0-preview3 or later at runtime, because the overridden methods only exist on the 7.1 base class. The NuGet dependency floor covers restore, but downgrading the driver below 7.1 at runtime produces a TypeLoadException.

Full details: release-notes/add-ons/AzureKeyVaultProvider/7.1/7.1.0-preview3.md

---

Microsoft.Data.SqlClient.Extensions.Azure 7.1.0-preview3

Fixed

• Entra ID tenant parsing for multi-segment authorities — the tenant is now taken from the first path segment rather than the last, so an OAuth v1 style authority such as .../{tenantId}/oauth2/authorize no longer yields the literal tenant id "authorize". Unparseable authorities raise a clear AuthenticationException, and provider errors are no longer re-wrapped as "Unexpected error". Bare authorities from Azure SQL, Fabric, and Synapse are unaffected (#4496, #4521)

Full details: release-notes/Extensions/Azure/7.1/7.1.0-preview3.md

---

Microsoft.Data.SqlClient.Extensions.Abstractions 7.1.0-preview3

• No functional or API changes; aligned version bump only.

Full details: release-notes/Extensions/Abstractions/7.1/7.1.0-preview3.md

---

Microsoft.Data.SqlClient.Internal.Logging 7.1.0-preview3

• Internal-use-only package. No functional or API changes; aligned version bump only.

Full details: release-notes/Internal/Logging/7.1/7.1.0-preview3.md

---

Target Platforms

• .NET Framework 4.6.2+ (Windows x86, x64, ARM64)
• .NET 8.0+ (Windows x86, x64, ARM, ARM64; Linux; macOS)

Per-TFM dependency lists are in the linked release-notes files above.

Contributors

A huge thank you to our community contributors for this release:

• @edwardneal — OS-independent build of non-SNI types (#4207) and removal of platform-specific builds (#4465), large decimal transport with explicit Precision/Scale (#4443), DateOnly as a Variant parameter (#4294) and in table-valued parameter sql_variant columns (#4439), connection capability metadata consolidation (#3862), SSRP response parsing scaffolding (#3741), Always Encrypted performance benchmarks (#4502), and NativeVectorFloat32Tests refactoring (#4347)