styled-exceljs 0.21.1 → 0.21.3

package/CHANGELOG.md

@@ -4,11 +4,35 @@ This log is intended to keep track of backwards-incompatible changes, including
 but not limited to API changes and file location changes.  Minor behavioral
 changes may not be included if they are not expected to break existing code.
 
+## v0.21.3
+
+* Store document-controlled worksheet names in own-property-only maps and
+  reject inherited lookups, preventing `__proto__` prototype pollution across
+  XLSX, XLS, XLML, ODS/FODS, Lotus, and workbook write paths
+* Replace high-complexity XML tag stripping and AutoFilter matching with
+  linear-time parsers for untrusted workbook content
+* Escape rich-text runs, HTML attributes, font CSS strings, and links at the
+  HTML output boundary; block unsafe link protocols by default
+* Validate dense worksheet origins before array writes and cover the security
+  boundary with malicious file and HTML-output regression tests
+
 * Sheet Visibility for ODS / FODS (h/t @edemaine)
 * HTML DOM ingress support formulae (`data-f`)
 * Proper handling of XLSX encoded entities (h/t @inreoh)
 * Proper handling of invalid DIF sheets that match heuristics (h/t @lowkeyfish)
 
+## v0.21.2
+
+* Preserve TIFF drawing MIME metadata for XLSX images so browser renderers can
+  select an explicit decoder instead of receiving `application/octet-stream`
+* Keep workbook column-width measurement stable across sheets and tolerate
+  missing Numbers format tables
+
+中文摘要：
+
+* XLSX 中的 TIFF 图片现在会保留 `image/tiff` 类型，便于浏览器渲染器按需解码
+* 稳定多工作表列宽测量，并容错缺失的 Numbers 格式表
+
 ## v0.21.1
 
 * Added browser-aware text measurement and `XLSX.utils.auto_fit_columns` for

package/README.md

@@ -1,5 +1,16 @@
 # [SheetJS](https://sheetjs.com)
 
+## Fork Notice
+
+`styled-exceljs` is a fork of the original SheetJS Community Edition source
+code.  This fork keeps the SheetJS-compatible workbook and worksheet model, then
+adds browser-oriented visual fidelity extensions for styles, dimensions,
+drawings, charts, merge validation, and HTML rendering.
+
+中文说明：`styled-exceljs` 基于 SheetJS Community Edition 原始代码 fork
+并继续增强，保持 SheetJS 兼容的数据模型，同时扩展样式、行列尺寸、图片绘图、
+图表、合并校验和浏览器 HTML 渲染能力。
+
 The SheetJS Community Edition offers battle-tested open-source solutions for
 extracting useful data from almost any complex spreadsheet and generating new
 spreadsheets that will work with legacy and modern software alike.
@@ -28,7 +39,7 @@ npm install styled-exceljs
 ```
 
 This build extends the SheetJS worksheet model for browser-oriented rendering of
-XLSX/XLS workbooks.  The default read path remains lightweight and compatible.
+XLSX/XLS workbooks.  The default read path stays lightweight and compatible.
 Visual metadata is exposed when explicit options are enabled:
 
 ```js
@@ -65,10 +76,10 @@ The following public worksheet fields are populated when requested:
   widths with wrap, overflow, shrink-to-fit, and merge-span handling.
 
 `XLSX.utils.validate_merges(ws, opts)` validates merge ranges and reports
-duplicate, overlapping, invalid, or out-of-bounds ranges.  Passing
-`{WTF:true}` or reading with `{validateMerges:true}` throws on invalid merges.
+duplicate, overlapping, malformed, or out-of-bounds ranges.  Passing
+`{WTF:true}` or reading with `{validateMerges:true}` throws on malformed merges.
 
-See [docs/visual-fidelity.md](docs/visual-fidelity.md) for the full data
+See the [visual fidelity guide](docs/visual-fidelity.md) for the full data
 structure reference and release notes for unsupported fallback behavior.
 
 ## 中文说明
@@ -96,7 +107,7 @@ npm install styled-exceljs
   收缩适应和合并跨度计算最优列宽。
 
 完整中文数据结构、选项说明和渲染行为请参考
-[docs/visual-fidelity.zh-CN.md](docs/visual-fidelity.zh-CN.md)。
+[中文视觉保真指南](docs/visual-fidelity.zh-CN.md)。
 
 ## Constellation
 
@@ -112,7 +123,7 @@ processing library
 - [`codepage`](https://git.sheetjs.com/SheetJS/js-codepage): Legacy text
 encodings for XLS and other legacy spreadsheet formats
 
-- [`dta`](packages/dta): Stata DTA file processor
+- [Stata file processor](packages/dta)
 
 ## License
 

package/bower.json

@@ -1,6 +1,6 @@
 {
   "name": "js-xlsx",
-  "version": "0.21.1",
+  "version": "0.21.3",
   "homepage": "https://github.com/SheetJS/js-xlsx",
   "main": ["xlsx.js"],
   "ignore": [