@xlvane/compat 1.2.3 → 1.3.0

package/dist/index.d.ts

@@ -408,9 +408,13 @@ interface CsvWriteOptions {
   /** fast-csv formatter options: `delimiter`, `rowDelimiter`, `quote`, `escape`, `quoteColumns`, `headers`, `writeHeaders`, `includeEndRowDelimiter`, `writeBOM`. */
   formatterOptions?: Record<string, unknown>;
   /**
-   * `"escape"` (default): text that starts with `=`, `+`, `-`, `@`, tab, CR or LF (or their
-   * full-width forms) is written with a leading `'`, so spreadsheet applications show it as text
-   * (OWASP CSV Injection). `"off"`: written unchanged, as exceljs does. An xlvane option.
+   * `"escape"` (default): text that starts with `=`, `+`, `-`, `@`, tab, CR, LF or another
+   * control character (or the full-width forms of the signs), or with a byte order mark, is
+   * written with a leading `'`, so spreadsheet applications show it as text (OWASP CSV
+   * Injection); so is a `latin1` or `utf16le` field whose first bytes are a byte order mark, and
+   * a `utf16le` field whose bytes without NULs start with `=`. `utf16le` output starts with the
+   * UTF-16LE byte order mark. A field holding a comma, `;`, tab or `|` is quoted whatever the
+   * delimiter. `"off"`: written unchanged, as exceljs does. An xlvane option.
    */
   formulaInjection?: "escape" | "off";
 }
@@ -2452,6 +2456,8 @@ export declare class Cell {
   _master: Cell | null;
   /** @internal Number of merged ranges this cell is the master of. */
   _mergeCount: number;
+  /** The moved formula of a `{ sharedFormula }` value, and what it was moved from (see `formula`). */
+  private _moved;
   /** @internal Use `worksheet.getCell()`. */
   constructor(_row: Row, _col: number);
   get worksheet(): Worksheet;
@@ -2808,6 +2814,11 @@ export declare class Worksheet {
   _columns: Column[];
   /** @internal */
   _merges: MergeMap;
+  /**
+   * @internal Formulas of shared-formula masters by address, for the dependents of a worksheet
+   * whose rows are not kept (stream.xlsx.WorkbookReader), so `cell.formula` can move them (K2).
+   */
+  _sharedMasters: Map<string, string> | undefined;
   /** The cells covered by `_merges` (row × 16 385 + column), valid while `_mergedVersion` equals `_merges.version`. */
   private _mergedCells;
   private _mergedVersion;

package/dist/index.js

@@ -1434,6 +1434,8 @@ function toNewWorkbook(sheets, date1904, meta = {}) {
 			}
 			return c;
 		};
+		const styleFor = (cell) => useStyles ? cellStyleIn(cell, styleOf(cell.style)) : isDateCell(cell) ? { numFmt: 14 } : {};
+		const uniform = uniformMerges(ws);
 		ws._rows.forEach((row) => {
 			if (!row) return;
 			if (row.height !== void 0 || row.hidden || row.outlineLevel) sheet.row(row.number, {
@@ -1443,13 +1445,31 @@ function toNewWorkbook(sheets, date1904, meta = {}) {
 				...row.collapsed ? { collapsed: true } : {}
 			});
 			row._cells.forEach((cell) => {
-				if (cell) at(ws.name, cell.address, () => writeCell(cell));
+				if (!cell) return;
+				if (cell._master !== null && uniform.masters.has(cell._master)) {
+					if (cell.note !== void 0) at(ws.name, cell.address, () => {
+						const note = noteIn(cell);
+						if (note) sheet.note(cell.address, note);
+					});
+				} else at(ws.name, cell.address, () => writeCell(cell));
 			});
 		});
+		for (const m of uniform.ranges) {
+			const master = ws.findCell(m.top, m.left);
+			if (!master) continue;
+			const style = styleFor(master);
+			if (Object.keys(style).length === 0) continue;
+			const width = m.right - m.left + 1;
+			const step = Math.max(1, Math.floor(MERGE_STYLE_BLOCK / width));
+			for (let top = m.top; top <= m.bottom; top += step) {
+				const bottom = Math.min(m.bottom, top + step - 1);
+				sheet.style(`${columnLetter(m.left)}${String(top)}:${columnLetter(m.right)}${String(bottom)}`, style);
+			}
+		}
 		function writeCell(cell) {
 			const note = noteIn(cell);
 			if (note) sheet.note(cell.address, note);
-			const style = useStyles ? cellStyleIn(cell, styleOf(cell.style)) : isDateCell(cell) ? { numFmt: 14 } : {};
+			const style = styleFor(cell);
 			const value = cell.type === ValueType.Merge ? null : valueIn(cell, sharedRanges);
 			if (value === null && Object.keys(style).length === 0) return;
 			sheet.set(cell.address, value, style);
@@ -1485,6 +1505,55 @@ function toNewWorkbook(sheets, date1904, meta = {}) {
 	for (const d of meta.definedNames ?? []) book.defineName(d.name, d.ranges.join(","));
 	return book;
 }
+/** Cells styled by one `sheet.style` call for a merged range: at most what the core styles at once. */
+const MERGE_STYLE_BLOCK = 1048576;
+/** Whether two exceljs styles have the same parts (the same objects, as a merge's copies have). */
+function sameStyleParts(a, b) {
+	if (a === b) return true;
+	let n = 0;
+	for (const k in a) {
+		if (a[k] !== b[k]) return false;
+		n++;
+	}
+	for (const _ in b) n--;
+	return n === 0;
+}
+/**
+* The merged ranges of a worksheet whose other cells all exist, belong to the range's master and
+* carry the master's style (the copy `mergeCells` gives them, as in exceljs), and the masters all
+* of whose ranges are such. Their cells are written as the master's style over the range (K2),
+* and their notes one by one (K3).
+*/
+function uniformMerges(ws) {
+	const ranges = [];
+	const masters = /* @__PURE__ */ new Set();
+	const mixed = /* @__PURE__ */ new Set();
+	for (const m of ws._merges.values()) {
+		const master = ws.findCell(m.top, m.left);
+		if (!master) continue;
+		let ok = true;
+		for (let r = m.top; ok && r <= m.bottom; r++) {
+			const row = ws.findRow(r);
+			for (let c = m.left; c <= m.right; c++) {
+				if (r === m.top && c === m.left) continue;
+				const cell = row?.findCell(c);
+				if (!cell || cell._master !== master || !sameStyleParts(cell.style, master.style)) {
+					ok = false;
+					break;
+				}
+			}
+		}
+		if (ok) {
+			ranges.push(m);
+			masters.add(master);
+		} else mixed.add(master);
+	}
+	for (const master of mixed) masters.delete(master);
+	return {
+		ranges: ranges.filter((m) => masters.has(ws.findCell(m.top, m.left))),
+		masters
+	};
+}
 /**
 * The validations, conditional formats, protection and printing settings of a worksheet in the
 * form of the core API (D-C06). exceljs always writes page margins and page setup
@@ -1598,6 +1667,18 @@ function viewOut(view, freeze) {
 	};
 }
 /**
+* Whether a formula read by xlvane has text, without making the core build it: the core moves a
+* shared master's text to a dependent only when the dependent's `text` is read (a getter), and
+* gives `null` (a plain value) when it cannot move it. Reading the text of every dependent made a
+* small file with a huge master and many dependents exhaust memory (K2), and exceljs reads a
+* dependent as `{ sharedFormula }` without its text anyway.
+*/
+function hasFormulaText(f) {
+	const d = Object.getOwnPropertyDescriptor(f, "text");
+	if (d !== void 0 && d.get !== void 0) return true;
+	return f.text !== null;
+}
+/**
 * A formula read by xlvane in exceljs's shape (cell-xform.js L460–470; X4-29): a shared-formula
 * master `{ formula, result, ref, shareType: 'shared' }`, a dependent `{ sharedFormula: master,
 * result }` (its `cell.formula` is translated), an array formula `{ formula, result, ref,
@@ -2858,6 +2939,56 @@ function notSupported(feature) {
 		details: { feature }
 	});
 }
+/**
+* The shared-formula text moved per workbook (K4 S1, D-K04). A move costs time in proportion to the
+* master's length, and the load-time budget is spent once, so a 4 KB file whose 1 000 000-character
+* master is shared with 250 cells took about 47 s to read every dependent's formula once. Two
+* budgets, counting the master's text read plus the moved text built for each `cell.formula` that
+* is not kept yet:
+* - every move: 512 Mi characters, the default `maxSharedStringChars` with which xlvane's
+*   `readWorkbook` expands shared formulas, so a workbook the core reads is read here too;
+* - moves of masters longer than 8192 characters, the longest formula Office writes ([MS-OI29500]
+*   §2.1.1085 a): 32 Mi characters, so such a master stops after a few moves.
+*/
+const SHARED_FORMULA_TEXT = 536870912;
+const LONG_SHARED_FORMULA_TEXT = 33554432;
+const LONG_FORMULA = 8192;
+/** Characters moved in all and for long masters, per workbook (a `Worksheet.workbook`). */
+const sharedFormulaSpent = /* @__PURE__ */ new WeakMap();
+/**
+* @internal Moves the text of a shared-formula master at `master` to `row`/`col` of `sheet` with
+* `shiftFormula`, counted against the workbook's shared-formula budgets; `undefined` when the
+* formula cannot be moved. Throws `XLV_E_LIMIT_EXCEEDED` before a move that would pass one.
+*/
+function moveSharedFormula(workbook, sheet, text, master, row, col) {
+	let spent = sharedFormulaSpent.get(workbook);
+	if (spent === void 0) sharedFormulaSpent.set(workbook, spent = {
+		chars: 0,
+		long: 0
+	});
+	const cost = 2 * text.length;
+	const long = text.length > LONG_FORMULA;
+	const limit = long && spent.long + cost > LONG_SHARED_FORMULA_TEXT ? LONG_SHARED_FORMULA_TEXT : spent.chars + cost > SHARED_FORMULA_TEXT ? SHARED_FORMULA_TEXT : null;
+	if (limit !== null) {
+		const cell = `${columnLetter(col)}${String(row)}`;
+		throw new XlvError("XLV_E_LIMIT_EXCEEDED", `Moving the shared formula of ${columnLetter(master.col)}${String(master.row)} (${String(text.length)} characters) to ${cell} of worksheet "${sheet}" would bring the shared-formula text moved in this workbook past ${String(limit)} characters.`, {
+			location: {
+				sheet,
+				cell
+			},
+			hint: "The workbook shares very long formulas with many cells. Read the dependents' cached result (cell.result) instead of cell.formula, or read the file with xlvane's readWorkbook, whose shared-formula text is limited by limits.maxSharedStringChars.",
+			details: {
+				limit: "sharedFormulaText",
+				value: limit
+			}
+		});
+	}
+	const moved = shiftFormula(text, row - master.row, col - master.col);
+	const used = text.length + (moved?.length ?? 0);
+	spent.chars += used;
+	if (long) spent.long += used;
+	return moved ?? void 0;
+}
 /** Column letters for a 1-based number (A … XFD). */
 function columnLetter(n) {
 	let s = "";
@@ -2902,7 +3033,7 @@ function typeOf(value) {
 	if (value instanceof Date) return ValueType.Date;
 	if (isRecord(value)) {
 		if (value["text"] && value["hyperlink"]) return ValueType.Hyperlink;
-		if (value["formula"] || value["sharedFormula"]) return ValueType.Formula;
+		if (value["sharedFormula"] || value["formula"]) return ValueType.Formula;
 		if (value["richText"]) return ValueType.RichText;
 		if (value["sharedString"]) return ValueType.SharedString;
 		if (value["error"]) return ValueType.Error;
@@ -2951,6 +3082,8 @@ var Cell = class {
 	_master = null;
 	/** @internal Number of merged ranges this cell is the master of. */
 	_mergeCount = 0;
+	/** The moved formula of a `{ sharedFormula }` value, and what it was moved from (see `formula`). */
+	_moved = void 0;
 	/** @internal Use `worksheet.getCell()`. */
 	constructor(_row, _col) {
 		this._row = _row;
@@ -3036,12 +3169,39 @@ var Cell = class {
 		const v = this.value;
 		if (!isRecord(v)) return void 0;
 		if (typeof v["formula"] === "string") return v["formula"];
-		if (typeof v["sharedFormula"] === "string") {
-			const masterRef = v["sharedFormula"].replace(/\$/g, "");
+		const shared = v["sharedFormula"];
+		if (typeof shared === "string") {
+			const masterRef = shared.replace(/\$/g, "");
 			const master = this.worksheet.findCell(masterRef);
-			const text = master?.formula;
-			if (!master || text === void 0 || master === this) return void 0;
-			return shiftFormula(text, this.row - master.row, this.col - master.col) ?? void 0;
+			let text;
+			let at;
+			if (!master) {
+				text = this.worksheet._sharedMasters?.get(masterRef.toUpperCase());
+				if (text === void 0) return void 0;
+				at = decodeAddress(masterRef);
+			} else {
+				if (master === this) return void 0;
+				text = master.formula;
+				if (text === void 0) return void 0;
+				at = {
+					row: master.row,
+					col: master.col
+				};
+			}
+			const kept = this._moved;
+			if (kept !== void 0 && kept.value === v && kept.shared === shared && kept.master === text && kept.masterRow === at.row && kept.masterCol === at.col && kept.row === this.row && kept.col === this.col) return kept.text;
+			const moved = moveSharedFormula(this.worksheet.workbook, this.worksheet.name, text, at, this.row, this.col);
+			this._moved = {
+				value: v,
+				shared,
+				master: text,
+				masterRow: at.row,
+				masterCol: at.col,
+				row: this.row,
+				col: this.col,
+				text: moved
+			};
+			return moved;
 		}
 	}
 	/** `FormulaType.Shared` for a `{ sharedFormula }` value, `Master` for other formulas, otherwise `None` (lib/doc/cell.js L807). */
@@ -3782,6 +3942,11 @@ var Worksheet = class {
 	_columns = [];
 	/** @internal */
 	_merges = new MergeMap();
+	/**
+	* @internal Formulas of shared-formula masters by address, for the dependents of a worksheet
+	* whose rows are not kept (stream.xlsx.WorkbookReader), so `cell.formula` can move them (K2).
+	*/
+	_sharedMasters = void 0;
 	/** The cells covered by `_merges` (row × 16 385 + column), valid while `_mergedVersion` equals `_merges.version`. */
 	_mergedCells = /* @__PURE__ */ new Set();
 	_mergedVersion = -1;
@@ -4698,8 +4863,12 @@ const INJECTION_START = /* @__PURE__ */ new Set([
 	"﹦",
 	"﹢",
 	"﹣",
-	"﹫"
+	"﹫",
+	"",
+	"￾"
 ]);
+/** Characters a field is quoted for while formulas are escaped, whatever the delimiter: other applications may split on them (K2). */
+const COMMON_DELIMITERS = ",;	|";
 function invalid(name, message, hint) {
 	return new XlvError("XLV_E_INVALID_OPTION", message, {
 		hint,
@@ -4985,9 +5154,41 @@ function malformed(line, message) {
 		details: { line }
 	});
 }
-/** Splits CSV text into rows of fields as fast-csv 4.3 does with the given parser options. */
-function parseCsv(text, o) {
-	const rows = [];
+/** Rows and columns of a worksheet (Part 1 §18.3.1.73, ST_CellRef up to XFD1048576). */
+const MAX_SHEET_ROWS = 1048576;
+const MAX_SHEET_COLUMNS = 16384;
+/** Fields added to the worksheet in total, as the core's `maxCells` read limit (K3). */
+const MAX_CSV_CELLS = DEFAULT_READ_LIMITS.maxCells;
+function tooMany(what, line) {
+	if (what === "cells") return new XlvError("XLV_E_LIMIT_EXCEEDED", `CSV line ${String(line)}: the CSV has more than ${String(MAX_CSV_CELLS)} fields in the rows read, the most csv.read adds to a worksheet.`, {
+		location: { line },
+		hint: "Split the CSV file into smaller parts, read only part of it with parserOptions.maxRows or skipRows, or read it with the core fromCSV, whose maxCells option can be raised for a trusted file.",
+		details: {
+			limit: "maxCells",
+			value: MAX_CSV_CELLS,
+			line
+		}
+	});
+	const rows = what === "rows";
+	const max = rows ? MAX_SHEET_ROWS : MAX_SHEET_COLUMNS;
+	return new XlvError("XLV_E_LIMIT_EXCEEDED", `CSV line ${String(line)}: ${rows ? `the CSV has more than ${String(max)} rows` : `the row has more than ${String(max)} fields`}, more than a worksheet can hold.`, {
+		location: { line },
+		hint: rows ? "Split the CSV file into parts of at most 1048576 rows, or read only part of it with parserOptions.maxRows." : "Split the CSV file into parts of at most 16384 columns, or check the delimiter (parserOptions.delimiter).",
+		details: {
+			limit: rows ? "maxRows" : "maxColumns",
+			value: max,
+			line
+		}
+	});
+}
+/**
+* The rows of CSV text, split as fast-csv 4.3 does with the given parser options, one at a time:
+* the rows that `ignoreEmpty`, the header, `skipRows` and `maxRows` drop are left out. More than
+* 1 048 576 rows, or a row of more than 16 384 fields, throw `XLV_E_LIMIT_EXCEEDED` as soon as
+* they are reached, because a worksheet cannot hold them (K2); so do more than 5 000 000 fields
+* in the rows given (`DEFAULT_READ_LIMITS.maxCells`, K3).
+*/
+function* csvRows(text, o) {
 	let at = 0;
 	let line = 1;
 	const n = text.length;
@@ -4996,6 +5197,10 @@ function parseCsv(text, o) {
 		if (text[i] === "\r" && text[i + 1] === "\n") return i + 2;
 		return i < n ? i + 1 : i;
 	};
+	const trim = (f) => o.trim ? f.trim() : o.ltrim ? f.trimStart() : o.rtrim ? f.trimEnd() : f;
+	let kept = 0;
+	let emitted = 0;
+	let cells = 0;
 	for (let k = 0; k < o.skipLines && at < n; k++) {
 		while (!atLineEnd(at)) at++;
 		at = skipLineEnd(at);
@@ -5008,38 +5213,50 @@ function parseCsv(text, o) {
 			line++;
 			continue;
 		}
+		const rowLine = line;
 		const fields = [];
+		let extra = 0;
+		let extraText = false;
+		const push = (field) => {
+			if (fields.length < MAX_SHEET_COLUMNS) fields.push(field);
+			else {
+				extra++;
+				if (field.trim() !== "") extraText = true;
+			}
+		};
 		for (;;) {
 			let start = at;
 			while (start < n && (text[start] === " " || text[start] === "	") && text[start] !== o.delimiter) start++;
 			if (o.quote !== "" && text[start] === o.quote) {
 				let value = "";
 				let i = start + 1;
+				let from = i;
 				const opened = line;
 				for (;;) {
 					if (i >= n) throw malformed(opened, `missing closing ${o.quote} for the field that starts here.`);
 					const ch = text[i];
 					if (ch === o.escape && text[i + 1] === o.quote) {
-						value += o.quote;
+						value += text.slice(from, i) + o.quote;
 						i += 2;
+						from = i;
 						continue;
 					}
 					if (ch === o.quote) {
+						value += text.slice(from, i);
 						i++;
 						break;
 					}
 					if (ch === "\n") line++;
-					value += ch;
 					i++;
 				}
 				while (i < n && (text[i] === " " || text[i] === "	") && text[i] !== o.delimiter) i++;
 				if (i < n && text[i] !== o.delimiter && text[i] !== "\n" && text[i] !== "\r") throw malformed(line, `unexpected text after the closing ${o.quote}.`);
-				fields.push(value);
+				push(value);
 				at = i;
 			} else {
 				let i = at;
 				while (i < n && text[i] !== o.delimiter && text[i] !== "\n" && text[i] !== "\r") i++;
-				fields.push(text.slice(at, i));
+				push(text.slice(at, i));
 				at = i;
 			}
 			if (at < n && text[at] === o.delimiter) {
@@ -5051,14 +5268,30 @@ function parseCsv(text, o) {
 		at = skipLineEnd(at);
 		line++;
 		const row = fields.length === 1 && fields[0].trim() === "" ? [""] : fields;
-		rows.push(row.map((f) => o.trim ? f.trim() : o.ltrim ? f.trimStart() : o.rtrim ? f.trimEnd() : f));
+		if (o.ignoreEmpty && !extraText && row.every((f) => f.trim() === "")) continue;
+		kept++;
+		if (o.skipHeader && kept === 1) continue;
+		if (kept - (o.skipHeader ? 1 : 0) <= o.skipRows) continue;
+		if (o.maxRows > 0 && emitted >= o.maxRows) continue;
+		if (extra > 0) throw tooMany("columns", rowLine);
+		if (++emitted > MAX_SHEET_ROWS) throw tooMany("rows", rowLine);
+		cells += row.length;
+		if (cells > MAX_CSV_CELLS) throw tooMany("cells", rowLine);
+		yield {
+			fields: row.map(trim),
+			line: rowLine
+		};
 	}
-	let out = rows;
-	if (o.ignoreEmpty) out = out.filter((r) => r.some((f) => f.trim() !== ""));
-	if (o.skipHeader) out = out.slice(1);
-	if (o.skipRows > 0) out = out.slice(o.skipRows);
-	if (o.maxRows > 0) out = out.slice(0, o.maxRows);
-	return out;
+}
+/** The delimiters and line-break characters in `text`: at least the number of fields less one. */
+function fieldEnds(text, delimiter) {
+	const d = delimiter.charCodeAt(0);
+	let n = 0;
+	for (let i = 0; i < text.length; i++) {
+		const c = text.charCodeAt(i);
+		if (c === d || c === 10 || c === 13) n++;
+	}
+	return n;
 }
 /**
 * exceljs's default conversion of a CSV field (lib/csv/csv.js L57–83), with two fixes: text of
@@ -5078,7 +5311,7 @@ function csvValue(datum, dateFormats) {
 	if (special !== void 0) return typeof special === "object" ? { ...special } : special;
 	return datum;
 }
-function formatterOptions(raw) {
+function formatterOptions(raw, escapeFormulas) {
 	const o = raw ?? {};
 	const delimiter = typeof o["delimiter"] === "string" ? o["delimiter"] : ",";
 	const rowDelimiter = typeof o["rowDelimiter"] === "string" ? o["rowDelimiter"] : "\n";
@@ -5095,9 +5328,27 @@ function formatterOptions(raw) {
 		headers: Array.isArray(o["headers"]) && o["writeHeaders"] !== false ? o["headers"].map(String) : null,
 		includeEndRowDelimiter: o["includeEndRowDelimiter"] === true,
 		writeBOM: o["writeBOM"] === true,
-		escapeChars: new RegExp(`[${escapeRe(delimiter)}${escapeRe(rowDelimiter)}|\\r|\\n]`)
+		escapeChars: new RegExp(`[${escapeRe(delimiter)}${escapeRe(rowDelimiter)}|\\r|\\n${escapeFormulas ? escapeRe(COMMON_DELIMITERS) : ""}]`),
+		strictQuoting: escapeFormulas
 	};
 }
+/**
+* Whether an application that splits `text` at a comma, ";", tab or "|" would get a field that
+* starts like a formula: one of those characters followed by a formula sign, a control character
+* or a byte order mark, after any spaces or tabs and an opening double quote (K2).
+*/
+function splitStartsFormula(text) {
+	for (let i = 0; i < text.length; i++) {
+		if (!COMMON_DELIMITERS.includes(text[i])) continue;
+		let j = i + 1;
+		while (text[j] === " " || text[j] === "	") j++;
+		if (text[j] === "\"") j++;
+		while (text[j] === " ") j++;
+		const c = text[j];
+		if (c !== void 0 && (INJECTION_START.has(c) || c.charCodeAt(0) < 32)) return true;
+	}
+	return false;
+}
 /** One field as fast-csv FieldFormatter.format writes it. */
 function formatField(value, index, f, forceQuote) {
 	const text = `${value === null || value === void 0 ? "" : String(value)}`.replace(/\0/g, "");
@@ -5108,6 +5359,13 @@ function formatField(value, index, f, forceQuote) {
 			field: index + 1
 		}
 	});
+	if (f.quote === "" && f.strictQuoting && splitStartsFormula(text)) throw new XlvError("XLV_E_INVALID_OPTION", `Field ${String(index + 1)} has a comma, ";", tab or "|" followed by a formula sign, which an application splitting on that character reads as a formula; it cannot be written with quote: false.`, {
+		hint: "Leave formatterOptions.quote at its default (\") so such fields are quoted, or pass formulaInjection: \"off\" for a trusted consumer.",
+		details: {
+			option: "quote",
+			field: index + 1
+		}
+	});
 	if (f.quote !== "" && text.includes(f.quote)) return `${f.quote}${text.split(f.quote).join(f.escapedQuote)}${f.quote}`;
 	const q = f.quoteColumns;
 	const quoteThis = forceQuote || q === true || Array.isArray(q) && q[index] === true;
@@ -5127,7 +5385,7 @@ function defaultWriteMap(dateFormat, dateUTC) {
 		if (typeof value === "object") {
 			const v = value;
 			if (v["text"] || v["hyperlink"]) return v["hyperlink"] || v["text"] || "";
-			if (v["formula"] || v["sharedFormula"] || "result" in v) {
+			if (v["sharedFormula"] || v["formula"] || "result" in v) {
 				const result = v["result"];
 				if (result === void 0 || result === null) return "";
 				if (result instanceof Date) return date(result);
@@ -5140,15 +5398,165 @@ function defaultWriteMap(dateFormat, dateUTC) {
 		return value;
 	};
 }
+/** The output encoding for the `encoding` option (an unsupported one is refused when encoding). */
+function outputEncoding(encoding) {
+	const e = (encoding ?? "").toLowerCase();
+	if (e === "latin1" || e === "binary") return "latin1";
+	if (e === "utf16le" || e === "utf-16le" || e === "ucs2" || e === "ucs-2") return "utf16le";
+	return "utf8";
+}
+/** Leading UTF-8 sequences of U+FF1D, U+FF0B, U+FF0D, U+FF20, U+FE66, U+FE62, U+FE63, U+FE6B. */
+const UTF8_FORMULA_SIGNS = [
+	[
+		239,
+		188,
+		157
+	],
+	[
+		239,
+		188,
+		139
+	],
+	[
+		239,
+		188,
+		141
+	],
+	[
+		239,
+		188,
+		160
+	],
+	[
+		239,
+		185,
+		166
+	],
+	[
+		239,
+		185,
+		162
+	],
+	[
+		239,
+		185,
+		163
+	],
+	[
+		239,
+		185,
+		171
+	]
+];
+/**
+* Whether the first bytes of a field, as latin1 or UTF-16LE writes it, are a byte order mark
+* (EF BB BF, FF FE, FE FF), which makes a reader decode the rest of the file in that encoding
+* and drop the mark, or the UTF-8 form of a full-width or small formula sign, which a reader that
+* guesses UTF-8 shows as one (K2). `prefix` holds bytes written before the field (latin1 writes
+* the `writeBOM` mark U+FEFF as the single byte FF). UTF-16LE bytes are taken without their NUL
+* bytes, as an 8-bit reader that drops them reads them (K3); a sequence that holds no NUL byte is
+* the same either way.
+*/
+function encodedStartIsUnsafe(text, encoding, prefix) {
+	if (encoding === "utf8") return false;
+	const bytes = [...prefix];
+	for (let i = 0; bytes.length < 3 && i < text.length; i++) {
+		const c = text.charCodeAt(i);
+		if (encoding === "latin1") bytes.push(c & 255);
+		else for (const b of [c & 255, c >> 8]) if (b !== 0) bytes.push(b);
+	}
+	const starts = (lead) => lead.every((b, i) => bytes[i] === b);
+	return starts([
+		239,
+		187,
+		191
+	]) || starts([255, 254]) || starts([254, 255]) || UTF8_FORMULA_SIGNS.some(starts);
+}
+/** Bytes that end a field or a row for a reader of the 8-bit text, whatever its delimiter. */
+const BYTE_BREAKS = /* @__PURE__ */ new Set([
+	44,
+	59,
+	9,
+	124,
+	13,
+	10
+]);
+/** Whether the 8-bit text `view` has a formula start at `i`: "=", or spaces or tabs, a quote and "=". */
+function viewFormulaAt(view, i) {
+	if (view[i] === "=") return true;
+	let j = i;
+	while (view[j] === " " || view[j] === "	") j++;
+	return view[j] === "\"" && view[j + 1] === "=";
+}
 /**
-* The CSV text of a worksheet, as exceljs `csv.write` gives it.
+* Whether the UTF-16LE bytes of `text` without NULs start a formula (see {@link viewFormulaAt})
+* because of a character above U+00FF, such as U+3D00 (00 3D) or U+4E3D (3D 4E). Starts made only
+* of characters up to U+00FF are the same text in both readings and are checked as text.
+*/
+function utf16StartsFormula(text) {
+	let view = "";
+	let foreign = false;
+	let lead = 0;
+	let blank = true;
+	for (let i = 0; i < text.length && view.length - lead < 2; i++) {
+		const c = text.charCodeAt(i);
+		if (c > 255) foreign = true;
+		for (const b of c > 255 ? [c & 255, c >> 8] : [c]) {
+			if (b === 0) continue;
+			view += String.fromCharCode(b);
+			if (blank && (b === 32 || b === 9)) lead++;
+			else blank = false;
+		}
+	}
+	return foreign && viewFormulaAt(view, 0);
+}
+/** The UTF-16LE bytes of a written field without NULs, and whether characters above U+00FF give a break or a quote among them. */
+function utf16View(written, delimiter) {
+	let view = "";
+	let foreignBreak = false;
+	let foreignQuote = false;
+	for (let i = 0; i < written.length; i++) {
+		const c = written.charCodeAt(i);
+		for (const b of c > 255 ? [c & 255, c >> 8] : [c]) {
+			if (b === 0) continue;
+			if (c > 255) {
+				if (b === 34) foreignQuote = true;
+				else if (BYTE_BREAKS.has(b) || delimiter.includes(String.fromCharCode(b))) foreignBreak = true;
+			}
+			view += String.fromCharCode(b);
+		}
+	}
+	return {
+		view,
+		foreignBreak,
+		foreignQuote
+	};
+}
+/** Whether the 8-bit text `view` has a delimiter (`delimiter` or a common one) or a line break followed by a formula start. */
+function viewSplitStartsFormula(view, delimiter) {
+	for (let i = 0; i < view.length; i++) {
+		if (BYTE_BREAKS.has(view.charCodeAt(i)) && viewFormulaAt(view, i + 1)) return true;
+		if (view.startsWith(delimiter, i) && viewFormulaAt(view, i + delimiter.length)) return true;
+	}
+	return false;
+}
+/** Column letters of a 1-based column number. */
+function columnName(n) {
+	let s = "";
+	for (let c = n; c > 0; c = Math.floor((c - 1) / 26)) s = String.fromCharCode(65 + (c - 1) % 26) + s;
+	return s;
+}
+/**
+* The CSV text of a worksheet, as exceljs `csv.write` gives it, for output in `encoding`.
 *
 * @internal
 */
-function worksheetCsv(sheet, options, latin1 = false) {
-	const f = formatterOptions(options.formatterOptions);
+function worksheetCsv(sheet, options, encoding = "utf8") {
 	const injection = options.formulaInjection ?? "escape";
 	if (injection !== "escape" && injection !== "off") throw invalid("formulaInjection", "The option \"formulaInjection\" must be \"escape\" or \"off\".", "Use \"escape\" (default) or \"off\".");
+	const f = formatterOptions(options.formatterOptions, injection === "escape");
+	const latin1 = encoding === "latin1";
+	const sheetName = sheet?.name ?? "";
 	if (latin1) {
 		for (const [name, value] of [
 			["delimiter", f.delimiter],
@@ -5159,6 +5567,10 @@ function worksheetCsv(sheet, options, latin1 = false) {
 	}
 	if (injection === "escape") {
 		const off = "or pass formulaInjection: \"off\" for a trusted consumer.";
+		if (f.delimiter === "") throw invalid("delimiter", "The delimiter is empty, so the fields of a row run together and the text of one field could complete a formula or a byte order mark begun by the one before.", `Use "," (default), ";", "|" or "\\t", ${off}`);
+		if (encoding !== "utf8") {
+			for (const [name, value] of [["delimiter", f.delimiter], ["rowDelimiter", f.rowDelimiter]]) if (/[^\u0000-\u007f]/.test(value)) throw invalid(name, `The option "${name}" (${JSON.stringify(value)}) has characters other than ASCII, whose ${encoding} bytes could join the bytes of the fields around them into a byte order mark or a formula sign.`, `Use ASCII characters with encoding "${encoding}" (for example "," or ";"), write UTF-8 (the default encoding), ${off}`);
+		}
 		if (f.delimiter !== "	" && [...f.delimiter].some((c) => INJECTION_START.has(c) || c.charCodeAt(0) < 32)) throw invalid("delimiter", `The delimiter ${JSON.stringify(f.delimiter)} holds a formula sign or a control character, so a line could start with a formula.`, `Use "," (default), ";", "|" or "\\t", ${off}`);
 		if (![
 			"\n",
@@ -5170,8 +5582,34 @@ function worksheetCsv(sheet, options, latin1 = false) {
 	}
 	/** The text latin1 will write: characters above U+00FF as "?". */
 	const narrow = (out) => latin1 && typeof out === "string" ? out.replace(/[^\u0000-\u00ff]/g, "?") : out;
-	/** A formatted field, refused if a standard reader would take its leading quote as quoting. */
-	const field = (out, index, force) => {
+	const utf16 = encoding === "utf16le" && injection === "escape";
+	const marked = injection === "escape" && (utf16 || latin1 && f.writeBOM);
+	/** A quote may be taken differently by a reader of the 8-bit text from here on (K3). */
+	let quoteShifted = false;
+	const unsafeField = (index, row, reason, hint) => {
+		const cell = `${columnName(index + 1)}${String(row)}`;
+		return new XlvError("XLV_E_INVALID_OPTION", `The text of ${row === 0 ? `header ${String(index + 1)}` : `cell ${cell}`} cannot be written safely as ${encoding}: ${reason}`, {
+			location: row === 0 ? { sheet: sheetName } : {
+				sheet: sheetName,
+				cell
+			},
+			hint,
+			details: {
+				option: "encoding",
+				field: index + 1,
+				row
+			}
+		});
+	};
+	/**
+	* A formatted field, refused if a standard reader would take its leading quote as quoting, or
+	* if a reader of the output as 8-bit text that drops NUL bytes (LibreOffice) would split it
+	* before a formula start: in utf16le output, when characters above U+00FF give a delimiter,
+	* line break or quote there, when an earlier quote of that kind may shift the quoting, or for
+	* the first field after a mark that reader keeps (K3). `row` is the row number, 0 for the header
+	* line; `atStart`: the field is the first one of the file.
+	*/
+	const field = (out, index, force, row, atStart) => {
 		const text = formatField(out, index, f, force);
 		if (injection === "escape" && f.quote !== "\"" && text.startsWith("\"")) throw new XlvError("XLV_E_INVALID_OPTION", `Field ${String(index + 1)} starts with a double quote, which a standard CSV reader takes as quoting when formatterOptions.quote is not '"'.`, {
 			hint: "Leave formatterOptions.quote at its default (\"), or pass formulaInjection: \"off\" for a trusted consumer.",
@@ -5180,20 +5618,32 @@ function worksheetCsv(sheet, options, latin1 = false) {
 				field: index + 1
 			}
 		});
+		const first = marked && atStart;
+		if (first || quoteShifted || utf16 && /[^\u0000-\u00ff]/.test(text)) {
+			const { view, foreignBreak, foreignQuote } = utf16 ? utf16View(text, f.delimiter) : {
+				view: text,
+				foreignBreak: false,
+				foreignQuote: false
+			};
+			if ((first || foreignBreak || foreignQuote || quoteShifted) && viewSplitStartsFormula(view, f.delimiter)) throw first ? unsafeField(index, row, `the file starts with ${utf16 ? "the UTF-16LE byte order mark (FF FE)" : "the byte FF (writeBOM)"}, which LibreOffice keeps when it reads the file as 8-bit text, so the opening quote of this first field is not taken as quoting and its delimiter or line break followed by "=" starts a formula.`, utf16 ? "Write UTF-8 (the default encoding), move this text out of the first cell, or pass formulaInjection: \"off\" for a trusted consumer." : "Leave formatterOptions.writeBOM off with latin1, write UTF-8, or pass formulaInjection: \"off\" for a trusted consumer.") : utf16 ? unsafeField(index, row, "read as 8-bit text without its NUL bytes, as LibreOffice reads UTF-16LE CSV files, its bytes hold a delimiter or a line break followed by \"=\", which starts a formula there.", "Write UTF-8 (the default encoding), or pass formulaInjection: \"off\" for a trusted consumer.") : unsafeField(index, row, "the first field, after the byte FF of writeBOM, is split by LibreOffice, which may then take the quotes after it differently, and this field holds a delimiter or a line break followed by \"=\".", "Leave formatterOptions.writeBOM off with latin1, write UTF-8, or pass formulaInjection: \"off\" for a trusted consumer.");
+			if (foreignQuote || first && ([...view].some((c) => BYTE_BREAKS.has(c.charCodeAt(0))) || view.includes(f.delimiter))) quoteShifted = true;
+		}
 		return text;
 	};
 	const map = options.map ?? defaultWriteMap(options.dateFormat, options.dateUTC === true);
 	const includeEmptyRows = options.includeEmptyRows === void 0 || options.includeEmptyRows;
 	const lines = [];
-	const escape = (raw) => {
-		const out = narrow(raw);
+	const escape = (raw, atStart) => {
+		const out = narrow(raw === null || raw === void 0 || typeof raw === "number" || typeof raw === "boolean" || typeof raw === "bigint" || typeof raw === "string" ? raw : String(raw));
 		if (injection !== "escape" || typeof out !== "string") return [out, false];
-		const first = out.replace(/\0/g, "")[0];
-		return first !== void 0 && (INJECTION_START.has(first) || first.charCodeAt(0) < 32) ? [`'${out}`, f.quote !== ""] : [out, false];
+		const text = out.replace(/\0/g, "");
+		const first = text[0];
+		if (first === void 0) return [out, false];
+		return INJECTION_START.has(first) || first.charCodeAt(0) < 32 || encodedStartIsUnsafe(text, encoding, atStart && f.writeBOM && latin1 ? [255] : []) || utf16 && utf16StartsFormula(text) ? [`'${out}`, f.quote !== ""] : [out, false];
 	};
 	if (f.headers) lines.push(f.headers.map((h, i) => {
-		const [out, force] = escape(h);
-		return field(out, i, force);
+		const [out, force] = escape(h, i === 0);
+		return field(out, i, force, 0, i === 0);
 	}).join(f.delimiter));
 	if (sheet) {
 		let lastRow = 0;
@@ -5207,8 +5657,9 @@ function worksheetCsv(sheet, options, latin1 = false) {
 					fields.push("");
 					continue;
 				}
-				const [out, force] = escape(map(values[i], i));
-				fields.push(field(out, i, force));
+				const atStart = lines.length === 0 && i === 0;
+				const [out, force] = escape(map(values[i], i), atStart);
+				fields.push(field(out, i, force, rowNumber, atStart));
 			}
 			lines.push(fields.join(f.delimiter));
 			lastRow = rowNumber;
@@ -5216,7 +5667,7 @@ function worksheetCsv(sheet, options, latin1 = false) {
 	}
 	let text = lines.join(f.rowDelimiter);
 	if (f.includeEndRowDelimiter) text += f.rowDelimiter;
-	return (f.writeBOM ? "" : "") + text;
+	return (f.writeBOM || utf16 ? "" : "") + text;
 }
 function encode(text, encoding) {
 	const e = (encoding ?? "utf8").toLowerCase();
@@ -5358,10 +5809,16 @@ var CsvIO = class {
 	async read(stream, options = {}) {
 		const worksheet = this.workbook.addWorksheet(options.sheetName);
 		const parser = parserOptions(options.parserOptions);
-		const rows = parseCsv(await readText(stream, parser.encoding), parser);
+		const text = await readText(stream, parser.encoding);
 		const formats = options.dateFormats ?? DEFAULT_DATE_FORMATS;
 		const map = options.map ?? ((datum) => csvValue(datum, formats));
-		for (const row of rows) worksheet.addRow(row.map((datum, i) => map(datum, i)));
+		if (text.length >= MAX_CSV_CELLS && fieldEnds(text, parser.delimiter) >= MAX_CSV_CELLS) try {
+			const rows = csvRows(text, parser);
+			while (rows.next().done !== true);
+		} catch (error) {
+			if (error instanceof XlvError && error.code === "XLV_E_LIMIT_EXCEEDED" && error.details?.limit === "maxCells") throw error;
+		}
+		for (const row of csvRows(text, parser)) worksheet.addRow(row.fields.map((datum, i) => map(datum, i)));
 		return worksheet;
 	}
 	/** Reads a CSV file (Node.js, Bun, Deno) into a new worksheet. */
@@ -5389,8 +5846,7 @@ var CsvIO = class {
 	}
 	/** Writes a worksheet to a CSV file (Node.js, Bun, Deno), replacing it. */
 	async writeFile(path, options = {}) {
-		const e = (options.encoding ?? "").toLowerCase();
-		const bytes = encode(this.text(options, e === "latin1" || e === "binary"), options.encoding);
+		const bytes = encode(this.text(options, outputEncoding(options.encoding)), options.encoding);
 		const fs = await nodeFs("writeFile");
 		try {
 			await fs.writeFile(path, bytes);
@@ -5414,7 +5870,7 @@ var CsvIO = class {
 	createInputStream() {
 		throw new Error("`CSV#createInputStream` is deprecated. You should use `CSV#read` instead. This method will be removed in version 5.0. Please follow upgrade instruction: https://github.com/exceljs/exceljs/blob/master/UPGRADE-4.0.md");
 	}
-	text(options, latin1 = false) {
+	text(options, encoding = "utf8") {
 		const key = options.sheetName || options.sheetId;
 		const sheet = this.workbook.getWorksheet(key);
 		if (key !== void 0 && !sheet) throw new XlvError("XLV_E_SHEET_NOT_FOUND", `The workbook has no worksheet ${typeof key === "string" ? `named "${key}"` : `with id ${String(key)}`}.`, {
@@ -5422,7 +5878,7 @@ var CsvIO = class {
 			hint: `Available worksheets: ${this.workbook.worksheets.map((w) => `"${w.name}"`).join(", ") || "none"}.`,
 			details: { available: this.workbook.worksheets.map((w) => w.name) }
 		});
-		return worksheetCsv(sheet, options, latin1);
+		return worksheetCsv(sheet, options, encoding);
 	}
 };
 // src/defined-names.ts
@@ -6286,6 +6742,23 @@ var Workbook = class {
 				}
 			});
 		};
+		const mergeBudget = Math.max(MERGED_CELLS_BUDGET, cellsRead);
+		let merged = 0;
+		const spendMerge = (positions, ref, sheet) => {
+			merged += positions;
+			if (merged <= mergeBudget) return;
+			throw new XlvError("XLV_E_LIMIT_EXCEEDED", `The merged range ${ref} of worksheet "${sheet}" would bring the merged cells past ${String(mergeBudget)} for ${String(cellsRead)} cells in the file.`, {
+				location: {
+					sheet,
+					cell: ref
+				},
+				hint: "The file merges far more cells than it holds. Load it with ignoreNodes: [\"mergeCells\"] to skip merged ranges, or read it with xlvane's readWorkbook, which does not create these cells.",
+				details: {
+					limit: "mergedCells",
+					value: mergeBudget
+				}
+			});
+		};
 		const rowBudget = Math.max(67108864, 16 * cellsRead);
 		const validations = validationBudget();
 		let rowsLooked = 0;
@@ -6398,7 +6871,7 @@ var Workbook = class {
 				const target = ws.getCell(cell.row, cell.col);
 				let value;
 				const plain = cell.type === "error" ? { error: cell.value } : cell.value;
-				if (cell.formula && cell.formula.text !== null) value = formulaOut(cell.formula, plain, cell.ref, masters);
+				if (cell.formula && hasFormulaText(cell.formula)) value = formulaOut(cell.formula, plain, cell.ref, masters);
 				else value = cell.richText ? richTextOut(cell.richText) : plain;
 				const h = cell.hyperlink;
 				if (h && use("hyperlinks") && (h.target !== null || h.location !== null && h.location !== "")) {
@@ -6440,6 +6913,7 @@ var Workbook = class {
 			for (const m of use("mergeCells") ? s.merges : []) {
 				if (!m.includes(":")) continue;
 				spend(areaOf(m), "A merged range", s.name);
+				spendMerge(areaOf(m), m, s.name);
 				try {
 					ws.mergeCells(m);
 				} catch (error) {
@@ -6483,6 +6957,8 @@ var Workbook = class {
 		}
 	}
 };
+/** Merged cells `xlsx.load` creates at most for a file with fewer cells (one whole column; K2). */
+const MERGED_CELLS_BUDGET = 1048576;
 /**
 * @internal The chunks of an input stream, read until it ends. Reading stops with
 * XLV_E_LIMIT_EXCEEDED as soon as the chunks pass maxInputBytes, the size the core reads at most,
@@ -6571,7 +7047,7 @@ function streamValueIn(cell, masters) {
 	const v = cell.value;
 	if (v !== null && typeof v === "object" && !Array.isArray(v) && !(v instanceof Date)) {
 		const r = v;
-		if (typeof r["formula"] === "string" && r["shareType"] !== "array" && typeof r["ref"] === "string") {
+		if (typeof r["ref"] === "string" && r["shareType"] !== "array" && typeof r["formula"] === "string") {
 			masters.set(cell.address, {
 				formula: r["formula"],
 				row: cell.row,
@@ -7178,6 +7654,44 @@ var WorksheetReader = class extends Emitter {
 	}
 };
 /**
+* The value of a shared-formula dependent read by the streaming reader: `{ sharedFormula: master,
+* result }`, as exceljs's xlsx.load gives it, with a non-enumerable `formula` that moves the
+* master's text (`masters`, by address) to `row`/`col` when it is first read. The master's row is
+* not kept, so a sheet the value is copied into (stream.xlsx.WorkbookWriter, whose committed rows
+* are dropped) can write this formula instead of looking the master up (K3); reading the rows
+* alone builds no moved texts (K2). Setting `formula` replaces it with an ordinary property. A move
+* counts against the shared-formula budget of `workbook`, as `cell.formula` does (K4 S1).
+*/
+function sharedDependent(master, result, masters, row, col, workbook, sheet) {
+	const value = {
+		sharedFormula: master,
+		...result
+	};
+	let moved;
+	let built = false;
+	Object.defineProperty(value, "formula", {
+		configurable: true,
+		enumerable: false,
+		get() {
+			if (!built) {
+				const text = masters.get(master);
+				moved = text === void 0 ? void 0 : moveSharedFormula(workbook, sheet, text, decodeAddress(master), row, col);
+				built = true;
+			}
+			return moved;
+		},
+		set(formula) {
+			Object.defineProperty(this, "formula", {
+				value: formula,
+				writable: true,
+				enumerable: true,
+				configurable: true
+			});
+		}
+	});
+	return value;
+}
+/**
 * The streaming reader of exceljs (`ExcelJS.stream.xlsx.WorkbookReader`): iterate worksheets
 * and their rows with `for await`, or call `read()` and listen to `worksheet`, `end`,
 * `finished` and `error` events (and `entry` with `entries: 'emit'`). Rows are not kept.
@@ -7227,16 +7741,31 @@ var WorkbookReader = class extends Emitter {
 			});
 			const sheet = host._addReadWorksheet(host.nextId, info.name, { state: info.state });
 			const name = info.name;
+			const masters = /* @__PURE__ */ new Map();
+			const kept = /* @__PURE__ */ new Map();
+			sheet._sharedMasters = kept;
 			const rows = async function* () {
 				for await (const r of book.rows(name)) {
 					const row = sheet.getRow(r.number);
 					for (const cell of r.cells) {
 						const plain = cell.type === "error" ? { error: cell.value } : cell.value;
 						const target = row.getCell(cell.col);
-						target.value = cell.formula && cell.formula.text !== null ? plain === null ? { formula: cell.formula.text } : {
-							formula: cell.formula.text,
-							result: plain
-						} : cell.richText ? richTextOut(cell.richText) : plain;
+						const f = cell.formula;
+						const result = plain === null ? {} : { result: plain };
+						let value;
+						if (f && f.kind === "shared" && f.sharedIndex !== null && f.ref === null && masters.has(f.sharedIndex) && hasFormulaText(f)) value = sharedDependent(masters.get(f.sharedIndex), result, kept, r.number, cell.col, host, name);
+						else if (f && hasFormulaText(f)) {
+							const text = f.text ?? "";
+							if (f.kind === "shared" && f.sharedIndex !== null && f.ref !== null) {
+								masters.set(f.sharedIndex, cell.ref);
+								kept.set(cell.ref, text);
+							}
+							value = {
+								formula: text,
+								...result
+							};
+						} else value = cell.richText ? richTextOut(cell.richText) : plain;
+						target.value = value;
 						if (styles) target.style = styleOut(cell.style, cell.numFmt);
 					}
 					for (const cell of r.styledCells) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xlvane/compat",
-  "version": "1.2.3",
+  "version": "1.3.0",
   "description": "The commonly used exceljs 4.4.0 API on top of xlvane, for switching with one line in package.json.",
   "keywords": [
     "xlsx",
@@ -72,7 +72,7 @@
     "build": "tsdown"
   },
   "dependencies": {
-    "xlvane": "^1.2.3"
+    "xlvane": "^1.3.0"
   },
   "publishConfig": {
     "access": "public",