Can we update to use sharpziplib.1.3.3.nupkg version?

[faraazhabeeb123]

There is a vulnerability noticed in version 1.3.2 or below of sharpziplib. Can we update the version to 1.3.3.? Reference to security: https://securitylab.github.com/advisories/GHSL-2021-125-sharpziplib/

[mganss]

The dependency on SharpZipLib comes as an indirect dependency through NPOI. They haven't updated to 1.3.3 yet, see here for the discussion: nissl-lab/npoi#741

OTOH it it should be fine if you take a direct dependency on SharpZipLib 1.3.3 in your project.

[mganss]

Fixed in 5.2.393 (via NPOI 2.5.6).