| 1 | # Vendored grid |
| 2 | |
| 3 | Jspreadsheet CE and its one runtime dependency, jsuites. Both MIT — the |
| 4 | licences are beside the code as `LICENSE.jspreadsheet` and |
| 5 | `LICENSE.jsuites`. |
| 6 | |
| 7 | Vendored, not fetched: spec §6 and AGENTS.md both rule out a CDN and a |
| 8 | build step. These files are served from this app's own origin, with a |
| 9 | content hash in the URL, and they change only when somebody runs the |
| 10 | commands below and commits the result. |
| 11 | |
| 12 | ## Versions |
| 13 | |
| 14 | | File | Package | Version | |
| 15 | |---|---|---| |
| 16 | | `jspreadsheet.js`, `jspreadsheet.css` | `jspreadsheet-ce` | 5.0.2 | |
| 17 | | `jsuites.js`, `jsuites.css` | `jsuites` | 5.13.5 | |
| 18 | |
| 19 | jsuites is pinned to the newest **5.x**, not to npm's `latest`. Version |
| 20 | 6 is out, and `jspreadsheet-ce@5.0.2` declares `jsuites: ^5.8.5` — so |
| 21 | 6.x is a major it has never claimed to work with, and taking `latest` |
| 22 | would silently cross that line on the next upgrade. |
| 23 | |
| 24 | ## Upgrading |
| 25 | |
| 26 | Re-run this from the repository root, then commit the diff: |
| 27 | |
| 28 | ```sh |
| 29 | D=$(mktemp -d) |
| 30 | JS=5.0.2 |
| 31 | SU=5.13.5 |
| 32 | mkdir -p "$D/js" "$D/su" |
| 33 | curl -sSL -o "$D/js.tgz" "https://registry.npmjs.org/jspreadsheet-ce/-/jspreadsheet-ce-$JS.tgz" |
| 34 | curl -sSL -o "$D/su.tgz" "https://registry.npmjs.org/jsuites/-/jsuites-$SU.tgz" |
| 35 | tar xzf "$D/js.tgz" -C "$D/js" |
| 36 | tar xzf "$D/su.tgz" -C "$D/su" |
| 37 | |
| 38 | V=internal/sheets/static/vendor |
| 39 | install -m 644 "$D/js/package/dist/index.js" "$V/jspreadsheet.js" |
| 40 | install -m 644 "$D/js/package/dist/jspreadsheet.css" "$V/jspreadsheet.css" |
| 41 | install -m 644 "$D/su/package/dist/jsuites.js" "$V/jsuites.js" |
| 42 | install -m 644 "$D/su/package/dist/jsuites.css" "$V/jsuites.css" |
| 43 | install -m 644 "$D/js/package/LICENSE" "$V/LICENSE.jspreadsheet" |
| 44 | install -m 644 "$D/su/package/LICENSE" "$V/LICENSE.jsuites" |
| 45 | ``` |
| 46 | |
| 47 | Then update the table above, and check two things by hand, because |
| 48 | nothing else will: |
| 49 | |
| 50 | 1. **Formula evaluation stays off.** `grid.js` never enables it. Our |
| 51 | engine computes and the client paints; a client-side evaluator would |
| 52 | disagree with the server on the first `SUM(1,2,"3")` — the divergence |
| 53 | the formula corpus already documents — and the disagreement would be |
| 54 | invisible. |
| 55 | 2. **The two files are the only exemptions** in |
| 56 | `internal/guardstest/jscap_test.go`. That test caps our own |
| 57 | JavaScript at 300 lines and names each vendored blob explicitly, so a |
| 58 | third file dropped in here is not silently exempt. |
| 59 | |
amadan