System.IO.Packaging 4.5.0 reference vulnerable

[rekna1]

Nuget package 2.9.1 has reference to System.IO.Packaging 4.5.0 which is marked vulnerable.

2.9.1 seems to be the latest version currently.

[twsouthwick]

2.9.1 seems to be the latest version currently.
This is not true and this version is quite old. The 2.x line reached 2.20.0, and now we're on v3.3.0. Please update to the latest version.

Are you using your own feed that you haven't updated from NuGet.org?

[twsouthwick]

I'm going to close this issue as the solution is to update to the latest version.

[rekna1]

Oké, name of package has changed from Open-XML-SDK to DocumentFormat.OpenXml
that's why I'am still on old version, maybe you should make Open-XML-SDK deprecated.