Skip to content

Commit b61be09

Browse files
JanKallmanJanKallman
committed
EPPlus version 8.5.2
1 parent 3995501 commit b61be09

File tree

6 files changed

+66
-41
lines changed

6 files changed

+66
-41
lines changed

‎SECURITY.md‎

Lines changed: 20 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,21 @@
11
# Security Policy
22

3-
_Last updated: 2026-01-08_
3+
*Last updated: 2026-04-16*
44

55
## Supported Versions
66

7-
EPPlus 7 and 8 are automatically scanned for vulnerabilities and static code analysis is performed as part of the CI.
7+
EPPlus 7 and 8 are automatically scanned for vulnerabilities and static code analysis is performed as part of the CI.
88

9-
| Version | Supported | Comment | Deprecation date |
10-
| ------- | ------------------ | ------------------ |----|
11-
| 8.x.x | :white_check_mark: | ||
12-
| 7.x.x | :white_check_mark: | ||
13-
| 6.x.x | :x: |Deprecated/unsupported versions |2025-12-31|
14-
| 5.x.x | :x: |Deprecated/unsupported versions |2024-12-31|
15-
| < 4.5 | :x: |Deprecated/unsupported versions|2020-12-31|
9+
|Version|Supported|Comment|Deprecation date|
10+
|-|-|-|-|
11+
|8.x.x|:white\_check\_mark:|||
12+
|7.x.x|:white\_check\_mark:|||
13+
|6.x.x|:x:|Deprecated/unsupported versions|2025-12-31|
14+
|5.x.x|:x:|Deprecated/unsupported versions|2024-12-31|
15+
|< 4.5|:x:|Deprecated/unsupported versions|2020-12-31|
1616

1717
## Security update policy
18+
1819
Security patches will be provided via new revisions released in our public Nuget feed. One patch for each supported major version/the two latest minor versions will be provided. [Subscribe to our newsletter](https://epplussoftware.com/en/Home/Newsletter) to get updates from EPPlus Software.
1920

2021
## Reporting a Vulnerability
@@ -26,15 +27,22 @@ If you discover a security vulnerability in EPPlus, please report it through Git
2627

2728
This ensures the report stays private until we have assessed and addressed the issue. Please do not report security vulnerabilities through the public issue tracker.
2829

29-
## Code signing
30+
## Code signing
31+
3032
Since version 7.5 the EPPlus Nuget package and the EPPlus libraries/dll:s are digitally signed by EPPlus Software AB.
3133

3234
## See also
33-
- [EPPlus versioning](https://github.com/EPPlusSoftware/EPPlus/wiki/Releases-versioning)
35+
36+
* [EPPlus versioning](https://github.com/EPPlusSoftware/EPPlus/wiki/Releases-versioning)
3437

3538
## Vulnerabilities
39+
3640
|Detected|Resolved|Affected EPPlus versions|CVE|Our comment|Resolution|
37-
|--------|--------| ----------------------|---|----------|----------|
41+
|-|-|-|-|-|-|
42+
|April 15, 2026|April 16, 2026|EPPlus 8.x,targeting .NET 9 or 10|[Microsoft Security Advisory - CVE-2026-33116](https://github.com/advisories/GHSA-37gx-xxp4-5rgx) and [Microsoft Security Advisory - CVE-2026-26171](https://github.com/advisories/GHSA-w3x6-4m5h-cxqf)|Microsoft has released a security fix in System.Security.Cryptography.Xml 10.0.6 and 9.0.15. EPPlus uses this package to create and validate digital signatures for workbooks. The potential risk for most users should be very low.|Patch released in version 8.5.2|
3843
|October 10, 2024|October 11, 2024|EPPlus 7.x,targeting .NET 7 or 8|[Microsoft Security Advisory CVE-2024-38095](https://github.com/advisories/GHSA-447r-wph3-92pm) and [Microsoft Security Advisory CVE-2024-30105](https://github.com/advisories/GHSA-hh2w-p6rv-4g7w)|Microsoft has released a security fix in Microsoft.Extensions.Configuration.Json 8.0.1. The potential risk for most users should be low.|Patch released in version 7.4.1|
3944
|September 9, 2024||EPPlus 7.x, targeting .NET 7 or 8|[Microsoft Security Advisory CVE-2024-38095](https://github.com/advisories/GHSA-447r-wph3-92pm) and [Microsoft Security Advisory CVE-2024-30105](https://github.com/advisories/GHSA-hh2w-p6rv-4g7w)|Microsoft has released security fixes for System.Text.Json and System.Formats.Asn1 (transient dependencies in EPPlus). The potential risk for most users should be low.|Patch released in version 7.3.2|
4045
|June 15, 2023|June 15, 2023|EPPlus 6.x prior to 6.2.6, targeting .NET 6 or 7.|[.NET Denial of Service vulnerability (CVE 2023-29331)](https://github.com/advisories/GHSA-555c-2p6r-68mm)|Microsoft has released a security fix for a Denial of Service vulnerability (CVE-2023-29331) in System.Security.Cryptography.Pkcs for .NET 6 and .NET 7. EPPlus uses this component for x509 certificates used when signing VBA projects in a workbook. The potential risk for most users should be low, as the certificates used to sign your workbooks are usually known.|Upgrade to EPPlus 6.2.6 or higher|
46+
47+
48+

‎appveyor8.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
version: 8.5.1.{build}
1+
version: 8.5.2.{build}
22
branches:
33
only:
44
- develop8
@@ -10,15 +10,15 @@ install:
1010
& $env:temp\dotnet-install.ps1 -Architecture x64 -Version '10.0.100' -InstallDir "$env:ProgramFiles\dotnet"
1111
init:
1212
- ps: >-
13-
Update-AppveyorBuild -Version "8.5.1.$env:appveyor_build_number-$(Get-Date -format yyyyMMdd)-$env:appveyor_repo_branch"
13+
Update-AppveyorBuild -Version "8.5.2.$env:appveyor_build_number-$(Get-Date -format yyyyMMdd)-$env:appveyor_repo_branch"
1414
15-
Write-Host "8.5.1.$env:appveyor_build_number-$(Get-Date -format yyyyMMdd)-$env:appveyor_repo_branch"
15+
Write-Host "8.5.2.$env:appveyor_build_number-$(Get-Date -format yyyyMMdd)-$env:appveyor_repo_branch"
1616
dotnet_csproj:
1717
patch: true
1818
file: '**\*.csproj'
1919
version: '{version}'
20-
assembly_version: 8.5.1.{build}
21-
file_version: 8.5.1.{build}
20+
assembly_version: 8.5.2.{build}
21+
file_version: 8.5.2.{build}
2222
nuget:
2323
project_feed: true
2424
before_build:

‎docs/articles/fixedissues.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,16 @@
11
# Features / Fixed issues - EPPlus 8
2+
## Version 8.5.2
3+
### Security
4+
* Updated System.Security.Cryptography.Xml to 10.0.6 to address a security vulnerability (CVE-2026-26171 and CVE-2026-33116).
5+
###Bug Fixes
6+
* ´ExcelRange.LoadFromCollection´: ´DisplayAttribute.Name´ was used directly instead of ´DisplayAttribute.GetName()´, causing resource keys to appear as column headers instead of localized values when ResourceType was set.
7+
* ´ExcelRange.LoadFromCollection´: ´EpplusTableColumnAttribute.Order´ was ignored when ´DisplayAttribute´ was also present.
8+
* Fixed various issues with the LAMBDA function and variable expressions.
9+
* Fixed an issue with the VSTACK and HSTACK functions when the argument is a single-cell range.
10+
* The IFS function did not handle arrays in the condition arguments.
11+
* The SORTBY function now preserves the original order of rows/columns when the sort key is not unique.
12+
* EPPlus will now throw a ´NotSupportedException´ if opening workbooks saved in the Strict OpenXML format.
13+
214
## Version 8.5.1
315
* Negation of numeric string values now returns the negated number instead of a #VALUE! error in the formula calculation.
416
* ´ExcelPackage.Configure´ now sets ´IConfiguration´ for license info.

‎src/Directory.Packages.props‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,12 @@
77
<PackageVersion Include="Microsoft.IO.RecyclableMemoryStream" Version="3.0.1" />
88
<PackageVersion Include="MSTest" Version="3.10.2" />
99
<PackageVersion Include="System.ComponentModel.Annotations" Version="5.0.0" />
10-
<PackageVersion Include="System.Drawing.Common" Version="8.0.14" />
11-
<PackageVersion Include="System.Formats.Asn1" Version="8.0.2" />
12-
<PackageVersion Include="System.Security.Cryptography.Pkcs" Version="8.0.1" />
13-
<PackageVersion Include="System.Security.Cryptography.Xml" Version="8.0.2" />
14-
<PackageVersion Include="System.Text.Encoding.CodePages" Version="8.0.0" />
15-
<PackageVersion Include="System.Text.Json" Version="8.0.5" />
10+
<PackageVersion Include="System.Drawing.Common" Version="9.0.15" />
11+
<PackageVersion Include="System.Formats.Asn1" Version="9.0.15" />
12+
<PackageVersion Include="System.Security.Cryptography.Pkcs" Version="9.0.15" />
13+
<PackageVersion Include="System.Security.Cryptography.Xml" Version="9.0.15" />
14+
<PackageVersion Include="System.Text.Encoding.CodePages" Version="9.0.15" />
15+
<PackageVersion Include="System.Text.Json" Version="9.0.15" />
1616
</ItemGroup>
1717
<ItemGroup>
1818
<PackageVersion Include="FakeItEasy" Version="8.0.0" />

‎src/EPPlus/EPPlus.csproj‎

Lines changed: 22 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
<Project Sdk="Microsoft.NET.Sdk">
22
<PropertyGroup>
33
<TargetFrameworks>net8.0;net9.0;net10.0;netstandard2.1;netstandard2.0;net462;net35</TargetFrameworks>
4-
<AssemblyVersion>8.5.1.0</AssemblyVersion>
5-
<FileVersion>8.5.1.0</FileVersion>
6-
<Version>8.5.1</Version>
4+
<AssemblyVersion>8.5.2.0</AssemblyVersion>
5+
<FileVersion>8.5.2.0</FileVersion>
6+
<Version>8.5.2</Version>
77
<GeneratePackageOnBuild>true</GeneratePackageOnBuild>
88
<PackageProjectUrl>https://epplussoftware.com</PackageProjectUrl>
99
<Authors>EPPlus Software AB</Authors>
@@ -18,24 +18,28 @@
1818
<PackageReadmeFile>readme.md</PackageReadmeFile>
1919
<Copyright>EPPlus Software AB</Copyright>
2020
<PackageReleaseNotes>
21-
EPPlus 8.5.1
21+
EPPlus 8.5.2
2222

2323
IMPORTANT NOTICE!
2424
From version 5 EPPlus changes the license model using a dual license, Polyform Non Commercial / Commercial license.
2525
EPPlus will still have the source available, but for non Polyform NC compliant projects, EPPlus will provide a commercial license.
2626
Commercial licenses can be purchased from https://epplussoftware.com
2727
This applies to EPPlus version 5 and later. Earlier versions are still licensed LGPL.
2828

29-
## Version 8.5.1
29+
## Version 8.5.2
30+
* Updated System.Security.Cryptography.XML to address a vulnerability.
3031
* Minor bug fixes. See https://epplussoftware.com/Developers/MinorFeaturesAndIssues
31-
32+
33+
## Version 8.5.1
34+
* Minor bug fixes.
35+
3236
## Version 8.5.0
3337
* Added ´CancellationToken´ option to the Calculate method.
3438
* Added property ´ValueFromCellsRange´ and the ´SetValueFromCellsRange´ method to data labels on chart series.
35-
* Minor bug fixes.
39+
* Minor bug fixes.
3640

3741
## Version 8.4.2
38-
* Minor bug fixes.
42+
* Minor bug fixes.
3943

4044
## Version 8.4.1
4145
* Minor bug fixes.
@@ -559,7 +563,8 @@
559563
A list of fixed issues can be found here https://epplussoftware.com/docs/7.0/articles/fixedissues.html
560564

561565
Version history
562-
8.5.1 20260330 Minor bug fixes. See https://epplussoftware.com/Developers/MinorFeaturesAndIssues
566+
8.5.2 20260416 Minor bug fixes. See https://epplussoftware.com/Developers/MinorFeaturesAndIssues
567+
8.5.1 20260330 Minor bug fixes.
563568
8.5.0 20260306 Minor features and bug fixes.
564569
8.4.2 20260204 Minor bug fixes.
565570
8.4.1 20260112 Minor bug fixes.
@@ -760,20 +765,20 @@
760765
</ItemGroup>
761766

762767
<ItemGroup Condition="'$(TargetFramework)' == 'net9.0'">
763-
<PackageReference Include="Microsoft.Extensions.Configuration.Json" VersionOverride="9.0.3" />
768+
<PackageReference Include="Microsoft.Extensions.Configuration.Json" VersionOverride="9.0.15" />
764769
<PackageReference Include="Microsoft.IO.RecyclableMemoryStream" />
765-
<PackageReference Include="System.Security.Cryptography.Pkcs" VersionOverride="9.0.3" />
770+
<PackageReference Include="System.Security.Cryptography.Pkcs" VersionOverride="9.0.15" />
766771
<PackageReference Include="System.ComponentModel.Annotations" />
767-
<PackageReference Include="System.Text.Encoding.CodePages" VersionOverride="9.0.3" />
768-
<PackageReference Include="System.Security.Cryptography.Xml" VersionOverride="9.0.3" />
772+
<PackageReference Include="System.Text.Encoding.CodePages" VersionOverride="9.0.15" />
773+
<PackageReference Include="System.Security.Cryptography.Xml" VersionOverride="9.0.15" />
769774
</ItemGroup>
770775
<ItemGroup Condition="'$(TargetFramework)' == 'net10.0'">
771-
<PackageReference Include="Microsoft.Extensions.Configuration.Json" VersionOverride="10.0.0" />
776+
<PackageReference Include="Microsoft.Extensions.Configuration.Json" VersionOverride="10.0.6" />
772777
<PackageReference Include="Microsoft.IO.RecyclableMemoryStream" />
773-
<PackageReference Include="System.Security.Cryptography.Pkcs" VersionOverride="10.0.0" />
778+
<PackageReference Include="System.Security.Cryptography.Pkcs" VersionOverride="10.0.6" />
774779
<PackageReference Include="System.ComponentModel.Annotations" />
775-
<PackageReference Include="System.Text.Encoding.CodePages" VersionOverride="10.0.0" />
776-
<PackageReference Include="System.Security.Cryptography.Xml" VersionOverride="10.0.0" />
780+
<PackageReference Include="System.Text.Encoding.CodePages" VersionOverride="10.0.6" />
781+
<PackageReference Include="System.Security.Cryptography.Xml" VersionOverride="10.0.6" />
777782
</ItemGroup>
778783
<ItemGroup>
779784
<Compile Remove="LoadFunctions\HeaderReader.cs" />

‎src/EPPlus/FormulaParsing/Excel/Functions/BuiltInFunctions.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -336,7 +336,7 @@ public BuiltInFunctions()
336336
// Reference and lookup
337337
Functions["address"] = new Address();
338338
Functions["areas"] = new Areas();
339-
Functions["groupby"] = new GroupBy();
339+
//Functions["groupby"] = new GroupBy(); //Will be released in next minor release.
340340
Functions["hlookup"] = new HLookup();
341341
Functions["vlookup"] = new VLookup();
342342
Functions["xlookup"] = new Xlookup();

0 commit comments

Comments
 (0)