This is an automated email from the ASF dual-hosted git repository. pjfanning pushed a commit to branch asf-site in repository https://gitbox.apache.org/repos/asf/poi.git
commit 260a75a035cd0038e88c1bdab764d9ee8bedd6e0 Author: PJ Fanning <[email protected]> AuthorDate: Mon May 25 21:56:25 2026 +0100 upgrade docs --- content/components/index.html | 8 ++++---- content/encryption.html | 2 +- content/security.html | 13 +++++++++++++ 3 files changed, 18 insertions(+), 5 deletions(-) diff --git a/content/components/index.html b/content/components/index.html index 432d5f79f0..5d4d4c4223 100644 --- a/content/components/index.html +++ b/content/components/index.html @@ -614,7 +614,7 @@ document.write("Last Published: " + document.lastModified); <tr> <td colspan="1" rowspan="1">poi</td> - <td colspan="1" rowspan="1"><a href="https://search.maven.org/#artifactdetails|org.apache.logging.log4j|log4j-api|2.25.3|jar">log4j 2.x</a>, + <td colspan="1" rowspan="1"><a href="https://search.maven.org/#artifactdetails|org.apache.logging.log4j|log4j-api|2.26.0|jar">log4j 2.x</a>, <a href="https://search.maven.org/#artifactdetails|commons-codec|commons-codec|1.17.1|jar">commons-codec</a>, <a href="https://search.maven.org/#artifactdetails|org.apache.commons|commons-collections4|4.4|jar">commons-collections</a>, <a href="https://search.maven.org/#artifactdetails|org.apache.commons|commons-math3|3.6.1|jar">commons-math3</a> @@ -637,7 +637,7 @@ document.write("Last Published: " + document.lastModified); <td colspan="1" rowspan="1">poi-ooxml</td> <td colspan="1" rowspan="1"><a href="https://search.maven.org/#search|gav|1|g:org.apache.poi AND a:poi">poi</a>, <a href="https://search.maven.org/#search|gav|1|g:org.apache.poi AND a:poi-ooxml-lite">poi-ooxml-lite</a>, - <a href="https://search.maven.org/#artifactdetails|org.apache.commons|commons-compress|1.23.0|jar">commons-compress</a>, + <a href="https://search.maven.org/#artifactdetails|org.apache.commons|commons-compress|1.28.0|jar">commons-compress</a>, <a href="https://search.maven.org/#artifactdetails|com.zaxxer|SparseBitSet|1.2|jar">SparseBitSet</a> <br> For SVG support: @@ -679,8 +679,8 @@ document.write("Last Published: " + document.lastModified); <td colspan="1" rowspan="1"><a href="https://search.maven.org/#artifactdetails|org.apache.xmlbeans|xmlbeans|5.3.0|jar">xmlbeans</a> <br> For signing: - <a href="https://search.maven.org/#artifactdetails|org.bouncycastle|bcpkix-jdk18on|1.82|jar">bcpkix-jdk18on</a>, - <a href="https://search.maven.org/#artifactdetails|org.bouncycastle|bcutil-jdk18on|1.82|jar">bcprov-jdk18on</a>, + <a href="https://search.maven.org/#artifactdetails|org.bouncycastle|bcpkix-jdk18on|1.84|jar">bcpkix-jdk18on</a>, + <a href="https://search.maven.org/#artifactdetails|org.bouncycastle|bcutil-jdk18on|1.84|jar">bcprov-jdk18on</a>, <a href="https://search.maven.org/#artifactdetails|org.apache.santuario|xmlsec|3.0.6|bundle">xmlsec</a>, <a href="https://search.maven.org/#artifactdetails|org.slf4j|slf4j-api|2.0.17|jar">slf4j-api</a> </td> diff --git a/content/encryption.html b/content/encryption.html index 098c2eb9c6..a5bcc4ad6b 100644 --- a/content/encryption.html +++ b/content/encryption.html @@ -574,7 +574,7 @@ document.write("Last Published: " + document.lastModified); <a href="components/">default dependencies</a>:</p> <ul> -<li>BouncyCastle bcpkix, bcprov and bcutil (tested against 1.82)</li> +<li>BouncyCastle bcpkix, bcprov and bcutil (tested against 1.84)</li> <li>Apache Santuario "xmlsec" (tested against 3.0.5)</li> diff --git a/content/security.html b/content/security.html index 6261c5ee12..1f39c337e4 100644 --- a/content/security.html +++ b/content/security.html @@ -251,6 +251,19 @@ document.write("Last Published: " + document.lastModified); streaming APIs. </li> +<li> +<strong>OutOfMemoryErrors</strong> +<br> + Memory usage can be high, potentially causing OutOfMemoryErrors. Malicious actors can create files designed to exploit parsers and generate large arrays. + Legacy formats (xls, doc, ppt, etc.) are particularly vulnerable, though all formats have potential issues. + <br> + Apache POI includes checks to detect suspicious values that may indicate malicious content, but these checks should not be considered comprehensive. + <br> + We strongly recommend never parsing files from untrusted or unknown sources. + <br> + While we welcome suggestions for additional safeguards, we typically do not classify these as security vulnerabilities in the POI libraries. + </li> + <li> <strong>Use of Temp Files</strong> <br> --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
