NodeJS
Package tarballs are available on https://cdn.sheetjs.com.
https://cdn.sheetjs.com/xlsx-0.20.0/xlsx-0.20.0.tgz is the URL for version 0.20.0
Installation
Tarballs can be directly installed using a package manager:
- npm
- pnpm
- Yarn
npm i --save https://cdn.sheetjs.com/xlsx-0.20.0/xlsx-0.20.0.tgz
pnpm install https://cdn.sheetjs.com/xlsx-0.20.0/xlsx-0.20.0.tgz
yarn add https://cdn.sheetjs.com/xlsx-0.20.0/xlsx-0.20.0.tgz
Watch the repo or subscribe to the RSS feed to be notified when new versions are released!
Snyk security tooling may report errors involving "Prototype Pollution":
Prototype Pollution [Medium Severity][https://security.snyk.io/vuln/SNYK-JS-XLSX-5457926]
As noted in the Snyk report:
The issue is resolved in version 0.19.3
Snyk is falsely reporting vulnerabilities. It is a bug in the Snyk tooling.
Until Snyk fixes the bugs, the official recommendation is to suppress the warning.
Legacy Endpoints
Older releases are technically available on the public npm registry as xlsx
,
but the registry is out of date. The latest version on that registry is 0.18.5
This is a known registry bug
The SheetJS CDN https://cdn.sheetjs.com/ is the authoritative source for SheetJS modules.
For existing projects, the easiest approach is to uninstall and reinstall:
- npm
- pnpm
- Yarn
npm rm --save xlsx
npm i --save https://cdn.sheetjs.com/xlsx-0.20.0/xlsx-0.20.0.tgz
pnpm rm xlsx
pnpm install https://cdn.sheetjs.com/xlsx-0.20.0/xlsx-0.20.0.tgz
yarn remove xlsx
yarn add https://cdn.sheetjs.com/xlsx-0.20.0/xlsx-0.20.0.tgz
When the xlsx
library is a dependency of a dependency, the overrides
field
in package.json
can control module resolution:
{
"overrides": {
"xlsx": "https://cdn.sheetjs.com/xlsx-0.20.0/xlsx-0.20.0.tgz"
}
}
Vendoring
For general stability, "vendoring" modules is the recommended approach:
1) Download the tarball (xlsx-0.20.0.tgz
) for the desired version. The current version is available at https://cdn.sheetjs.com/xlsx-0.20.0/xlsx-0.20.0.tgz
2) Create a vendor
subfolder at the root of your project and move the tarball
to that folder. Add it to your project repository.
3) Install the tarball using a package manager:
- npm
- pnpm
- Yarn
npm i --save file:vendor/xlsx-0.20.0.tgz
pnpm install file:vendor/xlsx-0.20.0.tgz
yarn add file:vendor/xlsx-0.20.0.tgz
The package will be installed and accessible as xlsx
.
Usage
The package supports CommonJS require
and ESM import
module systems.
It is strongly recommended to use CommonJS in NodeJS.
CommonJS require
By default, the module supports require
and it will automatically add support
for streams and file system access:
var XLSX = require("xlsx");
ESM import
The module also ships with xlsx.mjs
for use with import
. The mjs
version
does not automatically load native node modules, so they must be added manually:
import * as XLSX from 'xlsx';
/* load 'fs' for readFile and writeFile support */
import * as fs from 'fs';
XLSX.set_fs(fs);
/* load 'stream' for stream support */
import { Readable } from 'stream';
XLSX.stream.set_readable(Readable);
/* load the codepage support library for extended support with older formats */
import * as cpexcel from 'xlsx/dist/cpexcel.full.mjs';
XLSX.set_cptable(cpexcel);
NextJS
fs
cannot be imported from the top level in NextJS pages. This will not work:
/* it is safe to import the library from the top level */
import { readFile, utils, set_fs } from 'xlsx';
/* it is not safe to import 'fs' from the top level ! */
import * as fs from 'fs'; // this import will fail
set_fs(fs);
fs
should be loaded with a dynamic import within a lifecycle function:
/* it is safe to import the library from the top level */
import { readFile, utils, set_fs } from 'xlsx';
import { join } from 'path';
import { cwd } from 'process';
export async function getServerSideProps() {
set_fs(await import("fs")); // dynamically import 'fs' in `getServerSideProps`
const wb = readFile(join(cwd(), "public", "sheetjs.xlsx"));
// ...
}
The NextJS demo includes complete examples.