[3.1] Updating Microsoft.Data.SqlClient to 1.1.3

[ajcvickers]

Issue #20316

We brought this issue originally in March, at which time we decided to hold off on updating the dependency to gather more data that this is a safe update to make. The 1.1.3 patch has now been out a couple of months and is proving stable. We talked to the SqlClient folks again and they agreed that it is now time to make this change.

Description

SqlClient fixed a deadlock issue in their 3.1.1 patch. EF Core customers are hitting this, so we want to update our dependency to that version version.

Customer Impact

Several customers have hit the deadlock issue. They can fix the issue themselves by updating their SqlClient package, but this can be hard to discover as is often the case with deadlock issues.

How found

Reported by multiple customers.

Test coverage

SqlClient have tested and released the patch. We have run all EF Core tests with the updated package.

Regression?

Not in EF Core, but the underlying issue was a regression.

Risk

Low. The only risk to EF customers is if SqlClient broke something in their patch, which has already been out for some time.

[ajcvickers]

Note for team: Feedback from tactics was to understand what changes we are pulling in by updating this dependency. In particular, on checking, this is not just a patch bump--we're going from 1.0.19269.1 to 1.1.1, which also includes bringing in 1.1.0 fixes: https://github.com/dotnet/SqlClient/releases/tag/v1.1.0.

I suspect that this will not meet the patch risk bar for tactics, but we can discuss in triage.

[ErikEJ]

@ajcvickers That's too bad - 1.1.0 includes dotnet/SqlClient#284 😞

[ajcvickers]

Discussed in tactics. We're going to hold off on this for a month or so to make sure that 1.1.1 has a good record in the wild. If so, we'll bring it back to tactics then.

/cc @cheenamalhotra @David-Engel

[cheenamalhotra]

We brought more improvements in latest patch v1.1.2 today.
Would recommend using the latest version!

Thanks!

[andrejleal]

Are you planning to include this update in the next release? any ETA?

[ErikEJ]

@andrejleal you can just update the dependency. Manually

[andrejleal]

@andrejleal you can just update the dependency. Manually

Hi @ErikEJ, I prefer to avoid managing indirect dependencies. Is it planned to be included in next release?

[ajcvickers]

@andrejleal This will not be in 3.1.4, which is the next patch release. It may be in the one following that depending on whether or not it is approved.

[wtgodbe]

@ajcvickers what's the latest on this?

[ajcvickers]

@wtgodbe We decided to hold off a bit longer, but we do plan to still bring it back soon. Unlikely to be 3.1.6 at this point.

[ajcvickers]

Approved by Tactics for 3.1.7 when the branch opens.