Merge develop8

Author: JanKallman

SECURITY.md

@@ -1,18 +1,18 @@
 # Security Policy
 
-_Last updated: 2025-06-10_
+_Last updated: 2026-01-08_
 
 ## Supported Versions
 
-EPPlus 6, 7 and 8 are automatically scanned for vulnerabilities and static code analysis is performed as part of the CI. 
+EPPlus 7 and 8 are automatically scanned for vulnerabilities and static code analysis is performed as part of the CI. 
 
 | Version | Supported          | Comment            | Deprecation date |
 | ------- | ------------------ | ------------------ |----|
 | 8.x.x   | :white_check_mark: |                    ||
 | 7.x.x   | :white_check_mark: |                    ||
-| 6.x.x   | :white_check_mark: |                    |2025-12-31|
+| 6.x.x   | :x:                |Deprecated/unsupported versions              |2025-12-31|
 | 5.x.x   | :x:                |Deprecated/unsupported versions              |2024-12-31|
-| < 4.3   | :x:                |Deprecated/unsupported versions|2020-12-31|
+| < 4.5   | :x:                |Deprecated/unsupported versions|2020-12-31|
 
 ## Security update policy
 Security patches will be provided via new revisions released in our public Nuget feed. One patch for each supported major version/the two latest minor versions will be provided. [Subscribe to our newsletter](https://epplussoftware.com/en/Home/Newsletter) to get updates from EPPlus Software.

appveyor8.yml

@@ -1,4 +1,4 @@
-version: 8.4.0.{build}
+version: 8.4.1.{build}
 branches:
   only:
   - develop8
@@ -10,15 +10,15 @@ install:
     & $env:temp\dotnet-install.ps1 -Architecture x64 -Version '10.0.100' -InstallDir "$env:ProgramFiles\dotnet"
 init:
 - ps: >-
-    Update-AppveyorBuild -Version "8.4.0.$env:appveyor_build_number-$(Get-Date -format yyyyMMdd)-$env:appveyor_repo_branch"
+    Update-AppveyorBuild -Version "8.4.1.$env:appveyor_build_number-$(Get-Date -format yyyyMMdd)-$env:appveyor_repo_branch"
 
-    Write-Host "8.4.0.$env:appveyor_build_number-$(Get-Date -format yyyyMMdd)-$env:appveyor_repo_branch"
+    Write-Host "8.4.1.$env:appveyor_build_number-$(Get-Date -format yyyyMMdd)-$env:appveyor_repo_branch"
 dotnet_csproj:
   patch: true
   file: '**\*.csproj'
   version: '{version}'
-  assembly_version: 8.4.0.{build}
-  file_version: 8.4.0.{build}
+  assembly_version: 8.4.1.{build}
+  file_version: 8.4.1.{build}
 nuget:
   project_feed: true
 before_build:

docs/articles/fixedissues.md

@@ -1,4 +1,19 @@
 # Features / Fixed issues - EPPlus 8
+## Version 8.4.1
+* Fixes several issues related to expanding (spilling) and contracting dynamic array formulas.
+	* Changing cell dependencies were not taken into account when recalculating dirty cells from dynamic array formulas.
+	* Clearing dynamic array formulas that reduced in size did not work correctly.
+	* Cells containing formulas with the INDIRECT function are now always treated as dynamic.
+* Invalid UTF-16 surrogate sequences in comment text are now sanitized before XML generation to prevent ´XmlException´.
+* Using the [@page] attribute in headers or footers did not return the next character in some cases.
+* The FILTER function always returned the third parameter if it contained an error value (for example, #VALUE!).
+* The FACT function returned (n-1)! instead of n!.
+* Formula inline arrays did not correctly convert scientific notation (for example, 1.0E-305) to numbers.
+* Defined names could use the wrong scope when a name existed in both worksheet and workbook scope and a formula was calculated using the ´Calculate(formula)´ method.
+* Using the ^ operator on non-numeric values returned 0 instead of #VALUE!.
+* Inserting columns into an empty worksheet throw an ´ArgumentExceptio´n when inserting more than 8 columns.
+* GROWTH and TREND did not handle a single-value newX parameter correctly.
+
 ## Version 8.4.0
 ### Features
 * Added targeting framework .NET 10.

src/EPPlus/ConditionalFormatting/ExcelConditionalFormattingHelper.cs

@@ -202,7 +202,7 @@ public static double GetAttributeDouble(
       try
       {
         var value = node.Attributes[attribute].Value;
-        return double.Parse(value, NumberStyles.Number, CultureInfo.InvariantCulture);
+        return double.Parse(value, NumberStyles.Number | NumberStyles.AllowExponent, CultureInfo.InvariantCulture);
       }
       catch
       {

src/EPPlus/EPPlus.csproj

@@ -1,9 +1,9 @@
 <Project Sdk="Microsoft.NET.Sdk">
 	<PropertyGroup>
 		<TargetFrameworks>net8.0;net9.0;net10.0;netstandard2.1;netstandard2.0;net462;net35</TargetFrameworks>
-		<AssemblyVersion>8.4.0.0</AssemblyVersion>
-		<FileVersion>8.4.0.0</FileVersion>
-		<Version>8.4.0</Version>
+		<AssemblyVersion>8.4.1.0</AssemblyVersion>
+		<FileVersion>8.4.1.0</FileVersion>
+		<Version>8.4.1</Version>
 		<GeneratePackageOnBuild>true</GeneratePackageOnBuild>
 		<PackageProjectUrl>https://epplussoftware.com</PackageProjectUrl>
 		<Authors>EPPlus Software AB</Authors>
@@ -18,17 +18,20 @@
 		<PackageReadmeFile>readme.md</PackageReadmeFile>
 		<Copyright>EPPlus Software AB</Copyright>
 		<PackageReleaseNotes>
-			EPPlus 8.4.0
+			EPPlus 8.4.1
 
 			IMPORTANT NOTICE!
 			From version 5 EPPlus changes the license model using a dual license, Polyform Non Commercial / Commercial license.
 			EPPlus will still have the source available, but for non Polyform NC compliant projects, EPPlus will provide a commercial license.
 			Commercial licenses can be purchased from https://epplussoftware.com
 			This applies to EPPlus version 5 and later. Earlier versions are still licensed LGPL.
 
+			## Version 8.4.1
+			* Minor bug fixes. See https://epplussoftware.com/Developers/MinorFeaturesAndIssues
+			
 			## Version 8.4.0
 			* Added target framework .NET 10.
-			Minor bug fixes. See https://epplussoftware.com/Developers/MinorFeaturesAndIssues
+			Minor bug fixes.
 
 			## Version 8.3.1
 			Minor bug fixes.
@@ -545,6 +548,7 @@
 			A list of fixed issues can be found here https://epplussoftware.com/docs/7.0/articles/fixedissues.html
 
 			Version history
+			8.4.1			20260112 Minor bug fixes.
 			8.4.0			20251212 Updated target frameworks. Minor bug fixes.
 			8.3.1			20251128 Minor bug fixes.
 			8.3.0			20251120 Connections and query tables support. Minor features and bug fixes. See https://epplussoftware.com/Developers/MinorFeaturesAndIssues

src/EPPlus/ExcelWorksheet.cs

@@ -50,6 +50,7 @@ Date               Author                       Change
 using System.Linq;
 using System.Text;
 using System.Xml;
+using System.Security.Permissions;
 
 namespace OfficeOpenXml
 {
@@ -77,8 +78,8 @@ internal struct MetaDataReference
         {
             internal uint cm;
             internal uint vm;
-            internal bool aca;
-            internal bool ca;
+            //internal bool aca; //Removed, is set as a flag instead in the _flags store.
+            //internal bool ca;  //Removed, is set as a flag instead in the _flags store.
         }
         /// <summary>
         /// Removes all formulas within the entire worksheet, but keeps the calculated values.
@@ -2633,6 +2634,10 @@ private void UpdateCommentRichText()
         {
             foreach (ExcelComment comment in _comments)
             {
+                foreach(var rt in comment.RichText)
+                {
+                    rt.Text = StringUtil.SanitizeUtf16(rt.Text);
+                }
                 var textNode = comment._commentHelper.GetNode("d:text");
                 textNode.InnerXml = comment.RichText.GetXML();
             }

src/EPPlus/FormulaParsing/CalculateExtensions.cs

@@ -81,6 +81,34 @@ public static void Calculate(this ExcelWorkbook workbook, ExcelCalculationOption
                 workbook.FormulaParser.Logger.Log(msg);
             }
         }
+        internal static RpnOptimizedDependencyChain CalculateWithDC(this ExcelWorkbook workbook, Action<ExcelCalculationOption> configHandler)
+        {
+            var option = new ExcelCalculationOption();
+            configHandler.Invoke(option);
+            return CalculateWithDC(workbook, option);
+        }
+        internal static RpnOptimizedDependencyChain CalculateWithDC(this ExcelWorkbook workbook, ExcelCalculationOption options)
+        {
+            Init(workbook);
+
+            var filterInfo = new FilterInfo(workbook);
+            workbook.FormulaParser.InitNewCalc(filterInfo);
+
+            if (workbook.FormulaParser.Logger != null)
+            {
+                var msg = string.Format("Starting formula calculation.");
+                workbook.FormulaParser.Logger.Log(msg);
+            }
+
+            //CalcChain(workbook, workbook.FormulaParser, dc, options);
+            var dc = RpnFormulaExecution.Execute(workbook, options);
+            if (workbook.FormulaParser.Logger != null)
+            {
+                var msg = string.Format("Calculation done...number of cells parsed: {0}", dc.processedCells.Count);
+                workbook.FormulaParser.Logger.Log(msg);
+            }
+            return dc;
+        }
         /// <summary>
         /// Calculate all formulas in the current worksheet
         /// </summary>

src/EPPlus/FormulaParsing/DependencyChain/ArrayFormulaOutput.cs

@@ -151,6 +151,7 @@ internal static SimpleAddress[] FillDynamicArrayFromRangeInfo(RpnFormula f, IRan
                 CleanupSharedFormulaValues(f, ws, sf, endRow, endCol);
                 sf.EndRow = endRow;
                 sf.EndCol = endCol;
+                
             }
             FillArrayFromRangeInfo(f, array, rd, depChain);
             return dirtyRange;
@@ -239,8 +240,10 @@ private static SimpleAddress[] GetDirtyRange(int fromRow, int fromCol, int toRow
 
         private static void ClearDynamicFormulaIndex(ExcelWorksheet ws, int fromRow, int fromCol, int toRow, int toCol)
         {
-            ws._formulas.Clear(fromRow, fromCol, toRow, toCol);
-            ws._flags.Clear(fromRow, fromCol, toRow, toCol);
+            var rows = toRow - fromRow + 1;
+            var cols = toCol - fromCol + 1;
+            ws._formulas.Clear(fromRow, fromCol, rows, cols);
+            ws._flags.Clear(fromRow, fromCol, rows, cols);
 
             for (int col = fromCol; col <= toCol; col++)
             {

src/EPPlus/FormulaParsing/DependencyChain/RpnFormula.cs

@@ -261,12 +261,28 @@ public override string ToString()
             }
         }
 
-        internal void ClearCache()
+        internal void ClearCache(RpnOptimizedDependencyChain depChain)
         {
             foreach (var e in _expressions.Values)
             {
                 if (e.ExpressionType == ExpressionType.CellAddress)
+                {
                     e._cachedCompileResult = null;
+                }
+                if(e.ExpressionType == ExpressionType.Function)
+                {
+                    var funcExp= e as FunctionExpression;
+                    funcExp.Status = ExpressionStatus.NoSet;
+                    var key = funcExp.GetExpressionKey(this);
+                    if (key != null)
+                    {
+                        var cache = depChain.GetCache(_ws);
+                        if (cache.ContainsKey(key))
+                        {
+                            cache.Remove(key);
+                        }
+                    }
+                }
             }
         }