[Security] Bump phpoffice/phpspreadsheet from 1.15.0 to 1.18.0

[dependabot-preview]

Bumps phpoffice/phpspreadsheet from 1.15.0 to 1.18.0. This update includes security fixes.

Vulnerabilities fixed

Sourced from The GitHub Security Advisory Database.

"Cross-site scripting in phpoffice/phpspreadsheet" "This affects the package phpoffice/phpspreadsheet. The library is vulnerable to XSS when creating an html output from an excel file by adding a comment on any cell. The root cause of this issue is within the HTML writer where user comments are concatenated as part of link and this is returned as HTML."

Affected versions: < 1.16.0

Sourced from The PHP Security Advisories Database.

XSS Vulnerability in HTML Writer

Affected versions: <1.16.0

Release notes

Sourced from phpoffice/phpspreadsheet's releases.

1.18.0

• Enhancements to CSV Reader, allowing options to be set when using IOFactory::load() with a callback to set delimiter, enclosure, charset etc. [PR #2103](PHPOffice/PhpSpreadsheet#2103) - See documentation for details.

• Implemented basic AutoFiltering for Ods Reader and Writer [PR #2053](PHPOffice/PhpSpreadsheet#2053)

• Implemented basic AutoFiltering for Gnumeric Reader [PR #2055](PHPOffice/PhpSpreadsheet#2055)

• Improved support for Row and Column ranges in formulae [Issue #1755](PHPOffice/PhpSpreadsheet#1755) [PR #2028](PHPOffice/PhpSpreadsheet#2028)

• Implemented URLENCODE() Web Function

• Implemented the CHITEST(), CHISQ.DIST() and CHISQ.INV() and equivalent Statistical functions, for both left- and right-tailed distributions.

• Support for ActiveSheet and SelectedCells in the ODS Reader and Writer. [PR #1908](PHPOffice/PhpSpreadsheet#1908)

• Support for notContainsText Conditional Style in xlsx [Issue #984](PHPOffice/PhpSpreadsheet#984)

• Use of nb rather than no as the locale code for Norsk Bokmål.

• All Excel Function implementations in Calculation\Database, Calculation\DateTime, Calculation\Engineering, Calculation\Financial, Calculation\Logical, Calculation\LookupRef, Calculation\MathTrig, Calculation\Statistical, Calculation\TextData and Calculation\Web have been moved to dedicated classes for individual functions or groups of related functions. See the docblocks against all the deprecated methods for details of the new methods to call instead. At some point, these old classes will be deleted.

• Use of nb rather than no as the locale language code for Norsk Bokmål.

• Fixed error in COUPNCD() calculation for end of month [Issue #2116](PHPOffice/PhpSpreadsheet#2116) - [PR #2119](PHPOffice/PhpSpreadsheet#2119)

• Resolve default values when a null argument is passed for HLOOKUP(), VLOOKUP() and ADDRESS() functions [Issue #2120](PHPOffice/PhpSpreadsheet#2120) - [PR #2121](PHPOffice/PhpSpreadsheet#2121)

• Fixed incorrect R1C1 to A1 subtraction formula conversion (R[-2]C-R[2]C) [Issue #2076](PHPOffice/PhpSpreadsheet#2076) [PR #2086](PHPOffice/PhpSpreadsheet#2086)

• Correctly handle absolute A1 references when converting to R1C1 format [PR #2060](PHPOffice/PhpSpreadsheet#2060)

• Correct default fill style for conditional without a pattern defined [Issue #2035](PHPOffice/PhpSpreadsheet#2035) [PR #2050](PHPOffice/PhpSpreadsheet#2050)

• Fixed issue where array key check for existince before accessing arrays in Xlsx.php. [PR #1970](PHPOffice/PhpSpreadsheet#1970)

• Fixed issue with quoted strings in number format mask rendered with toFormattedString() Issue 1972# [PR #1978](PHPOffice/PhpSpreadsheet#1978)

• Fixed issue with percentage formats in number format mask rendered with toFormattedString() Issue 1929# [PR #1928](PHPOffice/PhpSpreadsheet#1928)

• Fixed issue with _ spacing character in number format mask corrupting output from toFormattedString() Issue 1924# [PR #1927](PHPOffice/PhpSpreadsheet#1927)

• Fix for [Issue #1887](PHPOffice/PhpSpreadsheet#1887) - Lose Track of Selected Cells After Save

• Fixed issue with Xlsx@listWorksheetInfo not returning any data

• Fixed invalid arguments triggering mb_substr() error in LEFT(), MID() and RIGHT() text functions. [Issue #640](PHPOffice/PhpSpreadsheet#640)

• Fix for [Issue #1916](PHPOffice/PhpSpreadsheet#1916) - Invalid signature check for XML files

• Fix change in Font::setSize() behavior for PHP8. [PR #2100](PHPOffice/PhpSpreadsheet#2100)

1.17.1

• Implementation of the Excel AVERAGEIFS() functions as part of a restructuring of Database functions and Conditional Statistical functions.

• Support for date values and percentages in query parameters for Database functions, and the IF expressions in functions like COUNTIF() and AVERAGEIF(). #1875

• Support for booleans, and for wildcard text search in query parameters for Database functions, and the IF expressions in functions like COUNTIF() and AVERAGEIF(). #1876

• Implemented DataBar for conditional formatting in Xlsx, providing read/write and creation of (type, value, direction, fills, border, axis position, color settings) as DataBar options in Excel. #1754

• Alignment for ODS Writer #1796

• Basic implementation of the PERMUTATIONA() Statistical Function

• Formula functions that previously called PHP functions directly are now processed through the Excel Functions classes; resolving issues with PHP8 stricter typing. #1789

  The following MathTrig functions are affected: ABS(), ACOS(), ACOSH(), ASIN(), ASINH(), ATAN(), ATANH(), COS(), COSH(), DEGREES() (rad2deg), EXP(), LN() (log), LOG10(), RADIANS() (deg2rad), SIN(), SINH(), SQRT(), TAN(), TANH().

  One TextData function is also affected: REPT() (str_repeat).

• formatAsDate correctly matches language metadata, reverting c55272e

• Formulae that previously crashed on sub function call returning excel error value now return said value. The following functions are affected CUMPRINC(), CUMIPMT(), AMORLINC(),

... (truncated)

Changelog

Sourced from phpoffice/phpspreadsheet's changelog.

1.18.0 - 2021-05-31

Added

• Enhancements to CSV Reader, allowing options to be set when using IOFactory::load() with a callback to set delimiter, enclosure, charset etc. [PR #2103](PHPOffice/PhpSpreadsheet#2103) - See documentation for details.
• Implemented basic AutoFiltering for Ods Reader and Writer [PR #2053](PHPOffice/PhpSpreadsheet#2053)
• Implemented basic AutoFiltering for Gnumeric Reader [PR #2055](PHPOffice/PhpSpreadsheet#2055)
• Improved support for Row and Column ranges in formulae [Issue #1755](PHPOffice/PhpSpreadsheet#1755) [PR #2028](PHPOffice/PhpSpreadsheet#2028)
• Implemented URLENCODE() Web Function
• Implemented the CHITEST(), CHISQ.DIST() and CHISQ.INV() and equivalent Statistical functions, for both left- and right-tailed distributions.
• Support for ActiveSheet and SelectedCells in the ODS Reader and Writer. [PR #1908](PHPOffice/PhpSpreadsheet#1908)
• Support for notContainsText Conditional Style in xlsx [Issue #984](PHPOffice/PhpSpreadsheet#984)

Changed

• Use of nb rather than no as the locale code for Norsk Bokmål.

Deprecated

• All Excel Function implementations in Calculation\Database, Calculation\DateTime, Calculation\Engineering, Calculation\Financial, Calculation\Logical, Calculation\LookupRef, Calculation\MathTrig, Calculation\Statistical, Calculation\TextData and Calculation\Web have been moved to dedicated classes for individual functions or groups of related functions. See the docblocks against all the deprecated methods for details of the new methods to call instead. At some point, these old classes will be deleted.

Removed

• Use of nb rather than no as the locale language code for Norsk Bokmål.

Fixed

• Fixed error in COUPNCD() calculation for end of month [Issue #2116](PHPOffice/PhpSpreadsheet#2116) - [PR #2119](PHPOffice/PhpSpreadsheet#2119)
• Resolve default values when a null argument is passed for HLOOKUP(), VLOOKUP() and ADDRESS() functions [Issue #2120](PHPOffice/PhpSpreadsheet#2120) - [PR #2121](PHPOffice/PhpSpreadsheet#2121)
• Fixed incorrect R1C1 to A1 subtraction formula conversion (R[-2]C-R[2]C) [Issue #2076](PHPOffice/PhpSpreadsheet#2076) [PR #2086](PHPOffice/PhpSpreadsheet#2086)
• Correctly handle absolute A1 references when converting to R1C1 format [PR #2060](PHPOffice/PhpSpreadsheet#2060)
• Correct default fill style for conditional without a pattern defined [Issue #2035](PHPOffice/PhpSpreadsheet#2035) [PR #2050](PHPOffice/PhpSpreadsheet#2050)
• Fixed issue where array key check for existince before accessing arrays in Xlsx.php. [PR #1970](PHPOffice/PhpSpreadsheet#1970)
• Fixed issue with quoted strings in number format mask rendered with toFormattedString() Issue 1972# [PR #1978](PHPOffice/PhpSpreadsheet#1978)
• Fixed issue with percentage formats in number format mask rendered with toFormattedString() Issue 1929# [PR #1928](PHPOffice/PhpSpreadsheet#1928)
• Fixed issue with _ spacing character in number format mask corrupting output from toFormattedString() Issue 1924# [PR #1927](PHPOffice/PhpSpreadsheet#1927)
• Fix for [Issue #1887](PHPOffice/PhpSpreadsheet#1887) - Lose Track of Selected Cells After Save
• Fixed issue with Xlsx@listWorksheetInfo not returning any data
• Fixed invalid arguments triggering mb_substr() error in LEFT(), MID() and RIGHT() text functions. [Issue #640](PHPOffice/PhpSpreadsheet#640)
• Fix for [Issue #1916](PHPOffice/PhpSpreadsheet#1916) - Invalid signature check for XML files
• Fix change in Font::setSize() behavior for PHP8. [PR #2100](PHPOffice/PhpSpreadsheet#2100)

1.17.1 - 2021-03-01

Added

• Implementation of the Excel AVERAGEIFS() functions as part of a restructuring of Database functions and Conditional Statistical functions.
• Support for date values and percentages in query parameters for Database functions, and the IF expressions in functions like COUNTIF() and AVERAGEIF(). #1875
• Support for booleans, and for wildcard text search in query parameters for Database functions, and the IF expressions in functions like COUNTIF() and AVERAGEIF(). #1876
• Implemented DataBar for conditional formatting in Xlsx, providing read/write and creation of (type, value, direction, fills, border, axis position, color settings) as DataBar options in Excel. #1754
• Alignment for ODS Writer #1796
• Basic implementation of the PERMUTATIONA() Statistical Function

... (truncated)

Commits

• 418cd30 Update changelog for release
• 3168cbf Select the correct TestCase
• d51e4ec phpstan appeasement
• 5336299 Additional unit tests to confirm behaviour when formulae reference cells with...
• 59aae87 Update change log
• eccfecd Reader XML Properties - Eliminate strtotime (#2134)
• e1cb997 Gnumeric Reader - Distinguish Created and Modified Timestamps (#2133)
• e53a2b2 Document Properties - Coverage and 32-bit-safe Timestamps (#2113)
• b533f43 Improve Coverage for HashTable, Fix Clone
• 781b247 Documentation updates (#2131)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)