Release Apache Fesod 2.1.0-incubating

[alaahong]

Release: Apache Fesod 2.1.0-incubating

Release Manager: Zhang Zhe
Release train: 2.x
Base branch: main
Previous release: 2.0.2-incubating

In scope

95 merged PRs since 2.0.2-incubating (2026-05-14).

Features

• feat: support freeze pane via @FreezePane or register WriteHandler on write #916 feat: support freeze pane via @FreezePane or register WriteHandler on write (feat: support freeze pane via @FreezePane or register WriteHandler on write #916)
• feat: split StringImageConverter into Pathname and Base64 #934 feat: split StringImageConverter into Pathname and Base64 (feat: split StringImageConverter into Pathname and Base64 #934)
• feat: add support for column index limit in ReadSheet #942 feat: add support for column index limit in ReadSheet (feat: add support for column index limit in ReadSheet #942)
• feat: add fluent header api for no-bean mode #943 feat: add fluent header api for no-bean mode (feat: add fluent header api for no-bean mode #943)
• feat: cache date and number formatters #948 feat: cache date and number formatters (feat: cache date and number formatters #948)
• feat: add support for column-based reading of XLS files #981 feat: add support for column-based reading of XLS files (feat: add support for column-based reading of XLS files #981)
• feat: add support for column-based reading of CSV files #982 feat: add support for column-based reading of CSV files (feat: add support for column-based reading of CSV files #982)
• feat: add java.time.LocalTime converters #1032 feat: add java.time.LocalTime converters (feat: add java.time.LocalTime converters #1032)
• feat: require an allowlist for remote URL images #1035 feat: require an allowlist for remote URL images (feat: require an allowlist for remote URL images #1035)
• feat: registered EscapeHexCellWriteHandler in DefaultWriteHandlerLoader for XLSX #1044 feat: registered EscapeHexCellWriteHandler in DefaultWriteHandlerLoader for XLSX (feat: registered EscapeHexCellWriteHandler in DefaultWriteHandlerLoader for XLSX #1044)
• feat: upgrade slf4j to 2.0.18 and replace logback with slf4j-simple (#905) #1046 feat: upgrade slf4j to 2.0.18 and replace logback with slf4j-simple ([Enhancement] Upgrade slf4j from 1.7.36 to 2.x Version? #905) (feat: upgrade slf4j to 2.0.18 and replace logback with slf4j-simple (#905) #1046)

Bug fixes

• fix: fix error in using relativeHeadRowIndex for writing tables only #810 fix: fix error in using relativeHeadRowIndex for writing tables only (fix: fix error in using relativeHeadRowIndex for writing tables only #810)
• fix: correct SheetWriteHandler.afterSheetDispose to avoid repeated execution #900 fix: correct SheetWriteHandler.afterSheetDispose to avoid repeated execution (fix: correct SheetWriteHandler.afterSheetDispose to avoid repeated execution #900)
• fix: avoid recursive hashCode in write holder contexts #911 fix: avoid recursive hashCode in write holder contexts (fix: avoid recursive hashCode in write holder contexts #911)
• fix: support SQL date types in WriteCellData #912 fix: support SQL date types in WriteCellData (fix: support SQL date types in WriteCellData #912)
• fix: CsvCell crashes on java.sql.Date/Time due to unsupported toInstant() #954 fix: CsvCell crashes on java.sql.Date/Time due to unsupported toInstant() (fix: CsvCell crashes on java.sql.Date/Time due to unsupported toInstant() #954)
• fix: clone DataFormatData in WriteCellStyle.merge to avoid mutating cached annotation style #957 fix: clone DataFormatData in WriteCellStyle.merge to avoid mutating cached annotation style (fix: clone DataFormatData in WriteCellStyle.merge to avoid mutating cached annotation style #957)
• fix: XLS BIFF8 encryption not applied due to premature password clearing #959 fix: XLS BIFF8 encryption not applied due to premature password clearing (fix: XLS BIFF8 encryption not applied due to premature password clearing #959)
• fix: reset cached batch in PageReadListener between sheets to avoid duplicate rows #961 fix: reset cached batch in PageReadListener between sheets to avoid duplicate rows (fix: reset cached batch in PageReadListener between sheets to avoid duplicate rows #961)
• fix: remove redundant buffer copy in IoUtils.toByteArray(InputStream) #963 fix: remove redundant buffer copy in IoUtils.toByteArray(InputStream) (fix: remove redundant buffer copy in IoUtils.toByteArray(InputStream) #963)
• fix: descriptive error for unrecognized cell type attribute #965 fix: descriptive error for unrecognized cell type attribute (fix: descriptive error for unrecognized cell type attribute #965)
• fix: copy default read converter map to isolate per-reader custom converters #972 fix: copy default read converter map to isolate per-reader custom converters (fix: copy default read converter map to isolate per-reader custom converters #972)
• fix: mark CsvCell Calendar value as a date to avoid silent empty write #974 fix: mark CsvCell Calendar value as a date to avoid silent empty write (fix: mark CsvCell Calendar value as a date to avoid silent empty write #974)
• fix: remove indexFieldMap entry by field key, not running counter #977 fix: remove indexFieldMap entry by field key, not running counter (fix: remove indexFieldMap entry by field key, not running counter #977)
• fix: eliminate implicit numeric cast warning in date generation #990 fix: eliminate implicit numeric cast warning in date generation (fix: eliminate implicit numeric cast warning in date generation #990)
• fix: decode _xHHHH_ escapes when reading inline string cells #991 fix: decode xHHHH escapes when reading inline string cells (fix: decode _xHHHH_ escapes when reading inline string cells #991)
• fix: remove the broken star history chart #998 fix: remove the broken star history chart (fix: remove the broken star history chart #998)
• fix: prioritize subclass fields and ignore superclass annotations on field shadowing #1007 fix: prioritize subclass fields and ignore superclass annotations on field shadowing (fix: prioritize subclass fields and ignore superclass annotations on field shadowing #1007)
• fix: read XLS literal error cells as errors instead of booleans #1011 fix: read XLS literal error cells as errors instead of booleans (fix: read XLS literal error cells as errors instead of booleans #1011)
• fix: resolve Windows fill template copy failures (#1021) #1034 fix: resolve Windows fill template copy failures ([Bug] Fill tests fail on Windows: output stream leak on CSV+template exception, and URL.getPath() breaks example templates #1021) (fix: resolve Windows fill template copy failures (#1021) #1034)
• fix: finding issues during 2.1.0 RC #1049 fix: finding issues during 2.1.0 RC (fix: finding issues during 2.1.0 RC #1049)
• fix: copy sheet-level read params to sheet holder #1052 fix: copy sheet-level read params to sheet holder (fix: copy sheet-level read params to sheet holder #1052)
• fix: fall back to global 1904 windowing when @DateTimeFormat default is used (#1042) #1054 fix: fall back to global 1904 windowing when @DateTimeFormat default is used ([Bug] @DateTimeFormat use1904windowing DEFAULT is collapsed to false, bypassing the global 1904 fallback #1042) (fix: fall back to global 1904 windowing when @DateTimeFormat default is used (#1042) #1054)
• fix: bundle Incubating NOTICE with EasyExcel attribution in jars #1066 fix: bundle Incubating NOTICE with EasyExcel attribution in jars (fix: bundle Incubating NOTICE with EasyExcel attribution in jars #1066)
• fix: make DataFormatter cache configuration-aware #1068 fix: make DataFormatter cache configuration-aware (fix: make DataFormatter cache configuration-aware #1068)

Documentation

• docs(blog): add blog for migration with OpenRewrite #910 docs(blog): add blog for migration with OpenRewrite (docs(blog): add blog for migration with OpenRewrite #910)
• docs: update download page for release 2.0.2-incubating #922 docs: update download page for release 2.0.2-incubating (docs: update download page for release 2.0.2-incubating #922)
• docs(blog): add CVE-2026-49328 security advisory #933 docs(blog): add CVE-2026-49328 security advisory (docs(blog): add CVE-2026-49328 security advisory #933)
• docs: add Copilot repository and code review instructions #958 docs: add Copilot repository and code review instructions (docs: add Copilot repository and code review instructions #958)
• docs: Update the release version document #967 docs: Update the release version document (docs: Update the release version document #967)
• docs: upgrade website dependencies and CI #968 docs: upgrade website dependencies and CI (docs: upgrade website dependencies and CI #968)
• docs: update code-review instructions for HeadBuilder and wildcard imports #970 docs: update code-review instructions for HeadBuilder and wildcard imports (docs: update code-review instructions for HeadBuilder and wildcard imports #970)
• docs: expand the write/fill pages and replace their screenshots with grids #979 docs: expand the write/fill pages and replace their screenshots with grids (docs: expand the write/fill pages and replace their screenshots with grids #979)
• docs: bump npm dependencies to address component vulnerability risks #984 docs: bump npm dependencies to address component vulnerability risks (docs: bump npm dependencies to address component vulnerability risks #984)
• docs: remove redundant blank line #992 docs: remove redundant blank line (docs: remove redundant blank line #992)
• docs: remove redundant blank line in java code block #996 docs: remove redundant blank line in java code block (docs: remove redundant blank line in java code block #996)
• docs: add both chinese and english versions of docs for the includeCo… #1008 docs: add both chinese and english versions of docs for the includeCo… (docs: add both chinese and english versions of docs for the includeCo… #1008)
• docs: add class and module changes section to FastExcel migration guide (#857) #1041 docs: add class and module changes section to FastExcel migration guide ([Task] Apache Fesod (Incubating) Upgrade Guide #857) (docs: add class and module changes section to FastExcel migration guide (#857) #1041)
• docs: add License headers to website files and assets #1043 docs: add License headers to website files and assets (docs: add License headers to website files and assets #1043)
• docs: maintain KEYS only in the release directory #1050 docs: maintain KEYS only in the release directory (docs: maintain KEYS only in the release directory #1050)
• docs(website): upgrade admonition: caution to warning #1053 docs(website): upgrade admonition: caution to warning (docs(website): upgrade admonition: caution to warning #1053)
• docs: update brand logos and maturity model assessment #1055 docs: update brand logos and maturity model assessment (docs: update brand logos and maturity model assessment #1055)

Other changes

• [Test] Add testkit infrastructure and refactor unit tests with JUnit 5 parameterized patterns #901 [Test] Add testkit infrastructure and refactor unit tests with JUnit 5 parameterized patterns ([Test] Add testkit infrastructure and refactor unit tests with JUnit 5 parameterized patterns #901)
• refactor: manage password handling in Excel processing #928 refactor: manage password handling in Excel processing (refactor: manage password handling in Excel processing #928)
• chore: merge 2.0.2-incubating into main branch #930 chore: merge 2.0.2-incubating into main branch (chore: merge 2.0.2-incubating into main branch #930)
• chore(test): remove wildcard imports #938 chore(test): remove wildcard imports (chore(test): remove wildcard imports #938)
• chore: update copyright year to 2026 in footer and NOTICE files #939 chore: update copyright year to 2026 in footer and NOTICE files (chore: update copyright year to 2026 in footer and NOTICE files #939)
• test: Assert valid excel file with expected column count #945 test: Assert valid excel file with expected column count (test: Assert valid excel file with expected column count #945)
• Column Support Feat Docs #949 Column Support Feat Docs (Column Support Feat Docs #949)
• refactor: encapsulate xlsx boolean cell parsing in CellData #964 refactor: encapsulate xlsx boolean cell parsing in CellData (refactor: encapsulate xlsx boolean cell parsing in CellData #964)
• ci: add ASF allowlist check #966 ci: add ASF allowlist check (ci: add ASF allowlist check #966)
• style: redesign homepage hero as a spreadsheet grid #983 style: redesign homepage hero as a spreadsheet grid (style: redesign homepage hero as a spreadsheet grid #983)
• refactor: generate trivial accessors with Lombok #995 refactor: generate trivial accessors with Lombok (refactor: generate trivial accessors with Lombok #995)
• Test: expand unit coverage for scalar converters in ConverterTest #999 Test: expand unit coverage for scalar converters in ConverterTest (Test: expand unit coverage for scalar converters in ConverterTest #999)
• test: add tests for EscapeHexCellWriteHandler #1001 test: add tests for EscapeHexCellWriteHandler (test: add tests for EscapeHexCellWriteHandler #1001)
• refactor: simplify hex escape pattern scanning #1003 refactor: simplify hex escape pattern scanning (refactor: simplify hex escape pattern scanning #1003)
• refactor: unify and overload readSheet methods for flexible usage #1014 refactor: unify and overload readSheet methods for flexible usage (refactor: unify and overload readSheet methods for flexible usage #1014)
• refactor: replace includeColumnIndexes list lookup with ColumnIndexResolver #1015 refactor: replace includeColumnIndexes list lookup with ColumnIndexResolver (refactor: replace includeColumnIndexes list lookup with ColumnIndexResolver #1015)
• Update dependabot configuration for GitHub Actions #1022 Update dependabot configuration for GitHub Actions (Update dependabot configuration for GitHub Actions #1022)
• refactor: remove fesod-examples module #1028 refactor: remove fesod-examples module (refactor: remove fesod-examples module #1028)
• chore: update pnpm action-setup to specific commit #1030 chore: update pnpm action-setup to specific commit (chore: update pnpm action-setup to specific commit #1030)
• refactor: reuse Head#field in ModelBuildEventListener field-assignment fallback #1031 refactor: reuse Head#field in ModelBuildEventListener field-assignment fallback (refactor: reuse Head#field in ModelBuildEventListener field-assignment fallback #1031)
• chore: remove unused mockserver-netty test dependency #1060 chore: remove unused mockserver-netty test dependency (chore: remove unused mockserver-netty test dependency #1060)
• refactor: extract sanitisation part for improved readability #1061 refactor: extract sanitisation part for improved readability (refactor: extract sanitisation part for improved readability #1061)
• chore: update gitattributes to exclude non-source files #1067 chore: update gitattributes to exclude non-source files (chore: update gitattributes to exclude non-source files #1067)

Dependencies

• build: bump com.alibaba.fastjson2:fastjson2 from 2.0.61 to 2.0.62 #909 build: bump com.alibaba.fastjson2:fastjson2 from 2.0.61 to 2.0.62 (build: bump com.alibaba.fastjson2:fastjson2 from 2.0.61 to 2.0.62 #909)
• build: bump org.jacoco:jacoco-maven-plugin from 0.8.14 to 0.8.15 #931 build: bump org.jacoco:jacoco-maven-plugin from 0.8.14 to 0.8.15 (build: bump org.jacoco:jacoco-maven-plugin from 0.8.14 to 0.8.15 #931)
• dependency: upgrade assertj-core to 3.27.7 to fix XXE vulnerability #969 dependency: upgrade assertj-core to 3.27.7 to fix XXE vulnerability (dependency: upgrade assertj-core to 3.27.7 to fix XXE vulnerability #969)
• build: bump com.alibaba.fastjson2:fastjson2 from 2.0.62 to 2.0.63 #980 build: bump com.alibaba.fastjson2:fastjson2 from 2.0.62 to 2.0.63 (build: bump com.alibaba.fastjson2:fastjson2 from 2.0.62 to 2.0.63 #980)
• build: bump com.alibaba.fastjson2:fastjson2 from 2.0.63 to 2.0.64 #987 build: bump com.alibaba.fastjson2:fastjson2 from 2.0.63 to 2.0.64 (build: bump com.alibaba.fastjson2:fastjson2 from 2.0.63 to 2.0.64 #987)
• build: bump org.apache.maven.wrapper:maven-wrapper from 3.1.0 to 3.1.1 #1013 build: bump org.apache.maven.wrapper:maven-wrapper from 3.1.0 to 3.1.1 (build: bump org.apache.maven.wrapper:maven-wrapper from 3.1.0 to 3.1.1 #1013)
• build: bump actions/setup-node from 6 to 7 #1023 build: bump actions/setup-node from 6 to 7 (build: bump actions/setup-node from 6 to 7 #1023)
• build: bump actions/upload-artifact from 4 to 7 #1024 build: bump actions/upload-artifact from 4 to 7 (build: bump actions/upload-artifact from 4 to 7 #1024)
• build: bump nwtgck/actions-netlify from 3.0.0 to 4.0.0 #1025 build: bump nwtgck/actions-netlify from 3.0.0 to 4.0.0 (build: bump nwtgck/actions-netlify from 3.0.0 to 4.0.0 #1025)
• build: bump DavidAnson/markdownlint-cli2-action from 24.1.0 to 24.2.0 #1026 build: bump DavidAnson/markdownlint-cli2-action from 24.1.0 to 24.2.0 (build: bump DavidAnson/markdownlint-cli2-action from 24.1.0 to 24.2.0 #1026)
• build: bump github/codeql-action from 3 to 4 #1027 build: bump github/codeql-action from 3 to 4 (build: bump github/codeql-action from 3 to 4 #1027)
• build: bump actions/stale from 10 to 11 #1037 build: bump actions/stale from 10 to 11 (build: bump actions/stale from 10 to 11 #1037)
• build: bump actions/checkout from 5 to 7 #1038 build: bump actions/checkout from 5 to 7 (build: bump actions/checkout from 5 to 7 #1038)
• build: bump actions/cache from 4 to 6 #1039 build: bump actions/cache from 4 to 6 (build: bump actions/cache from 4 to 6 #1039)
• build: bump actions/setup-java from 5 to 6 #1047 build: bump actions/setup-java from 5 to 6 (build: bump actions/setup-java from 5 to 6 #1047)
• build: bump org.slf4j:slf4j-api from 2.0.18 to 2.0.19 #1071 build: bump org.slf4j:slf4j-api from 2.0.18 to 2.0.19 (build: bump org.slf4j:slf4j-api from 2.0.18 to 2.0.19 #1071)
• build: bump org.slf4j:log4j-over-slf4j from 2.0.18 to 2.0.19 #1072 build: bump org.slf4j:log4j-over-slf4j from 2.0.18 to 2.0.19 (build: bump org.slf4j:log4j-over-slf4j from 2.0.18 to 2.0.19 #1072)
• build: bump org.slf4j:jcl-over-slf4j from 2.0.18 to 2.0.19 #1073 build: bump org.slf4j:jcl-over-slf4j from 2.0.18 to 2.0.19 (build: bump org.slf4j:jcl-over-slf4j from 2.0.18 to 2.0.19 #1073)
• build: bump com.alibaba.fastjson2:fastjson2 from 2.0.64 to 2.0.65 #1074 build: bump com.alibaba.fastjson2:fastjson2 from 2.0.64 to 2.0.65 (build: bump com.alibaba.fastjson2:fastjson2 from 2.0.64 to 2.0.65 #1074)
• build: bump org.slf4j:slf4j-simple from 2.0.18 to 2.0.19 #1081 build: bump org.slf4j:slf4j-simple from 2.0.18 to 2.0.19 (build: bump org.slf4j:slf4j-simple from 2.0.18 to 2.0.19 #1081)

Steps

• Step 1: Planning issue open ← this issue
• Step 2: Prep PR open (release-prepare prep 2.1.0-incubating)
• Step 3: KEYS reconciliation (release-keys-sync)
• Step 4–5: RC cut + stage (release-rc-cut 2.1.0-incubating rc5)
• Step 6: Pre-flight verify (release-verify-rc 2.1.0-incubating-rc5)
• Step 7: [VOTE] thread (release-vote-draft 2.1.0-incubating-rc5)
• Step 8: Voting window
• Step 9: Tally (release-vote-tally 2.1.0-incubating-rc5)
• Step 10: Promote (release-promote 2.1.0-incubating-rc5)
• Step 11: Announce + site bump (release-announce-draft 2.1.0-incubating)
• Step 12: Archive sweep (release-archive-sweep)
• Step 13: Audit log (release-audit-report 2.1.0-incubating)
• Step 14: Post-release bump (release-prepare post 2.1.0-incubating)

Artefacts

• Staging URL: (TBD)
• Tag URL: (TBD)
• RC artefact list: (TBD)

Timestamps

• Planning issue opened:
• Prep PR opened: (TBD)
• RC staged: (TBD)
• Vote opened: (TBD)
• Vote closed: (TBD)
• Promote commit: (TBD)
• [ANNOUNCE] sent: (TBD)

[alaahong]

Progress

• Step 1 ✅ Planning issue created (2026-09-08)
• Step 2 ✅ Prep PR opened: chore: prepare 2.1.0-incubating release #1084 (version bump \pom.xml\ <revision>\ → \2.1.0-incubating), marked ready, merger blocked pending one approving review from a write-access committer (required by branch policy)
• Step 3 ✅ KEYS synced — RM key \CCCF...7B880\ (zhangzhe, RSA 4096) already present in https://downloads.apache.org/incubator/fesod/KEYS (no-op)

Blocked on

Prep PR #1084 requires an approving review before merge. Once merged, proceed to RC cut via the remote GitHub Action (RC number: rc5, since rc1–rc4 tags exist).

[alaahong]

Update — Step 2 merge blocked

Prep PR #1084 is ready for review and all CI checks pass (JDK 8/11/17/21/25), but the branch policy requires one approving review from a different write-access committer. The RM (alaahong) cannot self-approve.

Action needed: another Fesod committer must approve #1084. Once merged, the RM will trigger the remote RC GitHub Action for rc5 (rc1–rc4 tags already exist).

[alaahong]

Progress update

• Step 2 ✅ Prep PR chore: prepare 2.1.0-incubating release #1084 merged into main (2026-09-08) — \pom.xml\ <revision>\ → \2.1.0-incubating. Main head now \�cd4045e.
• Step 4-5 (RC cut) in progress:
  • ✅ Cleaned obsolete \dist/dev/incubator/fesod/2.1.0-incubating-rc4\ (SVN r87355) — RC4 was cancelled.
  • ✅ Generated source tarball \�pache-fesod-2.1.0-incubating-src.tar.gz\ (20.7 MB) from main \�cd4045e; structure verified (single top-level dir, LICENSE/NOTICE/DISCLAIMER present, no prohibited binaries).
  • ⏳ Pending RM execution: sign git tag \2.1.0-incubating-rc5\ (\git tag -s ... acd4045), push to \�pache, GPG-sign tarball, generate sha512, SVN import to \dist/dev/incubator/fesod/2.1.0-incubating-rc5/.