)]}' { "log": [ { "commit": "dbb9c4c34e984623e34745add332c1192dc8b1b4", "tree": "7d04eb2e35904a3a1360ad095a1a760d27f0dac0", "parents": [ "ca95db92e50bc45914c38cd9dd5c93e5fd21c297" ], "author": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Thu Oct 29 07:25:46 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 29 07:25:46 2026 +0000" }, "message": "FileSharingRecord: support UTF-16LE user names (bug 70292) (#1505)\n\nThe user name in FILESHARING is an XLUnicodeString, but POI ignored the\nfHighByte flag and always read/wrote 8-bit characters. Write-protected\n.xls files saved by Excel with a non-latin user name failed to open with\na LeftoverDataException, and writeProtectWorkbook() wrote broken records\nfor such names.\n\nBased on the patch by JEONGHO attached to bug 70292, reworked to use the\nexisting StringUtil helpers and with the sample file added as a test.\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "ca95db92e50bc45914c38cd9dd5c93e5fd21c297", "tree": "47b8b6f80a1b111078ee5394a68e664352b55b58", "parents": [ "a4f27cd4c9f35b197048d23f1ed4dfe2ab79051a" ], "author": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Wed Oct 28 22:31:37 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 28 22:31:37 2026 +0000" }, "message": "Add missing @Test annotation to TestRangeReplacement.testOpen (#1502)\n\nAdd missing @Test annotations to TestSheetText and TestRangeReplacement\n\ntestSheetTwo, testWithShortTextPropData and testOpen date from JUnit 3, where\nthe test prefix was enough, and have not run since the move to annotations.\ntestOpen now also closes the document it opens.\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "a4f27cd4c9f35b197048d23f1ed4dfe2ab79051a", "tree": "ec78cd681e7c477298a3dbba504a936f833b172c", "parents": [ "bc8ac695782ed81d97438d508e1386b342456110" ], "author": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Wed Oct 28 21:32:53 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 28 21:32:53 2026 +0000" }, "message": "RelationshipTransformService: remove the content of signed Relationship elements (#1503)\n\nThe relationships transform digests Relationship elements without their\ncontent, as .NET\u0027s System.IO.Packaging does by writing them as empty\nelements. A pretty-printed \u003cRelationship ...\u003e\\r\\n\u003c/Relationship\u003e no longer\nbreaks the signature - the CR/LF stripping removed in #1498 used to hide\nthis case. Also simplify the OOXMLURIDereferencer part stream handling.\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "bc8ac695782ed81d97438d508e1386b342456110", "tree": "1f4e24e21f7033beed3c4e19466ec7e4c057e286", "parents": [ "9cc871645fd834a8725cbf385d7b12e176d628a0" ], "author": { "name": "Sharang Gupta", "email": "sharang@sharanggupta.dev", "time": "Wed Oct 28 21:26:05 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 28 21:26:05 2026 +0000" }, "message": "TestSheetText: run two tests that were missing @Test (#1501)\n\ntestSheetTwo and testWithShortTextPropData lost their run when the class stopped extending TestCase in 16ac6b107e. That commit switched the expected paragraph separators of the other tests from \\n to \\r; do the same for testWithShortTextPropData." }, { "commit": "9cc871645fd834a8725cbf385d7b12e176d628a0", "tree": "8ef6de38b0ad8c078387509674f1ef3f9cf49014", "parents": [ "a400d35eecdbe22b3cab4b6698fa88bc9a8b53b9" ], "author": { "name": "Nayyar", "email": "nayyar@bugqore.com", "time": "Thu Oct 29 01:13:17 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 28 19:43:17 2026 +0000" }, "message": "OOXMLURIDereferencer: don\u0027t strip line breaks from signed .rels parts (#1498)\n\ndon\u0027t strip line breaks from signed .rels parts\n\nOOXMLURIDereferencer removed every CR and LF byte from .rels parts\nbefore the relationship transform digested them, while the package\nreads a line break inside an attribute value as a space. A line feed\nappended to a signed relationship\u0027s Target therefore left the digest\nunchanged but made the package resolve another part, e.g.\n/word/document.xml%20, with the signature still valid.\n\nThe relationship transform already drops the whitespace between\nrelationships, which the workaround was for, so pass .rels parts\nunchanged." }, { "commit": "a400d35eecdbe22b3cab4b6698fa88bc9a8b53b9", "tree": "dfd990b2cdc8ca51806f5de9f53cc83f2765c011", "parents": [ "07f1631dd66f647aacf2f43e3f408fe033aac4d0" ], "author": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Wed Oct 28 19:38:25 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 28 19:38:25 2026 +0000" }, "message": "RLEDecompressingInputStream: recover from bad chunks more consistently (#1497)\n\n* RLEDecompressingInputStream: recover from bad chunks more consistently\n\nFollow-up to #1496.\n\n- VBAMacroReader: a module whose stream was read before its dir stream now\n falls back to the brute-force search when the dir offset is bad, as the\n other read order already did. A dir stream that fails to decompress is\n reported as an IOException with the record id, like other dir errors.\n- A chunk that fails to decode leaves the stream at its end instead of\n leaving bytes from the previous chunk to be read.\n- Input that ends inside a literal or copy token keeps the bytes already\n decompressed in that chunk, as input that ends at a flag byte does.\n- Uncompressed chunks must hold exactly 4096 bytes, per MS-OVBA.\n- Tests: cover reading past an empty chunk, compare the 4096-byte chunk in\n one assertion.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* TestRLEDecompressingInputStream: drop forbidden InputStream.available() call\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* TestRLEDecompressingInputStream: check available() after a failed chunk under @SuppressForbidden\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n---------\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "07f1631dd66f647aacf2f43e3f408fe033aac4d0", "tree": "2b7a61494496dc15a5729532a4622fb0a6932d0a", "parents": [ "88f4ea377194f67375a9f0deb9451ab431a6e072" ], "author": { "name": "Nayyar", "email": "nayyar@bugqore.com", "time": "Tue Oct 27 23:37:23 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 27 18:07:23 2026 +0000" }, "message": "RLEDecompressingInputStream: bound copy tokens to the chunk buffer (#1496)" }, { "commit": "88f4ea377194f67375a9f0deb9451ab431a6e072", "tree": "84b009884c929af08f3e542b9124a8cb29d1ba9c", "parents": [ "d51c386d706c93f2038cb4cae83be6900cb5d069" ], "author": { "name": "Dominik Stadler", "email": "dominik.stadler@gmx.at", "time": "Tue Oct 27 14:59:54 2026 +0100" }, "committer": { "name": "Dominik Stadler", "email": "dominik.stadler@gmx.at", "time": "Tue Oct 27 16:34:19 2026 +0100" }, "message": "Fuzzing: Adjust fuzzAll.sh to print out which fuzzer failed\n" }, { "commit": "d51c386d706c93f2038cb4cae83be6900cb5d069", "tree": "fdd1a99f486bc433f79c3c9101c361101011e7a7", "parents": [ "ae0af25dedd0c75758c793518d03759230dda504" ], "author": { "name": "Dominik Stadler", "email": "dominik.stadler@gmx.at", "time": "Tue Oct 27 10:57:11 2026 +0100" }, "committer": { "name": "Dominik Stadler", "email": "dominik.stadler@gmx.at", "time": "Tue Oct 27 16:34:19 2026 +0100" }, "message": "Avoid more NPEs and ClassCastExceptions in CellFormat\n" }, { "commit": "ae0af25dedd0c75758c793518d03759230dda504", "tree": "93bc6d74b437c4cb6b57f0358a4673bc6bfb8b5d", "parents": [ "cfc8f6d2619292fa4fa58292aba0153801b2c5b3" ], "author": { "name": "Dominik Stadler", "email": "dominik.stadler@gmx.at", "time": "Tue Oct 27 14:02:01 2026 +0100" }, "committer": { "name": "Dominik Stadler", "email": "dominik.stadler@gmx.at", "time": "Tue Oct 27 14:49:34 2026 +0100" }, "message": "Update JaCoCo to 0.8.16\n" }, { "commit": "cfc8f6d2619292fa4fa58292aba0153801b2c5b3", "tree": "3ca7293103bddc6ba8f835f79995c2da79b68954", "parents": [ "49225f20a85809fa782f247240cb96aa97323ba6" ], "author": { "name": "Dominik Stadler", "email": "centic@apache.org", "time": "Mon Oct 26 10:16:42 2026 +0100" }, "committer": { "name": "Dominik Stadler", "email": "dominik.stadler@gmx.at", "time": "Tue Oct 27 08:37:47 2026 +0100" }, "message": "Fuzzing: Remove double testing of write()\n\nShould be fully covered by the separate fuzzers already\n" }, { "commit": "49225f20a85809fa782f247240cb96aa97323ba6", "tree": "7488ed369f084fc113e0dfcf93666452e932ade0", "parents": [ "396f4461a712b51dd4074bb9a622d6cd0154b499" ], "author": { "name": "Dominik Stadler", "email": "centic@apache.org", "time": "Mon Oct 26 09:43:38 2026 +0100" }, "committer": { "name": "Dominik Stadler", "email": "dominik.stadler@gmx.at", "time": "Tue Oct 27 08:37:47 2026 +0100" }, "message": "Fuzzing: Make it possible to compute coverage of fuzzing\n\nThe script records coverage of all files currently\nin the corpus-directories.\n\nThis allows to check which areas of the code are\nwell-covered already and which one could use a\ndedicated fuzz-target.\n" }, { "commit": "396f4461a712b51dd4074bb9a622d6cd0154b499", "tree": "974bee2b65fb0c06d088229c0bba9e43c9de6011", "parents": [ "72047248ad86c5edebdfb1ccca2ea44283101873" ], "author": { "name": "Dominik Stadler", "email": "centic@apache.org", "time": "Mon Oct 26 09:07:12 2026 +0100" }, "committer": { "name": "Dominik Stadler", "email": "dominik.stadler@gmx.at", "time": "Tue Oct 27 08:37:47 2026 +0100" }, "message": "Add fuzzing for CellFormat and enable dictionaries\n" }, { "commit": "72047248ad86c5edebdfb1ccca2ea44283101873", "tree": "e09b901733d860b2e7e2b4eee1f364640a409217", "parents": [ "03d1ec16705a7ae5d7c98702a351f7dfea195a37" ], "author": { "name": "Dominik Stadler", "email": "centic@apache.org", "time": "Mon Oct 26 08:25:58 2026 +0100" }, "committer": { "name": "Dominik Stadler", "email": "dominik.stadler@gmx.at", "time": "Tue Oct 27 08:37:47 2026 +0100" }, "message": "Fix issues in CellFormat found by fuzzing\n\nAvoid NPEs and ClassCastExceptions on\ninvalid cell format\n\nFixes https://issues.oss-fuzz.com/issues/577661384\n" }, { "commit": "03d1ec16705a7ae5d7c98702a351f7dfea195a37", "tree": "1d07f41655cb963f8368ef9de3a0aee272f2897b", "parents": [ "019321c93ced3281747a8f2f3c5dfc75c1dc1c93" ], "author": { "name": "Dominik Stadler", "email": "centic@apache.org", "time": "Sun Oct 25 21:17:56 2026 +0100" }, "committer": { "name": "Dominik Stadler", "email": "dominik.stadler@gmx.at", "time": "Tue Oct 27 08:37:47 2026 +0100" }, "message": "Replace assertions with logs\n\nFixes https://issues.oss-fuzz.com/issues/577667825\n" }, { "commit": "019321c93ced3281747a8f2f3c5dfc75c1dc1c93", "tree": "f67f8c6a4ae25e2ce6dc8eb372706866d680e88a", "parents": [ "206f100e84b62ca706493feb66c5d9706b9ba9f4" ], "author": { "name": "Dominik Stadler", "email": "centic@apache.org", "time": "Sun Oct 25 19:53:16 2026 +0100" }, "committer": { "name": "Dominik Stadler", "email": "dominik.stadler@gmx.at", "time": "Tue Oct 27 08:37:47 2026 +0100" }, "message": "Avoid stackoverflow on formula with many nested names and ranges\n\nFixes https://issues.oss-fuzz.com/issues/491506839\n" }, { "commit": "206f100e84b62ca706493feb66c5d9706b9ba9f4", "tree": "1c56ae3247a7f4080ac374e71eebe41d0f048b81", "parents": [ "14fa73c18b859bf1b920f7c156913bde7ed259e4" ], "author": { "name": "Dominik Stadler", "email": "centic@apache.org", "time": "Sun Oct 25 11:31:02 2026 +0100" }, "committer": { "name": "Dominik Stadler", "email": "dominik.stadler@gmx.at", "time": "Tue Oct 27 08:37:47 2026 +0100" }, "message": "Disable test which performs the same as TestAllFiles\n\nThis is used for local testing and should not run\nthe same tests as TestAllFiles does anyway\n" }, { "commit": "14fa73c18b859bf1b920f7c156913bde7ed259e4", "tree": "d5809d4f82bb17f771d992e84780060d7522ed41", "parents": [ "9e2f58b411e8befcaba42786e9c736e70870e280" ], "author": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Mon Oct 26 20:17:24 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 26 20:17:24 2026 +0000" }, "message": "CellFormat: allow an improper fraction\u0027s numerator up to an unsigned 32-bit int (#1494)\n\nExcel stops working out an improper fraction before its numerator exceeds\nan unsigned 32-bit int: \u003dTEXT(300000.707106781, \"?????????/?????????\") is\n2435705741/8119. POI stopped at the int limit instead and gave\n1008902378/3363. The fraction is now worked out for the part after the\nwhole number, with the improper numerator capped at 2^32 - 1.\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "9e2f58b411e8befcaba42786e9c736e70870e280", "tree": "ab7c5678704f1216fd0426f7a0be63285675258f", "parents": [ "608242b08f43bd7a1d069d41aa12fe5a6b1f4b84" ], "author": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Mon Oct 26 19:38:45 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 26 19:38:45 2026 +0000" }, "message": "OPC: replaced zip parts forward to their memory part; XSLF picture checksum tracks part writes (#1491)\n\n* OPC: replaced zip parts forward to their memory part, add modification count\n\nWriting to a ZipPackagePart replaces it in the package with a new\nMemoryPackagePart, but POIXMLDocumentParts keep a reference to the zip\npart. Reads through that reference returned the original zip entry, so\ne.g. XSLFPictureData.setData on a loaded slideshow was not visible through\ngetData() and findPictureData missed the new bytes.\n\nThe replaced ZipPackagePart now forwards reads, writes, size and clear()\nto the part that replaced it. PackagePart.getModificationCount is\nincremented each time an output stream is obtained; XSLFPictureData uses\nit to drop its cached checksum and dimensions when the part is written to\noutside of setData. setData now clears the part first, as in-memory\nparts append to their existing content.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* XSLFPictureData.hasData: drop a stale cached checksum too\n\nhasData (from #1490) reads the cached checksum directly, so it needs the\nsame modification-count check as cacheProperties.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n---------\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "608242b08f43bd7a1d069d41aa12fe5a6b1f4b84", "tree": "935bd64a9a1eb344a1ff63d7abec3881d41a9593", "parents": [ "ecfa4e668e5d62523c6cd9c10e1564708f68c75e" ], "author": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Mon Oct 26 19:38:27 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 26 19:38:27 2026 +0000" }, "message": "TestCellFormat: pin Excel\u0027s results for improper fractions near int overflow (#1493)\n\nChecked against Excel\u0027s \u003dTEXT(value, \"?????????/?????????\"). POI matches\nfor 2500.123456789 and 2100000000.12345; the 300000.707106781 case, where\nPOI stops at a smaller denominator than Excel, is added as a disabled test.\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "ecfa4e668e5d62523c6cd9c10e1564708f68c75e", "tree": "ef3645f1f48becfdba93042ab4730a2138266c5d", "parents": [ "224662681f4ed320e4853741a649d37199334b27" ], "author": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Mon Oct 26 18:25:08 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 26 18:25:08 2026 +0000" }, "message": "XSLF findPictureData: read each picture part at most once (#1490)\n\nFollow-up to #1486. When a picture\u0027s checksum was not cached yet,\ngetChecksum() read the part to compute it and the byte compare then read\nit a second time. XSLFPictureData.hasData now computes the CRC from the\nbytes it already read, and no longer parses the image header just to get\nthe checksum.\n\nThe collision test also checks that real duplicates are still reused past\na colliding entry, and that lookups work on a reloaded deck where no\nchecksum is cached.\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "224662681f4ed320e4853741a649d37199334b27", "tree": "ad783a6fbd2d73770d6ea9d1ec0bcd18cd71d20b", "parents": [ "09fc6db0ccbb4d4be2c62b7c1e8c198edb7f4839" ], "author": { "name": "Nayyar", "email": "nayyar@bugqore.com", "time": "Mon Oct 26 23:00:02 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 26 17:30:02 2026 +0000" }, "message": "XMLSlideShow.findPictureData: compare data, not just the CRC32 (#1486)" }, { "commit": "09fc6db0ccbb4d4be2c62b7c1e8c198edb7f4839", "tree": "9d432d376840dcc062356a5893e3633d03444bf5", "parents": [ "5a7b9868601665ec9a2c01d98d689ea6add086a4" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Oct 26 17:19:06 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 26 17:19:06 2026 +0000" }, "message": "Bump net.bytebuddy:byte-buddy from 1.18.15 to 1.18.16 (#1488)\n\nBumps [net.bytebuddy:byte-buddy](https://github.com/raphw/byte-buddy) from 1.18.15 to 1.18.16.\n- [Release notes](https://github.com/raphw/byte-buddy/releases)\n- [Changelog](https://github.com/raphw/byte-buddy/blob/master/release-notes.md)\n- [Commits](https://github.com/raphw/byte-buddy/compare/byte-buddy-1.18.15...byte-buddy-1.18.16)\n\n---\nupdated-dependencies:\n- dependency-name: net.bytebuddy:byte-buddy\n dependency-version: 1.18.16\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "5a7b9868601665ec9a2c01d98d689ea6add086a4", "tree": "f11000b0139103363e7d3f7647e229a85960d22d", "parents": [ "a45e77ce7986fd7172eb0f7759de587a9a13ceb5" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Oct 26 17:18:55 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 26 17:18:55 2026 +0000" }, "message": "Bump github/codeql-action from 4.39.0 to 4.39.1 (#1487)\n\nBumps [github/codeql-action](https://github.com/github/codeql-action) from 4.39.0 to 4.39.1.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/v4.39.0...v4.39.1)\n\n---\nupdated-dependencies:\n- dependency-name: github/codeql-action\n dependency-version: 4.39.1\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "a45e77ce7986fd7172eb0f7759de587a9a13ceb5", "tree": "42ed863908e3f0d71e2d6b1e4de3ed88ece326b6", "parents": [ "330815c00d462cbbabe826ed2d063db83548d746" ], "author": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Mon Oct 26 17:18:04 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 26 17:18:04 2026 +0000" }, "message": "DataFormatter: scale each section by its own percent signs (#1484)\n\nDecimalFormat applies the positive section\u0027s multiplier to negative\nvalues, so \"0%%;-0%\" showed -0.25 as \"-2500%\" and \"0%;-0\" showed -5 as\n\"-500\". Negative values now use a copy of the DecimalFormat with the\nnegative section\u0027s multiplier, as CellFormat does.\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "330815c00d462cbbabe826ed2d063db83548d746", "tree": "b5783733acb70ddd3d0b59e035efad630c17feda", "parents": [ "5de26e846918e4fbbeadce96ecdef0c92548a8b9" ], "author": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Mon Oct 26 17:17:39 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 26 17:17:39 2026 +0000" }, "message": "Fraction formatting: follow-ups to #1473 (#1485)\n\n* Fraction formatting: follow-ups to #1473\n\n- CellFormat shows an improper fraction whose numerator does not fit in\n an int, e.g. \"?/?\" shows 3e9+0.5 as 6000000001/2, instead of throwing,\n so callers of CellFormat other than DataFormatter (e.g. ToHtml) do not\n fail\n- DataFormatter no longer tries a CellFormat on a probe value or on the\n first cell\u0027s value, so the cached format does not depend on which value\n comes first or which section the probe lands in; a value the CellFormat\n fails on uses the fallback, which is created when it is first needed\n- a CellFormat failure is logged at warn the first time for a format,\n and at debug after that\n- the fallback for a fraction with text allows as many denominator\n digits as CellFormat does, from one constant,\n SimpleFraction.MAX_DENOMINATOR_DIGITS\n- SimpleFraction: one overflow check for the numerator and denominator\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* CellNumberFormatter: show a fraction\u0027s whole number above Long.MAX_VALUE\n\nThe whole number was cast to a long, so \"# ?/?\" showed 1e20 as\n9223372036854775807 (printed as 9223372036854776000).\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n---------\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "5de26e846918e4fbbeadce96ecdef0c92548a8b9", "tree": "219a5895fad8b078e540c99722acce41c29d2bd0", "parents": [ "140db93794f3029dadd216be522e68c8d9b76ec8" ], "author": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Mon Oct 26 15:54:52 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 26 15:54:52 2026 +0000" }, "message": "DataFormatter: percent format with a negative section multiplied by 100 twice (#1483)\n\nDataFormatter: only the positive section\u0027s percent signs scale the value\n\nA percent format with a negative section, e.g. \"0.00%;[Red]-0.00%\", was\nmultiplied by 100 twice since #1404, because the percent signs of both\nsections were counted. Count them per section.\n\nFixes #1482\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "140db93794f3029dadd216be522e68c8d9b76ec8", "tree": "28cf022a52f0ef104f0fa04dc68e141f44d63fd2", "parents": [ "68d4db94e081df3d8f5f3159a7e07386c67b8613" ], "author": { "name": "Tim Allison", "email": "tallison@apache.org", "time": "Mon Oct 26 10:27:52 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 26 14:27:52 2026 +0000" }, "message": "HemfComment: default max record length matches HwmfPicture (100 MB) (#1481)" }, { "commit": "68d4db94e081df3d8f5f3159a7e07386c67b8613", "tree": "0ddf95eeb258f516bbb935bfedc4432fdbab396c", "parents": [ "2c00b85db18148bca97449f1886ded08be100ffc" ], "author": { "name": "Tim Allison", "email": "tallison@apache.org", "time": "Mon Oct 26 10:25:04 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 26 14:25:04 2026 +0000" }, "message": "Fraction formatting: fix SimpleFraction overflow and cap denominator … (#1473)\n\n* Fraction formatting: fix SimpleFraction overflow and cap denominator digits\n\n* clean up\n\n* fixes/updates based on PJ\u0027s feedback\n\n* drop to debug\n\n* Probe fraction-with-text formats with a fixed value, so the cached format does not depend on cell order" }, { "commit": "2c00b85db18148bca97449f1886ded08be100ffc", "tree": "d6f4dfa3236085ba2630fdec30f12b62c5bb45fb", "parents": [ "6eb2a1d996a37caefb0e1a269f7e628e9609daa6" ], "author": { "name": "Dominik Stadler", "email": "centic@apache.org", "time": "Sun Oct 25 21:23:32 2026 +0100" }, "committer": { "name": "Dominik Stadler", "email": "centic@apache.org", "time": "Sun Oct 25 21:23:57 2026 +0100" }, "message": "Fuzzing: GitHub Actions need to switch from \"adopt\" to \"temurin\"\n\nThe JDK distribution \"adopt\" is not supported any more\n" }, { "commit": "6eb2a1d996a37caefb0e1a269f7e628e9609daa6", "tree": "a52eeb5685ceb5c854d8b68fbd342fc42457dc4b", "parents": [ "91865572cbeff16d55860f0d1ef1c68129fd9449" ], "author": { "name": "Dominik Stadler", "email": "centic@apache.org", "time": "Sun Oct 25 12:59:56 2026 +0100" }, "committer": { "name": "Dominik Stadler", "email": "centic@apache.org", "time": "Sun Oct 25 19:55:59 2026 +0100" }, "message": "Add missing dependency for FileHandlerFuzzer\n" }, { "commit": "91865572cbeff16d55860f0d1ef1c68129fd9449", "tree": "9e88d018e6970e57203106e111bcb1444b85a891", "parents": [ "a59a51046d160fef0ddafbe6759bedda81519656" ], "author": { "name": "Dominik Stadler", "email": "centic@apache.org", "time": "Sun Oct 25 11:32:27 2026 +0100" }, "committer": { "name": "Dominik Stadler", "email": "centic@apache.org", "time": "Sun Oct 25 19:55:59 2026 +0100" }, "message": "Prevent OOM on overly large image dimensions in slideshows\n\nLet\u0027s limit image sizes for rendering slides by default to 4K\nto avoid OOM on extreme values in broken files.\n\nFixes https://issues.oss-fuzz.com/issues/490920727\n" }, { "commit": "a59a51046d160fef0ddafbe6759bedda81519656", "tree": "b6ff1456bed16b9fbf423f29599d98fd37f4d740", "parents": [ "8bdecdac889e261936eca890b77d4f85a04a45b2" ], "author": { "name": "Dominik Stadler", "email": "centic@apache.org", "time": "Sun Oct 25 11:08:10 2026 +0100" }, "committer": { "name": "Dominik Stadler", "email": "centic@apache.org", "time": "Sun Oct 25 19:55:59 2026 +0100" }, "message": "Fuzzing: Fix GitHub Action to properly stop after some time\n" }, { "commit": "8bdecdac889e261936eca890b77d4f85a04a45b2", "tree": "d5a335e2b05364b7d9149a21164964a6cd3d0376", "parents": [ "6df168bab549d9402bb6960d1f2d7922bfd45858" ], "author": { "name": "Dominik Stadler", "email": "centic@apache.org", "time": "Sun Oct 25 10:40:15 2026 +0100" }, "committer": { "name": "Dominik Stadler", "email": "centic@apache.org", "time": "Sun Oct 25 19:55:59 2026 +0100" }, "message": "Fuzzing: Add script to run all fuzzers for some time\n\nThis allows to run fuzzing on all targets locally\nto verify for newly introduced crashes even before\ncommitting changes\n" }, { "commit": "6df168bab549d9402bb6960d1f2d7922bfd45858", "tree": "549507b511e2f937bdb817c7bca30f861b01a01a", "parents": [ "f1de5a8d87217f70b1f71af75ea57213a51036a9" ], "author": { "name": "Dominik Stadler", "email": "centic@apache.org", "time": "Sun Oct 25 09:33:59 2026 +0100" }, "committer": { "name": "Dominik Stadler", "email": "centic@apache.org", "time": "Sun Oct 25 19:55:59 2026 +0100" }, "message": "Fuzzing: Adjust XSSFBFuzzer\n\nAdd fuzzing XSSFWorkbook()\nAdjust expected exceptions\n" }, { "commit": "f1de5a8d87217f70b1f71af75ea57213a51036a9", "tree": "96ce8e6db9f9e56b73a01f1fb108569f21c077cf", "parents": [ "e4c4f502f2622008c1520485793f937d841a5ae4" ], "author": { "name": "Dominik Stadler", "email": "centic@apache.org", "time": "Sun Oct 25 08:59:03 2026 +0100" }, "committer": { "name": "Dominik Stadler", "email": "centic@apache.org", "time": "Sun Oct 25 19:55:59 2026 +0100" }, "message": "Avoid duplicate work in XSSFBFileHandler\n\nhandleFile() and handleExtracting() are both called for each\nfile during integration-testing, so they should not both\nperform the same actions.\n" }, { "commit": "e4c4f502f2622008c1520485793f937d841a5ae4", "tree": "11e324e27074c2330e2a1f74e06d92fec956ba1c", "parents": [ "f10567f53f05827837c8eff2fec0c1942082f0af" ], "author": { "name": "Dominik Stadler", "email": "centic@apache.org", "time": "Sat Oct 24 18:04:44 2026 +0200" }, "committer": { "name": "Dominik Stadler", "email": "centic@apache.org", "time": "Sun Oct 25 19:55:59 2026 +0100" }, "message": "Gradle add shadowJar to jenkinsLite\n" }, { "commit": "f10567f53f05827837c8eff2fec0c1942082f0af", "tree": "1b38be0899973bc2ea4f63c8b6443522b0fdf588", "parents": [ "5c44755a2a7569a5884dc8f1f680ca3a86fa245f" ], "author": { "name": "Dominik Stadler", "email": "centic@apache.org", "time": "Sat Oct 24 17:34:17 2026 +0200" }, "committer": { "name": "Dominik Stadler", "email": "centic@apache.org", "time": "Sun Oct 25 19:55:59 2026 +0100" }, "message": "ByteChunks: Limit allocation\n\nTo avoid OOM on input with invalid size-fields\n" }, { "commit": "5c44755a2a7569a5884dc8f1f680ca3a86fa245f", "tree": "5812937490d98d5a8ff095996f12d5b6b1e69cf2", "parents": [ "05cd05e545e1bade669f1ba35081d641cb9b07b0" ], "author": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Sun Oct 25 09:46:43 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Oct 25 09:46:43 2026 +0000" }, "message": "XSSFPasswordHelper: parse spinCount as an unsignedInt (#1480)\n\nspinCount is an xsd:unsignedInt, so values above Integer.MAX_VALUE made\nInteger.parseInt throw NumberFormatException instead of the\nEncryptedDocumentException used for other out-of-range spin counts.\nParse as a long and report a non-numeric value as EncryptedDocumentException too.\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "05cd05e545e1bade669f1ba35081d641cb9b07b0", "tree": "f5c6d2c545e3314218101a75baba604e3a66f3f1", "parents": [ "fc8f32b93e9d0c4cce7ed1ee722f90575b43a3c8" ], "author": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Sun Oct 25 09:45:45 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Oct 25 09:45:45 2026 +0000" }, "message": "Document spin count limit on protection password validation (#1479)\n\nFollow-up to #1478: add @throws to the validate*Password methods, note in\nAgileEncryptionVerifier that the max spin count also covers protection\npasswords, and test that a cryptSpinCount wrapping to a small int is rejected.\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "fc8f32b93e9d0c4cce7ed1ee722f90575b43a3c8", "tree": "a368f5c04ace2346e4d497f0d1f402fadae5a881", "parents": [ "4f3c25563919e7efa4a75feccf6cef1ac3d05a04" ], "author": { "name": "Nayyar", "email": "nayyar@bugqore.com", "time": "Sun Oct 25 14:54:22 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Oct 25 09:24:22 2026 +0000" }, "message": "XSSF/XWPF: cap spinCount when validating protection passwords (#1478)\n\ncap spinCount when validating xssf/xwpf protection passwords" }, { "commit": "4f3c25563919e7efa4a75feccf6cef1ac3d05a04", "tree": "f4e259b8c9eec3b6fb65bd5ad81401ee76ee2637", "parents": [ "fe6d94cb9a3b60d84c1e4a65be2206d9073f52a4" ], "author": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Sun Oct 25 00:14:15 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Oct 25 00:14:15 2026 +0100" }, "message": "SignaturePart: stricter checks of what a signature covers (#1477)\n\n* RelationshipTransformService: only treat relationships-namespace elements as relationships\n\nFollow-up to #1467. The transform matched Relationship elements in any\nnamespace, but PackageRelationshipCollection only reads those in the\nrelationships namespace, as the spec defines them. A foreign element named\nRelationship with a signed Id changed the digest, so a valid signature\nfailed to verify. Also make the comment say which case keeping all elements\ncovers, and share the signed-docx rewriting between the tests.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* SignaturePart: check that relationships of signed types are covered by the signature\n\nWhen verifying, also check each relationships part of the package: a\nrelationship that the signature doesn\u0027t cover must not have the same type\nas a relationship from the same source that it does cover. Relationship\ntypes a signer leaves out entirely (e.g. customXml in Office signatures)\nare unaffected.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* SignaturePart: report a content type mismatch as an invalid signature\n\nFollow-up to #1472. A part whose content type differs from the one a\nsignature reference was made for made verifySignature() throw an\nEncryptedDocumentException. It now returns false, as for other changes\nmade after signing. The dereferencer throws a package-private\nURIReferenceException subclass, which SignaturePart.validate() recognises.\n\nThe tests share a rewriteSignedDocx helper, and the content type test no\nlonger depends on how xmlsec wraps exceptions.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* Use a Hamcrest matcher in testAddedRelationshipIsNotSigned\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* Use assertFalse with a failure message in testAddedRelationshipIsNotSigned\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* Use assertFalse with a failure message in contentTypeChangeInvalidatesSignature\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n---------\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "fe6d94cb9a3b60d84c1e4a65be2206d9073f52a4", "tree": "bef029352d1ca93a38bb6e952b328911ff96c967", "parents": [ "1924da009d04421e11f1804ce52e6d1bcc8d6990" ], "author": { "name": "Nayyar", "email": "nayyar@bugqore.com", "time": "Sun Oct 25 04:21:22 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 24 23:51:22 2026 +0100" }, "message": "OOXMLURIDereferencer: check the content type a signature reference was made for (#1472)\n\ncheck the signed content type of OOXML signature references\n\nOOXMLURIDereferencer resolved /part?ContentType\u003d... references by path\nonly, so changing a part\u0027s content type in the unsigned\n[Content_Types].xml left the signature valid. Compare the ContentType\nquery with the part\u0027s content type and reject the reference on mismatch." }, { "commit": "1924da009d04421e11f1804ce52e6d1bcc8d6990", "tree": "2e53d3b50271164152dbb77c43a470e4cc0a8d66", "parents": [ "d1d3f6b1026279d487a8d36ce029bf34664d6910" ], "author": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Sat Oct 24 23:43:17 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 24 23:43:17 2026 +0100" }, "message": "RelationshipTransformService: only treat relationships-namespace elements as relationships (#1475)\n\nFollow-up to #1467. The transform matched Relationship elements in any\nnamespace, but PackageRelationshipCollection only reads those in the\nrelationships namespace, as the spec defines them. A foreign element named\nRelationship with a signed Id changed the digest, so a valid signature\nfailed to verify. Also make the comment say which case keeping all elements\ncovers, and share the signed-docx rewriting between the tests.\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "d1d3f6b1026279d487a8d36ce029bf34664d6910", "tree": "694aeaa43766e3f3be1373bff4f8d530dcf430aa", "parents": [ "54f9dbe28933947d545ccae23b9aea449aa1ece6" ], "author": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Sat Oct 24 23:40:46 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 24 23:40:46 2026 +0100" }, "message": "AgileDecryptor: allow decrypting a package whose integrity check fails (#1474)\n\nFollow-up to #1465. A DataIntegrity HMAC mismatch still fails by default,\nbut AgileDecryptor.setFailOnIntegrityError(false) logs a warning and\ndecrypts the package anyway. Excel for the web flags such a file but still\nshows it in read-only mode, so read-only consumers can get the content too.\n\nAlso document the exception on getDataStream, name the setting in the\nexception message, and test a file where only the HMAC value is altered.\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "54f9dbe28933947d545ccae23b9aea449aa1ece6", "tree": "e7bf56e7eb73b850bc6c2d690e75575fa9fdc137", "parents": [ "c04778ea477255716a25b8c31fc7eb6af6fb1ecd" ], "author": { "name": "Nayyar", "email": "nayyar@bugqore.com", "time": "Sun Oct 25 03:58:58 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 24 23:28:58 2026 +0100" }, "message": "RelationshipTransformService: don\u0027t drop duplicate relationship ids from the digest (#1467)\n\nkeep duplicate relationship ids in the relationship transform digest" }, { "commit": "c04778ea477255716a25b8c31fc7eb6af6fb1ecd", "tree": "33378d8a1c73283d690ade1f751da4f01914c95d", "parents": [ "e7b69f116b30b15143b963e52d230a706e4c33a4" ], "author": { "name": "Nayyar", "email": "nayyar@bugqore.com", "time": "Sun Oct 25 03:42:33 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 24 23:12:33 2026 +0100" }, "message": "AgileDecryptor: verify the DataIntegrity HMAC before decrypting (#1465)" }, { "commit": "e7b69f116b30b15143b963e52d230a706e4c33a4", "tree": "cd7417e7ff6d80d7d83ec8bc3bfef6a855509863", "parents": [ "d5ff2047aede95948b920e84dbae897e4e0ff1e2" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sat Oct 24 23:00:23 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 24 23:00:23 2026 +0100" }, "message": "Bump actions/setup-java from 2 to 6 (#1469)\n\nBumps [actions/setup-java](https://github.com/actions/setup-java) from 2 to 6.\n- [Release notes](https://github.com/actions/setup-java/releases)\n- [Commits](https://github.com/actions/setup-java/compare/v2...v6)\n\n---\nupdated-dependencies:\n- dependency-name: actions/setup-java\n dependency-version: \u00276\u0027\n dependency-type: direct:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "d5ff2047aede95948b920e84dbae897e4e0ff1e2", "tree": "8ddbd0edd14322141748ab9f48e2003788a7487c", "parents": [ "e71122973747f955e5f3c5911f7d7cfe213a8d93" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sat Oct 24 23:00:05 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 24 23:00:05 2026 +0100" }, "message": "Bump batikVersion from 1.19 to 1.20 (#1468)\n\nBumps `batikVersion` from 1.19 to 1.20.\n\nUpdates `org.apache.xmlgraphics:batik-svggen` from 1.19 to 1.20\n- [Changelog](https://github.com/apache/xmlgraphics-batik/blob/main/CHANGES)\n- [Commits](https://github.com/apache/xmlgraphics-batik/commits)\n\nUpdates `org.apache.xmlgraphics:batik-svgrasterizer` from 1.19 to 1.20\n- [Changelog](https://github.com/apache/xmlgraphics-batik/blob/main/CHANGES)\n- [Commits](https://github.com/apache/xmlgraphics-batik/commits)\n\nUpdates `org.apache.xmlgraphics:batik-codec` from 1.19 to 1.20\n- [Changelog](https://github.com/apache/xmlgraphics-batik/blob/main/CHANGES)\n- [Commits](https://github.com/apache/xmlgraphics-batik/commits)\n\nUpdates `org.apache.xmlgraphics:batik-bridge` from 1.19 to 1.20\n- [Changelog](https://github.com/apache/xmlgraphics-batik/blob/main/CHANGES)\n- [Commits](https://github.com/apache/xmlgraphics-batik/commits)\n\nUpdates `org.apache.xmlgraphics:batik-script` from 1.19 to 1.20\n- [Changelog](https://github.com/apache/xmlgraphics-batik/blob/main/CHANGES)\n- [Commits](https://github.com/apache/xmlgraphics-batik/commits)\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.xmlgraphics:batik-svggen\n dependency-version: \u00271.20\u0027\n dependency-type: direct:production\n update-type: version-update:semver-minor\n- dependency-name: org.apache.xmlgraphics:batik-svgrasterizer\n dependency-version: \u00271.20\u0027\n dependency-type: direct:production\n update-type: version-update:semver-minor\n- dependency-name: org.apache.xmlgraphics:batik-codec\n dependency-version: \u00271.20\u0027\n dependency-type: direct:production\n update-type: version-update:semver-minor\n- dependency-name: org.apache.xmlgraphics:batik-bridge\n dependency-version: \u00271.20\u0027\n dependency-type: direct:production\n update-type: version-update:semver-minor\n- dependency-name: org.apache.xmlgraphics:batik-script\n dependency-version: \u00271.20\u0027\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "e71122973747f955e5f3c5911f7d7cfe213a8d93", "tree": "e1057d51e3d58fce098bb5d6f5916dbde6153a76", "parents": [ "956bfa59f82d423b225424ca92ca8227d27330f3" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sat Oct 24 22:59:49 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 24 22:59:49 2026 +0100" }, "message": "Bump actions/cache from 4 to 6 (#1470)\n\nBumps [actions/cache](https://github.com/actions/cache) from 4 to 6.\n- [Release notes](https://github.com/actions/cache/releases)\n- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)\n- [Commits](https://github.com/actions/cache/compare/v4...v6)\n\n---\nupdated-dependencies:\n- dependency-name: actions/cache\n dependency-version: \u00276\u0027\n dependency-type: direct:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "956bfa59f82d423b225424ca92ca8227d27330f3", "tree": "51e3e0be3a483837d8857e6383c1f7e5360de151", "parents": [ "b014b071ab8ffe9ec025ae750c52ffdc02eeff27" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sat Oct 24 22:59:38 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 24 22:59:38 2026 +0100" }, "message": "Bump actions/checkout from 2 to 7 (#1471)\n\nBumps [actions/checkout](https://github.com/actions/checkout) from 2 to 7.\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/actions/checkout/compare/v2...v7)\n\n---\nupdated-dependencies:\n- dependency-name: actions/checkout\n dependency-version: \u00277\u0027\n dependency-type: direct:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "b014b071ab8ffe9ec025ae750c52ffdc02eeff27", "tree": "5fd1554e0154697a7d89acf0bac19eecdf6e26b1", "parents": [ "cb5b899752bbae0b96cd13db64d320634f69f472" ], "author": { "name": "Dominik Stadler", "email": "centic@apache.org", "time": "Sat Oct 24 11:51:07 2026 +0200" }, "committer": { "name": "Dominik Stadler", "email": "centic@apache.org", "time": "Sat Oct 24 11:52:52 2026 +0200" }, "message": "Fuzzing: make name of shadow-jar independent from version\n" }, { "commit": "cb5b899752bbae0b96cd13db64d320634f69f472", "tree": "5102b1dabc9831b46601222f2bf74efd4a869529", "parents": [ "8ba1cf4a39e4817c173f9ec94d052fad1f6e3014" ], "author": { "name": "Dominik Stadler", "email": "centic@apache.org", "time": "Sat Oct 24 11:50:12 2026 +0200" }, "committer": { "name": "Dominik Stadler", "email": "centic@apache.org", "time": "Sat Oct 24 11:52:52 2026 +0200" }, "message": "Set version 6.0.1-SNAPSHOT everywhere\n" }, { "commit": "8ba1cf4a39e4817c173f9ec94d052fad1f6e3014", "tree": "8a6eb56fc2be2f12ec84a88169da5923ce003082", "parents": [ "c75182422060b1af46378eaa5d993f1495064e58" ], "author": { "name": "Dominik Stadler", "email": "centic@apache.org", "time": "Sat Oct 24 11:49:49 2026 +0200" }, "committer": { "name": "Dominik Stadler", "email": "centic@apache.org", "time": "Sat Oct 24 11:52:52 2026 +0200" }, "message": "Ignore some more fuzzing binaries\n" }, { "commit": "c75182422060b1af46378eaa5d993f1495064e58", "tree": "8ac81694b00cb3b11c10248a641213c15b377669", "parents": [ "a259bcede8ffeeb5190757828f8ea3162d4aebb0" ], "author": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Fri Oct 23 16:16:36 2026 +0100" }, "committer": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Fri Oct 23 16:16:36 2026 +0100" }, "message": "poi 6.0 doc link\n" }, { "commit": "a259bcede8ffeeb5190757828f8ea3162d4aebb0", "tree": "e5f0a60084206b4fe550237a74137fa0b812de1e", "parents": [ "4ba0d9472e80d7594e0b01e8d73e41dbed36aac8" ], "author": { "name": "Dominik Stadler", "email": "dominik.stadler@gmx.at", "time": "Fri Jul 11 11:37:25 2025 +0200" }, "committer": { "name": "Dominik Stadler", "email": "dominik.stadler@gmx.at", "time": "Fri Oct 23 15:21:05 2026 +0200" }, "message": "Remove temporary file\n\nSeems to have been committed at some point\nbut seems not necessary and should be removed.\n" }, { "commit": "4ba0d9472e80d7594e0b01e8d73e41dbed36aac8", "tree": "82ac34fe32dd513f2302eeb3391549aaadaa759e", "parents": [ "daab5520083d43b4f561b50ab557de93af4db92f" ], "author": { "name": "Dominik Stadler", "email": "dominik.stadler@gmx.at", "time": "Fri Oct 23 15:20:31 2026 +0200" }, "committer": { "name": "Dominik Stadler", "email": "dominik.stadler@gmx.at", "time": "Fri Oct 23 15:21:05 2026 +0200" }, "message": "Fuzzing: Fix pathname in GitHub Action\n" }, { "commit": "daab5520083d43b4f561b50ab557de93af4db92f", "tree": "852b78223624a5b123ebb891bd2eeb5239b1f244", "parents": [ "1cc2b605280b82a3efa65ba68586323225c183c7" ], "author": { "name": "Dominik Stadler", "email": "dominik.stadler@gmx.at", "time": "Fri Oct 23 09:07:57 2026 +0200" }, "committer": { "name": "Dominik Stadler", "email": "dominik.stadler@gmx.at", "time": "Fri Oct 23 09:08:06 2026 +0200" }, "message": "Fuzzing: Remove action which cannot be executed for Apache projects\n" }, { "commit": "1cc2b605280b82a3efa65ba68586323225c183c7", "tree": "4404195e64d2fa41837b2636eee992964e4c1a6c", "parents": [ "4e986a26bd94f92f8cde9bae876487fd13ce17d0" ], "author": { "name": "Dominik Stadler", "email": "dominik.stadler@gmx.at", "time": "Fri Oct 23 08:48:18 2026 +0200" }, "committer": { "name": "Dominik Stadler", "email": "dominik.stadler@gmx.at", "time": "Fri Oct 23 09:05:26 2026 +0200" }, "message": "Fuzzing: Add GitHub Action to run fuzzing\n\nRun all fuzz-targets for some time and\ntry to provide any resulting crash-reproducer\nas artifact\n" }, { "commit": "4e986a26bd94f92f8cde9bae876487fd13ce17d0", "tree": "c400f9b40640ec748baf1200c8c44abfedcfa808", "parents": [ "41a1bc2f0e0c1e6b7b5611c0e54244d4a16b8ec2" ], "author": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Fri Oct 23 01:55:04 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 23 01:55:04 2026 +0100" }, "message": "WordToFoConverter: allow a custom hyperlink validator (#1464)\n\nSame as WordToHtmlConverter.setHyperlinkValidator (#1459): an extra check on\nHYPERLINK field targets, applied after WordToHtmlUtils.isSafeHyperlink.\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "41a1bc2f0e0c1e6b7b5611c0e54244d4a16b8ec2", "tree": "dec45977ea445829a4460f28269c15ec61c0eaef", "parents": [ "40c175fa661945454f1c2f7ebdb0a6ab1904052f" ], "author": { "name": "Nayyar", "email": "nayyar@bugqore.com", "time": "Fri Oct 23 04:41:23 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 23 00:11:23 2026 +0100" }, "message": "SVGImageRenderer: only load embedded resources from SVG pictures (#1452)\n\n* SVGImageRenderer: only load embedded resources from SVG pictures\n\n* SVGImageRenderer: report blocked SVG references as IOException\n\nBatik\u0027s BridgeException is a RuntimeException, so a refused or broken\nexternal reference aborted the whole slide instead of skipping the picture.\nAlso skip TestSVGImageRenderer when Batik isn\u0027t on the module path (Ant build)\nand drop a stale TODO - Batik already parses securely.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n---------\n\nCo-authored-by: PJ Fanning \u003cpjfanning@users.noreply.github.com\u003e\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "40c175fa661945454f1c2f7ebdb0a6ab1904052f", "tree": "f881122e29cd7f564cac99673834ee07fbf067cc", "parents": [ "323b55161a02b51e20f851df35eb806063809fc9" ], "author": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Fri Oct 23 00:10:38 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 23 00:10:38 2026 +0100" }, "message": "TimeStampSimpleHttpClient: follow-ups to redirect credential handling (#1463)\n\n- make the 4-arg handleRedirect protected so an override also sees the redirect hop\n- normalize default ports before comparing origins\n- resolve relative Location headers against the request url\n- disable HttpURLConnection\u0027s own redirect handling, which followed same-protocol\n redirects without going through handleRedirect, followRedirects or the credential check\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "323b55161a02b51e20f851df35eb806063809fc9", "tree": "734d4db4245db51738dd9500cee1dd4774fa6cda", "parents": [ "b05c33b58c0b1f5d5dfab5494356a955a434b9d9" ], "author": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Thu Oct 22 23:31:44 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 23:31:44 2026 +0100" }, "message": "Update documentation for the 6.0.0 release (#1462)\n\n* release 6.0.0\n\n* docs: update dependency versions and Java requirement for 6.0.0\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* docs: update Java version FAQ entries for 6.0.0\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n---------\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "b05c33b58c0b1f5d5dfab5494356a955a434b9d9", "tree": "74037c8f9104c4cebdc6525e98a923029a33c3fa", "parents": [ "8390dfe22d7130d756c01e74c0db18eab9a39fd6" ], "author": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Thu Oct 22 23:31:28 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 23:31:28 2026 +0100" }, "message": "WordToHtmlConverter: allow a custom hyperlink validator (#1459)\n\nA validator set with setHyperlinkValidator can reject further HYPERLINK\ntargets, e.g. to only link to some hosts. It is only consulted for targets\nthat pass WordToHtmlUtils.isSafeHyperlink, so it can never let a\njavascript: or other script target through.\n\nThe isSafeHyperlink test now uses Hamcrest so a failure lists the targets\nthat were classified wrongly.\n\nFollow-up to #1455.\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "8390dfe22d7130d756c01e74c0db18eab9a39fd6", "tree": "85d908f88ea9f932d6934bfd5295baea72831d71", "parents": [ "b66dd87478b0a6455cea03d70bae54659ccb444b" ], "author": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Thu Oct 22 23:31:09 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 23:31:09 2026 +0100" }, "message": "ToHtml example: escape cell text (#1461)\n\n* ToHtml example: escape cell text\n\nThe formatted cell value was written into the table cell as it is, so\nmarkup in a cell, e.g. \u003cscript\u003e or a javascript: link, ended up in the\ngenerated page. Escape it with XMLHelper.escapeXml.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* ToHtml example: ship excelStyle.css as a resource\n\nThe style sheet lived in src/main/java, so neither the Gradle nor the Ant\nbuild put it in the output and printPage() failed with an NPE when\nloading it. Move it to src/main/resources and add the examples resources\nto the Ant jar.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n---------\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "b66dd87478b0a6455cea03d70bae54659ccb444b", "tree": "44720845a22002b941d97277668feda6c5c31113", "parents": [ "29d6070a5ad085120c403457bc617e9ce3fa34c9" ], "author": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Thu Oct 22 23:21:38 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 23:21:38 2026 +0100" }, "message": "WordToFoConverter: don\u0027t link HYPERLINK fields with script targets (#1460)\n\nApply the scheme check from #1455 to the external-destination of\nfo:basic-link too. A target like javascript: keeps its text but is not\nemitted as a link.\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "29d6070a5ad085120c403457bc617e9ce3fa34c9", "tree": "330acbb8a5b650397c2e7b402f6ae511c4bdf2d5", "parents": [ "466c8b54bede57ccd14c10d9e9f4ca54ccd65e96" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Oct 22 23:20:57 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 23:20:57 2026 +0100" }, "message": "Bump com.gradleup.shadow from 9.2.2 to 9.6.1 (#1457)\n\nBumps com.gradleup.shadow from 9.2.2 to 9.6.1.\n\n---\nupdated-dependencies:\n- dependency-name: com.gradleup.shadow\n dependency-version: 9.6.1\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "466c8b54bede57ccd14c10d9e9f4ca54ccd65e96", "tree": "dc6dc812f5da94a3efa0b83f655fc94e4f3992e6", "parents": [ "064406bd5a2ac5b7e38f060882ffe4b48cc16615" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Oct 22 23:20:43 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 23:20:43 2026 +0100" }, "message": "Bump gradle-wrapper from 9.8.1 to 9.8.2 (#1458)\n\nBumps [gradle-wrapper](https://github.com/gradle/gradle) from 9.8.1 to 9.8.2.\n- [Release notes](https://github.com/gradle/gradle/releases)\n- [Commits](https://github.com/gradle/gradle/compare/v9.8.1...v9.8.2)\n\n---\nupdated-dependencies:\n- dependency-name: gradle-wrapper\n dependency-version: 9.8.2\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "064406bd5a2ac5b7e38f060882ffe4b48cc16615", "tree": "7e4b05a8bae70612d0c5cc89092288b4133c3f5b", "parents": [ "cbcff4059ffb9eca4143b4fd9089bf2e1f9c4411" ], "author": { "name": "Nayyar", "email": "nayyar@bugqore.com", "time": "Fri Oct 23 02:09:08 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 21:39:08 2026 +0100" }, "message": "TimeStampSimpleHttpClient: drop credentials on cross-origin redirect (#1456)\n\nhandleRedirect copied every configured header, including the Basic\nAuthorization header built from tspUser/tspPass, onto the connection\nfor the redirect target. HttpURLConnection follows same-protocol\nredirects itself and drops Authorization there, so the redirects that\nreach this code are the scheme-changing ones: https to http sent the\ncredentials in cleartext, and the Location could name any host.\n\nOnly resend Authorization to the same host on the same scheme and\nport, or on an http to https upgrade with default ports." }, { "commit": "cbcff4059ffb9eca4143b4fd9089bf2e1f9c4411", "tree": "2bab161d87b67d190ad8c64838fab1dc5a738f17", "parents": [ "4a0ac917be72f2ae84ef1646b2db19033dc0b9c3" ], "author": { "name": "Nayyar", "email": "nayyar@bugqore.com", "time": "Fri Oct 23 00:54:52 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 20:24:52 2026 +0100" }, "message": "WordToHtmlConverter: don\u0027t link HYPERLINK fields with script targets (#1455)" }, { "commit": "4a0ac917be72f2ae84ef1646b2db19033dc0b9c3", "tree": "cd4eec8d83f687b0c520ee5d3e8448262ee1eba3", "parents": [ "abe4794f9453b85fabf05c39de0ab453cc401a16" ], "author": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Thu Oct 22 17:29:05 2026 +0100" }, "committer": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Thu Oct 22 17:29:05 2026 +0100" }, "message": "snapshot version\n" }, { "commit": "abe4794f9453b85fabf05c39de0ab453cc401a16", "tree": "1218db1fc5aebb127b2c12ad640be3cb632b1401", "parents": [ "5fb3244453688b967aa730fbcfdba9ca76fc9e15" ], "author": { "name": "Dominik Stadler", "email": "dominik.stadler@gmx.at", "time": "Thu Oct 22 16:24:33 2026 +0200" }, "committer": { "name": "Dominik Stadler", "email": "dominik.stadler@gmx.at", "time": "Thu Oct 22 16:24:52 2026 +0200" }, "message": "Avoid an NPE when a cell format cannot be parsed\n\nFixes https://issues.oss-fuzz.com/issues/575061063\n" }, { "commit": "5fb3244453688b967aa730fbcfdba9ca76fc9e15", "tree": "00698327fd8f1fe537c34b56c4c940d0ac1a2365", "parents": [ "5d14e09d7d074ea0e0a633c59414dc6314fc19c1" ], "author": { "name": "Dominik Stadler", "email": "dominik.stadler@gmx.at", "time": "Thu Oct 22 14:43:04 2026 +0200" }, "committer": { "name": "Dominik Stadler", "email": "dominik.stadler@gmx.at", "time": "Thu Oct 22 16:24:52 2026 +0200" }, "message": "Switch assert to Exception\n\nCan be triggered by invalid input format, so\nlet\u0027s report it always\n\nFixes https://issues.oss-fuzz.com/issues/561968961\n" }, { "commit": "5d14e09d7d074ea0e0a633c59414dc6314fc19c1", "tree": "85e4df206966318e0371b8db030cfc745504c261", "parents": [ "6decd3b4df67bcb4c7716286c7c5b002d35e2f56" ], "author": { "name": "Dominik Stadler", "email": "dominik.stadler@gmx.at", "time": "Thu Oct 22 13:06:46 2026 +0200" }, "committer": { "name": "Dominik Stadler", "email": "dominik.stadler@gmx.at", "time": "Thu Oct 22 13:08:29 2026 +0200" }, "message": "Fuzzing: Expect ArithmeticException and NPE in commons-compress in more places\n\nAlso fixes https://issues.oss-fuzz.com/issues/520018227\n" }, { "commit": "6decd3b4df67bcb4c7716286c7c5b002d35e2f56", "tree": "641eec401517056faa54529f83ff59d92bb3f4d0", "parents": [ "e3192f894c2bda8b993dacac52f9f1848dd3a27f" ], "author": { "name": "Dominik Stadler", "email": "dominik.stadler@gmx.at", "time": "Thu Oct 22 12:10:54 2026 +0200" }, "committer": { "name": "Dominik Stadler", "email": "dominik.stadler@gmx.at", "time": "Thu Oct 22 13:08:29 2026 +0200" }, "message": "Add dedicated fuzzer for XSSFBEventBasedExcelExtractor\n\nTo try to cover this area some more as the\ngeneral text-extraction does not reach this\narea currently\n" }, { "commit": "e3192f894c2bda8b993dacac52f9f1848dd3a27f", "tree": "8ff4a81f405b5797dfc83d2aefc5268459268632", "parents": [ "644120270b1684bfb056869916728e5d74671e43" ], "author": { "name": "Dominik Stadler", "email": "dominik.stadler@gmx.at", "time": "Thu Oct 22 09:18:44 2026 +0200" }, "committer": { "name": "Dominik Stadler", "email": "dominik.stadler@gmx.at", "time": "Thu Oct 22 09:53:30 2026 +0200" }, "message": "Add README and dependencies to run fuzzing locally\n\nAllow to build a shadowJar\nAdd zstd dependency\nAlso ignore corpus and jazzer-binaries which\nare produced during fuzzing runs\n" }, { "commit": "644120270b1684bfb056869916728e5d74671e43", "tree": "a19995ad9f768e89a58288ebe72a6c5b9a1e39d6", "parents": [ "472405769b8b29ab45d89c0428688698dff4b189" ], "author": { "name": "Dominik Stadler", "email": "dominik.stadler@gmx.at", "time": "Wed Oct 21 17:44:20 2026 +0200" }, "committer": { "name": "Dominik Stadler", "email": "dominik.stadler@gmx.at", "time": "Thu Oct 22 09:53:30 2026 +0200" }, "message": "Fuzzing: Adjust how we detect if an NPE is casued by commons-compress\n\nThere will be NPEs detected by fuzzing\nin commons-compress until a new release\nis done, so we need to detect and exclude\nthose for now to keep fuzzing other code-areas\n" }, { "commit": "472405769b8b29ab45d89c0428688698dff4b189", "tree": "22c853a38042f5d171d23b40abbfdc68f3a342bd", "parents": [ "d66b912e36d01572f141f42f59b8adafcb73ba12" ], "author": { "name": "Dominik Stadler", "email": "dominik.stadler@gmx.at", "time": "Thu Oct 22 09:16:36 2026 +0200" }, "committer": { "name": "Dominik Stadler", "email": "dominik.stadler@gmx.at", "time": "Thu Oct 22 09:53:30 2026 +0200" }, "message": "Avoid possible NPE in formula parsing\n\nDetected when running fuzzing locally\n" }, { "commit": "d66b912e36d01572f141f42f59b8adafcb73ba12", "tree": "82efa31958c1ccaa7ef74e70fa682b3c036f0622", "parents": [ "9b6e6241faabbe1d1df1efae75b376f6e9954661" ], "author": { "name": "Dominik Stadler", "email": "dominik.stadler@dynatrace.com", "time": "Wed Oct 21 10:11:26 2026 +0200" }, "committer": { "name": "Dominik Stadler", "email": "dominik.stadler@gmx.at", "time": "Wed Oct 21 12:11:06 2026 +0200" }, "message": "Fuzzing: Expect ArithmeticException in some places\n\nThis is sometimes triggered by Math.toIntExact()\non invalid input.\n" }, { "commit": "9b6e6241faabbe1d1df1efae75b376f6e9954661", "tree": "fbb0e7e221fb1bdd6c3b7b60a50d8fd42d2307ba", "parents": [ "d91a76448f0963a93b6cd95fb97fbe1d8bad82c6" ], "author": { "name": "Dominik Stadler", "email": "dominik.stadler@dynatrace.com", "time": "Wed Oct 21 08:52:50 2026 +0200" }, "committer": { "name": "Dominik Stadler", "email": "dominik.stadler@gmx.at", "time": "Wed Oct 21 12:11:06 2026 +0200" }, "message": "Avoid NPE found by fuzzing\n" }, { "commit": "d91a76448f0963a93b6cd95fb97fbe1d8bad82c6", "tree": "19b969571ebe9979c926b4aca23b652d7d92a797", "parents": [ "1c601a7de745ea5ac36f8764e7ba0fd4f1c15797" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Oct 19 18:58:17 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 18:58:17 2026 +0100" }, "message": "Bump github/codeql-action from 4.38.3 to 4.39.0 (#1451)\n\nBumps [github/codeql-action](https://github.com/github/codeql-action) from 4.38.3 to 4.39.0.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/v4.38.3...v4.39.0)\n\n---\nupdated-dependencies:\n- dependency-name: github/codeql-action\n dependency-version: 4.39.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "1c601a7de745ea5ac36f8764e7ba0fd4f1c15797", "tree": "bff6793b420bc63e636ce69678d8a417f551c76f", "parents": [ "e6176ba2661bc7a6a5bd30fb036b7059258ed3aa" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Oct 19 18:58:05 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 18:58:05 2026 +0100" }, "message": "Bump jakarta.xml.bind:jakarta.xml.bind-api from 4.0.2 to 4.0.5 (#1448)\n\n* Bump jakarta.xml.bind:jakarta.xml.bind-api from 4.0.2 to 4.0.5\n\nBumps [jakarta.xml.bind:jakarta.xml.bind-api](https://github.com/jakartaee/jaxb-api) from 4.0.2 to 4.0.5.\n- [Release notes](https://github.com/jakartaee/jaxb-api/releases)\n- [Commits](https://github.com/jakartaee/jaxb-api/compare/4.0.2...4.0.5)\n\n---\nupdated-dependencies:\n- dependency-name: jakarta.xml.bind:jakarta.xml.bind-api\n dependency-version: 4.0.5\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\n\n* Update jakartaActivationVersion to 2.1.4\n\n---------\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nCo-authored-by: PJ Fanning \u003cpjfanning@users.noreply.github.com\u003e" }, { "commit": "e6176ba2661bc7a6a5bd30fb036b7059258ed3aa", "tree": "ad7167b01d445fb468d6cfa9b91dedf222c3b362", "parents": [ "688c991e1414593830225bb74064353a6cb53496" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Oct 19 18:56:25 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 18:56:25 2026 +0100" }, "message": "Bump jakarta.activation:jakarta.activation-api from 2.1.3 to 2.1.4 (#1449)\n\nBumps [jakarta.activation:jakarta.activation-api](https://github.com/jakartaee/jaf-api) from 2.1.3 to 2.1.4.\n- [Release notes](https://github.com/jakartaee/jaf-api/releases)\n- [Commits](https://github.com/jakartaee/jaf-api/compare/2.1.3...2.1.4)\n\n---\nupdated-dependencies:\n- dependency-name: jakarta.activation:jakarta.activation-api\n dependency-version: 2.1.4\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "688c991e1414593830225bb74064353a6cb53496", "tree": "4f71946c76004bb74f4fb5500b57f23266766928", "parents": [ "04804ac97487ceded07a8231bc106a258109cbeb" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Oct 19 18:56:02 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 18:56:02 2026 +0100" }, "message": "Bump net.sf.saxon:Saxon-HE from 13.0 to 13.1 (#1450)\n\nBumps net.sf.saxon:Saxon-HE from 13.0 to 13.1.\n\n---\nupdated-dependencies:\n- dependency-name: net.sf.saxon:Saxon-HE\n dependency-version: \u002713.1\u0027\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "04804ac97487ceded07a8231bc106a258109cbeb", "tree": "b00c15e6e515e30bb2c34cc5c87f9afc0d8bbb53", "parents": [ "20001ab9eeb2d68ccb3504c49b1152f2c725fa58" ], "author": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Mon Oct 19 16:15:12 2026 +0100" }, "committer": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Mon Oct 19 16:15:12 2026 +0100" }, "message": "Update changes.xml\n" }, { "commit": "20001ab9eeb2d68ccb3504c49b1152f2c725fa58", "tree": "9935c832ff87e522c5fac5167cf27b69835cc5ac", "parents": [ "6c56d546eb4ecc3bf3d87702454dfeb67c5d562c" ], "author": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Mon Oct 19 16:13:24 2026 +0100" }, "committer": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Mon Oct 19 16:13:24 2026 +0100" }, "message": "Update .asf.yaml\n" }, { "commit": "6c56d546eb4ecc3bf3d87702454dfeb67c5d562c", "tree": "7b82b1eac491fc1d8d32bdfb53bf905b49d4f5af", "parents": [ "7660dfb20956e970adf309b36f31bab4ab35d556" ], "author": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Mon Oct 19 16:06:31 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 16:06:31 2026 +0100" }, "message": "Remove \u0027asf-site\u0027 from protected branches\n\nRemoved \u0027asf-site\u0027 from protected branches." }, { "commit": "7660dfb20956e970adf309b36f31bab4ab35d556", "tree": "9935c832ff87e522c5fac5167cf27b69835cc5ac", "parents": [ "2aac6161d704bf3db5592796a95ca7877a848ce7" ], "author": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Mon Oct 19 15:45:16 2026 +0100" }, "committer": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Mon Oct 19 15:45:16 2026 +0100" }, "message": "Update changes.xml\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "2aac6161d704bf3db5592796a95ca7877a848ce7", "tree": "996289da28285cea93c055b887469c21e5cc108e", "parents": [ "bf7c9b6a1490046517cbd8e1504e702a89be4bc9" ], "author": { "name": "Nayyar", "email": "nayyar@bugqore.com", "time": "Mon Oct 19 14:57:19 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 10:27:19 2026 +0100" }, "message": "WordToHtmlConverter: escape font names written into the stylesheet (#1446)\n\n* WordToHtmlConverter: escape font names written into the stylesheet\n\n* Quote font names that are not CSS identifiers; split cssFontFamily test\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n---------\n\nCo-authored-by: PJ Fanning \u003cpjfanning@users.noreply.github.com\u003e\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "bf7c9b6a1490046517cbd8e1504e702a89be4bc9", "tree": "455ec30ade12b65f24bccda4dffa555105cee1d8", "parents": [ "62a309652ca7ac115d8b15b5c870c5ceceecd5f7" ], "author": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Sun Oct 18 12:35:14 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Oct 18 12:35:14 2026 +0100" }, "message": "Fix poi-integration tests when scratchpad is ignored (#1445)\n\nSince module-info.class moved to the jar root (#1365), the\norg.apache.poi.stress module hard-requires org.apache.poi.scratchpad,\nso the POI-DSL-no-scratchpad job fails with\n\"FindException: Module org.apache.poi.scratchpad not found\".\n\nMake the dependency static (as poi-examples already does) and add the\nscratchpad module explicitly when it is not ignored.\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "62a309652ca7ac115d8b15b5c870c5ceceecd5f7", "tree": "2b51c5e79f320330390cc8c5d709876a4200ae46", "parents": [ "40145607ac5df515d58fbbb4b454639dd525e37d" ], "author": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Sun Oct 18 11:29:54 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Oct 18 11:29:54 2026 +0100" }, "message": "IMAGINARY/IMREAL of a number without a real part; COMPLEX with -1 or 0 (#1444)\n\nIMAGINARY(\"3i\") returned 1 and IMREAL(\"3i\") returned 3, because\nCOMPLEX_NUMBER_PATTERN captures the sign and coefficient of a number\nwithout a real part, e.g. \"-i\" or \"3i\", in the real part groups.\n\nCOMPLEX dropped the sign of an imaginary coefficient of -1, giving \"3i\"\nfor COMPLEX(3,-1) and \"i\" for COMPLEX(0,-1), and returned \"\" rather\nthan \"0\" for COMPLEX(0,0).\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "40145607ac5df515d58fbbb4b454639dd525e37d", "tree": "7272b6f442a5fe8e85375eae53dd9e0f2e990bd0", "parents": [ "9d33c42e5e24b2cfa7698d43e4bf21ab239487c8" ], "author": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Sun Oct 18 11:22:40 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Oct 18 11:22:40 2026 +0100" }, "message": "DataFormatter: adjust years to 4 digits in a loop rather than recursively (#1443)\n\nadjustTo4DigitYearsIfConfigured recursed once per \"yy\" and searched the\nrest of the format each time, so a long format with many \"yy\" threw\nStackOverflowError when 4 digit years are configured. The loop gives the\nsame output, including stopping at a 3 digit year.\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "9d33c42e5e24b2cfa7698d43e4bf21ab239487c8", "tree": "abb468961523fc8f454ea505a4529bd5f20d8749", "parents": [ "e9e51e10a6daba723b293d2a775308d18565f0b3" ], "author": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Sun Oct 18 11:20:12 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Oct 18 11:20:12 2026 +0100" }, "message": "Avoid quadratic regex backtracking in Context, AbstractWordConverter and MAPIMessage (#1442)\n\n- Context.DOUBLE_PATTERN: make the digit runs possessive.\n- AbstractWordConverter: use atomic groups in the HYPERLINK and PAGEREF\n field patterns so a failing \".*$\" tail is not retried for every\n shorter match.\n- MAPIMessage.guess7BitEncoding: replace the content-type charset regex\n with an equivalent hand-written matcher.\n\nAll changes keep the exact accept/reject results and captured groups.\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "e9e51e10a6daba723b293d2a775308d18565f0b3", "tree": "0f98fad57bd4bb7b1f2e29b738b93dded72b655d", "parents": [ "e1850d7c34bcafe4e46feb60207d006ca990aa4f" ], "author": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Sun Oct 18 11:15:18 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Oct 18 11:15:18 2026 +0100" }, "message": "Formula evaluation: avoid regex backtracking in wildcard criteria, number parsing and IMAGINARY/IMREAL (#1441)\n\nFormula evaluation: avoid exponential/polynomial regex backtracking in wildcard criteria, number parsing and complex numbers\n\n- COUNTIF/SUMIF/AVERAGEIF/*IFS, D* functions and MATCH/VLOOKUP/HLOOKUP/XLOOKUP\n matched wildcard criteria with a regex built from \u0027*\u0027 -\u003e \u0027.*\u0027, which\n backtracks exponentially in the number of \u0027*\u0027. Use a new package-private\n WildcardMatcher (NFA simulation, O(text * criteria)) with the same\n semantics: code points, ASCII-only case folding, \u0027?\u0027 and \u0027*\u0027 not\n matching line terminators, same \u0027~\u0027 escapes. getWildCardPattern is kept.\n- OperandResolver.parseDouble: make the number regex possessive; it accepts\n the same text.\n- IMAGINARY/IMREAL: replace COMPLEX_NUMBER_PATTERN matching with a parser\n that tries the same splits in the same order as the regex, so the groups\n are identical. The public pattern constants are kept.\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "e1850d7c34bcafe4e46feb60207d006ca990aa4f", "tree": "b59eb04be91ba9fe1024c7a7f684f769ac8b4404", "parents": [ "83d5e63bfb30a3014dc15635ba6b33c15479444c" ], "author": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Sun Oct 18 11:07:59 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Oct 18 11:07:59 2026 +0100" }, "message": "Avoid quadratic regex scans of number format strings and embedded file names (#1440)\n\nDataFormatter: remove colours in one pass, replace the [$...] locale/currency\nregex with a scanner that finds the same matches, stop endsWithCommas from\nretrying every comma in a run that is not at the end, and count the scaling\ncommas without repeated substrings. DateUtil: make the first part of\ndate_ptrn3b possessive. EmbeddedData: take the name after the last separator\nwith lastIndexOf instead of a replaceAll. Results are unchanged.\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "83d5e63bfb30a3014dc15635ba6b33c15479444c", "tree": "58ddc6550bd795421568d146db7d07c64a689273", "parents": [ "ce07f720837c6a2260d03662b015ea975c55f54d" ], "author": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Sun Oct 18 10:57:07 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Oct 18 10:57:07 2026 +0100" }, "message": "Avoid quadratic regex backtracking in HeaderFooter.stripFields, OOXMLSignatureFacet and XSLFComment (#1439)\n\n* Avoid quadratic regex backtracking in HeaderFooter.stripFields, OOXMLSignatureFacet and XSLFComment\n\n- HeaderFooter.stripFields: replace the \u0026\".*?,.*?\" replaceAll with an\n equivalent linear scan\n- OOXMLSignatureFacet: anchor the .*/relationships/ and (.*)/_rels/.*\n replaceFirst patterns to line starts with (?\u003c!.), which is where the\n leftmost match starts anyway\n- XSLFComment.setAuthor: anchor the initials pattern to the start of a\n whitespace run with (?\u003c!\\s)\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* Use unicode escapes for line terminator characters in HeaderFooter\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n---------\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "ce07f720837c6a2260d03662b015ea975c55f54d", "tree": "9f89925361d72025be16185920d33345403d7afb", "parents": [ "62322b97f3f1bca39cdcd0b7705973833c74ad25" ], "author": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Sun Oct 18 10:51:16 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Oct 18 10:51:16 2026 +0100" }, "message": "openxml4j: avoid regex backtracking and recursion in part name and content type checks (#1438)\n\n* openxml4j: avoid regex backtracking and recursion when loading part names and content types\n\nPackagePartName.isRelationshipPartURI and PackagingURIHelper.isRelationshipPartURI\nmatched \"^.*/_rels/.*\\.rels$\" and \".*_rels.*.rels$\", which backtrack quadratically\non \"/_rels\" (or \"_rels\") repeated. Both are replaced by indexOf/endsWith checks\nthat give the same result for every string.\n\nContentType matched parameters with \"(;parameter)*$\", which recurses per\nparameter and throws StackOverflowError at around 1,000 parameters. The\nparameters are now matched one at a time with lookingAt.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* Use escapes for U+2028/U+2029 in hasLineTerminator\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n---------\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "62322b97f3f1bca39cdcd0b7705973833c74ad25", "tree": "dad9ee0d55ccfe1b0e2e2eb1070433fded27b449", "parents": [ "4a09f31c041bea8bc0533ea9a8a0ffa30b83c763" ], "author": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Sun Oct 18 09:39:08 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Oct 18 09:39:08 2026 +0100" }, "message": "DataFormatter: avoid quadratic backtracking in fractionPattern (#1437)\n\nIn fractionPattern, find() rescanned a run of # or digits from every\nposition in it, so a format such as \"#\".repeat(20_000) + \"/\" took about\n28 s per format. Lookbehinds stop a match from starting inside a run,\nand possessive quantifiers drop backtracking that could never succeed.\nThe leftmost match and its groups are unchanged.\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "4a09f31c041bea8bc0533ea9a8a0ffa30b83c763", "tree": "8befa2a9b7d4df6a6b26963e021c1800c9583961", "parents": [ "dc577a8cbcdec22ae5547615502d63b2051f35a6" ], "author": { "name": "Nayyar", "email": "nayyar@bugqore.com", "time": "Sun Oct 18 14:08:11 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Oct 18 09:38:11 2026 +0100" }, "message": "DataFormatter: avoid backtracking blowup in rangeConditionalPattern (#1436)\n\nThe constant in rangeConditionalPattern, -?[0-9]*\\.?[0-9]+, can split a\nrun of digits between the two quantifiers in every possible way, so an\nunterminated condition such as \"[\u003c\" followed by many digits backtracks\npolynomially. The pattern is checked on every getFormat call, before the\nformat cache, so the cost is paid for every formatted cell.\n\n-?(?:[0-9]*\\.)?[0-9]+ matches the same strings with a single way to\nmatch a digit run." }, { "commit": "dc577a8cbcdec22ae5547615502d63b2051f35a6", "tree": "6a05d3af96856a75c8fb46c830e7481fe8e45fb5", "parents": [ "a1e954f61cb18b30b00fff2d190556c640fd9f22" ], "author": { "name": "PJ Fanning", "email": "pjfanning@users.noreply.github.com", "time": "Sat Oct 17 22:29:29 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 22:29:29 2026 +0100" }, "message": "WorkbookUtil.validateSheetName: show control chars as U+XXXX (#1435)\n\nFollow-up to #1433. The error for an invalid sheet-name char embedded the\nchar itself, which for 0x0000 and 0x0003 is invisible in logs. Show\ncontrol chars as a code point, and assert the full messages in the tests.\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" } ], "next": "a1e954f61cb18b30b00fff2d190556c640fd9f22" }