Skip to content

Security updates 8.6.3 - System.Security.Cryptography.Xml #2438

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
swmal merged 4 commits into from
Jul 24, 2026
+27 −20
Merged

Security updates 8.6.3 - System.Security.Cryptography.Xml #2438

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
7784db6
Added DisableImageFunctionDownloads property to ParsingConfiguration.…
Jul 21, 2026
c72cfbc
Update System.Security.Cryptography.Xml to 8.0.4/9.0.18/10.0.10 for C…
Jul 24, 2026
b3b7842
Merge branch 'develop8' into fix/security-updates-202607
Jul 24, 2026
4597a5a
Additional fixes för appveyor8.yml, fixedIssures.md and EPPlus projec…
Jul 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions appveyor8.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
version: 8.6.2.{build}
version: 8.6.3.{build}
branches:
only:
- develop8
Expand All @@ -10,15 +10,15 @@ install:
& $env:temp\dotnet-install.ps1 -Architecture x64 -Version '10.0.100' -InstallDir "$env:ProgramFiles\dotnet"
init:
- ps: >-
Update-AppveyorBuild -Version "8.6.2.$env:appveyor_build_number-$(Get-Date -format yyyyMMdd)-$env:appveyor_repo_branch"
Update-AppveyorBuild -Version "8.6.3.$env:appveyor_build_number-$(Get-Date -format yyyyMMdd)-$env:appveyor_repo_branch"

Write-Host "8.6.2.$env:appveyor_build_number-$(Get-Date -format yyyyMMdd)-$env:appveyor_repo_branch"
Write-Host "8.6.3.$env:appveyor_build_number-$(Get-Date -format yyyyMMdd)-$env:appveyor_repo_branch"
dotnet_csproj:
patch: true
file: '**\*.csproj'
version: '{version}'
assembly_version: 8.6.2.{build}
file_version: 8.6.2.{build}
assembly_version: 8.6.3.{build}
file_version: 8.6.3.{build}
nuget:
project_feed: true
before_build:
Expand Down
3 changes: 3 additions & 0 deletions docs/articles/fixedissues.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,7 @@
# Features / Fixed issues - EPPlus 8
## Version 8.6.3
### Security
* Updated System.Security.Cryptography.Xml to address five security vulnerabilities in the .NET XML signing dependency: four denial of service vulnerabilities (CVE-2026-47302, CVE-2026-50525, CVE-2026-50527, CVE-2026-50648) and one security feature bypass (CVE-2026-47304). The package is updated to 8.0.4 (.NET Framework, .NET 8 and .NET Standard), 9.0.18 (.NET 9) and 10.0.10 (.NET 10).
## Version 8.6 2
### Minor features and fixed issues
* Added property ´AlwaysRefreshImageFunction´ to ´ParsingConfiguration´, to disable download of external content in the calculation of the IMAGE function.
Expand Down
4 changes: 2 additions & 2 deletions src/Directory.Packages.props
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,8 +9,8 @@
<PackageVersion Include="System.ComponentModel.Annotations" Version="5.0.0" />
<PackageVersion Include="System.Drawing.Common" Version="8.0.26" />
<PackageVersion Include="System.Formats.Asn1" Version="8.0.2" />
<PackageVersion Include="System.Security.Cryptography.Pkcs" Version="8.0.1" />
<PackageVersion Include="System.Security.Cryptography.Xml" Version="8.0.3" />
<PackageVersion Include="System.Security.Cryptography.Pkcs" Version="8.0.1" />
<PackageVersion Include="System.Security.Cryptography.Xml" Version="8.0.4" />
<PackageVersion Include="System.Text.Encoding.CodePages" Version="8.0.0" />
<PackageVersion Include="System.Text.Json" Version="8.0.6" />
</ItemGroup>
Expand Down
30 changes: 17 additions & 13 deletions src/EPPlus/EPPlus.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
<Project Sdk="Microsoft.NET.Sdk">
<PropertyGroup>
<TargetFrameworks>net8.0;net9.0;net10.0;netstandard2.1;netstandard2.0;net462;net35</TargetFrameworks>
<AssemblyVersion>8.6.2.0</AssemblyVersion>
<FileVersion>8.6.2.0</FileVersion>
<Version>8.6.2</Version>
<AssemblyVersion>8.6.3.0</AssemblyVersion>
<FileVersion>8.6.3.0</FileVersion>
<Version>8.6.3</Version>
<GeneratePackageOnBuild>true</GeneratePackageOnBuild>
<PackageProjectUrl>https://epplussoftware.com</PackageProjectUrl>
<Authors>EPPlus Software AB</Authors>
Expand All @@ -18,14 +18,17 @@
<PackageReadmeFile>readme.md</PackageReadmeFile>
<Copyright>EPPlus Software AB</Copyright>
<PackageReleaseNotes>
EPPlus 8.6.2
EPPlus 8.6.3

IMPORTANT NOTICE!
From version 5 EPPlus changes the license model using a dual license, Polyform Non Commercial / Commercial license.
EPPlus will still have the source available, but for non Polyform NC compliant projects, EPPlus will provide a commercial license.
Commercial licenses can be purchased from https://epplussoftware.com
This applies to EPPlus version 5 and later. Earlier versions are still licensed LGPL.

## Version 8.6.3
* Updated System.Security.Cryptography.Xml to address security vulnerabilities (CVE-2026-47302, CVE-2026-47304, CVE-2026-50525, CVE-2026-50527, CVE-2026-50648).

## Version 8.6.2
* Minor bug fixes. See https://epplussoftware.com/Developers/MinorFeaturesAndIssues

Expand Down Expand Up @@ -583,8 +586,9 @@
A list of fixed issues can be found here https://epplussoftware.com/docs/8.6/articles/fixedissues.html

Version history
8.6.3 20260724 Updated System.Security.Cryptography.Xml for security vulnerabilities.
8.6.2 20260721 Minor bug fixes. See https://epplussoftware.com/Developers/MinorFeaturesAndIssues
8.6.1 20260616 3 new functions. Minor bug fixes.
8.6.1 20260616 3 new functions. Minor bug fixes.
8.6.0 20260529 9 new functions. Support for trim Reference operator.
8.5.4 20260430 Minor bug fixes.
8.5.3 20260416 Updated .NET 8 references incorrectly update to 9.x to 8.x.
Expand Down Expand Up @@ -790,20 +794,20 @@
</ItemGroup>

<ItemGroup Condition="'$(TargetFramework)' == 'net9.0'">
<PackageReference Include="Microsoft.Extensions.Configuration.Json" VersionOverride="9.0.15" />
<PackageReference Include="Microsoft.Extensions.Configuration.Json" VersionOverride="9.0.18" />
<PackageReference Include="Microsoft.IO.RecyclableMemoryStream" />
<PackageReference Include="System.Security.Cryptography.Pkcs" VersionOverride="9.0.15" />
<PackageReference Include="System.Security.Cryptography.Pkcs" VersionOverride="9.0.18" />
<PackageReference Include="System.ComponentModel.Annotations" />
<PackageReference Include="System.Text.Encoding.CodePages" VersionOverride="9.0.15" />
<PackageReference Include="System.Security.Cryptography.Xml" VersionOverride="9.0.15" />
<PackageReference Include="System.Text.Encoding.CodePages" VersionOverride="9.0.18" />
<PackageReference Include="System.Security.Cryptography.Xml" VersionOverride="9.0.18" />
</ItemGroup>
<ItemGroup Condition="'$(TargetFramework)' == 'net10.0'">
<PackageReference Include="Microsoft.Extensions.Configuration.Json" VersionOverride="10.0.7" />
<PackageReference Include="Microsoft.Extensions.Configuration.Json" VersionOverride="10.0.10" />
<PackageReference Include="Microsoft.IO.RecyclableMemoryStream" />
<PackageReference Include="System.Security.Cryptography.Pkcs" VersionOverride="10.0.7" />
<PackageReference Include="System.Security.Cryptography.Pkcs" VersionOverride="10.0.10" />
<PackageReference Include="System.ComponentModel.Annotations" />
<PackageReference Include="System.Text.Encoding.CodePages" VersionOverride="10.0.7" />
<PackageReference Include="System.Security.Cryptography.Xml" VersionOverride="10.0.7" />
<PackageReference Include="System.Text.Encoding.CodePages" VersionOverride="10.0.10" />
<PackageReference Include="System.Security.Cryptography.Xml" VersionOverride="10.0.10" />
</ItemGroup>
<ItemGroup>
<Compile Remove="LoadFunctions\HeaderReader.cs" />
Expand Down
Loading