Transitive Microsoft.Bcl.Memory 9.0.0 advisory via CUE4Parse (build-time tooling)

[ChrisonSimtian]

Building tools/SatisfactoryPakExtractor against CUE4Parse 1.2.2.202608 surfaces:

warning NU1903: Package 'Microsoft.Bcl.Memory' 9.0.0 has a known high severity
vulnerability, https://github.com/advisories/GHSA-73j8-2gch-69rq

It arrives transitively through CUE4Parse's dependency tree, not from anything we reference directly.

Exposure

Low, but worth being deliberate about rather than assuming:

• The extractor is offline, build-time-only tooling — not in ErpForFactoryGames.slnx, never deployed, never handling untrusted input beyond local game paks.
• It is not a runtime dependency of any shipped app.

That's an argument for not panicking, not for ignoring it.

Scope

• Confirm nothing in the deployed graph pulls Microsoft.Bcl.Memory 9.0.0 — check the main solution too, not just the tool.
• Try a direct PackageReference pin to a patched Microsoft.Bcl.Memory in the extractor to override the transitive resolve.
• If that breaks CUE4Parse, check whether a newer rolling build (1.2.2.YYYYMM) already moved off it, and bump instead.
• If neither works, record the accepted risk here with the reasoning, so the next person doesn't re-investigate from scratch.

Context

Noted while migrating off the vendor/CUE4Parse submodule (#310, ADR-0029). The warning was invisible before, because the extractor didn't build at all on a normal checkout — the submodule is update = none and never populated.