Skip to content

Commit b333523

Browse files
JanKallmanJanKallman
committed
EPPlus version 8.5.3
1 parent 0dbb099 commit b333523

File tree

4 files changed

+19
-12
lines changed

4 files changed

+19
-12
lines changed

‎SECURITY.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ Since version 7.5 the EPPlus Nuget package and the EPPlus libraries/dll:s are di
3939

4040
|Detected|Resolved|Affected EPPlus versions|CVE|Our comment|Resolution|
4141
|-|-|-|-|-|-|
42-
|April 15, 2026|April 16, 2026|EPPlus 8.x,targeting .NET 9 or 10|[Microsoft Security Advisory - CVE-2026-33116](https://github.com/advisories/GHSA-37gx-xxp4-5rgx) and [Microsoft Security Advisory - CVE-2026-26171](https://github.com/advisories/GHSA-w3x6-4m5h-cxqf)|Microsoft has released a security fix in System.Security.Cryptography.Xml 10.0.6 and 9.0.15. EPPlus uses this package to create and validate digital signatures for workbooks. The potential risk for most users should be very low.|Patch released in version 8.5.2|
42+
|April 15, 2026|April 16, 2026|EPPlus 8.x,targeting .NET 9 or 10|[Microsoft Security Advisory - CVE-2026-33116](https://github.com/advisories/GHSA-37gx-xxp4-5rgx) and [Microsoft Security Advisory - CVE-2026-26171](https://github.com/advisories/GHSA-w3x6-4m5h-cxqf)|Microsoft has released a security fix in System.Security.Cryptography.Xml 10.0.6 and 9.0.15. EPPlus uses this package to create and validate digital signatures for workbooks. The potential risk for most users should be very low.|Patch released in version 8.5.3|
4343
|October 10, 2024|October 11, 2024|EPPlus 7.x,targeting .NET 7 or 8|[Microsoft Security Advisory CVE-2024-38095](https://github.com/advisories/GHSA-447r-wph3-92pm) and [Microsoft Security Advisory CVE-2024-30105](https://github.com/advisories/GHSA-hh2w-p6rv-4g7w)|Microsoft has released a security fix in Microsoft.Extensions.Configuration.Json 8.0.1. The potential risk for most users should be low.|Patch released in version 7.4.1|
4444
|September 9, 2024||EPPlus 7.x, targeting .NET 7 or 8|[Microsoft Security Advisory CVE-2024-38095](https://github.com/advisories/GHSA-447r-wph3-92pm) and [Microsoft Security Advisory CVE-2024-30105](https://github.com/advisories/GHSA-hh2w-p6rv-4g7w)|Microsoft has released security fixes for System.Text.Json and System.Formats.Asn1 (transient dependencies in EPPlus). The potential risk for most users should be low.|Patch released in version 7.3.2|
4545
|June 15, 2023|June 15, 2023|EPPlus 6.x prior to 6.2.6, targeting .NET 6 or 7.|[.NET Denial of Service vulnerability (CVE 2023-29331)](https://github.com/advisories/GHSA-555c-2p6r-68mm)|Microsoft has released a security fix for a Denial of Service vulnerability (CVE-2023-29331) in System.Security.Cryptography.Pkcs for .NET 6 and .NET 7. EPPlus uses this component for x509 certificates used when signing VBA projects in a workbook. The potential risk for most users should be low, as the certificates used to sign your workbooks are usually known.|Upgrade to EPPlus 6.2.6 or higher|

‎docs/articles/fixedissues.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,7 @@
11
# Features / Fixed issues - EPPlus 8
2+
## Version 8.5.3
3+
* Downgraded references incorrectly update to 9.x to 8.x in version 8.5.2.
4+
25
## Version 8.5.2
36
### Security
47
* Updated System.Security.Cryptography.Xml to 10.0.6 to address a security vulnerability (CVE-2026-26171 and CVE-2026-33116).

‎src/Directory.Packages.props‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,12 @@
77
<PackageVersion Include="Microsoft.IO.RecyclableMemoryStream" Version="3.0.1" />
88
<PackageVersion Include="MSTest" Version="3.10.2" />
99
<PackageVersion Include="System.ComponentModel.Annotations" Version="5.0.0" />
10-
<PackageVersion Include="System.Drawing.Common" Version="9.0.15" />
11-
<PackageVersion Include="System.Formats.Asn1" Version="9.0.15" />
12-
<PackageVersion Include="System.Security.Cryptography.Pkcs" Version="9.0.15" />
13-
<PackageVersion Include="System.Security.Cryptography.Xml" Version="9.0.15" />
14-
<PackageVersion Include="System.Text.Encoding.CodePages" Version="9.0.15" />
15-
<PackageVersion Include="System.Text.Json" Version="9.0.15" />
10+
<PackageVersion Include="System.Drawing.Common" Version="8.0.26" />
11+
<PackageVersion Include="System.Formats.Asn1" Version="8.0.2" />
12+
<PackageVersion Include="System.Security.Cryptography.Pkcs" Version="8.0.1" />
13+
<PackageVersion Include="System.Security.Cryptography.Xml" Version="8.0.3" />
14+
<PackageVersion Include="System.Text.Encoding.CodePages" Version="8.0.0" />
15+
<PackageVersion Include="System.Text.Json" Version="8.0.6" />
1616
</ItemGroup>
1717
<ItemGroup>
1818
<PackageVersion Include="FakeItEasy" Version="8.0.0" />

‎src/EPPlus/EPPlus.csproj‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
<Project Sdk="Microsoft.NET.Sdk">
22
<PropertyGroup>
33
<TargetFrameworks>net8.0;net9.0;net10.0;netstandard2.1;netstandard2.0;net462;net35</TargetFrameworks>
4-
<AssemblyVersion>8.5.2.0</AssemblyVersion>
5-
<FileVersion>8.5.2.0</FileVersion>
6-
<Version>8.5.2</Version>
4+
<AssemblyVersion>8.5.3.0</AssemblyVersion>
5+
<FileVersion>8.5.3.0</FileVersion>
6+
<Version>8.5.3</Version>
77
<GeneratePackageOnBuild>true</GeneratePackageOnBuild>
88
<PackageProjectUrl>https://epplussoftware.com</PackageProjectUrl>
99
<Authors>EPPlus Software AB</Authors>
@@ -18,14 +18,17 @@
1818
<PackageReadmeFile>readme.md</PackageReadmeFile>
1919
<Copyright>EPPlus Software AB</Copyright>
2020
<PackageReleaseNotes>
21-
EPPlus 8.5.2
21+
EPPlus 8.5.3
2222

2323
IMPORTANT NOTICE!
2424
From version 5 EPPlus changes the license model using a dual license, Polyform Non Commercial / Commercial license.
2525
EPPlus will still have the source available, but for non Polyform NC compliant projects, EPPlus will provide a commercial license.
2626
Commercial licenses can be purchased from https://epplussoftware.com
2727
This applies to EPPlus version 5 and later. Earlier versions are still licensed LGPL.
2828

29+
## Version 8.5.3
30+
* Downgraded .NET 8 references incorrectly update to 9.x to 8.x.
31+
2932
## Version 8.5.2
3033
* Updated System.Security.Cryptography.XML to address a vulnerability.
3134
* Minor bug fixes. See https://epplussoftware.com/Developers/MinorFeaturesAndIssues
@@ -563,8 +566,9 @@
563566
A list of fixed issues can be found here https://epplussoftware.com/docs/7.0/articles/fixedissues.html
564567

565568
Version history
569+
8.5.3 20260416 Updated .NET 8 references incorrectly update to 9.x to 8.x.
566570
8.5.2 20260416 Minor bug fixes. See https://epplussoftware.com/Developers/MinorFeaturesAndIssues
567-
8.5.1 20260330 Minor bug fixes.
571+
8.5.1 20260330 Minor bug fixes.
568572
8.5.0 20260306 Minor features and bug fixes.
569573
8.4.2 20260204 Minor bug fixes.
570574
8.4.1 20260112 Minor bug fixes.

0 commit comments

Comments
 (0)