.NET: Update system package dependencies for CVE-2026-26127

[rogerbarreto]

Summary

Update NuGet package dependencies to address CVE-2026-26127, a high severity denial of service vulnerability caused by an out of bounds read during malformed Base64Url decoding.

This mirrors the fix applied in Agent Framework PR #4647.

Package Updates (Directory.Packages.props)

Package	Old Version	New Version
Microsoft.Bcl.Memory	10.0.2	10.0.4
Microsoft.Bcl.AsyncInterfaces	10.0.3	10.0.4
System.Linq.AsyncEnumerable	10.0.2	10.0.4

Transitive Vulnerability Fix

Added direct PackageReference to Microsoft.Bcl.Memory in 3 projects that transitively pulled in the vulnerable 9.0.4 version via Microsoft.ML.Tokenizers.Data.Cl100kBase. The direct reference forces NuGet to resolve the centrally managed 10.0.4 version instead.

Affected projects:

• SemanticKernel.UnitTests
• IntegrationTests
• Concepts (sample)

Validation

• dotnet restore completes with zero vulnerability warnings
• dotnet build succeeds with zero errors

[rogerbarreto]

Integration Tests failing are unrelated to the PR changes.

xUnit.net 00:07:08.73]     SemanticKernel.IntegrationTests.Connectors.AzureOpenAI.AzureOpenAITextToImageTests.GetImageContentsCanReturnImageUrlAsync [FAIL]
[xUnit.net 00:07:08.73]       System.NullReferenceException : Object reference not set to an instance of an object.
[xUnit.net 00:07:08.73]       Stack Trace:
[xUnit.net 00:07:08.74]         /home/runner/work/semantic-kernel/semantic-kernel/dotnet/src/IntegrationTests/Connectors/AzureOpenAI/AzureOpenAITextToImageTests.cs(73,0): at SemanticKernel.IntegrationTests.Connectors.AzureOpenAI.AzureOpenAITextToImageTests.GetImageContentsCanReturnImageUrlAsync()
[xUnit.net 00:07:08.74]         --- End of stack trace from previous location ---
  Failed SemanticKernel.IntegrationTests.Connectors.AzureOpenAI.AzureOpenAITextToImageTests.GetImageContentsCanReturnImageUrlAsync [31 s]
  Error Message:
   System.NullReferenceException : Object reference not set to an instance of an object.
  Stack Trace:
     at SemanticKernel.IntegrationTests.Connectors.AzureOpenAI.AzureOpenAITextToImageTests.GetImageContentsCanReturnImageUrlAsync() in /home/runner/work/semantic-kernel/semantic-kernel/dotnet/src/IntegrationTests/Connectors/AzureOpenAI/AzureOpenAITextToImageTests.cs:line 73
--- End of stack trace from previous location ---
[xUnit.net 00:07:08.74]     SemanticKernel.IntegrationTests.Connectors.AzureOpenAI.AzureOpenAITextToImageTests.ItCanReturnImageUrlAsync [SKIP]
[xUnit.net 00:07:08.74]       This test is for manual verification.
  Skipped SemanticKernel.IntegrationTests.Connectors.AzureOpenAI.AzureOpenAITextToImageTests.ItCanReturnImageUrlAsync [1 ms]
[xUnit.net 00:07:49.69]     SemanticKernel.IntegrationTests.Connectors.AzureOpenAI.AzureOpenAITextToImageTests.SemanticKernelVersionHeaderIsSentAsync [FAIL]
[xUnit.net 00:07:49.69]       System.NullReferenceException : Object reference not set to an instance of an object.
[xUnit.net 00:07:49.69]       Stack Trace:
[xUnit.net 00:07:49.69]         /home/runner/work/semantic-kernel/semantic-kernel/dotnet/src/IntegrationTests/Connectors/AzureOpenAI/AzureOpenAITextToImageTests.cs(103,0): at SemanticKernel.IntegrationTests.Connectors.AzureOpenAI.AzureOpenAITextToImageTests.SemanticKernelVersionHeaderIsSentAsync()
[xUnit.net 00:07:49.69]         --- End of stack trace from previous location ---
  Failed SemanticKernel.IntegrationTests.Connectors.AzureOpenAI.AzureOpenAITextToImageTests.SemanticKernelVersionHeaderIsSentAsync [40 s]
  Error Message:
   System.NullReferenceException : Object reference not set to an instance of an object.
  Stack Trace: