Skip to content
Sheetwritev0.5.2

Sheetwrite 0.5.2

Smaller npm packages, lower CSV import memory, shifted keyboard shortcuts, the Brotli security update for Bun and Node, redesigned documentation, and the upgrade checklist for Sheetwrite 0.5.2.
npm install @sheetwrite/core@0.5.2
Update each adapter and add-on you use to 0.5.2 too: all packages release together.
On this page

Sheetwrite 0.5.2 makes the npm packages smaller, lowers CSV import memory, and runs shortcuts with Shift or Alt and a digit or symbol. It has no API changes. All seven packages release as 0.5.2.

Highlights

  • Smaller packages. Downloads are 4.5% smaller and installs 13.2% smaller.
  • Lower CSV import memory. Peak memory for a 1,000,000-row import is 21 MiB (9.6%) lower.
  • Shifted shortcuts run. Mod+Shift+1 runs when the browser reports !.
  • Patched runtimes. Development and release builds use Bun 1.4.4 and Node 26.12.1, which fix a Brotli decoder vulnerability.

Changes

Smaller packages

Published JavaScript has no comments and less whitespace. Module paths, exported names, type documentation, and WebAssembly binaries do not change.

PackageDownload beforeDownload afterInstall beforeInstall after
@sheetwrite/core348.8 KiB315.1 KiB1.62 MiB1.22 MiB
@sheetwrite/wasm352.2 KiB345.8 KiB1002.6 KiB963.3 KiB
@sheetwrite/formulas471.1 KiB464.0 KiB1.26 MiB1.22 MiB
@sheetwrite/xlsx52.5 KiB44.8 KiB228.4 KiB165.9 KiB
@sheetwrite/react5.9 KiB5.6 KiB18.6 KiB15.9 KiB
@sheetwrite/vue6.9 KiB6.7 KiB21.5 KiB18.7 KiB
@sheetwrite/svelte5.9 KiB5.9 KiB16.2 KiB16.2 KiB

Downloads are npm pack tarball sizes; installs are unpacked sizes. The performance page records the size of every published release.

Lower CSV import memory

fromCsv reuses its parsed arrays for visible columns instead of copying them. For a 1,000,000-row, two-column import, peak memory falls from 218.2 MiB to 197.2 MiB. The median import time does not change.

Shortcuts with Shift or Alt

With Shift or Alt held, a browser reports the changed character, such as ! for Shift+1. A key combination with a digit or symbol now also matches the physical key, so Mod+Shift+1 and Mod+Shift+/ run. Letters and digits keep their meaning on other keyboard layouts: on AZERTY, the A key runs Mod+Shift+A. See Keyboard shortcuts.

Brotli security update

Bun 1.4.3 and Node 26.9.0 have a Brotli decoder out-of-bounds write (CVE-2026-111497). The Sheetwrite packages do not decode Brotli, so their code is not affected. Development, CI, and release builds now use Bun 1.4.4 and Node 26.12.1.

If your server or build runs Bun or Node, update it too: Bun 1.4.4, or Node 26.12.1, 24.22.1, or 22.23.4.

Documentation

  • Install commands have npm, pnpm, Yarn, and Bun tabs. The choice persists on every page.
  • The formula reference has a search by name and a filter by engine.
  • Release notes and the performance page show results as charts with actual times and memory.
  • Code examples in hovers have syntax colors, and their "See also" links open.
  • Showcases explain their empty states before the first run, and their grids follow the site theme.

Upgrade checklist

  1. EveryoneRequired

    Update every package together

    Install 0.5.2 for each @sheetwrite/* package that you use. Packages from different versions are not supported together.

    corewasmformulasxlsxreactvuesvelte

  2. If you run Bun or NodeRecommended

    Update your runtime

    Use Bun 1.4.4, or Node 26.12.1, 24.22.1, or 22.23.4, for the Brotli decoder fix.

  3. If you upgrade from before 0.5.1Also do

    Complete the earlier steps first

    Read the 0.5.1 upgrade checklist and, before that, the 0.5.0 upgrade checklist.

Documentation