@xlsxflow/core 1.1.2 → 1.1.3

package/CHANGELOG.md

@@ -1,108 +1,122 @@
-# Changelog
-
-## 1.1.2
-
-### Fixed
-
-- `SheetWriter` throws an error for a row longer than 16,384 cells or past row 1,048,576, instead of writing a file Excel reports as damaged.
-- `SheetEditor.setCells`: a date in a cell without a date format gets `yyyy-mm-dd` (or `yyyy-mm-dd hh:mm:ss` with a time), as in `SheetWriter`, instead of showing as a serial number.
-- `OdsWriter` stores formula results, so readers that don't recalculate show them.
-- `sheetToJson` keeps every column when headers repeat: the second `Name` becomes `Name_2`.
-- `parseCsv` returns `null` for empty unquoted fields with `{ convert: false }` too.
-
-### Added
-
-- `StylePatcher` is exported, for `@xlsxflow/pro`.
-
-## 1.1.1
-
-- README: the XlsxFlow website address, and Pro at a flat $5.
-- More npm keywords: `xls` and `ods`.
-
-## 1.1.0
-
-### Added
-
-- `SheetWriter`: workbook properties (title, author, company and so on), defined names, hidden and very hidden sheets, and sheet views (zoom, gridlines, headings, right-to-left). `SheetReader.readWorkbook` reads them back.
-- `{ formatted: true }` reports each cell's text as Excel shows it, from its number format.
-- `SheetEditor.insertRows`, `deleteRows`, `insertColumns` and `deleteColumns`. Everything that points at the moved cells moves with them: formulas on all sheets, defined names, merges, conditional formats, validations, hyperlinks, filters, page breaks, column widths, tables, pictures, notes, sparklines, data tables, chart series and pivot sources.
-- `SheetEditor.setCells` edits and restyles cells of existing files; `addSheet` and `deleteSheet` add and remove sheets.
-- `parseCsv` streams CSV rows, which `SheetWriter.addSheet` turns into a sheet.
-- `SheetReader` reads Excel 97-2003 `.xls` files and OpenDocument `.ods` files: values, dates, formula results, merges, hidden rows, columns and sheets, frozen panes, defined names and document properties. `.ods` also gives formulas, hyperlinks and notes.
-- `OdsWriter` writes `.ods` files: values, dates, formulas, merges, column widths, frozen panes and hidden sheets.
-- Password-protected `.xlsx` files are rejected with an error that points to `decryptWorkbook` in `@xlsxflow/pro`, instead of a ZIP error.
-- Cell notes on write (plain or formatted text) and `getComments()` on read.
-- Conditional formats `cellIs`, `expression`, `top10`, `aboveAverage`, text rules, `duplicateValues`/`uniqueValues` and `iconSet`.
-- Excel tables, sheet protection, page setup (margins, header and footer, print area and titles), row heights, hidden rows and columns, outline grouping, tab colour, and validation operators and messages.
-- `Date` cell values, hyperlinks (URLs and locations in the workbook), `autoFilter`, and an optional shared string table on write.
-- Reading returns formulas (`formulas: true`, shared formulas expanded), styles (`styles: true`) and rich text (`richText: true`). Theme and indexed colours are resolved to ARGB.
-- PNG, JPEG and GIF images (`images` sheet option), anchored to a cell or stretched over a range. `getImages()` reads them back.
-- Low-level parts are exported for add-ons: the ZIP reader and writer, `resolveWorkbookParts`, `readSharedStrings`, and `mapFormulaRefs`/`shiftFormula`.
-- Tested: `.xlsm` files keep their macros through `SheetEditor`; the library runs in Cloudflare Workers without `nodejs_compat` (`scripts/workers` checks it).
-
-### Security
-
-Fixed crashes, hangs and memory blowups caused by crafted files:
-
-- A ZIP directory pointing outside the file crashed Node.
-- Unclosed tags and elements made the parser quadratic. The XML tokenizer is now linear on giant tags, text nodes and CDATA.
-- Repeated hidden columns, far-right cells, fraction formats with long denominators and large style tables were slow or used unbounded memory.
-- One deflated entry could be read many times under different names.
-
-Also:
-
-- `SheetEditor.edit` takes `maxUncompressedBytes`.
-- Option values typed as enums are escaped, and appended rows encode control characters.
-- `sheetToJson` keeps a `__proto__` header as an ordinary key.
-- In-memory parts are capped at 1 GiB uncompressed by default.
-
-### Fixed
-
-- Sheets with frozen panes were all marked as selected, so Excel opened them grouped.
-- The reader dropped or corrupted cells at stream chunk boundaries.
-- Styles pointed at the wrong font, fill or border, and styles used only by `AsyncIterable` rows were missing from `styles.xml`.
-- Number formats with quoted text, escapes or colours (`#,##0.00 "USD"`, `[Red]0.0`) were taken for date formats.
-- Reading a corrupt file without calling `getMetadata()` caused an unhandled promise rejection, which is fatal in Node.
-- `addSheet` accepted sheet names Excel refuses to open. It now throws.
-- Files Excel would repair:
-  - gradient stops were written as `<gradientStop>`;
-  - `vertical: 'middle'` was written as is instead of `center`;
-  - conditional formats came after validations.
-- Data bar `minValue`/`maxValue` were ignored, every conditional format had priority 1, and colours and ranges were not XML-escaped.
-- Strings with `_xHHHH_`, control characters, CR, or leading and trailing spaces now survive a round trip. `NaN` and `Infinity` are written as `#NUM!`.
-- Reader:
-  - Strict OOXML and non-standard part names work;
-  - empty `<v/>` reads as empty and `-0` as `0`;
-  - out-of-order cells land in the right column;
-  - time-only values are no longer a day off, and datetimes keep milliseconds.
-  - frozen panes saved by Excel as `frozenSplit` (frozen after a split) are reported.
-- `sheetToJson` ignored its `headerRowIndex` argument.
-
-### Changed
-
-- The package ships compiled ESM and CommonJS builds with type declarations.
-- Browser bundles no longer try to resolve Node's `fs`.
-- `[Content_Types].xml` is written last in the ZIP.
-- Real backpressure in the ZIP writer and worksheet stream. Producer errors now error the output stream instead of hanging it.
-- About 2.5× faster reads, and a table-driven CRC-32 for faster writes.
-- Styles, formulas and conditional formats are part of the MIT core. Paid add-ons are in the separate `@xlsxflow/pro` package.
-- Benchmarks corrected: the earlier ExcelJS write time came from a cold first run, and write-excel-file was run with an old API.
-
-## 1.0.0
-
-- `SheetWriter` and `SheetEditor` stream the ZIP with data descriptors instead of buffering the file in memory.
-- Dates are returned as ISO-8601 strings, detected from each cell's number format.
-
-## 0.3.0-beta
-
-- Workbooks with several sheets.
-- Fixed a buffer bug that made parsing quadratic.
-
-## 0.2.0-beta
-
-- Deflate compression with `CompressionStream`: a 1M-cell file went from 30 MB to 2.9 MB.
-- Inline and rich text strings are read.
-
-## 0.1.0-beta
-
-- First release: streaming reader, writer, and shared strings.
+# Changelog
+
+## 1.1.3
+
+### Fixed
+
+- `SheetEditor.setCells` refuses addresses past column XFD or row 1,048,576, instead of writing a file Excel reports as damaged.
+- `SheetWriter` and `SheetEditor` refuse text longer than Excel's 32,767 characters per cell.
+- Colours are checked: ARGB (`FFFF0000`) and RGB (`FF0000`, `#FF0000`) hex are accepted, anything else (`'red'`) throws instead of making Excel repair the file.
+- Picture anchors past the last column or row throw; a range given the wrong way round (`F20:A2`) is turned round.
+- `SheetReader`: a shared string index past the end of the table reads as an empty cell, not as the index.
+
+### Added
+
+- `checkCellText` is exported, for `@xlsxflow/pro`.
+
+## 1.1.2
+
+### Fixed
+
+- `SheetWriter` throws an error for a row longer than 16,384 cells or past row 1,048,576, instead of writing a file Excel reports as damaged.
+- `SheetEditor.setCells`: a date in a cell without a date format gets `yyyy-mm-dd` (or `yyyy-mm-dd hh:mm:ss` with a time), as in `SheetWriter`, instead of showing as a serial number.
+- `OdsWriter` stores formula results, so readers that don't recalculate show them.
+- `sheetToJson` keeps every column when headers repeat: the second `Name` becomes `Name_2`.
+- `parseCsv` returns `null` for empty unquoted fields with `{ convert: false }` too.
+
+### Added
+
+- `StylePatcher` is exported, for `@xlsxflow/pro`.
+
+## 1.1.1
+
+- README: the XlsxFlow website address, and Pro at a flat $5.
+- More npm keywords: `xls` and `ods`.
+
+## 1.1.0
+
+### Added
+
+- `SheetWriter`: workbook properties (title, author, company and so on), defined names, hidden and very hidden sheets, and sheet views (zoom, gridlines, headings, right-to-left). `SheetReader.readWorkbook` reads them back.
+- `{ formatted: true }` reports each cell's text as Excel shows it, from its number format.
+- `SheetEditor.insertRows`, `deleteRows`, `insertColumns` and `deleteColumns`. Everything that points at the moved cells moves with them: formulas on all sheets, defined names, merges, conditional formats, validations, hyperlinks, filters, page breaks, column widths, tables, pictures, notes, sparklines, data tables, chart series and pivot sources.
+- `SheetEditor.setCells` edits and restyles cells of existing files; `addSheet` and `deleteSheet` add and remove sheets.
+- `parseCsv` streams CSV rows, which `SheetWriter.addSheet` turns into a sheet.
+- `SheetReader` reads Excel 97-2003 `.xls` files and OpenDocument `.ods` files: values, dates, formula results, merges, hidden rows, columns and sheets, frozen panes, defined names and document properties. `.ods` also gives formulas, hyperlinks and notes.
+- `OdsWriter` writes `.ods` files: values, dates, formulas, merges, column widths, frozen panes and hidden sheets.
+- Password-protected `.xlsx` files are rejected with an error that points to `decryptWorkbook` in `@xlsxflow/pro`, instead of a ZIP error.
+- Cell notes on write (plain or formatted text) and `getComments()` on read.
+- Conditional formats `cellIs`, `expression`, `top10`, `aboveAverage`, text rules, `duplicateValues`/`uniqueValues` and `iconSet`.
+- Excel tables, sheet protection, page setup (margins, header and footer, print area and titles), row heights, hidden rows and columns, outline grouping, tab colour, and validation operators and messages.
+- `Date` cell values, hyperlinks (URLs and locations in the workbook), `autoFilter`, and an optional shared string table on write.
+- Reading returns formulas (`formulas: true`, shared formulas expanded), styles (`styles: true`) and rich text (`richText: true`). Theme and indexed colours are resolved to ARGB.
+- PNG, JPEG and GIF images (`images` sheet option), anchored to a cell or stretched over a range. `getImages()` reads them back.
+- Low-level parts are exported for add-ons: the ZIP reader and writer, `resolveWorkbookParts`, `readSharedStrings`, and `mapFormulaRefs`/`shiftFormula`.
+- Tested: `.xlsm` files keep their macros through `SheetEditor`; the library runs in Cloudflare Workers without `nodejs_compat` (`scripts/workers` checks it).
+
+### Security
+
+Fixed crashes, hangs and memory blowups caused by crafted files:
+
+- A ZIP directory pointing outside the file crashed Node.
+- Unclosed tags and elements made the parser quadratic. The XML tokenizer is now linear on giant tags, text nodes and CDATA.
+- Repeated hidden columns, far-right cells, fraction formats with long denominators and large style tables were slow or used unbounded memory.
+- One deflated entry could be read many times under different names.
+
+Also:
+
+- `SheetEditor.edit` takes `maxUncompressedBytes`.
+- Option values typed as enums are escaped, and appended rows encode control characters.
+- `sheetToJson` keeps a `__proto__` header as an ordinary key.
+- In-memory parts are capped at 1 GiB uncompressed by default.
+
+### Fixed
+
+- Sheets with frozen panes were all marked as selected, so Excel opened them grouped.
+- The reader dropped or corrupted cells at stream chunk boundaries.
+- Styles pointed at the wrong font, fill or border, and styles used only by `AsyncIterable` rows were missing from `styles.xml`.
+- Number formats with quoted text, escapes or colours (`#,##0.00 "USD"`, `[Red]0.0`) were taken for date formats.
+- Reading a corrupt file without calling `getMetadata()` caused an unhandled promise rejection, which is fatal in Node.
+- `addSheet` accepted sheet names Excel refuses to open. It now throws.
+- Files Excel would repair:
+  - gradient stops were written as `<gradientStop>`;
+  - `vertical: 'middle'` was written as is instead of `center`;
+  - conditional formats came after validations.
+- Data bar `minValue`/`maxValue` were ignored, every conditional format had priority 1, and colours and ranges were not XML-escaped.
+- Strings with `_xHHHH_`, control characters, CR, or leading and trailing spaces now survive a round trip. `NaN` and `Infinity` are written as `#NUM!`.
+- Reader:
+  - Strict OOXML and non-standard part names work;
+  - empty `<v/>` reads as empty and `-0` as `0`;
+  - out-of-order cells land in the right column;
+  - time-only values are no longer a day off, and datetimes keep milliseconds.
+  - frozen panes saved by Excel as `frozenSplit` (frozen after a split) are reported.
+- `sheetToJson` ignored its `headerRowIndex` argument.
+
+### Changed
+
+- The package ships compiled ESM and CommonJS builds with type declarations.
+- Browser bundles no longer try to resolve Node's `fs`.
+- `[Content_Types].xml` is written last in the ZIP.
+- Real backpressure in the ZIP writer and worksheet stream. Producer errors now error the output stream instead of hanging it.
+- About 2.5× faster reads, and a table-driven CRC-32 for faster writes.
+- Styles, formulas and conditional formats are part of the MIT core. Paid add-ons are in the separate `@xlsxflow/pro` package.
+- Benchmarks corrected: the earlier ExcelJS write time came from a cold first run, and write-excel-file was run with an old API.
+
+## 1.0.0
+
+- `SheetWriter` and `SheetEditor` stream the ZIP with data descriptors instead of buffering the file in memory.
+- Dates are returned as ISO-8601 strings, detected from each cell's number format.
+
+## 0.3.0-beta
+
+- Workbooks with several sheets.
+- Fixed a buffer bug that made parsing quadratic.
+
+## 0.2.0-beta
+
+- Deflate compression with `CompressionStream`: a 1M-cell file went from 30 MB to 2.9 MB.
+- Inline and rich text strings are read.
+
+## 0.1.0-beta
+
+- First release: streaming reader, writer, and shared strings.

package/README.md

@@ -224,6 +224,8 @@ writer.addSheet('Sales', [
 });
 ```
 
+Colours are ARGB hex (`FFC00000`); RGB hex (`C00000` or `#C00000`) is opaque. A cell holds at most 32,767 characters, as in Excel.
+
 Other sheet options:
 
 ```typescript

package/dist/index.cjs

@@ -464,6 +464,21 @@ function decodeXString(s) {
 // Excel's sheet size (A..XFD, 1..1048576)
 const MAX_COLUMNS$1 = 16384;
 const MAX_ROWS$1 = 1048576;
+// Excel's limit on the characters in one cell
+const MAX_CELL_TEXT = 32767;
+function checkCellText(s, ref) {
+    if (s.length > MAX_CELL_TEXT)
+        throw new Error(`Cell ${ref} has ${s.length} characters, more than Excel's ${MAX_CELL_TEXT}.`);
+    return s;
+}
+// Colours are ARGB hex ("FFFF0000"); "FF0000" and "#FF0000" get an opaque alpha. Anything else
+// makes Excel repair the file.
+function argb(c) {
+    const m = /^#?([0-9A-Fa-f]{6}|[0-9A-Fa-f]{8})$/.exec(String(c));
+    if (!m)
+        throw new Error(`Invalid colour "${c}": use ARGB hex such as "FFFF0000".`);
+    return (m[1].length === 6 ? 'FF' + m[1] : m[1]).toUpperCase();
+}
 // 0-based column of letters like "BC" (or a reference like "BC12"); -1 when there are none
 function colIndex(ref) {
     const match = ref.match(/[A-Za-z]+/);
@@ -1461,7 +1476,8 @@ function parseWorksheet(xmlTokenStream, sharedStrings, styles, is1904 = false, o
                                 }
                                 else if (currentCellType === 's') {
                                     const index = parseInt(currentCellValue, 10);
-                                    resolvedValue = sharedStrings.get(index) ?? currentCellValue;
+                                    // An index past the table points nowhere: the cell is empty
+                                    resolvedValue = sharedStrings.get(index) ?? null;
                                 }
                                 else if (currentCellType === 'b') {
                                     resolvedValue = currentCellValue === '1' || currentCellValue === 'true';
@@ -1635,9 +1651,10 @@ async function readSheetImages(readText, readBytes, sheetPath) {
 const escapeXml$4 = (s) => s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
 const cellPos = (ref) => {
     const m = /^\$?([A-Za-z]{1,3})\$?(\d+)$/.exec(ref.trim());
-    if (!m)
+    const col = m ? colIndex(m[1]) : -1, row = m ? parseInt(m[2], 10) - 1 : -1;
+    if (col < 0 || col >= MAX_COLUMNS$1 || row < 0 || row >= MAX_ROWS$1)
         throw new Error(`Invalid anchor cell "${ref}".`);
-    return { col: colIndex(m[1]), row: parseInt(m[2], 10) - 1 };
+    return { col, row };
 };
 const marker = (tag, { col, row }) => `<xdr:${tag}><xdr:col>${col}</xdr:col><xdr:colOff>0</xdr:colOff><xdr:row>${row}</xdr:row><xdr:rowOff>0</xdr:rowOff></xdr:${tag}>`;
 const DRAWING_NS = 'xmlns:xdr="http://schemas.openxmlformats.org/drawingml/2006/spreadsheetDrawing" ' +
@@ -1649,9 +1666,11 @@ const DRAWING_NS = 'xmlns:xdr="http://schemas.openxmlformats.org/drawingml/2006/
 function anchorXml(place, natural, body, attrs = '') {
     if ('range' in place) {
         const [from, to = from] = place.range.split(':');
-        const end = cellPos(to);
-        // The object fills the range: it ends at the far edge of the last cell
-        return `<xdr:twoCellAnchor editAs="oneCell"${attrs}>${marker('from', cellPos(from))}${marker('to', { col: end.col + 1, row: end.row + 1 })}${body}<xdr:clientData/></xdr:twoCellAnchor>`;
+        const a = cellPos(from), b = cellPos(to);
+        // The object fills the range, given either way round: it ends at the far edge of the last cell
+        const start = { col: Math.min(a.col, b.col), row: Math.min(a.row, b.row) };
+        const end = { col: Math.max(a.col, b.col) + 1, row: Math.max(a.row, b.row) + 1 };
+        return `<xdr:twoCellAnchor editAs="oneCell"${attrs}>${marker('from', start)}${marker('to', end)}${body}<xdr:clientData/></xdr:twoCellAnchor>`;
     }
     const { width: w, height: h } = natural;
     const width = place.width ?? (place.height ? w * place.height / h : w);
@@ -2636,22 +2655,22 @@ function fontXml(font, nameTag = 'name') {
     if (font.size)
         xml += `<sz val="${escapeXml$3(font.size)}"/>`;
     if (font.color)
-        xml += `<color rgb="${escapeXml$3(font.color)}"/>`;
+        xml += `<color rgb="${argb(font.color)}"/>`;
     if (font.name)
         xml += `<${nameTag} val="${escapeXml$3(font.name)}"/>`;
     return xml;
 }
-const borderSideXml = (tag, s) => s ? `<${tag} style="${escapeXml$3(s.style)}">${s.color ? `<color rgb="${escapeXml$3(s.color)}"/>` : ''}</${tag}>` : `<${tag}/>`;
+const borderSideXml = (tag, s) => s ? `<${tag} style="${escapeXml$3(s.style)}">${s.color ? `<color rgb="${argb(s.color)}"/>` : ''}</${tag}>` : `<${tag}/>`;
 function borderXml(b) {
     const side = borderSideXml;
     return `<border>${side('left', b.left)}${side('right', b.right)}${side('top', b.top)}${side('bottom', b.bottom)}<diagonal/></border>`;
 }
 function fillXml(fill) {
     if (fill.type === 'gradient') {
-        const stops = fill.stops.map(s => `<stop position="${s.position}"><color rgb="${escapeXml$3(s.color)}"/></stop>`).join('');
+        const stops = fill.stops.map(s => `<stop position="${s.position}"><color rgb="${argb(s.color)}"/></stop>`).join('');
         return `<fill><gradientFill degree="${escapeXml$3(fill.degree ?? 0)}">${stops}</gradientFill></fill>`;
     }
-    return `<fill><patternFill patternType="solid"><fgColor rgb="${escapeXml$3(fill.fgColor)}"/></patternFill></fill>`;
+    return `<fill><patternFill patternType="solid"><fgColor rgb="${argb(fill.fgColor)}"/></patternFill></fill>`;
 }
 // Attributes of an <alignment> element
 function alignmentAttrs(alignment) {
@@ -2693,7 +2712,7 @@ class StyleEngine {
             xml += `<numFmt numFmtId="${this.registerNumFmt(style.numFmt)}" formatCode="${escapeXml$3(style.numFmt)}"/>`;
         if (style.fill?.type === 'solid') {
             // A differential solid fill takes its colour from bgColor
-            const c = escapeXml$3(style.fill.fgColor);
+            const c = argb(style.fill.fgColor);
             xml += `<fill><patternFill patternType="solid"><fgColor rgb="${c}"/><bgColor rgb="${c}"/></patternFill></fill>`;
         }
         if (style.border)
@@ -2821,7 +2840,7 @@ ${this.dxfs.size ? `<dxfs count="${this.dxfs.size}">${[...this.dxfs.keys()].map(
 function escapeXml$2(val) {
     return String(val).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
 }
-const color = (rgb) => `<color rgb="${escapeXml$2(rgb)}"/>`;
+const color = (rgb) => `<color rgb="${argb(rgb)}"/>`;
 const bound = (type, value) => value === undefined ? `<cfvo type="${type}"/>` : `<cfvo type="num" val="${escapeXml$2(value)}"/>`;
 const formula = (f) => `<formula>${escapeXml$2(String(f).replace(/^=/, ''))}</formula>`;
 // Excel string literal inside a formula
@@ -3399,13 +3418,13 @@ const W3CDTF = (d) => d.toISOString().replace(/\.\d{3}Z$/, 'Z');
 const propXml = (tag, v) => v === undefined ? '' : `<${tag}>${escapeXml$1(v)}</${tag}>`;
 function corePropsXml(p) {
     const created = p.created ? `<dcterms:created xsi:type="dcterms:W3CDTF">${W3CDTF(p.created)}</dcterms:created>` : '';
-    return `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+    return `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
 <cp:coreProperties xmlns:cp="http://schemas.openxmlformats.org/package/2006/metadata/core-properties" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:dcterms="http://purl.org/dc/terms/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">` +
         propXml('dc:title', p.title) + propXml('dc:subject', p.subject) + propXml('dc:creator', p.creator) + propXml('cp:keywords', p.keywords) +
         propXml('dc:description', p.description) + propXml('cp:category', p.category) + created + '</cp:coreProperties>';
 }
 function appPropsXml(p) {
-    return `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+    return `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
 <Properties xmlns="http://schemas.openxmlformats.org/officeDocument/2006/extended-properties"><Application>XlsxFlow</Application>${propXml('Manager', p.manager)}${propXml('Company', p.company)}</Properties>`;
 }
 // A name Excel accepts: letters, digits, _ . and \, not a cell reference (A1, R1C1) and not reserved
@@ -3573,7 +3592,7 @@ class SheetWriter {
         });
         await this.streamString(zip, `xl/drawings/drawing${n}.xml`, drawingXml(images, images.map(img => this.media.get(img.data).info), rIds));
         const rels = targets.map((t, k) => `<Relationship Id="rId${k + 1}" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/image" Target="${t}"/>`).join('');
-        await this.streamString(zip, `xl/drawings/_rels/drawing${n}.xml.rels`, `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+        await this.streamString(zip, `xl/drawings/_rels/drawing${n}.xml.rels`, `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
 <Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">${rels}</Relationships>`);
     }
     applyAutoFit(rows, options) {
@@ -3650,7 +3669,7 @@ class SheetWriter {
         const page = options.pageSetup;
         const fitToPage = page && (page.fitToWidth !== undefined || page.fitToHeight !== undefined);
         const sheetPr = options.tabColor || fitToPage
-            ? `<sheetPr>${options.tabColor ? `<tabColor rgb="${escapeXml$1(options.tabColor)}"/>` : ''}${fitToPage ? '<pageSetUpPr fitToPage="1"/>' : ''}</sheetPr>`
+            ? `<sheetPr>${options.tabColor ? `<tabColor rgb="${argb(options.tabColor)}"/>` : ''}${fitToPage ? '<pageSetUpPr fitToPage="1"/>' : ''}</sheetPr>`
             : '';
         const sheetFormatPr = outlineRow || outlineCol
             ? `<sheetFormatPr defaultRowHeight="15"${outlineRow ? ` outlineLevelRow="${outlineRow}"` : ''}${outlineCol ? ` outlineLevelCol="${outlineCol}"` : ''}/>`
@@ -3754,6 +3773,7 @@ class SheetWriter {
                     return `<c r="${colRef}"${sAttr}><v>${dateToSerial(val)}</v></c>`;
                 }
                 if (typeof val === 'string') {
+                    checkCellText(val, colRef);
                     if (this.writerOptions.sharedStrings) {
                         let index = this.sharedStrings.get(val);
                         if (index === undefined)
@@ -3841,7 +3861,7 @@ class SheetWriter {
         let items = '';
         for (const s of this.sharedStrings.keys())
             items += `<si>${stringXml(s)}</si>`;
-        return `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+        return `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
 <sst xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" count="${this.sharedStringRefs}" uniqueCount="${this.sharedStrings.size}">${items}</sst>`;
     }
     // '' when the sheet has no relationships
@@ -3856,7 +3876,7 @@ class SheetWriter {
         tableIds.forEach((id, k) => { rels += `<Relationship Id="rIdTable${k + 1}" Type="${REL}/table" Target="../tables/table${id}.xml"/>`; });
         if (!rels)
             return '';
-        return `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+        return `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
 <Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">${rels}</Relationships>`;
     }
     buildWorkbookXml() {
@@ -3881,14 +3901,14 @@ class SheetWriter {
             }
             return names;
         }).join('');
-        return `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
-<workbook xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main"
-  xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships">
-  ${active > 0 ? `<bookViews><workbookView firstSheet="${active}" activeTab="${active}"/></bookViews>` : ''}
-  <sheets>
-    ${sheetsXml}
-  </sheets>
-  ${filterNames || userNames ? `<definedNames>${filterNames}${userNames}</definedNames>` : ''}
+        return `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<workbook xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main"
+  xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships">
+  ${active > 0 ? `<bookViews><workbookView firstSheet="${active}" activeTab="${active}"/></bookViews>` : ''}
+  <sheets>
+    ${sheetsXml}
+  </sheets>
+  ${filterNames || userNames ? `<definedNames>${filterNames}${userNames}</definedNames>` : ''}
 </workbook>`;
     }
     // The first visible sheet, which Excel opens on
@@ -3899,19 +3919,19 @@ class SheetWriter {
         const sheetRels = this.sheets.map((_, i) => `<Relationship Id="rId${i + 1}" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet" Target="worksheets/sheet${i + 1}.xml"/>`).join('\n  ');
         const ssId = this.sheets.length + 1;
         const stylesId = this.sheets.length + 2;
-        return `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
-<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">
-  ${sheetRels}
-  <Relationship Id="rId${ssId}" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/sharedStrings" Target="sharedStrings.xml"/>
-  <Relationship Id="rId${stylesId}" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/styles" Target="styles.xml"/>
+        return `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">
+  ${sheetRels}
+  <Relationship Id="rId${ssId}" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/sharedStrings" Target="sharedStrings.xml"/>
+  <Relationship Id="rId${stylesId}" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/styles" Target="styles.xml"/>
 </Relationships>`;
     }
     buildRootRels() {
-        return `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
-<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">
-  <Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="xl/workbook.xml"/>${this.writerOptions.properties ? `
-  <Relationship Id="rId2" Type="http://schemas.openxmlformats.org/package/2006/relationships/metadata/core-properties" Target="docProps/core.xml"/>
-  <Relationship Id="rId3" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/extended-properties" Target="docProps/app.xml"/>` : ''}
+        return `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">
+  <Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="xl/workbook.xml"/>${this.writerOptions.properties ? `
+  <Relationship Id="rId2" Type="http://schemas.openxmlformats.org/package/2006/relationships/metadata/core-properties" Target="docProps/core.xml"/>
+  <Relationship Id="rId3" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/extended-properties" Target="docProps/app.xml"/>` : ''}
 </Relationships>`;
     }
     buildContentTypes(drawings, commentSheets, tables) {
@@ -3922,17 +3942,17 @@ class SheetWriter {
             commentSheets.map(n => `<Override PartName="/xl/comments${n}.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.comments+xml"/>`).join('') +
             Array.from({ length: tables }, (_, i) => `<Override PartName="/xl/tables/table${i + 1}.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.table+xml"/>`).join('') +
             (commentSheets.length ? '<Default Extension="vml" ContentType="application/vnd.openxmlformats-officedocument.vmlDrawing"/>' : '');
-        return `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
-<Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types">
-  <Default Extension="rels" ContentType="application/vnd.openxmlformats-package.relationships+xml"/>
-  <Default Extension="xml" ContentType="application/xml"/>
-  ${imageTypes}${drawingOverrides}
-  <Override PartName="/xl/workbook.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml"/>
-  ${sheetOverrides}
-  <Override PartName="/xl/sharedStrings.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.sharedStrings+xml"/>
-  <Override PartName="/xl/styles.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.styles+xml"/>${this.writerOptions.properties ? `
-  <Override PartName="/docProps/core.xml" ContentType="application/vnd.openxmlformats-package.core-properties+xml"/>
-  <Override PartName="/docProps/app.xml" ContentType="application/vnd.openxmlformats-officedocument.extended-properties+xml"/>` : ''}
+        return `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types">
+  <Default Extension="rels" ContentType="application/vnd.openxmlformats-package.relationships+xml"/>
+  <Default Extension="xml" ContentType="application/xml"/>
+  ${imageTypes}${drawingOverrides}
+  <Override PartName="/xl/workbook.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml"/>
+  ${sheetOverrides}
+  <Override PartName="/xl/sharedStrings.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.sharedStrings+xml"/>
+  <Override PartName="/xl/styles.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.styles+xml"/>${this.writerOptions.properties ? `
+  <Override PartName="/docProps/core.xml" ContentType="application/vnd.openxmlformats-package.core-properties+xml"/>
+  <Override PartName="/docProps/app.xml" ContentType="application/vnd.openxmlformats-officedocument.extended-properties+xml"/>` : ''}
 </Types>`;
     }
 }
@@ -3964,7 +3984,7 @@ function pageSetupXml(page) {
 function commentsXml(comments) {
     const authors = [...new Set(comments.map(c => c.comment.author ?? ''))];
     const list = comments.map(c => `<comment ref="${c.ref}" authorId="${authors.indexOf(c.comment.author ?? '')}"><text>${runsXml(c.comment.text)}</text></comment>`).join('');
-    return `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+    return `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
 <comments xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main"><authors>${authors.map(a => `<author>${escapeXml$1(a)}</author>`).join('')}</authors><commentList>${list}</commentList></comments>`;
 }
 // The legacy VML shapes Excel needs to show the note boxes (hidden until the cell is hovered)
@@ -3984,7 +4004,7 @@ function tableXml(table, id, columns) {
     const ref = table.ref.replace(/\$/g, '');
     const filter = table.autoFilter === false ? '' : `<autoFilter ref="${ref}"/>`;
     const cols = columns.map((c, k) => `<tableColumn id="${k + 1}" name="${escapeXml$1(c)}"/>`).join('');
-    return `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+    return `<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
 <table xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" id="${id}" name="${escapeXml$1(table.name)}" displayName="${escapeXml$1(table.name)}" ref="${ref}" totalsRowShown="0">` +
         `${filter}<tableColumns count="${columns.length}">${cols}</tableColumns>` +
         `<tableStyleInfo name="${escapeXml$1(table.style ?? 'TableStyleMedium2')}" showFirstColumn="0" showLastColumn="0" showRowStripes="${table.showRowStripes === false ? 0 : 1}" showColumnStripes="0"/></table>`;
@@ -4724,7 +4744,7 @@ function editedCell(p, ref, attrs, edit) {
     }
     if (typeof edit === 'object')
         return `<${p}c r="${ref}"${attrs}><${p}f>${escapeXml$5(edit.formula.replace(/^=/, ''))}</${p}f></${p}c>`;
-    const text = escapeXml$5(encodeXString(edit));
+    const text = escapeXml$5(encodeXString(checkCellText(edit, ref)));
     const t = /^\s|\s$/.test(edit) ? `<${p}t xml:space="preserve">${text}</${p}t>` : `<${p}t>${text}</${p}t>`;
     return `<${p}c r="${ref}"${attrs} t="inlineStr"><${p}is>${t}</${p}is></${p}c>`;
 }
@@ -4775,9 +4795,9 @@ class SheetEditor {
             this.cellEdits.set(sheetName, rows = new Map());
         for (const [ref, edit] of Object.entries(cells)) {
             const m = /^\$?([A-Za-z]{1,3})\$?(\d+)$/.exec(ref);
-            if (!m || parseInt(m[2], 10) < 1)
+            const r = m ? parseInt(m[2], 10) : 0;
+            if (!m || r < 1 || r > MAX_ROWS$1 || colIndex(m[1]) >= MAX_COLUMNS$1)
                 throw new Error(`Invalid cell reference "${ref}".`);
-            const r = parseInt(m[2], 10);
             if (!rows.has(r))
                 rows.set(r, new Map());
             rows.get(r).set(colIndex(m[1]), edit);
@@ -5196,7 +5216,7 @@ class SheetEditor {
                 if (typeof val === 'number')
                     return `<c r="${colRef}"><v>${val}</v></c>`;
                 if (typeof val === 'string') {
-                    return `<c r="${colRef}" t="inlineStr"><is><t xml:space="preserve">${escapeXml$5(encodeXString(val))}</t></is></c>`;
+                    return `<c r="${colRef}" t="inlineStr"><is><t xml:space="preserve">${escapeXml$5(encodeXString(checkCellText(val, colRef)))}</t></is></c>`;
                 }
                 return `<c r="${colRef}"/>`;
             }).join('');
@@ -6156,6 +6176,7 @@ exports.XlsxFlow = XlsxFlow;
 exports.ZipRandomAccessParser = ZipRandomAccessParser;
 exports.ZipStreamWriter = ZipStreamWriter;
 exports.anchorXml = anchorXml;
+exports.checkCellText = checkCellText;
 exports.colIndex = colIndex;
 exports.colLetter = colLetter;
 exports.crc32 = crc32;