From c74d670d093f01ec5f1bcbbd898b286a4a77bf88 Mon Sep 17 00:00:00 2001 From: Dominik Bezic Date: Tue, 7 Jul 2026 10:47:51 +0100 Subject: [PATCH 1/2] Fix: pin Microsoft.Bcl.Memory to 10.0.4 (CVE-2026-26127) Patches High-severity DoS (GHSA-73j8-2gch-69rq) in transitive Microsoft.Bcl.Memory <= 10.0.3, pulled in via Microsoft.Agents.Connector. --- src/Directory.Packages.props | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/Directory.Packages.props b/src/Directory.Packages.props index 5bed357d..dca64304 100644 --- a/src/Directory.Packages.props +++ b/src/Directory.Packages.props @@ -42,6 +42,8 @@ + + From 1daf5039811a5bcf909087928ee7c485dcd73156 Mon Sep 17 00:00:00 2001 From: Dominik Bezic Date: Tue, 7 Jul 2026 11:18:42 +0100 Subject: [PATCH 2/2] Add TODO note to remove Bcl.Memory pin after upgrading Microsoft.Agents.* to >= 1.6.150 --- src/Directory.Packages.props | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/Directory.Packages.props b/src/Directory.Packages.props index dca64304..40e71f11 100644 --- a/src/Directory.Packages.props +++ b/src/Directory.Packages.props @@ -42,7 +42,8 @@ - +