We need v3.1.0 which depends on poi-ooxml v5.4.0 which fixes https://nvd.nist.gov/vuln/detail/CVE-2025-31672 .