geckon01/PhpSpreadsheet
1
0
Fork 0
mirror of https://github.com/PHPOffice/PhpSpreadsheet.git synced 2026-09-24 09:09:22 +00:00
Code Issues Packages Projects Releases Wiki Activity
4,653 Commits 21 Branches 147 Tags
eb2ad61ccffa21bdc77481c69403f2bed5b13e5b
Commit Graph

204 Commits

Author SHA1 Message Date
oleibman 3d5637a696 Resync Third Party Packages 2026-07-26 14:01:47 -07:00
oleibman 92b0d98413 Third-Party Security Updates 2026-07-26 13:51:07 -07:00
oleibman 44b8dac2b6 Revert "Security Patch" 
This reverts commit 49d828bbd2.
 2026-05-30 23:09:07 -07:00
oleibman 49d828bbd2 Security Patch 2026-05-30 22:27:49 -07:00
oleibman dfa2b1db80 Changes to WEBSERVICE R210 (#4757) 2025-12-22 22:16:28 -08:00
oleibman 1fdee23756 Update Mpdf (Php8.5 compatibility) r210 (#4593) 2025-08-21 13:42:56 -07:00
oleibman 9300fcab66 Update setasign/fpdi (security) release210 (#4587) 2025-08-19 16:55:55 -07:00
oleibman a3f9ba96bb Update content-hash 2025-02-07 21:43:24 -08:00
oleibman f68f688810 Security Patch Special Characters in Protocol 2025-01-23 22:40:52 -08:00
oleibman 0a3d70c2cc Upgrade mitoteam/jpgraph 2025-01-15 22:47:13 -08:00
oleibman 1840d713e4 Upgrade tcpdf to 6.8.0 2024-12-27 16:20:48 -08:00
oleibman 7327aa0d45 Upgrade Dompdf, Tcpdf, .gitattributes 2024-12-07 22:01:17 -08:00
oleibman 819854a668 Upgrade PhpUnit 
To a version which is aware that Php8.4 deprecates E_STRICT.
 2024-11-14 12:08:33 -08:00
oleibman 4545ecf648 Downgrade Symfony/Process 
A bit messier than expected. Current version of symfony/process (used only in dev) has a security advisory. There is no version that can be upgraded to which supports Php8.0. However, a downgrade to V5 will work.

When running with Php8.4, PhpUnit references E_STRICT, which is deprecated in 8.4. I don't understand why this doesn't happen with release1291. Be that as it may, we can't upgrade Phpunit to V10 because we need to support Php8.0. So, monkey around with tests/bootstrap.php to avoid problems.
 2024-11-12 19:23:20 -08:00
oleibman e64d99a91f Merge branch 'master' into dependabot/composer/phpstan/phpstan-1.10.67 2024-05-01 10:57:17 -07:00
dependabot[bot] f012091c81 Bump phpstan/phpstan from 1.10.66 to 1.10.67 
Bumps [phpstan/phpstan](https://github.com/phpstan/phpstan) from 1.10.66 to 1.10.67.
- [Release notes](https://github.com/phpstan/phpstan/releases)
- [Changelog](https://github.com/phpstan/phpstan/blob/1.11.x/CHANGELOG.md)
- [Commits](https://github.com/phpstan/phpstan/compare/1.10.66...1.10.67)

---
updated-dependencies:
- dependency-name: phpstan/phpstan
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-05-01 17:49:27 +00:00
oleibman 13fe27182c Merge pull request #4012 from PHPOffice/dependabot/composer/tecnickcom/tcpdf-6.7.5 
Bump tecnickcom/tcpdf from 6.7.4 to 6.7.5
 2024-05-01 17:46:44 +00:00
oleibman ae59fe429e Merge pull request #4010 from PHPOffice/dependabot/composer/friendsofphp/php-cs-fixer-3.54.0 
Bump friendsofphp/php-cs-fixer from 3.53.0 to 3.54.0
 2024-05-01 17:45:38 +00:00
oleibman 1eaadb3643 Merge pull request #4009 from PHPOffice/dependabot/composer/squizlabs/php_codesniffer-3.9.2 
Bump squizlabs/php_codesniffer from 3.9.1 to 3.9.2
 2024-05-01 17:45:17 +00:00
dependabot[bot] 0543c1ff8d Bump tecnickcom/tcpdf from 6.7.4 to 6.7.5 
Bumps [tecnickcom/tcpdf](https://github.com/tecnickcom/TCPDF) from 6.7.4 to 6.7.5.
- [Changelog](https://github.com/tecnickcom/TCPDF/blob/main/CHANGELOG.TXT)
- [Commits](https://github.com/tecnickcom/TCPDF/compare/6.7.4...6.7.5)

---
updated-dependencies:
- dependency-name: tecnickcom/tcpdf
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-05-01 11:42:11 +00:00
dependabot[bot] d0198b8720 Bump friendsofphp/php-cs-fixer from 3.53.0 to 3.54.0 
Bumps [friendsofphp/php-cs-fixer](https://github.com/PHP-CS-Fixer/PHP-CS-Fixer) from 3.53.0 to 3.54.0.
- [Release notes](https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/releases)
- [Changelog](https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/blob/master/CHANGELOG.md)
- [Commits](https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/compare/v3.53.0...v3.54.0)

---
updated-dependencies:
- dependency-name: friendsofphp/php-cs-fixer
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-05-01 11:41:59 +00:00
dependabot[bot] f19eac78d6 Bump squizlabs/php_codesniffer from 3.9.1 to 3.9.2 
Bumps [squizlabs/php_codesniffer](https://github.com/PHPCSStandards/PHP_CodeSniffer) from 3.9.1 to 3.9.2.
- [Release notes](https://github.com/PHPCSStandards/PHP_CodeSniffer/releases)
- [Changelog](https://github.com/PHPCSStandards/PHP_CodeSniffer/blob/master/CHANGELOG.md)
- [Commits](https://github.com/PHPCSStandards/PHP_CodeSniffer/compare/3.9.1...3.9.2)

---
updated-dependencies:
- dependency-name: squizlabs/php_codesniffer
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-05-01 11:41:53 +00:00
dependabot[bot] 9167f00278 Bump dompdf/dompdf from 2.0.4 to 2.0.8 
Bumps [dompdf/dompdf](https://github.com/dompdf/dompdf) from 2.0.4 to 2.0.8.
- [Release notes](https://github.com/dompdf/dompdf/releases)
- [Commits](https://github.com/dompdf/dompdf/compare/v2.0.4...v2.0.8)

---
updated-dependencies:
- dependency-name: dompdf/dompdf
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-05-01 11:41:48 +00:00
oleibman b732e55b61 Merge pull request #3984 from PHPOffice/dependabot/composer/friendsofphp/php-cs-fixer-3.53.0 
Bump friendsofphp/php-cs-fixer from 3.51.0 to 3.53.0
 2024-04-15 00:35:54 +00:00
dependabot[bot] 9c502b7d02 Bump friendsofphp/php-cs-fixer from 3.51.0 to 3.53.0 
Bumps [friendsofphp/php-cs-fixer](https://github.com/PHP-CS-Fixer/PHP-CS-Fixer) from 3.51.0 to 3.53.0.
- [Release notes](https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/releases)
- [Changelog](https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/blob/master/CHANGELOG.md)
- [Commits](https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/compare/v3.51.0...v3.53.0)

---
updated-dependencies:
- dependency-name: friendsofphp/php-cs-fixer
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-04-15 00:23:24 +00:00
oleibman a076cfd00b Merge pull request #3970 from PHPOffice/dependabot/composer/squizlabs/php_codesniffer-3.9.1 
Bump squizlabs/php_codesniffer from 3.9.0 to 3.9.1
 2024-04-15 00:20:59 +00:00
oleibman 350162c938 Merge pull request #3971 from PHPOffice/dependabot/composer/mpdf/mpdf-8.2.3 
Bump mpdf/mpdf from 8.2.2 to 8.2.3
 2024-04-15 00:09:57 +00:00
oleibman 5748f3fe62 Merge pull request #3983 from PHPOffice/dependabot/composer/phpunit/phpunit-9.6.19 
Bump phpunit/phpunit from 9.6.17 to 9.6.19
 2024-04-15 00:08:39 +00:00
oleibman 0c0040840d Merge pull request #3966 from PHPOffice/dependabot/composer/phpstan/phpstan-1.10.66 
Bump phpstan/phpstan from 1.10.59 to 1.10.66
 2024-04-15 00:08:09 +00:00
oleibman e401743465 Merge pull request #3967 from PHPOffice/dependabot/composer/tecnickcom/tcpdf-6.7.4 
Bump tecnickcom/tcpdf from 6.6.5 to 6.7.4
 2024-04-14 23:35:38 +00:00
dependabot[bot] 40ccfb9b65 Bump phpunit/phpunit from 9.6.17 to 9.6.19 
Bumps [phpunit/phpunit](https://github.com/sebastianbergmann/phpunit) from 9.6.17 to 9.6.19.
- [Release notes](https://github.com/sebastianbergmann/phpunit/releases)
- [Changelog](https://github.com/sebastianbergmann/phpunit/blob/9.6.19/ChangeLog-9.6.md)
- [Commits](https://github.com/sebastianbergmann/phpunit/compare/9.6.17...9.6.19)

---
updated-dependencies:
- dependency-name: phpunit/phpunit
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-04-14 23:29:32 +00:00
dependabot[bot] 419806484a Bump phpstan/phpstan from 1.10.59 to 1.10.66 
Bumps [phpstan/phpstan](https://github.com/phpstan/phpstan) from 1.10.59 to 1.10.66.
- [Release notes](https://github.com/phpstan/phpstan/releases)
- [Changelog](https://github.com/phpstan/phpstan/blob/1.11.x/CHANGELOG.md)
- [Commits](https://github.com/phpstan/phpstan/compare/1.10.59...1.10.66)

---
updated-dependencies:
- dependency-name: phpstan/phpstan
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-04-14 23:29:25 +00:00
dependabot[bot] 44accfd2d7 Bump mpdf/mpdf from 8.2.2 to 8.2.3 
Bumps [mpdf/mpdf](https://github.com/mpdf/mpdf) from 8.2.2 to 8.2.3.
- [Release notes](https://github.com/mpdf/mpdf/releases)
- [Changelog](https://github.com/mpdf/mpdf/blob/development/CHANGELOG.md)
- [Commits](https://github.com/mpdf/mpdf/compare/v8.2.2...v8.2.3)

---
updated-dependencies:
- dependency-name: mpdf/mpdf
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-04-01 11:35:37 +00:00
dependabot[bot] 377895b965 Bump squizlabs/php_codesniffer from 3.9.0 to 3.9.1 
Bumps [squizlabs/php_codesniffer](https://github.com/PHPCSStandards/PHP_CodeSniffer) from 3.9.0 to 3.9.1.
- [Release notes](https://github.com/PHPCSStandards/PHP_CodeSniffer/releases)
- [Changelog](https://github.com/PHPCSStandards/PHP_CodeSniffer/blob/master/CHANGELOG.md)
- [Commits](https://github.com/PHPCSStandards/PHP_CodeSniffer/compare/3.9.0...3.9.1)

---
updated-dependencies:
- dependency-name: squizlabs/php_codesniffer
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-04-01 11:35:33 +00:00
dependabot[bot] dac6c93295 Bump tecnickcom/tcpdf from 6.6.5 to 6.7.4 
Bumps [tecnickcom/tcpdf](https://github.com/tecnickcom/TCPDF) from 6.6.5 to 6.7.4.
- [Changelog](https://github.com/tecnickcom/TCPDF/blob/main/CHANGELOG.TXT)
- [Commits](https://github.com/tecnickcom/TCPDF/commits/6.7.4)

---
updated-dependencies:
- dependency-name: tecnickcom/tcpdf
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-04-01 11:35:17 +00:00
oleibman 989a4cec54 Html Writer Comments - Breaking Change 
Fix #3954. In response to a Security Incident, a package was added to the project to sanitize the Html for comments attached to a cell. We have tried at least 2 different packages for this purpose, and users have raised legitimate concerns about both.

I believe that adding a sanitizer package, although it addresses the problem, was overkill. Cell comments are a RichText object, and Html Writer already handled RichText cell *values*. Values did not figure in the Incident, and they surely would have done so if they were a problem because it is a lot easier to set up test cases for values than for comments. RichText values were not a problem because they were sanitized with `htmlspecialchars`; if comments were to use the same code that RichText was already using, it would likewise be safely sanitized. As an added bonus, the existing code for comments only uses the plaintext value, but the values code would allow the comments to be styled, just as they are for Xlsx.

This is a breaking change - I don't think it will affect a lot of users, but there may be some. It is worth noting that the comment block before function `writeComment` has a link explaining what is being done. That link mentions only styling elements, not other possibilities like hyperlinks. At any rate, if people are putting styling tags (e.g. `<b>`) in their comments for this purpose, those will no longer work; the styling needs to be applied to the RichText elements. That will keep the user code the same regardless of the format of the intended output, which is certainly a good thing, but it is a break. If people are trying to insert non-styling tage (e.g. `<a>`), those will no longer work, just as there is no way to do it for Xlsx (although Excel itself may convert the raw text to a hyperlink, but that's out of scope, at least for now). I also note that, even with the current code, I haven't yet found a way to keep the Html comment in place long enough to actually click on any hyperlinks.

The main package being dropped brings several other packages along with it, so the project as a whole will have a slightly lighter footprint than before.

The existing `XssVulnerability` test cases are all preserved. Although the final result of the sanitizing changes, it can easily be seen that the results are all harmless.
 2024-03-20 10:57:16 -07:00
oleibman bea48f068c Merge pull request #3929 from PHPOffice/dependabot/composer/squizlabs/php_codesniffer-3.9.0 
Bump squizlabs/php_codesniffer from 3.8.1 to 3.9.0
 2024-03-01 17:08:05 +00:00
oleibman d1378929c2 Merge pull request #3928 from PHPOffice/dependabot/composer/phpstan/phpstan-phpunit-1.3.16 
Bump phpstan/phpstan-phpunit from 1.3.15 to 1.3.16
 2024-03-01 17:07:38 +00:00
oleibman 95b9125206 Merge pull request #3927 from PHPOffice/dependabot/composer/phpstan/phpstan-1.10.59 
Bump phpstan/phpstan from 1.10.57 to 1.10.59
 2024-03-01 17:07:14 +00:00
oleibman 89f996ad95 Merge pull request #3926 from PHPOffice/dependabot/composer/phpunit/phpunit-9.6.17 
Bump phpunit/phpunit from 9.6.16 to 9.6.17
 2024-03-01 17:06:44 +00:00
dependabot[bot] a749480a42 Bump squizlabs/php_codesniffer from 3.8.1 to 3.9.0 
Bumps [squizlabs/php_codesniffer](https://github.com/PHPCSStandards/PHP_CodeSniffer) from 3.8.1 to 3.9.0.
- [Release notes](https://github.com/PHPCSStandards/PHP_CodeSniffer/releases)
- [Changelog](https://github.com/PHPCSStandards/PHP_CodeSniffer/blob/master/CHANGELOG.md)
- [Commits](https://github.com/PHPCSStandards/PHP_CodeSniffer/compare/3.8.1...3.9.0)

---
updated-dependencies:
- dependency-name: squizlabs/php_codesniffer
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-03-01 11:58:44 +00:00
dependabot[bot] e4ff49566e Bump phpstan/phpstan-phpunit from 1.3.15 to 1.3.16 
Bumps [phpstan/phpstan-phpunit](https://github.com/phpstan/phpstan-phpunit) from 1.3.15 to 1.3.16.
- [Release notes](https://github.com/phpstan/phpstan-phpunit/releases)
- [Commits](https://github.com/phpstan/phpstan-phpunit/compare/1.3.15...1.3.16)

---
updated-dependencies:
- dependency-name: phpstan/phpstan-phpunit
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-03-01 11:58:38 +00:00
dependabot[bot] d62172a35d Bump phpstan/phpstan from 1.10.57 to 1.10.59 
Bumps [phpstan/phpstan](https://github.com/phpstan/phpstan) from 1.10.57 to 1.10.59.
- [Release notes](https://github.com/phpstan/phpstan/releases)
- [Changelog](https://github.com/phpstan/phpstan/blob/1.11.x/CHANGELOG.md)
- [Commits](https://github.com/phpstan/phpstan/compare/1.10.57...1.10.59)

---
updated-dependencies:
- dependency-name: phpstan/phpstan
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-03-01 11:58:33 +00:00
dependabot[bot] 35c6111a23 Bump phpunit/phpunit from 9.6.16 to 9.6.17 
Bumps [phpunit/phpunit](https://github.com/sebastianbergmann/phpunit) from 9.6.16 to 9.6.17.
- [Changelog](https://github.com/sebastianbergmann/phpunit/blob/9.6.17/ChangeLog-9.6.md)
- [Commits](https://github.com/sebastianbergmann/phpunit/compare/9.6.16...9.6.17)

---
updated-dependencies:
- dependency-name: phpunit/phpunit
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-03-01 11:58:22 +00:00
dependabot[bot] ee1fd8b9aa Bump friendsofphp/php-cs-fixer from 3.48.0 to 3.51.0 
Bumps [friendsofphp/php-cs-fixer](https://github.com/PHP-CS-Fixer/PHP-CS-Fixer) from 3.48.0 to 3.51.0.
- [Release notes](https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/releases)
- [Changelog](https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/blob/master/CHANGELOG.md)
- [Commits](https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/compare/v3.48.0...v3.51.0)

---
updated-dependencies:
- dependency-name: friendsofphp/php-cs-fixer
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-03-01 11:58:14 +00:00
dependabot[bot] d0895c65de Bump phenx/php-svg-lib from 0.5.1 to 0.5.2 
Bumps [phenx/php-svg-lib](https://github.com/PhenX/php-svg-lib) from 0.5.1 to 0.5.2.
- [Release notes](https://github.com/PhenX/php-svg-lib/releases)
- [Commits](https://github.com/PhenX/php-svg-lib/compare/0.5.1...0.5.2)

---
updated-dependencies:
- dependency-name: phenx/php-svg-lib
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-02-21 18:29:46 +00:00
oleibman 84cc3b560f Php-cs-fixer Changes 
Its latest update added some new stringencies, resulting in 62 messages. Used `composer fix` to take care of them.
 2024-02-01 11:26:22 -08:00
oleibman d93c07bf67 Merge pull request #3885 from PHPOffice/dependabot/composer/phpstan/phpstan-1.10.57 
Bump phpstan/phpstan from 1.10.50 to 1.10.57
 2024-02-01 17:27:45 +00:00
oleibman 847f39f009 Merge pull request #3884 from PHPOffice/dependabot/composer/phpunit/phpunit-9.6.16 
Bump phpunit/phpunit from 9.6.15 to 9.6.16
 2024-02-01 17:12:01 +00:00
oleibman f6ac28d838 Merge pull request #3886 from PHPOffice/dependabot/composer/squizlabs/php_codesniffer-3.8.1 
Bump squizlabs/php_codesniffer from 3.8.0 to 3.8.1
 2024-02-01 17:11:19 +00:00