2.5.3 is more bad than 2.5.2

[EmilNachev]

Hi
In 2.5.2 you depends on SharpZipLib >= 1.2.0
But in 2.5.3 you fixed SharpZipLib = 1.2.0
SharpZipLib lattest version is 1.3.2 and works fine but with your old 2.5.2 vesrion of NPOI

Good luck

[tonyqus]

This is on purpose. But why do you think it's worse? I don't get your point. Are you using some new feature from SharpZipLib?

[tonyqus]

The reason I do that is because several users report that SharpZipLib 1.2.0 dll is not found while using NPOI 2.5.1 or NPOI 2.5.2. And NPOI is indeed fully tested on SharpZipLib 1.2.0 while I run all the 4000 unit tests on my local. Moreover, I have no idea what are changed in SharpZipLib 1.3.2.

[tonyqus]

Anyway, I'm collecting more feedback about NPOI 2.5.3. This is a open discussion. Please feel free to let me know your thoughts.

[tonyqus]

#548 #474

[chucklu]

several users report that SharpZipLib 1.2.0 dll is not found while using NPOI 2.5.1 or NPOI 2.5.2

Next time, I can do troubleshooting for dependency missing problem, if they can provide a mcve repository.

[EmilNachev]

[EmilNachev]

[tonyqus]

Again, I know there is a new version of SharpZipLib. But new doesn't mean better. I'm not a big fans of latest version. Only time can tell which version is more stable.

As you request, I'm considering upgrading the package in the next release of NPOI. It will happen in Aug or Sep, 2021.

[pmiossec]

I think that there are a lot of discussion on this topic because v2.5.3 obliged developers to use the v1.2.0 of SharpZipLib that has some security flaws.
I also have to find a way to remove these vulnerabilities raised by our enterprise JFrog Xray scan tool.
And you should understand that having to wait 2 or 3 others months to have these security fixes could be very worrying :(

I also ask you to, please, reconsider the question and see if it's not possible to release a new version (2.5.4) with only this dependency update.

The list of vulnerabilities in SharpZipLib raised:

Severity	Issue	CVEs	Summary	Impacted Artifact	Fix version
High	XRAY-126532	CVSS2: 9.3 / CVSS3: 9.8	SharpZipLib Tar/TarArchive.cs TarArchive::ExtractEntry() Function Tar Archive Handling Path Traversal Arbitrary File Write	nuget://SharpZipLib:1.2.0	1.3.0
Medium	XRAY-86114	CVSS2: 6.9 / CVSS3: 6.7	SharpZipLib Multiple Extraction Helper Symlink Local File Overwrite	nuget://SharpZipLib:1.2.0
Low	XRAY-129146	CVSS2: 3.3 / CVSS3: 6.7	SharpZipLib Zip/ZipFile.cs DiskArchiveStorage::GetTempFileName() Function Insecure Temporary File Creation File Access Weakness	nuget://SharpZipLib:1.2.0	1.3.1
Low	XRAY-129169	CVSS2: 2.6 / CVSS3: 6.5	SharpZipLib Encryption/PkzipClassic.cs PkzipClassic::GenerateKey() Function Insufficient PRNG Key Generation Weakness	nuget://SharpZipLib:1.2.0	1.3.1
Low	XRAY-129170	CVSS2: 2.6 / CVSS3: 6.5	SharpZipLib Zip/ZipFile.cs ZipFile::WriteEncryptionHeader() Function Insufficient PRNG Header Generation Weakness	nuget://SharpZipLib:1.2.0	1.3.1
Low	XRAY-129171	CVSS2: 2.6 / CVSS3: 6.5	SharpZipLib Zip/ZipOutputStream.cs ZipOutputStream::WriteEncryptionHeader() Function Insufficient PRNG Header Generation Weakness	nuget://SharpZipLib:1.2.0	1.3.1

[tonyqus]

Thank you for the list. Looks 1.3.1 is more suitable for the next release.

[EmilNachev]

I can't understand how NPOI 2.5.2 can work stably (when you have released 2.5.2) with SharpZipLib >= 1.2.0,
but NPOI 2.5.3 can only work with SharpZipLib = 1.2.0.
I.e. your old version can work with subsequent versions of SharpZipLib, but your new version may not.
Please explain this to me and your customers!
Greetings Emil

[tonyqus]

The reason is here.

[tonyqus]

and Just be kind. If you believe 2.5.2 is better, I suggest you downgrade to 2.5.2 immediately. It's just a open source project. Not commercial and there is no cost for you to downgrade.

[tonyqus]

NPOI 2.5.4 released.