Reference to deprecated NuGet package System.Formats.Asn1

[cremor]

Describe the bug

The current version of Microsoft.Data.SqlClient has an (indirect) reference on a deprecated NuGet package:
Microsoft.Data.SqlClient 5.1.1 (latest) -> System.Security.Cryptography.Cng 5.0.0 (latest) -> System.Formats.Asn1 5.0.0 (old, deprecated)

To reproduce

1. Create a new .NET 7 project.
2. Add a reference to Microsoft.Data.SqlClient
3. Run dotnet list package --include-transitive --deprecated

The output shows deprecated package System.Formats.Asn1 5.0.0

Expected behavior

No deprecated package should be found.

Further technical details

Microsoft.Data.SqlClient version: 5.1.1
.NET target: .NET 7
SQL Server version: not relevant
Operating system: not relevant

Additional context
Since this is not a direct dependency, and the version of the direct dependency is already the latest version, this can't be fixed by just increasing a version number. It looks like the package System.Security.Cryptography.Cng shouldn't be referenced any more. See dotnet/runtime#51853.

[Kaur-Parminder]

@cremor Thank you for bringing this to our attention. I will take look into it.

[MDzyga]

Hi,
this issue appears again on version 5.1.5 (CVE-2024-38095).