styled-exceljs 0.21.2 → 0.21.3

package/CHANGELOG.md

@@ -4,6 +4,18 @@ This log is intended to keep track of backwards-incompatible changes, including
 but not limited to API changes and file location changes.  Minor behavioral
 changes may not be included if they are not expected to break existing code.
 
+## v0.21.3
+
+* Store document-controlled worksheet names in own-property-only maps and
+  reject inherited lookups, preventing `__proto__` prototype pollution across
+  XLSX, XLS, XLML, ODS/FODS, Lotus, and workbook write paths
+* Replace high-complexity XML tag stripping and AutoFilter matching with
+  linear-time parsers for untrusted workbook content
+* Escape rich-text runs, HTML attributes, font CSS strings, and links at the
+  HTML output boundary; block unsafe link protocols by default
+* Validate dense worksheet origins before array writes and cover the security
+  boundary with malicious file and HTML-output regression tests
+
 * Sheet Visibility for ODS / FODS (h/t @edemaine)
 * HTML DOM ingress support formulae (`data-f`)
 * Proper handling of XLSX encoded entities (h/t @inreoh)

package/README.md

@@ -39,7 +39,7 @@ npm install styled-exceljs
 ```
 
 This build extends the SheetJS worksheet model for browser-oriented rendering of
-XLSX/XLS workbooks.  The default read path remains lightweight and compatible.
+XLSX/XLS workbooks.  The default read path stays lightweight and compatible.
 Visual metadata is exposed when explicit options are enabled:
 
 ```js
@@ -76,10 +76,10 @@ The following public worksheet fields are populated when requested:
   widths with wrap, overflow, shrink-to-fit, and merge-span handling.
 
 `XLSX.utils.validate_merges(ws, opts)` validates merge ranges and reports
-duplicate, overlapping, invalid, or out-of-bounds ranges.  Passing
-`{WTF:true}` or reading with `{validateMerges:true}` throws on invalid merges.
+duplicate, overlapping, malformed, or out-of-bounds ranges.  Passing
+`{WTF:true}` or reading with `{validateMerges:true}` throws on malformed merges.
 
-See [docs/visual-fidelity.md](docs/visual-fidelity.md) for the full data
+See the [visual fidelity guide](docs/visual-fidelity.md) for the full data
 structure reference and release notes for unsupported fallback behavior.
 
 ## 中文说明
@@ -107,7 +107,7 @@ npm install styled-exceljs
   收缩适应和合并跨度计算最优列宽。
 
 完整中文数据结构、选项说明和渲染行为请参考
-[docs/visual-fidelity.zh-CN.md](docs/visual-fidelity.zh-CN.md)。
+[中文视觉保真指南](docs/visual-fidelity.zh-CN.md)。
 
 ## Constellation
 
@@ -123,7 +123,7 @@ processing library
 - [`codepage`](https://git.sheetjs.com/SheetJS/js-codepage): Legacy text
 encodings for XLS and other legacy spreadsheet formats
 
-- [`dta`](packages/dta): Stata DTA file processor
+- [Stata file processor](packages/dta)
 
 ## License
 

package/bower.json

@@ -1,6 +1,6 @@
 {
   "name": "js-xlsx",
-  "version": "0.21.2",
+  "version": "0.21.3",
   "homepage": "https://github.com/SheetJS/js-xlsx",
   "main": ["xlsx.js"],
   "ignore": [