Bilig

vlibraries-v0.90.0 scope: libraries Feature

This release adds 3 notable features for engineering teams evaluating rollout.

Published 10d Developer Productivity

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

agent-tools ai-agents excel excel-formulas formula-engine formula-recalculation

+14 more

headless-spreadsheet mcp mcp-server model-context-protocol nodejs spreadsheet spreadsheet-automation spreadsheet-engine spreadsheet-formulas typescript workbook-api xlsx xlsx-formulas xlsx-recalculation

ReleasePort's take

Light signal

editorial:auto 10d

The libraries‑v0.90.0 release adds safety checks and bug fixes across the workbook module and engine while updating runtime dependencies to version 0.90.0.

Why it matters: Addresses security by blocking protected direct cell mutations; updates all runtime packages to version 0.90.0, requiring immediate dependency alignment.

Summary

AI summary

Broad release touches Libraries v0.90.0, workbook, Internal runtime changes, and 2a685fd7.

Changes in this release

Type	Severity	Summary	CVE
Security	Medium	Blocks protected direct cell mutations in engine Blocks protected direct cell mutations in engine Source: llm_adapter@2026-05-24 Confidence: low	—
Feature
Feature	Medium	Adds check for transported ref data in workbook Adds check for transported ref data in workbook Source: llm_adapter@2026-05-24 Confidence: high	—
Feature	Medium	Adds check for live refs in workbook Adds check for live refs in workbook Source: llm_adapter@2026-05-24 Confidence: high	—
Feature	Medium	Canonicalizes transported plan data in workbook Canonicalizes transported plan data in workbook Source: llm_adapter@2026-05-24 Confidence: high	—
Dependency	Medium	Updates runtime packages to version 0.90.0 Updates runtime packages to version 0.90.0 Source: llm_adapter@2026-05-24 Confidence: low	—
Bugfix
Bugfix	Medium	Canonicalizes receipt ranges in engine Canonicalizes receipt ranges in engine Source: llm_adapter@2026-05-24 Confidence: high	—
Bugfix	Medium	Preserves legacy comment vml after sheet rename in xlsx handling Preserves legacy comment vml after sheet rename in xlsx handling Source: llm_adapter@2026-05-24 Confidence: low	—
Bugfix	Medium	Ignores command envelope scratch fields in workbook Ignores command envelope scratch fields in workbook Source: llm_adapter@2026-05-24 Confidence: low	—
Bugfix	Medium	Allows command scratch metadata in workbook Allows command scratch metadata in workbook Source: llm_adapter@2026-05-24 Confidence: low	—

Full changelog

Libraries v0.90.0

Release type: minor
Previous libraries tag: libraries-v0.86.1
Manual override: no

Features

feat(workbook): check transported ref data (2a685fd7)
feat(workbook): check live refs (998efa61)
feat(workbook): canonicalize transported plan data (3dd51d0e)

Fixes

fix(xlsx): preserve legacy comment vml after sheet rename (60706d82)
fix(workbook): ignore command envelope scratch fields (047a916d)
fix(workbook): allow command scratch metadata (53de4c71)
fix(workbook): canonicalize receipt ranges (35a7dc53)
fix(engine): block protected direct cell mutations (7983cce8)
fix(release): sync WorkPaper Dockerfile version (3fbe9649)

Internal runtime changes

chore(release): runtime packages v0.87.0 (b7833b50)
chore(release): runtime packages v0.88.0 (ecbea8e9)
chore(release): runtime packages v0.89.0 (6c59925a)
chore(release): runtime packages v0.90.0 (f3fd2a5c)

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Bilig

Get notified when new releases ship.

About Bilig

All releases →