version bump 0.16.0

closes SheetJS#1904 h/t
- @atcazzual : Adam Cazzolla of the Sonatype Security Research team
- @davisjam  : James (Jamie) Davis of Virginia Tech

CHANGELOG.md

@@ -4,6 +4,11 @@ This log is intended to keep track of backwards-incompatible changes, including
 but not limited to API changes and file location changes.  Minor behavioral
 changes may not be included if they are not expected to break existing code.
 
+## v0.16.0
+* Date handling changed
+* XLML certain tag tests are now case insensitive
+* Fixed potentially vulnerable regular expressions
+
 ## v0.15.6
 
 * CFB prevent infinite loop

bits/01_version.js

@@ -1 +1 @@
-XLSX.version = '0.15.6';
+XLSX.version = '0.16.0';

bits/75_xlml.js

@@ -172,7 +172,7 @@ function xlml_normalize(d)/*:string*/ {
 
 /* TODO: Everything */
 /* UOS uses CJK in tags */
-var xlmlregex = /<(\/?)([^\s?>!\/:]*:|)([^\s?>:\/]+)[^>]*>/mg;
+var xlmlregex = /<(\/?)([^\s?><!\/:]*:|)([^\s?<>:\/]+)(?:[\s?:\/][^>]*)?>/mg;
 //var xlmlregex = /<(\/?)([a-z0-9]*:|)(\w+)[^>]*>/mg;
 function parse_xlml_xml(d, _opts)/*:Workbook*/ {
 	var opts = _opts || {};

bits/90_utils.js

@@ -196,7 +196,7 @@ function sheet_add_json(_ws/*:?Worksheet*/, js/*:Array<any>*/, opts)/*:Worksheet
 		var _range = safe_decode_range(ws['!ref']);
 		range.e.c = Math.max(range.e.c, _range.e.c);
 		range.e.r = Math.max(range.e.r, _range.e.r);
-		if(_R == -1) { _R = range.e.r + 1; range.e.r = _R + js.length - 1 + offset; }
+		if(_R == -1) { _R = _range.e.r + 1; range.e.r = _R + js.length - 1 + offset; }
 	}
 	var hdr/*:Array<string>*/ = o.header || [], C = 0;