Fix: pin Microsoft.Bcl.Memory to 10.0.4 (CVE-2026-26127)

[dbezic (dbezic)]

Fix: Patch High-severity DoS in transitive Microsoft.Bcl.Memory (CVE-2026-26127)

Summary

Component Governance flagged a High severity vulnerability in the transitive
dependency Microsoft.Bcl.Memory 10.0.2. This PR pins the package to the
patched version 10.0.4 to remediate the alert.

Vulnerability

Advisory	GHSA-73j8-2gch-69rq / CVE-2026-26127
Severity	High (CVSS 3.1: 7.5 — AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Type	Denial of Service — out-of-bounds read when decoding malformed Base64Url input (CWE-125 / CWE-129)
Affected	Microsoft.Bcl.Memory >= 10.0.0, <= 10.0.3 (repo resolved 10.0.2)
Patched	10.0.4

How it entered the repo

The package is not a direct dependency — it is pulled in transitively via the
Microsoft Agents SDK, which is why dotnet package update Microsoft.Bcl.Memory
does not work:

Microsoft.Agents.Builder 1.4.83
  └─ Microsoft.Agents.Connector 1.4.83
      └─ Microsoft.Bcl.Memory 10.0.2

Fix

The repo uses Central Package Management with
CentralPackageTransitivePinningEnabled=true, so a single PackageVersion
entry in src/Directory.Packages.props pins the transitive dependency to the
patched version across all projects:

<!-- Transitive pin: patches CVE-2026-26127 (GHSA-73j8-2gch-69rq) DoS in Microsoft.Bcl.Memory <= 10.0.3, pulled in via Microsoft.Agents.Connector -->
<PackageVersion Include="Microsoft.Bcl.Memory" Version="10.0.4" />

10.0.4 also aligns with the other 10.0.4 BCL / Microsoft.Extensions.*
packages already pinned in the file.

Verification

• ✅ Microsoft.Bcl.Memory now resolves to 10.0.4 across all projects
  (dotnet list package --include-transitive).
• ✅ dotnet list package --vulnerable --include-transitive reports no
  vulnerable packages.
• ✅ dotnet build src/Microsoft.Agents.A365.Sdk.sln succeeds with 0 warnings, 0 errors.

Files changed

• src/Directory.Packages.props — added transitive pin for Microsoft.Bcl.Memory 10.0.4.

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[Copilot]

Pull request overview

This PR addresses a high-severity DoS vulnerability (CVE-2026-26127 / GHSA-73j8-2gch-69rq) by centrally pinning the transitive dependency Microsoft.Bcl.Memory to a patched version, aligning with the repo’s Central Package Management + transitive pinning approach.

Changes:

• Add a central transitive pin for Microsoft.Bcl.Memory to version 10.0.4.
• Document the security motivation for the pin directly alongside the package version entry.

[Krishnadheeraj (DheerajPannala)]

LGTM