chore(deps): update rust crate calamine to 0.33

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
calamine	dependencies	minor	0.24 → 0.33

---

Release Notes

tafia/calamine (calamine)

v0.33.0

Compare Source

Added

• Added support for reading data from Pivot Tables, which involves reading data
  from the internal Pivot Cache. PR #​559.

Changed

• Update dependencies for release 0.33.0:

  • zip: 4.2.0 -> 7.0.
  • atoi_simd: 0.16 -> 0.17

Fixed

• Fixed potential memory exhaustion issue in ODS files that could be triggered
  via repeated empty rows/columns.

  The fix adds limits to prevent memory exhaustion from malicious ODS files that
  declare billions of repeated cells via table:number-rows-repeated and
  table:number-columns-repeated attributes.

  The change adds the following protection layers:

  • Add cap for columns per row at MAX_COLUMNS (16,384).
  • Add cap for total row repeats at MAX_ROWS (1,048,576).
  • Add cap for total cells at MAX_CELLS (100 million) in get_range().

  These limits match XLSX's existing row/column limits and prevent a 7KB
  malicious file from attempting to allocate memory for 17+ billion cells.

  When MAX_CELLS is exceeded, return OdsError::CellLimitExceeded instead
  of silently returning an empty range. This ensures callers are properly
  informed of truncation rather than receiving silent data loss.

  Issue #​594, PR #​596.

• Fixed an issue where XLSX files with tables that had the internal insertRow
  attribute set returned a Dimensions object where the end row was less than
  the start row. This caused an assert/panic when trying to create a Range
  object to return the table range. Issue #​589.

• Fixed an issue with XLSX files where worksheet tables used the unusual, but
  valid, absolute reference system like "/xl/tables/table1.xml" instead of the
  common Excel generated relative system "../tables/table1.xml". Issue #​587.

v0.32.0

Compare Source

Changed

• Refactored VBA reading functions to be on-demand for better performance.

• Simplified vba_project() function return type from Option<Result<T>> to
  Result<Option<T>> for more idiomatic error handling. This is a breaking
  change.

Fixed

• Fixed out-of-memory vulnerabilities in XLS file parsing by bounding
  allocations.

• Fixed and extended support for XLSX shared formulas with handling of ranges,
  absolute references, and column/row ranges in XLSX files.

• Fixed XLSX issue with missing shared string sub-elements. Also improved error
  messages for shared string parsing issues.

• Fixed acceptance of XLS XLUnicodeRichExtendedString records without reserved
  tags.

• Fixed various edge cases in XLS handling that could lead to parsing errors.

v0.31.0

Compare Source

Changed

• Upgraded quick-xml to v0.38. This was a significant change in quick-xml
  relative to v0.37 and required changes in calamine to entity handling. It
  also fixes EOL handling which may lead to regressions in calamine
  applications if they expected to see "\r\n" in strings instead of the
  correct (for XML and Excel) "\n".

  For most users these will be inconsequential changes but please take note
  before upgrading production code.

• Renamed the "dates" feature flag to "chrono" since there is now some
  native date handling features without "chrono". The "chrono" flag is more
  specific and accurate. The "dates" flag is still supported as before for
  backward compatibility.

  This change also made some datatype methods related to date/times available in
  the "default" feature set. They were previously hidden unnecessarily behind
  the "dates/"chrono" flag.

Added

• Added a conversion function to ExcelDateTime to convert the inner serial
  Excel datetime to standard year, month, date, hour, minute, second and
  millisecond components. Works for 1900 and 1904 epochs.

Fixed

• Fixed issue where Excel xlsx shared formula failed if it contained Unicode
  characters. Issue #​553.

• Fixed issue where Excel XML escapes in strings weren't unescaped. For example
  "_x000D_" -> "\r". Issue #​469.

v0.30.1

Compare Source

Added

• Added Debug and Clone to Table for easier debugging. PR #​547.

Fixed

• Fixed issue Issue #​548 for xls files where the SST record had an incorrect
  number of unique strings.

v0.30.0

Compare Source

Changed

• Unpinned the zip.rs dependency from v4.2.0 to allow cargo to choose the
  correct version for the user's rustc version.

  The Rust MSRV was bumped to v1.75.0 (which it should have been for for
  zip.rs compatibility in previous releases).

  See the discussion at Issue #​527.

v0.29.0

Compare Source

Added

• Add additional documentation and examples for the Range, Cell, XlsxError
  and Table structs, and Xlsx Table and Merge methods. Issue #​459

Changed

• Pin zip.rs to v4.2.0.

  The current latest release of zip.rs, v4.3.0, requires a MSRV of v1.85.0.
  This release pins zip.rs to v4.2.0 to allow users to maintain a MSRV of
  v1.73.0 for at least one more release. It is likely that calamine v0.30.0 or
  later will move back to the latest zip.rs v4.x and require rustc v1.85.0.

Fixed

• Fixed issue where XLSX files had Windows style directory separators for
  internal paths instead of the required Unix style separators. Issue #​530.
• Fixed several XLS parsing issues which could lead to out-of-memory errors. PR
  #​525.
• Fixed numeric underflow in Xlsx::from_sparse() and also ensured that the
  associated Range of cells would be in row-column order. PR #​524.

v0.28.0

Compare Source

Changed

• Bump zip to 4.0.

v0.27.0

Compare Source

Added

• (xls): add one more Error variant related to formatting.

Changed

• Bump dependencies.
• (xls): Invalid formats parsing.
• Always parse string cell as string.
• Pin zip crate to 2.5.
• (xlsx): check 'closing' tag name with more prefixes.

v0.26.1

Compare Source

Fixed

• Sparse cells expect 0 index rows, even when using header_row.

v0.26.0

Compare Source

Added

• Ability to merge cells from xls and xlsx.
• Options to keep first empty rows for xlsx.
• Support consecutive repeated empty cells for ods.
• New header_row config.

Changed

• Bump MSRV to 1.73.
• Fix broken links in README.
• Enable dates and pictures features in docs.rs build.
• Fix broken fuzzer.

v0.25.0

Compare Source

Added

• Add is_error and get_error methods to the DataType trait.
• Add deserializer helper functions.
• Support getting merged region.
• Range::headers method.
• Expose some Dimensions methods.

Changed

• Use OnceLock instead of once_cell crate (MSRV: 1.71).

Fixed

• Use case insensitive comparison when searching for file in xlsx.
• Do not panic when reading cell format with invalid index.

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.