@jbogard - Hello, please take a look

I don't see any published vulnerabilities for the first package. And the second is for tests, I don't care about that since it's never published.

You're right.
A vulnerability has been identified in Microsoft.Data.SqlClient by a security tool, but it has not been confirmed by other sources.

You are referencing Microsoft.Data.SqlClient version 4.0.5.
Version 4.0.5 references Azure.Identity 1.3.0.

Version 1.3.0 of Azure.Identity does have a vulnerability. I would still recommend upgrading Microsoft.Data.SqlClient. The earliest fix for this is in version 5.1.4, the vulnerability is also addressed in the release notes.

On top of this, version 4.0.5 of Microsoft.Data.SqlClient references version 6.8.0 of Microsoft.IdentityModel.JsonWebTokens. This has been fixed in version 5.1.5.

I only address CVEs for direct dependencies (aka ones that dependabot catches). Not transitive dependencies. End users can upgrade their transitive dependencies.