Dispose with ConfigureAwait(false) in the procedure-name queries; pin Pkcs in the benchmarks (#108)

* The stored-procedure name queries in both SQL Server packages dispose their command and reader with ConfigureAwait(false), like every other await in the library.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* The benchmarks project pins System.Security.Cryptography.Pkcs 10.0.14, so Microsoft.Data.SqlClient no longer brings in the vulnerable 9.0.18.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>

Author: electricessence

Benchmarks/Open.Database.Extensions.Benchmarks/Open.Database.Extensions.Benchmarks.csproj

@@ -20,6 +20,7 @@
 		<PackageReference Include="ZLinq" Version="1.6.1" />
 		<PackageReference Include="Microsoft.Data.Sqlite" Version="10.0.14" />
 		<PackageReference Include="Microsoft.Data.SqlClient" Version="7.1.1" />
+		<PackageReference Include="System.Security.Cryptography.Pkcs" Version="10.0.14" />
 	</ItemGroup>
 
 	<ItemGroup>

Source/MSSqlClient/ExpressiveSqlCommand.cs

@@ -194,8 +194,10 @@ protected override async ValueTask<ImmutableArray<string>> GetProcedureParameter
 		try
 		{
 #if NET10_0_OR_GREATER
-			await using SqlCommand command = ProcedureNamesCommand(connection, procedure);
-			await using SqlDataReader reader = await command.ExecuteReaderAsync(cancellationToken).ConfigureAwait(false);
+			SqlCommand command = ProcedureNamesCommand(connection, procedure);
+			await using var commandDisposal = command.ConfigureAwait(false);
+			SqlDataReader reader = await command.ExecuteReaderAsync(cancellationToken).ConfigureAwait(false);
+			await using var readerDisposal = reader.ConfigureAwait(false);
 #else
 			using SqlCommand command = ProcedureNamesCommand(connection, procedure);
 			using SqlDataReader reader = await command.ExecuteReaderAsync(cancellationToken).ConfigureAwait(false);

Source/SqlClient/ExpressiveSqlCommand.cs

@@ -197,8 +197,10 @@ protected override async ValueTask<ImmutableArray<string>> GetProcedureParameter
 			using SqlCommand command = ProcedureNamesCommand(connection, procedure);
 			using SqlDataReader reader = await command.ExecuteReaderAsync(cancellationToken).ConfigureAwait(false);
 #else
-			await using SqlCommand command = ProcedureNamesCommand(connection, procedure);
-			await using SqlDataReader reader = await command.ExecuteReaderAsync(cancellationToken).ConfigureAwait(false);
+			SqlCommand command = ProcedureNamesCommand(connection, procedure);
+			await using var commandDisposal = command.ConfigureAwait(false);
+			SqlDataReader reader = await command.ExecuteReaderAsync(cancellationToken).ConfigureAwait(false);
+			await using var readerDisposal = reader.ConfigureAwait(false);
 #endif
 			return await ReadNamesAsync(reader, cancellationToken).ConfigureAwait(false);
 		}