Bump ClosedXML from 0.102.3 to 0.104.2

[dependabot]

Bumps ClosedXML from 0.102.3 to 0.104.2.

Release notes

Sourced from ClosedXML's releases.

0.104.2

What's Changed

• Update DocumentFormat.OpenXml due to vulnerability in System.IO.Packaging 8.0.0 by @​jahav in ClosedXML/ClosedXML#2503
• Update RBUsh 4.0.0 due to security analyzer by @​jahav in ClosedXML/ClosedXML#2504

Full Changelog: ClosedXML/ClosedXML@0.104.1...0.104.2

0.104.1

Release notes from 0.102.1 to the 0.104.1.

Summary of breaking changes is available at docs.closedxml.io:

• Migration from 0.102 to 0.103
• Migration from 0.103 to 0.104
• New calculation engine just works in a different way and will behave slightly differently.

OpenXML SDK

OpenXML SDK has released version 3. The 0.104.0 uses it as a dependency.

XLParser replaced with ClosedParser

The XLParser has been replaced with ClosedParser. The key benefits are

• performance - ~2μs/formula, it's likely formulas will be parseable on the demand, necessary for construction of dependency tree
• A1/R1C1 parsing parity - both modes can be parsed with no problems
• AST oriented - it's likely a construction of AST in memory won't even be necessary, just use AST factory to evaluate formula directly

There is also a visualizer to display AST in a browser at https://parser.closedxml.io

Formula Calculation

In previous version, formulas used to be calculated recursively. Each formula checked it's supporting cells for other formulas and if there were some, they were recursively evaluated. There was some logic to decrease number of evaluations. That works for a very simple cases, but isn't very good for various non-happy paths (i.e. cells weren't calculated when they should be).

This version has replaced it with a standard

• dependency tree for checking which formulas are dirty and need to be recalculated
• calculation chain that manages dependencies and order of formulas during calculation

For more info, see docs, the Microsoft has a page about principles Excel Recalculation and there is one with API at docs.closedxml.io.

Structured references

New parser also allows a basic evaluation of structured references. Format of structured reference must use official grammar, not Excel friendly names (e.g. Pastry[@Name] is user-friendly name for Pastry[[#This Row],[Name]]). It's now possible to

using var wb = new XLWorkbook();
var ws = wb.AddWorksheet();
</tr></table> 

... (truncated)

Commits

• 3dfd341 Bump to 0.104.2
• 8154983 Update RBush due to security
• 3e51104 Update DocumentFormat.OpenXml due to vulnerability
• afc6573 Bump version to 0.104.1
• 0dcce42 Bump version to 0.104.0 for release
• c4f5315 Fix typo
• ca1c6aa Remove O(n^2) from pivot cache creation
• 17f9f57 Bump version for release candidate 1
• 22324e9 Add a test for Adobe jpg
• 1b56ff3 Trust length of each section in JPG decoder
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)