search

EvotecIT / OfficeIMO

Fast and easy to use cross-platform .NET library that creates or modifies Microsoft Word (DocX) and later also Excel (XLSX) files without installing any software. Library is based on Open XML SDK
MIT License
289 stars 50 forks source link

Bump dependencies to remove vulnerabilities #243

Closed Willh76 closed 3 months ago

PrzemyslawKlys commented 3 months ago

Hello @Willh76

Version 3.0.0+ is completly different license + doesn't really work with OfficeIMO without further changes to the logic.

In addition 2.1.9 has backports the security fixes from 3.1.5, so it's perfectly safe. While 3.X.X license allows transitive dependency for free, I am not sure we really need it as we use very little of that library and if I would find a way to find the size of images without it, I would probably be able to drop it as RGB stuff, or builtin colors is something that's easily replaceable.

Willh76 commented 3 months ago

Hello @Willh76

Version 3.0.0+ is completly different license + doesn't really work with OfficeIMO without further changes to the logic.

In addition 2.1.9 has backports the security fixes from 3.1.5, so it's perfectly safe. While 3.X.X license allows transitive dependency for free, I am not sure we really need it as we use very little of that library and if I would find a way to find the size of images without it, I would probably be able to drop it as RGB stuff, or builtin colors is something that's easily replaceable.

Hello @PrzemyslawKlys I wonder if you could assist with my issue. I have recently updated from framework 4.8 to .NET 8 in my application and anywhere I have used paragraph.AddImage(imageStream, Title, null, null) My application is catching due to sixlabours. I assumed it was due to the discrepencies between versions.

Method not found: 'SixLabors.ImageSharp.Image SixLabors.ImageSharp.Image.Load(System.IO.Stream, SixLabors.ImageSharp.Formats.IImageFormat ByRef)'.

PrzemyslawKlys commented 3 months ago

Just downgrade SixLabors to 2.1.9 in your project and it will work. The moment you use anything higher than that it will throw error. That's what I meant when I said it's not compatible. There is a slight change between 3.X and 2.X versions, including big license change.

Willh76 commented 3 months ago

Great, thank you