Skip to content

Bump NPOI from 2.7.3 to 2.7.6#10

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/NPOI-2.7.6
Closed

Bump NPOI from 2.7.3 to 2.7.6#10
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/NPOI-2.7.6

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 20, 2026

Updated NPOI from 2.7.3 to 2.7.6.

Release notes

Sourced from NPOI's releases.

2.7.6

Release Notes
Nuget Link

What's Changed

New Contributors

Full Changelog: nissl-lab/npoi@2.7.5-rc1...2.7.6-rc1

2.7.5

Nuget link
Release Notes

What's Changed

New Contributors

Full Changelog: nissl-lab/npoi@2.7.4-rc3...2.7.5-rc1

2.7.4

Nuget Link
Release Notes

What's Changed

New Contributors

Commits viewable in compare view.

@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 20, 2026

Labels

The following labels could not be found: dependencies, nuget. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot requested a review from jkindrix as a code owner May 20, 2026 18:56
@dependabot dependabot Bot force-pushed the dependabot/nuget/NPOI-2.7.6 branch from 9b9e8ab to e890f4f Compare May 20, 2026 19:11
@jkindrix
Copy link
Copy Markdown
Owner

@dependabot rebase

jkindrix added a commit that referenced this pull request May 20, 2026
NPOI 2.7.4 removed the byte[]-only XSSFColor constructor we were
using in CellStylePool.ToXssfColor. The replacement (byte[],
IIndexedColorMap) requires a 2nd argument we have no need for, and
the named-arg form is brittle across NPOI versions.

Switch to constructing via CT_Color, which has been the stable
backing ctor since NPOI 2.5.x. Encodes the color as ARGB with
alpha=0xFF (opaque) — same on-disk representation as before.

Verified: still builds on 2.7.3 (current pin); style-related tests
pass. Unblocks the NPOI 2.7.3 -> 2.7.6 dependabot bump (PR #10).
@jkindrix
Copy link
Copy Markdown
Owner

@dependabot rebase

---
updated-dependencies:
- dependency-name: NPOI
  dependency-version: 2.7.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/nuget/NPOI-2.7.6 branch from e890f4f to eba6502 Compare May 20, 2026 20:00
@jkindrix
Copy link
Copy Markdown
Owner

Closing this PR. NPOI 2.7.6's nuspec is still Apache-2.0 (no OSMF — that's 2.8.0+ only), but the 2.7.x patch line is mid-migration to whatever API shape NPOI is heading toward for 2.8.0:

  1. 2.7.4 removed the byte[]-only XSSFColor constructor we were using.
  2. 2.7.6 [Obsolete]s the XSSFColor(CT_Color) constructor ("Remove it at NPOI 2.8.0").

Two breaking API churn events in patch releases is not patch-release discipline.

Separate consideration: we already override SixLabors.ImageSharp to 2.1.11 directly in Directory.Packages.props (the real CVE fix). NPOI 2.7.6's headline upstream improvement is also bumping ImageSharp to 2.1.11 — which our override already gives us. There's no consumer-visible value in this bump beyond the headline that's already addressed.

Per decision I23, we stay on NPOI 2.7.3 (last clean Apache-2.0 release pre-OSMF). The forward-compat fix landed on main (42fbda3) keeps our code resilient if we ever do need to take a 2.7.x bump, but we're not pulling this one.

Updating .github/dependabot.yml to ignore NPOI patches too, so future 2.7.x patch PRs don't keep cycling — we'll opt in manually if upstream signals stabilize.

@jkindrix jkindrix closed this May 20, 2026
@jkindrix jkindrix deleted the dependabot/nuget/NPOI-2.7.6 branch May 20, 2026 20:04
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 20, 2026

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

jkindrix added a commit that referenced this pull request May 20, 2026
…ache to v5

Two follow-ups to the dep wave:

NPOI: closed PR #10 (2.7.3 -> 2.7.6) because the 2.7.x patch line has
introduced breaking API changes twice (2.7.4 removed byte[]-only
XSSFColor ctor; 2.7.6 [Obsolete]s the CT_Color ctor — both relied on
by our CellStylePool.ToXssfColor). The earlier forward-compat fix
(commit 42fbda3) keeps our code resilient if we ever do take a 2.7.x
patch, but we're not auto-merging them. Dependabot ignore expanded
to also cover semver-patch on NPOI — we opt in manually if upstream
stabilizes. Documented in the inline comment.

actions/cache: v4 -> v5 (latest 5.0.5, Node.js 24-ready). Resolves
the deprecation notice that fired on the last bench workflow run.
Verified via gh api repos/actions/cache/releases/latest.
jkindrix added a commit that referenced this pull request Jun 1, 2026
Wire ICell.SetRichText / GetRichText on the SDK engine. A rich-text value
is written as an inline rich string (<c t="inlineStr"><is> with one <r>
per RichTextRun); each run's <rPr> font axes (bold/italic/underline/size/
color/rFont) are built by the new OoxmlStylePool run-property helper, which
reuses the existing color/underline maps but emits inline run properties
rather than a cellXfs font index.

The marquee semantic (lesson #10): a run whose RichTextStyle is empty is
written with NO <rPr>, so it inherits the cell font — faithfully modeling
the unformatted-prefix-run inheritance that NPOI's fully-explicit run fonts
could not preserve. On read, a run with no <rPr> maps back to
RichTextStyle.Default.

A rich-text cell's Kind is CellKind.String and GetString returns the
concatenated run text; GetRichText returns null for a plain string or a
non-string cell, reading inline <is> runs and (for opened files)
shared-string <si> runs. Empty-text runs contribute no formatting run, and
the cell-text-length limit is enforced on the concatenated text.

Parallel-engine rules respected: touches only Internal/Ooxml*.cs and
OoxmlEngine.Tests; no public-API change (both members already on ICell).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant