diff --git a/website/blog/2026-10-07-apache-fesod-2-1-0-incubating-released.md b/website/blog/2026-10-07-apache-fesod-2-1-0-incubating-released.md new file mode 100644 index 000000000..2b3b41b1e --- /dev/null +++ b/website/blog/2026-10-07-apache-fesod-2-1-0-incubating-released.md @@ -0,0 +1,137 @@ +--- +title: "Apache Fesod (Incubating) 2.1.0-incubating Officially Released" +description: "The Apache Fesod community is pleased to announce the official release of Apache Fesod (Incubating) 2.1.0-incubating." +authors: [alaahong] +tags: [announcement, release] +--- + + + +**October 2026** — The Apache Fesod (Incubating) community is pleased to announce the official release of **Apache Fesod (Incubating) 2.1.0-incubating**. + +This release continues Fesod's steady evolution under the Apache Software Foundation (ASF) Incubator. With **110 pull requests** merged by contributors from around the world, it delivers significant new capabilities for column-based reading and writing, enhanced Excel format compatibility, performance optimizations, and strengthened supply-chain security through fully reproducible builds. + + + +## Milestone Significance: From Compliance to Capability + +After laying a solid compliance and governance foundation in the 2.0.x releases, version 2.1.0 marks Fesod's transition from "getting the house in order" to **shipping meaningful new features at scale**: + +* **110 PRs Merged:** Covering features, bug fixes, refactoring, documentation, testing, and build automation. +* **10 New Contributors from Four Countries:** Hailing from **China, Ireland, Latvia, and South Korea**, this release's contributors reflect Fesod's growing international reach. +* **Reproducible Builds:** Fixed `project.build.outputTimestamp` guarantees byte-for-byte reproducible artifacts — a key supply-chain security improvement. +* **Security Hardening:** Remote URL image access now requires an explicit allowlist, and multiple dependency vulnerabilities (XXE, CVE fixes) were resolved. + +## Key Highlights + +### 1. New Features for Flexible Excel Processing + +* **Freeze Pane Support:** Freeze rows and columns when writing via the `@FreezePane` annotation or a custom `WriteHandler`. +* **Column-Based Reading for XLS and CSV:** In addition to existing column-based reading for XLSX, `2.1.0` extends column-level read control to legacy **XLS** and **CSV** files, letting you read only the columns you need. +* **Fluent Header API for No-Bean Mode:** Build headers programmatically with a fluent API when you are not using annotated beans. +* **`java.time.LocalTime` Converters:** Native conversion support for `LocalTime` values in read and write paths. +* **Image Converter Refinement:** `StringImageConverter` was split into dedicated `Pathname` and `Base64` converters for clearer, safer image handling. +* **Performance:** Date and number formatters are now cached to reduce repeated parsing overhead during large reads. + +### 2. Security & Compliance + +* **Remote URL Image Allowlist:** `read` now requires an explicit allowlist for remote URL images, mitigating SSRF-style risks. +* **Reproducible Builds:** Fixed timestamps produce identical artifacts across builds, enabling community verification of published binaries. +* **Incubating Compliance:** `DISCLAIMER` files are now bundled into both binary and sources JARs under `META-INF`. +* **Dependency Hardening:** Upgraded `assertj-core` (XXE fix), `fastjson2`, `slf4j`, and npm dependencies to resolve known vulnerabilities. + +### 3. Stability & Robustness + +* **Legacy Format Fixes:** XLS BIFF8 encryption is now correctly applied (previously broken by premature password clearing). +* **Correct Date Handling:** Fixed `java.sql.Date/Time` handling in CSV cells and `1904` windowing fallback for `@DateTimeFormat` defaults. +* **Template Fill on Windows:** Resolved fill-template copy failures on Windows platforms. +* **Batch Read Integrity:** Fixed `PageReadListener` duplicate rows when switching sheets, and copied sheet-level read parameters to sheet holders. + +## A Global Community + +"Community Over Code" comes alive in the geography of this release. The **16 named contributors** behind 2.1.0-incubating span four countries: + +* **China (13):** Suzhou (3), Hangzhou (1), Tianjin (1), Beijing (1), and other cities (7). +* **Ireland (1):** Kilkenny. +* **Latvia (1).** +* **South Korea (1).** + +From column-based reading to freeze panes, these features were shaped through international collaboration — code reviews, discussions, and testing carried out across time zones. This diversity is the engine driving Fesod's steady progress under the ASF Incubator. + +## Key Changes at a Glance + +### **Features** + +* Added freeze pane support via `@FreezePane` or `WriteHandler`. +* Added column-based reading for XLS and CSV files. +* Added fluent header API for no-bean mode. +* Split `StringImageConverter` into `Pathname` and `Base64` converters. +* Added `java.time.LocalTime` converters. +* Added column index limit support in `ReadSheet`. +* Registered `EscapeHexCellWriteHandler` by default for XLSX. + +### **Bugfixes** + +* Fixed XLS BIFF8 encryption not being applied. +* Fixed `CsvCell` crashes on `java.sql.Date/Time` values. +* Fixed `PageReadListener` duplicate rows between sheets. +* Fixed Windows fill-template copy failures. +* Fixed `1904` windowing fallback for `@DateTimeFormat` defaults. +* Fixed `_xHHHH_` escape decoding in inline string cells. + +### **Refactoring** + +* Unified and overloaded `readSheet` methods for flexible usage. +* Replaced list-based column lookups with `ColumnIndexResolver`. +* Generated trivial accessors with Lombok. +* Removed the `fesod-examples` module. + +> For a detailed list of changes, please refer to the [GitHub Release Notes](https://github.com/apache/fesod/releases/tag/2.1.0-incubating) and the [full changelog](https://github.com/apache/fesod/compare/2.0.2-incubating...2.1.0-incubating). + +## Acknowledgments + +"Community Over Code" is the core philosophy of the Apache Software Foundation. We would like to thank all the developers, mentors, and community members who contributed to this release. + +### New Contributors + +We would like to extend a warm welcome and a special thank you to the **10 new members** who made their first contribution in this release: + +> @32154678925, @skytin1004, @sapienza88, @Duansg, @nkuprins, @Aias00, @xleoken, @leehaut, @codeAnqiang-ma, @Mikkey-f + +Special thanks to **@alaahong, @delei, @psxjoy, @bengbengbalabalabeng, @nkuprins, @sapienza88, @GOODBOY008, @pjfanning**, and everyone who submitted PRs and suggestions on GitHub. Your dedication to features, bug fixing, testing, and release management made this release possible. + +## How to Get Involved + +You can download and experience the new Apache Fesod (Incubating) through the following channels: + +* **Official Website:** [https://fesod.apache.org/](https://fesod.apache.org/) +* **Source Code:** [https://github.com/apache/fesod](https://github.com/apache/fesod) +* **Maven Central:** + +```xml + + org.apache.fesod + fesod-sheet + 2.1.0-incubating + +``` + +**Join Us!** +The Apache Fesod (Incubating) community is always open to new contributors. You can reach out to us by subscribing to the mailing list at `dev@fesod.apache.org` or by submitting issues on GitHub. + +We look forward to growing together within the Apache Incubator! diff --git a/website/i18n/zh-cn/docusaurus-plugin-content-blog/2026-10-07-apache-fesod-2-1-0-incubating-released.md b/website/i18n/zh-cn/docusaurus-plugin-content-blog/2026-10-07-apache-fesod-2-1-0-incubating-released.md new file mode 100644 index 000000000..26cb153e5 --- /dev/null +++ b/website/i18n/zh-cn/docusaurus-plugin-content-blog/2026-10-07-apache-fesod-2-1-0-incubating-released.md @@ -0,0 +1,137 @@ +--- +title: "Apache Fesod (Incubating) 2.1.0-incubating 正式发布" +description: "Apache Fesod (Incubating) 社区欣然宣布，Apache Fesod (Incubating) 2.1.0-incubating 版本正式发布！" +authors: [alaahong] +tags: [announcement, release] +--- + + + +**2026年10月** —— Apache Fesod (Incubating) 社区欣然宣布，**Apache Fesod (Incubating) 2.1.0-incubating 版本正式发布！** + +这是 Fesod 在 **Apache 软件基金会 (ASF)** 孵化器治理下持续推进的一次版本迭代。本版本共合并 **110 个 Pull Request**，汇聚了来自全球各地贡献者的智慧，带来了按列读写等重磅新能力、更完善的 Excel 格式兼容性、性能优化，并通过完全可复现的构建进一步强化了供应链安全。 + + + +## 里程碑意义：从合规走向能力 + +在 2.0.x 系列打牢合规与治理基础之后，2.1.0 标志着 Fesod 从"整理内务"转向**规模化交付新功能**： + +* **110 个 PR 合并：** 涵盖新功能、缺陷修复、重构、文档、测试与构建自动化等各个方面。 +* **10 位新贡献者，来自四个国家：** 中国、爱尔兰、拉脱维亚与韩国——社区持续成长，国际化程度日益加深。 +* **可复现构建：** 通过固定的 `project.build.outputTimestamp` 实现字节级一致的可复现构件，这是供应链安全的关键改进。 +* **安全加固：** 远程 URL 图片访问必须显式加入白名单，同时修复了多项依赖漏洞（含 XXE、CVE）。 + +## 版本核心亮点 + +### 1. 新特性：更灵活的 Excel 处理 + +* **冻结窗格（Freeze Pane）：** 写入时可通过 `@FreezePane` 注解或自定义 `WriteHandler` 冻结行与列。 +* **XLS 与 CSV 按列读取：** 在原有 XLSX 按列读取的基础上，2.1.0 将列级读取控制扩展至老旧的 **XLS** 与 **CSV** 文件，可按需只读取所需列。 +* **无 Bean 模式流式表头 API：** 不使用注解 Bean 时，可通过流式 API 以编程方式构建表头。 +* **`java.time.LocalTime` 转换器：** 读写链路原生支持 `LocalTime` 值的转换。 +* **图片转换器精细化：** `StringImageConverter` 拆分为专用的 `Pathname` 与 `Base64` 两个转换器，图片处理更清晰、更安全。 +* **性能提升：** 日期与数字格式化器现在会被缓存，减少大规模读取时的重复解析开销。 + +### 2. 安全与合规 + +* **远程 URL 图片白名单：** `read` 要求远程 URL 图片必须显式加入白名单，规避 SSRF 类风险。 +* **可复现构建：** 固定时间戳使构件在多次构建间完全一致，便于社区验证已发布二进制产物。 +* **孵化器合规：** `DISCLAIMER` 文件现已随二进制与源码 JAR 一起打包至 `META-INF` 目录。 +* **依赖加固：** 升级 `assertj-core`（修复 XXE）、`fastjson2`、`slf4j` 及 npm 依赖，修复已知漏洞。 + +### 3. 稳定性与健壮性 + +* **老旧格式修复：** XLS BIFF8 加密现在可以正确生效（此前因密码过早清除而失效）。 +* **日期处理修正：** 修复 CSV 单元格中 `java.sql.Date/Time` 的处理，以及 `@DateTimeFormat` 默认值下的 1904 日期系统回退。 +* **Windows 模板填充：** 修复 Windows 平台上的填充模板复制失败问题。 +* **分批读取完整性：** 修复 `PageReadListener` 在切换 Sheet 时产生的重复行，并将 Sheet 级读取参数复制到 Sheet holder。 + +## 全球化的开源社区 + +"社区优于代码"在本版本的贡献者版图上得到了生动体现。2.1.0-incubating 的 **16 位具名贡献者** 遍布四个国家： + +* **中国（13 位）：** 苏州 3 位、杭州 1 位、天津 1 位、北京 1 位，以及其他城市 7 位。 +* **爱尔兰（1 位）：** Kilkenny。 +* **拉脱维亚（1 位）。** +* **韩国（1 位）。** + +从按列读取到冻结窗格，这些新特性都是在跨时区的国际协作中——代码评审、讨论与测试——打磨成型的。正是这种多样性，驱动着 Fesod 在 ASF 孵化器治理下稳步前行。 + +## 关键变更概览 + +### **新功能 (Feature)** + +* 通过 `@FreezePane` 或 `WriteHandler` 支持冻结窗格。 +* 支持 XLS 与 CSV 文件的按列读取。 +* 新增无 Bean 模式的流式表头 API。 +* `StringImageConverter` 拆分为 `Pathname` 与 `Base64` 转换器。 +* 新增 `java.time.LocalTime` 转换器。 +* `ReadSheet` 支持列索引上限。 +* 默认注册 `EscapeHexCellWriteHandler` 以支持 XLSX。 + +### **修复 (Bugfix)** + +* 修复 XLS BIFF8 加密未生效的问题。 +* 修复 `CsvCell` 处理 `java.sql.Date/Time` 时崩溃的问题。 +* 修复 `PageReadListener` 在 Sheet 间产生重复行的问题。 +* 修复 Windows 平台填充模板复制失败的问题。 +* 修复 `@DateTimeFormat` 默认值下的 1904 日期系统回退。 +* 修复内联字符串单元格中 `_xHHHH_` 转义的解码问题。 + +### **重构 (Refactor)** + +* 统一并重载 `readSheet` 方法，使用更灵活。 +* 使用 `ColumnIndexResolver` 取代基于列表的列查找。 +* 使用 Lombok 生成简单访问器。 +* 移除 `fesod-examples` 模块。 + +> 详细的变更列表请参考：[GitHub Release Notes](https://github.com/apache/fesod/releases/tag/2.1.0-incubating) 以及 [完整变更日志](https://github.com/apache/fesod/compare/2.0.2-incubating...2.1.0-incubating)。 + +## 致谢 + +"社区优于代码"是 Apache 的核心理念。感谢所有为此版本做出贡献的开发者、Mentors 以及社区成员。 + +### 新贡献者 (New Contributors) + +我们要特别欢迎并感谢在该版本中做出首次贡献的 **10 位新成员**： + +> @32154678925, @skytin1004, @sapienza88, @Duansg, @nkuprins, @Aias00, @xleoken, @leehaut, @codeAnqiang-ma, @Mikkey-f + +特别感谢 **@alaahong, @delei, @psxjoy, @bengbengbalabalabeng, @nkuprins, @sapienza88, @GOODBOY008, @pjfanning** 以及所有在 GitHub 上提交 PR 和建议的朋友们。正是你们在功能开发、缺陷修复、测试与发布管理上的付出，才促成了本次版本的成功发布。 + +## 如何获取 + +你可以通过以下渠道下载并体验全新的 Apache Fesod (Incubating) ： + +* **官方网站：** [https://fesod.apache.org/](https://fesod.apache.org/) +* **源码仓库：** [https://github.com/apache/fesod](https://github.com/apache/fesod) +* **Maven 坐标：** + +```xml + + org.apache.fesod + fesod-sheet + 2.1.0-incubating + +``` + +**欢迎加入我们！** +Apache Fesod (Incubating) 社区始终对开发者保持开放。你可以通过订阅邮件列表 `dev@fesod.apache.org` 或在 GitHub 上提交 Issue 与我们交流。 + +让我们共同期待 Fesod 在 Apache 孵化器中茁壮成长！