After creating Razor Pages with Individual, "Azure.Identity" 1.7.0 is added and identified as a vulnerable package.

[v-elenafeng]

INSTALL STEPS

1. Clean machine: Win11 x64 22h2 ENU
2. Install Dev17.8 GA VAL (Includes SDK 8.0.100), Web workload

REPRO STEPS

1. File > New project > ASP.NET Core Web App (Razor Pages) > .NET 8.0 > Individual Account > Create
2. Go to Manage NuGet Packages

ACTUAL
It shows that a vulnerable package is installed. If you check the 'Show only vulnerable' checkbox, then you can see that the warning is because the 'Microsoft.EntityFrameworkCore.SqlServer.8.0.0' package have a dependency on Azure.Identity 1.7.0, which has been detected as the vulnerable package.

EXPECTED
The 'Microsoft.EntityFrameworkCore.SqlServer.8.0.0' package should be updated to depend on a newer version of Azure.Identity that is not vulnerable.

[ajcvickers]

This is a SqlClient dependency. Once SqlClient updates its dependency, then EF can update to that.

[shenjiawei]

This is a SqlClient dependency. Once SqlClient updates its dependency, then EF can update to that.

Do we have a timeline on when the update will be released?

[ErikEJ]

@shenjiawei The update is in SqlClient 5.2 preview 4, due in November

[DavoudEshtehari]

Duplicate of #2195, and will be published with the next preview (MDS 5.2-preview4).