github.com/xuri/excelize/v2 v2.11.0

Why

• warnVulnerability

  Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks in github.com/xuri/excelize (fixed in 2.11.1-0.20260915055537-22f76f9acb94)

• warnVulnerability

  Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days in github.com/xuri/excelize (fixed in 2.11.1-0.20260930021559-01a9ff32fb3c)

• warnVulnerability

  Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element in github.com/xuri/excelize (fixed in 2.11.1-0.20260929015830-8ffeb07ec9a3)

• warnVulnerability

  Mutually-referencing array formulas recurse unboundedly, causing a fatal stack overflow in github.com/xuri/excelize (fixed in 2.11.1-0.20260911060113-ea12859e43c6)

• warnVulnerability

  Panic and memory exhaustion via unbounded CFB stream allocation in github.com/xuri/excelize (fixed in 2.11.1-0.20260912113515-5f636f9dcde5)

• warnVulnerability

  Panic via unchecked pivot-cache field index in github.com/xuri/excelize/v2 (fixed in 2.11.1-0.20261003002531-6258dcebc4e2)

• warnVulnerability

  Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks (fixed in 2.11.1-0.20260915055537-22f76f9acb94)

• warnVulnerability

  Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml (fixed in 2.11.1-0.20260731010303-ae2113b410e5)

• warnVulnerability

  Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics (fixed in 2.11.1-0.20260908032718-ecd99d761fe0)

• warnVulnerability

  Excelize: a row whose earlier cell has a higher column reference than its last cell panics index out of range on almost every worksheet read API (fixed in 2.11.1-0.20260816084418-46a5eb289448)

• warnVulnerability

  Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rows (fixed in 2.11.1-0.20260910071107-696050fbf14e)

• warnVulnerability

  Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process (fixed in 2.11.1-0.20260807015645-a54c578af309)

• warnVulnerability

  Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader (fixed in 2.11.1-0.20260805032953-db93f8d89de7)

• warnVulnerability

  Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref (fixed in 2.11.1-0.20260820023833-99903a3240e5)

• warnVulnerability

  Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile (fixed in 2.11.1-0.20260906004932-2badfcd5841d)

• warnVulnerability

  Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days (fixed in 2.11.1-0.20260930021559-01a9ff32fb3c)

• warnVulnerability

  Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic (fixed in 2.11.1-0.20261003002531-6258dcebc4e2)

• warnVulnerability

  Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element (fixed in 2.11.1-0.20260929015830-8ffeb07ec9a3)

• warnVulnerability

  Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil check (fixed in 2.11.1-0.20260812075026-be7a16390fa6)

• warnVulnerability

  Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflow (fixed in 2.11.1-0.20260911060113-ea12859e43c6)

• warnVulnerability

  Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS (fixed in 2.11.1-0.20260912113515-5f636f9dcde5)

What the code does

On its own this is weak signal: plenty of honest libraries read files or talk to the network. What PkgFire watches is a release gaining something the one before it did not.