Upgrading EPPlus 7 to 8
Review needed7.7.4 → 8.7.2Security5New38Changed1Fixed22Other1
Review neededUpgrade verdict
1 behavior change and 5 security fixes.
In plain terms
- Fix for security advisory GHSA-f4h2-2r6m-w59r.
- Updated System.Security.Cryptography.Xml and System.Security.Cryptography.Pkcs to address security vulnerabilities (CVE-2026-96222, CVE-2026-96958, CVE-2026-96959, CVE-2026-96960, CVE-2026-84008…
- Security release addressing five vulnerabilities in the System.Security.Cryptography.Xml dependency.
- Denial of service: CVE-2026-47302, CVE-2026-50525, CVE-2026-50527, CVE-2026-50648 Security feature bypass: CVE-2026-47304.
Must act Top 3 of 5 that need code or config changes
Target frameworks requirement changed in 8.4.0: .NETFramework3.5, .NETFramework4.6.2, .NETStandard2.0, .NETStandard2.1, net8.0, net9.0 → .NETFramework3.5, .NETFramework4.6.2, .NETStandard2.0, .NETStandard2.1, net10.0, net8.0, net9.0.
Adds epplus.interfaces 8.6.2, system.security.cryptography.xml 9.0.21.
Drops epplus.system.drawing.
What you must change
Security5
Fix for security advisory GHSA-f4h2-2r6m-w59r.
Updated System.Security.Cryptography.Xml and System.Security.Cryptography.Pkcs to address security vulnerabilities (CVE-2026-96222, CVE-2026-96958, CVE-2026-96959, CVE-2026-96960, CVE-2026-84008…
Security release addressing five vulnerabilities in the System.Security.Cryptography.Xml dependency.
Denial of service: CVE-2026-47302, CVE-2026-50525, CVE-2026-50527, CVE-2026-50648 Security feature bypass: CVE-2026-47304.
Updated System.Security.Cryptography.Xml for .NET 9 & 10 to address a security vulnerability (CVE-2026-26171 and CVE-2026-33116).