@osdk/react-components 0.25.0 → 0.25.1-main-67d5449ea9601ae2922a9ed041937b86380a867a

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @osdk/react-components
 
+## 0.25.1-main-67d5449ea9601ae2922a9ed041937b86380a867a
+
+### Patch Changes
+
+- 67d5449: Replace `xlsx` dependency with `xlsx-republish`, a community republish of the latest SheetJS CDN release (`0.20.3`) back to npm. The maintainer-published `xlsx` on npm is pinned at `0.18.5` (which has a known prototype-pollution CVE) and SheetJS now distributes fixed releases only via their own CDN, so npm consumers cannot get a patched version through the registry.
+
 ## 0.25.0
 
 ### Minor Changes

package/build/browser/excel-viewer/parseSpreadsheet.js

@@ -16,7 +16,7 @@
 
 /* cspell:words defval */
 
-import { read, utils } from "xlsx";
+import { read, utils } from "xlsx-republish";
 export async function parseSpreadsheetFromResponse(response) {
   const buffer = await response.arrayBuffer();
   const workbook = read(buffer, {

package/build/browser/excel-viewer/parseSpreadsheet.js.map

@@ -1 +1 @@
-{"version":3,"file":"parseSpreadsheet.js","names":["read","utils","parseSpreadsheetFromResponse","response","buffer","arrayBuffer","workbook","type","sheets","SheetNames","map","name","sheet","Sheets","rows","sheet_to_json","header","defval","raw"],"sources":["parseSpreadsheet.ts"],"sourcesContent":["/*\n * Copyright 2026 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/* cspell:words defval */\n\nimport { read, utils } from \"xlsx\";\nimport type { ParsedSpreadsheet, SheetData } from \"./ExcelViewerApi.js\";\n\nexport async function parseSpreadsheetFromResponse(\n  response: Response,\n): Promise<ParsedSpreadsheet> {\n  const buffer = await response.arrayBuffer();\n  const workbook = read(buffer, { type: \"array\" });\n\n  const sheets: SheetData[] = workbook.SheetNames.map((name) => {\n    const sheet = workbook.Sheets[name];\n    const rows: string[][] = sheet != null\n      ? utils.sheet_to_json<string[]>(sheet, {\n        header: 1,\n        defval: \"\",\n        raw: false,\n      })\n      : [];\n    return { name, rows };\n  });\n\n  return { sheets };\n}\n"],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;;AAEA,SAASA,IAAI,EAAEC,KAAK,QAAQ,MAAM;AAGlC,OAAO,eAAeC,4BAA4BA,CAChDC,QAAkB,EACU;EAC5B,MAAMC,MAAM,GAAG,MAAMD,QAAQ,CAACE,WAAW,CAAC,CAAC;EAC3C,MAAMC,QAAQ,GAAGN,IAAI,CAACI,MAAM,EAAE;IAAEG,IAAI,EAAE;EAAQ,CAAC,CAAC;EAEhD,MAAMC,MAAmB,GAAGF,QAAQ,CAACG,UAAU,CAACC,GAAG,CAAEC,IAAI,IAAK;IAC5D,MAAMC,KAAK,GAAGN,QAAQ,CAACO,MAAM,CAACF,IAAI,CAAC;IACnC,MAAMG,IAAgB,GAAGF,KAAK,IAAI,IAAI,GAClCX,KAAK,CAACc,aAAa,CAAWH,KAAK,EAAE;MACrCI,MAAM,EAAE,CAAC;MACTC,MAAM,EAAE,EAAE;MACVC,GAAG,EAAE;IACP,CAAC,CAAC,GACA,EAAE;IACN,OAAO;MAAEP,IAAI;MAAEG;IAAK,CAAC;EACvB,CAAC,CAAC;EAEF,OAAO;IAAEN;EAAO,CAAC;AACnB","ignoreList":[]}
+{"version":3,"file":"parseSpreadsheet.js","names":["read","utils","parseSpreadsheetFromResponse","response","buffer","arrayBuffer","workbook","type","sheets","SheetNames","map","name","sheet","Sheets","rows","sheet_to_json","header","defval","raw"],"sources":["parseSpreadsheet.ts"],"sourcesContent":["/*\n * Copyright 2026 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/* cspell:words defval */\n\nimport { read, utils } from \"xlsx-republish\";\nimport type { ParsedSpreadsheet, SheetData } from \"./ExcelViewerApi.js\";\n\nexport async function parseSpreadsheetFromResponse(\n  response: Response,\n): Promise<ParsedSpreadsheet> {\n  const buffer = await response.arrayBuffer();\n  const workbook = read(buffer, { type: \"array\" });\n\n  const sheets: SheetData[] = workbook.SheetNames.map((name) => {\n    const sheet = workbook.Sheets[name];\n    const rows: string[][] = sheet != null\n      ? utils.sheet_to_json<string[]>(sheet, {\n        header: 1,\n        defval: \"\",\n        raw: false,\n      })\n      : [];\n    return { name, rows };\n  });\n\n  return { sheets };\n}\n"],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;;AAEA,SAASA,IAAI,EAAEC,KAAK,QAAQ,gBAAgB;AAG5C,OAAO,eAAeC,4BAA4BA,CAChDC,QAAkB,EACU;EAC5B,MAAMC,MAAM,GAAG,MAAMD,QAAQ,CAACE,WAAW,CAAC,CAAC;EAC3C,MAAMC,QAAQ,GAAGN,IAAI,CAACI,MAAM,EAAE;IAAEG,IAAI,EAAE;EAAQ,CAAC,CAAC;EAEhD,MAAMC,MAAmB,GAAGF,QAAQ,CAACG,UAAU,CAACC,GAAG,CAAEC,IAAI,IAAK;IAC5D,MAAMC,KAAK,GAAGN,QAAQ,CAACO,MAAM,CAACF,IAAI,CAAC;IACnC,MAAMG,IAAgB,GAAGF,KAAK,IAAI,IAAI,GAClCX,KAAK,CAACc,aAAa,CAAWH,KAAK,EAAE;MACrCI,MAAM,EAAE,CAAC;MACTC,MAAM,EAAE,EAAE;MACVC,GAAG,EAAE;IACP,CAAC,CAAC,GACA,EAAE;IACN,OAAO;MAAEP,IAAI;MAAEG;IAAK,CAAC;EACvB,CAAC,CAAC;EAEF,OAAO;IAAEN;EAAO,CAAC;AACnB","ignoreList":[]}

package/build/browser/util/UserAgent.js

@@ -14,7 +14,7 @@
  * limitations under the License.
  */
 
-const PACKAGE_USER_AGENT = `osdk-react-components/${"0.25.0"}`;
+const PACKAGE_USER_AGENT = `osdk-react-components/${"0.25.1-main-67d5449ea9601ae2922a9ed041937b86380a867a"}`;
 export function componentUserAgent(componentName) {
   return `${PACKAGE_USER_AGENT}/${componentName}`;
 }

package/build/browser/util/UserAgent.js.map

@@ -1 +1 @@
-{"version":3,"file":"UserAgent.js","names":["PACKAGE_USER_AGENT","componentUserAgent","componentName"],"sources":["UserAgent.ts"],"sourcesContent":["/*\n * Copyright 2025 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nconst PACKAGE_USER_AGENT =\n  `osdk-react-components/${process.env.PACKAGE_VERSION}`;\n\nexport function componentUserAgent(componentName: string): string {\n  return `${PACKAGE_USER_AGENT}/${componentName}`;\n}\n"],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,MAAMA,kBAAkB,GACtB,mCAAsD;AAExD,OAAO,SAASC,kBAAkBA,CAACC,aAAqB,EAAU;EAChE,OAAO,GAAGF,kBAAkB,IAAIE,aAAa,EAAE;AACjD","ignoreList":[]}
+{"version":3,"file":"UserAgent.js","names":["PACKAGE_USER_AGENT","componentUserAgent","componentName"],"sources":["UserAgent.ts"],"sourcesContent":["/*\n * Copyright 2025 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nconst PACKAGE_USER_AGENT =\n  `osdk-react-components/${process.env.PACKAGE_VERSION}`;\n\nexport function componentUserAgent(componentName: string): string {\n  return `${PACKAGE_USER_AGENT}/${componentName}`;\n}\n"],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,MAAMA,kBAAkB,GACtB,iFAAsD;AAExD,OAAO,SAASC,kBAAkBA,CAACC,aAAqB,EAAU;EAChE,OAAO,GAAGF,kBAAkB,IAAIE,aAAa,EAAE;AACjD","ignoreList":[]}

package/build/cjs/{chunk-6L63NPQG.cjs → chunk-2EDYBKDP.cjs}

@@ -6,7 +6,7 @@ var chunkE5OKIBYJ_cjs = require('./chunk-E5OKIBYJ.cjs');
 var chunkNE7GRF7G_cjs = require('./chunk-NE7GRF7G.cjs');
 var chunk7LXS66DW_cjs = require('./chunk-7LXS66DW.cjs');
 var chunkUCTQICPR_cjs = require('./chunk-UCTQICPR.cjs');
-var chunkMQTQLA4O_cjs = require('./chunk-MQTQLA4O.cjs');
+var chunkBL4ZNJOI_cjs = require('./chunk-BL4ZNJOI.cjs');
 var button = require('@base-ui/react/button');
 var classnames3 = require('classnames');
 var React13 = require('react');
@@ -5384,7 +5384,7 @@ function summarizeFilterValue(definition, state) {
 }
 
 // src/public/experimental/filter-list.ts
-var FilterList2 = chunkMQTQLA4O_cjs.withOsdkMetrics(FilterList, "FilterList");
+var FilterList2 = chunkBL4ZNJOI_cjs.withOsdkMetrics(FilterList, "FilterList");
 
 exports.BaseFilterList = BaseFilterList;
 exports.FilterInput = FilterInput;
@@ -5399,5 +5399,5 @@ exports.narrowObjectSet = narrowObjectSet;
 exports.serializeFilterStates = serializeFilterStates;
 exports.summarizeFilterValue = summarizeFilterValue;
 exports.useFilterListState = useFilterListState;
-//# sourceMappingURL=chunk-6L63NPQG.cjs.map
-//# sourceMappingURL=chunk-6L63NPQG.cjs.map
+//# sourceMappingURL=chunk-2EDYBKDP.cjs.map
+//# sourceMappingURL=chunk-2EDYBKDP.cjs.map