Update Semantic Kernel to 1.71.0 and required dependencies

[matouskozak]

Summary

Update ten version properties in eng/Versions.props to address CVE-2026-25592 / GHSA-2ww3-72rp-wpp4:

• Semantic Kernel: 1.48.0 -> 1.71.0, the first patched Core version listed by the advisory.
• Microsoft.Extensions.AI.Abstractions: 9.5.0 -> 10.2.0, to meet the new dependency minimum.
• Bcl.AsyncInterfaces, DependencyInjection, DependencyInjection.Abstractions, IO.Pipelines, Numerics.Tensors, Text.Encodings.Web, Text.Json, and Threading.Channels: 9.0.4 -> 10.0.2.

The runtime updates prevent central-version downgrade errors, including the netstandard2.0 dependencies of Tokenizers and the internal analyzer. No C# changes, new package references, target-framework changes, or suppressions are included.

The Core alert comes from test/sample dependencies. The shipping GenAI manifests reference Abstractions; the review found no use of the affected SessionsPythonPlugin. This PR does not claim confirmed shipping exposure.

Related: #7720. The separate GenAI removal PR, #7719, is still open; this change updates the dependencies while those projects remain in main.

Validation

On macOS arm64, with SDK 11.0.100-rc.1.26411.119 and test runtime 8.0.31:

• Built the GenAI sample and all four GenAI libraries for net8.0 with the existing analyzers enabled.
• Built Tokenizers for netstandard2.0 and the internal analyzer.
• Ran both existing Phi SemanticKernelTests: 2 passed, 0 failed.
• Confirmed the sample and Phi test dependency graphs resolve Core and Abstractions to 1.71.0, and AI.Abstractions to 10.2.0.

The version properties are shared across the repository. Full CI, the remaining x64 GenAI tests, package/consumer checks, and a fresh component scan are still needed before release.

[Copilot]

🔵 Needs a closer look

Full CI, remaining platform tests, package/consumer checks, and a fresh component scan are still pending.

Pull request overview

Updates centrally managed Semantic Kernel and .NET dependencies to address the referenced security advisory and dependency requirements.

Changes:

• Upgrades Semantic Kernel to 1.71.0 and AI Abstractions to 10.2.0.
• Updates eight shared .NET dependencies to 10.0.2.

File summaries

File	Description
eng/Versions.props	Updates ten shared dependency version properties.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 69.88%. Comparing base (e4dff01) to head (6d521f3).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7723      +/-   ##
==========================================
- Coverage   69.88%   69.88%   -0.01%     
==========================================
  Files        1487     1487              
  Lines      276249   276249              
  Branches    28291    28291              
==========================================
- Hits       193064   193055       -9     
- Misses      75696    75701       +5     
- Partials     7489     7493       +4     

Flag	Coverage Δ
Debug	69.88% <ø> (-0.01%)	⬇️
production	64.07% <ø> (-0.01%)	⬇️
test	89.82% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.
see 7 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.