From e0491e4faf832889f740421eb956a0ef51367498 Mon Sep 17 00:00:00 2001
From: Marco Russo <marco@sqlbi.com>
Date: Tue, 20 Oct 2026 17:49:26 +0200
Subject: [PATCH] Reference System.Security.Cryptography.Pkcs 10.0.13 directly

DocumentFormat.OpenXml pulls in version 8.0.1, which NuGet's audit now
flags for GHSA-846f-f764-76mx and GHSA-2fmv-rv2c-59x7, and the project
treats warnings as errors, so every restore fails since the advisories
were published. A direct reference to a patched version takes precedence
over the transitive one.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 src/SQLBI.Whiteboard.Export/SQLBI.Whiteboard.Export.csproj | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/SQLBI.Whiteboard.Export/SQLBI.Whiteboard.Export.csproj b/src/SQLBI.Whiteboard.Export/SQLBI.Whiteboard.Export.csproj
index 9a2383f..b67f86e 100644
--- a/src/SQLBI.Whiteboard.Export/SQLBI.Whiteboard.Export.csproj
+++ b/src/SQLBI.Whiteboard.Export/SQLBI.Whiteboard.Export.csproj
@@ -10,5 +10,8 @@
     <PackageReference Include="DocumentFormat.OpenXml" Version="3.5.1" />
     <!-- PDFsharp (Core build): MIT, managed-only, no native binary to sign. -->
     <PackageReference Include="PdfSharp" Version="6.2.4" />
+    <!-- Direct reference, because the version DocumentFormat.OpenXml pulls in (8.0.1) has
+         advisories GHSA-846f-f764-76mx and GHSA-2fmv-rv2c-59x7 and the audit fails the build. -->
+    <PackageReference Include="System.Security.Cryptography.Pkcs" Version="10.0.13" />
   </ItemGroup>
 </Project>