fix(NPOI): pin 传递漏洞 System.Text.Encodings.Web + Cryptography.Xml

阶段 2 步骤 6:治理 NPOI 2.8.0 传递依赖漏洞。

NPOI 2.8.0 nuspec 强制 System.Security.Cryptography.Xml >= 8.0.2(8.0.2 有 GHSA-w3x6-4m5h-cxqf High),pin 到 8.0.3(fix 补丁)。

Core 同步:netstandard2.0/2.1 路径经 RazorEngine 拉 System.Text.Encodings.Web 4.7.1(Critical),加 TFM 条件 PackageReference 提升到 props 指定的 8.0.0。

实现要点:
- CPM 硬约束:csproj 不能写 Version,版本必须在 Directory.Packages.props
- props 加 PackageVersion System.Security.Cryptography.Xml 8.0.3 + System.Text.Encodings.Web 8.0.0
- Excel.NPOI.csproj:加顶层 PackageReference(无 Version)强制 NuGet 解析
- Core.csproj:ns2.x 条件 ItemGroup 单独加 System.Text.Encodings.Web 引用,仅 ns2.x 路径需要(net6+ 已无此漏洞传递)

验证:dotnet list package --vulnerable 对两个项目输出'没有易受攻击的包'。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: hueifeng

Directory.Packages.props

@@ -25,6 +25,10 @@
     <PackageVersion Include="GitHubActionsTestLogger" Version="2.4.1" />
     <PackageVersion Include="System.ComponentModel.Annotations" Version="4.7.0" />
     <PackageVersion Include="System.Runtime.Loader" Version="4.3.0" />
+    <!-- Transitive CVE overrides (Stage 2 Step 6): see Excel.NPOI.csproj for context.
+         Top-level PackageReference in the consumer csproj forces NuGet to honor these. -->
+    <PackageVersion Include="System.Text.Encodings.Web" Version="8.0.0" />
+    <PackageVersion Include="System.Security.Cryptography.Xml" Version="8.0.3" />
     <PackageVersion Include="NPOI" Version="2.8.0" />
     <PackageVersion Include="Newtonsoft.Json" Version="13.0.3" />
     <PackageVersion Include="Microsoft.SourceLink.GitHub" Version="8.0.0" />

src/Magicodes.ExporterAndImporter.Core/Magicodes.IE.Core.csproj

@@ -7,6 +7,13 @@
 		<PackageReference Include="System.ComponentModel.Annotations" />
 	</ItemGroup>
 
+	<!-- Override transitive CVE: System.Text.Encodings.Web 4.7.1 (Critical, GHSA-ghhp-997w-qr28)
+	     brought in by RazorEngine/Magicodes.RazorEngine.NetCore on netstandard2.0/2.1.
+	     Reference: https://github.com/dotnetcore/Magicodes.IE/issues/554 -->
+	<ItemGroup Condition=" '$(TargetFramework)' == 'netstandard2.0' OR '$(TargetFramework)' == 'netstandard2.1' ">
+		<PackageReference Include="System.Text.Encodings.Web" />
+	</ItemGroup>
+
 	<!-- netstandard 2.x 依赖 (System.Runtime.Loader 仅 ns2.0+ 需要) -->
 	<ItemGroup Condition=" '$(TargetFramework)' == 'netstandard2.0' OR '$(TargetFramework)' == 'netstandard2.1' ">
 		<PackageReference Include="Microsoft.Extensions.DependencyInjection" />

src/Magicodes.IE.Excel.NPOI/Magicodes.IE.Excel.NPOI.csproj

@@ -9,4 +9,15 @@
 		<ProjectReference Include="..\Magicodes.ExporterAndImporter.Core\Magicodes.IE.Core.csproj" />
 		<!--TODO::peel off Epplus-->
 	</ItemGroup>
+
+	<!-- Override transitive CVEs brought in by NPOI 2.8.0:
+	     System.Text.Encodings.Web 4.7.1 (Critical, GHSA-ghhp-997w-qr28)
+	     System.Security.Cryptography.Xml 8.0.2 (High, GHSA-37gx-xxp4-5rgx / GHSA-w3x6-4m5h-cxqf)
+	     Top-level PackageReference forces NuGet to resolve to a non-vulnerable version
+	     (versions declared in Directory.Packages.props).
+	     Reference: https://github.com/dotnetcore/Magicodes.IE/issues/554 -->
+	<ItemGroup>
+		<PackageReference Include="System.Text.Encodings.Web" />
+		<PackageReference Include="System.Security.Cryptography.Xml" />
+	</ItemGroup>
 </Project>