How to update Microsoft.Data.SqlClient 1.1.3 to 3.1.7 referred indirectly Microsoft.EntityFrameworkCore.SqlServer without updatiing this Nuget

I have a .NET Framework web app that has service and data layer targeting both .NET 4.7.1 and .NET Core 8.0.

The blackduck identifies a vulnerability in Microsoft.Data.SqlClient 1.1.3. Updates Microsoft.Data.SqlClient from v1.1.3 to v3.7.1 which works with both .NET 4.7.1, and .NET Core 8.0.

But some project where Microsoft.EntityFrameworkCore.SqlServer is referenced has a dependency on Microsoft.Data.SqlClient v1.1.3 which cannot be updated without updating the main library but if I update Microsoft.EntityFrameworkCore.SqlServer to latest, it won't work with .NET 4.7.1.

I tried adding Microsoft.Data.SqlClient v3.7.1 this to those project where it referred indirectly but even then project.asset.json has reference of Microsoft.Data.SqlClient v1.1.3

Please advise best way to overcome this issue.