Excelize 2.11.1 Released - Powerful open-source library for spreadsheet (Excel) document

Excelize is a library written in pure Go providing a set of functions that allow you to write to and read from XLAM / XLSM / XLSX / XLTM / XLTX files. Supports reading and writing spreadsheet documents generated by Microsoft Excel™ 2007 and later. Supports complex components by high compatibility, and provided streaming API for generating or reading data from a worksheet with huge amounts of data.

GitHub: github.com/xuri/excelize

We are pleased to announce the release of version 2.11.1. Featured are a handful of new areas of functionality and numerous bug fixes.

A summary of changes is available in the Release Notes. A full list of changes is available in the changelog.

Release Notes

The most notable changes in this release are:

Breaking Change

• Upgraded requirement: Go language version is Go 1.26.0 or later, due to upgrading dependency package golang.org/x/crypto

Security

• Fixed a panic when getting a cell value with a negative shared string index (CVE-2026-104819), related security advisory GHSA-48hm-4h8j-58fg
• Fixed a GetPivotTables panic on invalid pivot table field indices (CVE-2026-107211), related security advisory GHSA-mx22-3794-2vpv
• Fixed an unbounded row number in the rows iterator (CVE-2026-107212), related security advisory GHSA-jw42-f3rr-4cc3
• Fixed a GetSlicers panic when getting slicers from a worksheet without a drawing part (CVE-2026-107213), related security advisory GHSA-r7x5-4969-99p7
• Fixed a panic when decrypting a malformed workbook (CVE-2026-107214), related security advisory GHSA-2j4c-ffch-9f23
• Fixed unbounded EncryptionInfo and EncryptedPackage stream sizes being allocated when decrypting a workbook (CVE-2026-107215), related security advisory GHSA-x2q3-8cjh-766f
• Fixed a CalcCellValue stack overflow caused by circular ANCHORARRAY formula references (CVE-2026-107216), related security advisory GHSA-wp2g-vpjj-g53r
• Fixed ColumnNameToNumber and JoinCellName accepting invalid column names, which caused integer overflow (CVE-2026-107217), related security advisory GHSA-c85p-xxjj-2r75
• Fixed Unicode handling and count overflow in the LEFT, LEFTB, RIGHT, and RIGHTB formula functions (CVE-2026-107218), related security advisory GHSA-8jjq-8j9w-m2v6
• Fixed an unbounded spin count when deriving the agile decryption key (CVE-2026-107219), related security advisory GHSA-jrfj-fhj2-jjvm
• Fixed a panic on a worksheet with an empty merged cell reference (CVE-2026-107220), related security advisory GHSA-g27h-8qhm-6pff
• Fixed a panic on a row whose cells are not in ascending column order (CVE-2026-107221), related security advisory GHSA-8mcq-6wmr-jrjv
• Fixed a GetConditionalFormats panic on malformed conditional formatting rules (CVE-2026-107222), related security advisory GHSA-rxcj-4pj5-74gr
• Fixed an overflow of the minimum and maximum column numbers (CVE-2026-107223), related security advisory GHSA-fq3v-74gv-27gm
• Fixed a panic by rejecting Zip64 uncompressed sizes that do not fit in a signed int64 (CVE-2026-107224), related security advisory GHSA-fw94-4wwp-w8pw
• Fixed a panic when getting styles with a negative style index (CVE-2026-107225), related security advisory GHSA-5h23-36rv-pm65

Notable Features

• Added new EmbeddedObject data type
• Added 2 new constants, MaxCFBStreamSizeV3 and MaxCFBStreamSizeV4
• Added new function GetShapes to support get shape, related issue 436
• Added new functions GetEmbeddedObjects and SetGetEmbeddedObject to support get and set embedded objects, related issues 158 and 2186
• The CalcCellValue function now supports matrix arguments in the AND formula function
• The SetConditionalFormat function now validates the style index, related issue 2400

Compatibility Improvements

• Aligned the numeric precision of values stored by the SetCellValue function with Microsoft Excel™, related issue 1757

Bug Fixes

• Fixed the GetPictures function not returning the edit positioning in some cases, resolved issue 2217
• Fixed the CalcCellValue function returning incorrect results when error values appear inside parentheses or operators, resolved issues 1164 and 2344
• Fixed the CalcCellValue function not returning the expected error in some cases, resolved issues #2349 and #2432
• Fixed the CalcCellValue function returning incorrect results for 16 formula functions: COUNT, COUNTA, EDATE, HLOOKUP, IF, INDIRECT, ISNUMBER, MDETERM, MINVERSE, OR, SUM, TRIM, VALUE, VLOOKUP, WEEKDAY and XLOOKUP, resolved issues #2411, #2412, #2413, #2414, #2415, #2416, #2417, #2430, #2436, #2439, and #2445
• Fixed a CalcCellValue panic on unbalanced closing parentheses in a formula, resolved issue 2409
• Fixed a CalcCellValue panic when calculating the AVERAGEIFS, COUNTIFS, MAXIFS, MINIFS, PERCENTILE.EXC and SUMIFS formula functions with invalid arguments, resolved issue 2426
• Fixed the AddChart and AddChartSheet functions generating invalid charts that corrupted the workbook in some cases, resolved issues #2355 and #2356
• Fixed stream writer not applying number formatting to duration cell values, resolved issue 2371
• Fixed precision loss when setting cell values with time.Duration, resolved issue 2372
• Fixed the AddSlicer function reusing the pivot table slicer cache for different fields, resolved issue 2383
• Fixed the GetStyle function returning an invalid style for fills without a pattern, resolved issue 2384
• Fixed the GetFormControls and GetTables functions being unable to get form controls and tables when the workbook uses absolute paths, resolved issue 2386
• Fixed the GetPanes function being unable to get split panes in some cases, resolved issue 2387
• Fixed the SetCalcProps function being unable to set calculation properties to false, resolved issue 2404
• Fixed the ExcelDateToTime function returns dates one day early for January and February 1900, resolved issue 2466

Miscellaneous

• Updated dependencies
• Updated unit tests and godoc
• Updated the documentation website, which is available in 12 languages: Arabic, German, English, Spanish, French, Italian, Japanese, Korean, Portuguese, Russian, Simplified Chinese and Traditional Chinese
• Released an updated excelize-wasm NPM package for WebAssembly / JavaScript support
• Released an updated excelize-py PyPI package for Python
• Released an updated ExcelizeCs NuGet package for C# / .NET

Thank you

Thanks to all the contributors to Excelize. Below is a list of contributors who made code contributions in this version:

• Aprax14 (Damiano Scarpellini)
• xixixi1118
• zhouxuanyu1204-bot (ZHOU XUANYU)
• lzoeydzdnn
• arpitjain099 (Arpit Jain)
• n0liu (Roland)
• 1436761858 (LP-LDY)
• yashisrani (Yash Israni)
• alliasgher (Ali Asghar)
• ensiouel
• a3190778733-pixel (shixia)
• Nayjest (Vitalii Stepanenko)
• ValeryVerkhoturov (Valery)
• freeeve (Eve Freeman)
• saifulferoz (Feroz)
• lmonstergg
• pcvelz (Peter van Velzen)
• askalf (Thomas Sprayberry)
• zac-scheiwe (Zac Scheiwe)
• lrweck (Luis)
• akashchamp
• PhilflowIO (Philipp Lütje)
• White0xdi3 (Jnyandeep Koyya)
• keithadler (Keith Adler)
• EpicHigh (Prasit Tongpradit)
• wangyica879112 (ChangAo)
• yl030628 (YL)
• prostomarkeloff (prostomarkeloff)
• Gabik21
• Alifarid0011 (AliFarid)