@particle-academy/holy-sheet 2.10.1 → 2.10.2

package/CHANGELOG.md

@@ -10,6 +10,29 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.10.2] - 2026-10-26
+
+### Security
+
+- Route XLSX/ODS and public `unzipSync` reads through bounded ZIP validation:
+  coherent local/central records, safe unique member names, CRC and exact sizes,
+  archive/part/total/ratio limits and bounded DEFLATE output. Reject truncated or
+  invalid codes and back-references with typed `ArchiveRefused`; Node file input
+  is bounded before allocation. Defaults: 64 MiB archive/part, 256 MiB expanded,
+  16,384 entries and 1000:1 ratio. `unzipSync(bytes, limits)` supports lower host
+  ceilings. Existing valid payload bytes and spreadsheet projections are retained.
+
+- Update Vitest to 4.1.12 for security fixes; dev toolchain only, nothing to do.
+
+- **Dev toolchain only — no runtime change, nothing for consumers to do.** The
+  lockfile now resolves `vite` 8.3.5 (was 8.2.2), whose bundled
+  `launch-editor` fixes GHSA-587h-7wmj-h5pm (HIGH, `fs.existsSync()` check
+  bypassable on Windows), GHSA-698v-4r3x-3vcv (`escapeCmdArgs()` omits `%`
+  escaping on Windows) and GHSA-r825-w8mm-5pxw (editor CLI flag
+  misinterpretation). `vite` is only reached through the test/dev toolchain
+  and the published package does not ship our lockfile, so the exposure was
+  this repo's own dev server.
+
 ## [2.10.1] — 2026-10-19
 
 ### Fixed

package/README.md

@@ -37,6 +37,13 @@ await Agent.write(schema, "sales.xlsx");
 
 ## API
 
+Spreadsheet reads and `unzipSync` validate ZIP structure, CRC, unique safe names
+and expansion before XML parsing. Unsafe ZIPs throw exported `ArchiveRefused`
+with a bounded `reason`; ordinary non-spreadsheet formats retain
+`UnsupportedFormatException`. Defaults are 64 MiB archive/part, 256 MiB expanded,
+16,384 entries and 1000:1 ratio. `unzipSync(bytes, limits)` accepts lower host
+ceilings via `ArchiveLimits`. This input layer does not add lossless editing.
+
 `Agent` (static) mirrors the PHP surface:
 
 - `validate(schema)` → structured errors `{path, expected, got, value, hint}[]`