EF Core 8 depends on Azure.Identity 1.7.0 has reported vulnerabilities

[patrickklaeren]

Microsoft.EntityFrameworkCore.SqlServer references Azure.Identity 1.7.0

Reported vulnerability: GHSA-5mfx-4wcx-rv27

Related to #32608

Include provider and version information

EF Core version: 8
Database provider: Microsoft.EntityFrameworkCore.SqlServer
Target framework: .NET 8
Operating system: Windows 11 Pro
IDE: Rider / Visual Studio / VS Code

[ErikEJ]

This is a SqlClient issue and will be fixed in 5.2

[roji]

Duplicate of dotnet/SqlClient#2195

[bertvan]

Question: SqlClient 5.2 has been released 7 months ago.
Is efcore planning to bump to 5.2 in 8, or only in 9?

[ErikEJ]

Is efcore planning to bump to 5.2 in 8, or only in 9?
@bertvan No, as 5.2 is not LTS. You can just add an explicit reference to 5.1.6, I think 5.1.6 will be used soon in EF Core 8