FreeDotnetPOI 2.7.10

Dependency update.

NuGet: https://www.nuget.org/packages/FreeDotnetPOI/2.7.10

Changes

• Depends on FreeDotnetImageSharp 2.1.15 (was 2.1.14). It hardens ICC profile parsing: a small malformed ICC profile could make reading IccProfile.Entries allocate gigabytes of memory. NPOI itself never reads ICC profiles, so NPOI's own behavior is unchanged; this release makes sure applications get the patched version by default.

The test suite now also runs on .NET 10, alongside .NET 8 and .NET Framework 4.7.2.

Upgrading

No API changes:

dotnet add package FreeDotnetPOI --version 2.7.10

FreeDotnetPOI is not affiliated with or endorsed by Nissl Lab, Six Labors or The Apache Software Foundation. All credit for the original work goes to Tony Qu and the NPOI contributors.

FreeDotnetPOI 2.7.9

FreeDotnetPOI no longer depends on any Six Labors package.

NuGet: https://www.nuget.org/packages/FreeDotnetPOI/2.7.9

Changes

• Text measurement now uses FreeDotnetFonts 1.0.2 instead of SixLabors.Fonts 1.0.1. FreeDotnetFonts is an Apache-2.0 fork of SixLabors.Fonts 1.0.1, the last release before Six Labors moved to the Split License. The code is identical, so text measurement (for example, auto-sizing columns) behaves exactly as before.

With this release, both of NPOI's Six Labors dependencies are replaced by Apache-2.0 forks: FreeDotnetImageSharp (since 2.7.7) and FreeDotnetFonts.

Upgrading

No API changes:

dotnet add package FreeDotnetPOI --version 2.7.9

If your project also references SixLabors.Fonts directly, replace it with FreeDotnetFonts (and SixLabors.ImageSharp with FreeDotnetImageSharp). The forks ship the same assemblies and can't be used together with the originals.

FreeDotnetPOI is not affiliated with or endorsed by Nissl Lab, Six Labors or The Apache Software Foundation. All credit for the original work goes to Tony Qu and the NPOI contributors.

FreeDotnetPOI 2.7.8

Bug-fix release. Upgrading from 2.7.7 is recommended for all users, especially applications that open .xlsx, .docx or .pptx files from a file path.

NuGet: https://www.nuget.org/packages/FreeDotnetPOI/2.7.8

Fixes

• Fixed data loss when opening an OOXML file from a path. When NPOI can't open a file as a zip archive right away (for example, because another process such as an antivirus scanner briefly has it open), it falls back to reading the file as a stream. That fallback opened the file in a mode that truncated it to 0 bytes, destroying the original document, and then failed with ZipException: EOF in header. The fallback now opens the file read-only. This bug is also present in NPOI 2.7.6.
• Temp file names no longer collide across processes. TempFile.GetTempFilePath derived names from a random generator seeded with the current millisecond, so processes creating temp files at the same moment could get the same path and overwrite each other's data. Names are now GUID-based, like TempFile.CreateTempFile.

Other changes

• Fixed a test that deleted the shared temp directory while other test runs were using it. Windows CI now passes.

Upgrading

No API changes. Update the package version:

dotnet add package FreeDotnetPOI --version 2.7.8

Dependencies are unchanged from 2.7.7.

FreeDotnetPOI is not affiliated with or endorsed by Nissl Lab or The Apache Software Foundation. All credit for the original work goes to Tony Qu and the NPOI contributors.

FreeDotnetPOI 2.7.7

First release of FreeDotnetPOI, a community-maintained, Apache-2.0 licensed fork of NPOI 2.7.6.

NuGet: https://www.nuget.org/packages/FreeDotnetPOI/2.7.7

Security fixes

• Image handling now uses FreeDotnetImageSharp 2.1.14 instead of SixLabors.ImageSharp 2.1.11. This fixes GHSA-j9gm-c75j-xc9q, GHSA-jjfr-hcj7-qf5w, GHSA-j3p4-wp97-rph4, GHSA-gwg2-r3hj-4w44 and GHSA-wmxv-xphr-5c9g without moving to the non-free ImageSharp 3.x+.
• System.Security.Cryptography.Xml updated from 8.0.2 to 8.0.4, which fixes its known high-severity advisories.

With these updates, projects referencing FreeDotnetPOI no longer get NuGet audit warnings (NU1902/NU1903) from NPOI's dependencies.

Upgrading from NPOI 2.7.x

Assembly names and namespaces (NPOI.*) are unchanged, so no code changes are needed:

dotnet remove package NPOI
dotnet add package FreeDotnetPOI

If your project also references SixLabors.ImageSharp directly, replace it with FreeDotnetImageSharp. Both ship SixLabors.ImageSharp.dll and can't be used together.

The assembly version is now 2.7.7. On .NET Framework, libraries compiled against NPOI 2.7.6 need a binding redirect, which SDK-style projects generate automatically.

FreeDotnetPOI is not affiliated with or endorsed by Nissl Lab or The Apache Software Foundation. All credit for the original work goes to Tony Qu and the NPOI contributors.