fix(NPOI): pin 传递漏洞 System.Text.Encodings.Web + Cryptography.Xml

治理 NPOI 2.8.0 传递依赖漏洞:
- System.Security.Cryptography.Xml 8.0.2 (High) → pin 8.0.3
- Core ns2.0/2.1 路径经 RazorEngine 拉 System.Text.Encodings.Web 4.7.1 (Critical)
  → TFM 条件 PackageReference 提升到 8.0.0

实现:
- props 加 PackageVersion System.Security.Cryptography.Xml 8.0.3
  + System.Text.Encodings.Web 8.0.0
- Excel.NPOI.csproj 加顶层 PackageReference (CPM 下不写 Version)
- Core.csproj ns2.x 条件 ItemGroup 加 System.Text.Encodings.Web (net6+ 无此传递)

dotnet list package --vulnerable 对两个项目输出无易受攻击包。

Author: hueifeng

Directory.Packages.props

@@ -25,6 +25,10 @@
     <PackageVersion Include="GitHubActionsTestLogger" Version="2.4.1" />
     <PackageVersion Include="System.ComponentModel.Annotations" Version="4.7.0" />
     <PackageVersion Include="System.Runtime.Loader" Version="4.3.0" />
+    <!-- Transitive CVE overrides (Stage 2 Step 6): see Excel.NPOI.csproj for context.
+         Top-level PackageReference in the consumer csproj forces NuGet to honor these. -->
+    <PackageVersion Include="System.Text.Encodings.Web" Version="8.0.0" />
+    <PackageVersion Include="System.Security.Cryptography.Xml" Version="8.0.3" />
     <PackageVersion Include="NPOI" Version="2.8.0" />
     <PackageVersion Include="Newtonsoft.Json" Version="13.0.3" />
     <PackageVersion Include="Microsoft.SourceLink.GitHub" Version="8.0.0" />

src/Magicodes.ExporterAndImporter.Core/Magicodes.IE.Core.csproj

@@ -7,6 +7,13 @@
 		<PackageReference Include="System.ComponentModel.Annotations" />
 	</ItemGroup>
 
+	<!-- Override transitive CVE: System.Text.Encodings.Web 4.7.1 (Critical, GHSA-ghhp-997w-qr28)
+	     brought in by RazorEngine/Magicodes.RazorEngine.NetCore on netstandard2.0/2.1.
+	     Reference: https://github.com/dotnetcore/Magicodes.IE/issues/554 -->
+	<ItemGroup Condition=" '$(TargetFramework)' == 'netstandard2.0' OR '$(TargetFramework)' == 'netstandard2.1' ">
+		<PackageReference Include="System.Text.Encodings.Web" />
+	</ItemGroup>
+
 	<!-- netstandard 2.x 依赖 (System.Runtime.Loader 仅 ns2.0+ 需要) -->
 	<ItemGroup Condition=" '$(TargetFramework)' == 'netstandard2.0' OR '$(TargetFramework)' == 'netstandard2.1' ">
 		<PackageReference Include="Microsoft.Extensions.DependencyInjection" />

src/Magicodes.IE.Excel.NPOI/Magicodes.IE.Excel.NPOI.csproj

@@ -9,4 +9,15 @@
 		<ProjectReference Include="..\Magicodes.ExporterAndImporter.Core\Magicodes.IE.Core.csproj" />
 		<!--TODO::peel off Epplus-->
 	</ItemGroup>
+
+	<!-- Override transitive CVEs brought in by NPOI 2.8.0:
+	     System.Text.Encodings.Web 4.7.1 (Critical, GHSA-ghhp-997w-qr28)
+	     System.Security.Cryptography.Xml 8.0.2 (High, GHSA-37gx-xxp4-5rgx / GHSA-w3x6-4m5h-cxqf)
+	     Top-level PackageReference forces NuGet to resolve to a non-vulnerable version
+	     (versions declared in Directory.Packages.props).
+	     Reference: https://github.com/dotnetcore/Magicodes.IE/issues/554 -->
+	<ItemGroup>
+		<PackageReference Include="System.Text.Encodings.Web" />
+		<PackageReference Include="System.Security.Cryptography.Xml" />
+	</ItemGroup>
 </Project>