Read, inspect and write XLSX files

xlvane is an MIT-licensed library for Excel workbooks that treats every input file as untrusted. ESM only, with one runtime dependency (fflate). The core works with Uint8Array and has no Node.js dependencies; file helpers are in xlvane/node.

npm install xlvane

Read the guide Inspect a file in the browser GitHub

Quick start

import { inspect, readTable, writeTable } from 'xlvane';
import { readWorkbookFile } from 'xlvane/node';

const workbook = await readWorkbookFile('orders.xlsx');
console.log(inspect(workbook).sheets.map((s) => [s.name, s.usedRange])); // what is in the file
const { rows } = readTable(workbook, { sheet: 'Orders' }); // [{ Customer: 'Ann', Total: 120.5 }, …]
const big = rows.filter((row) => typeof row['Total'] === 'number' && row['Total'] > 100);
const bytes = writeTable(big, { sheet: 'Big orders' }); // a formatted .xlsx file as a Uint8Array

What it does

Reading

Values, dates, formulas with their cached results, styles, merged cells, hyperlinks, notes, tables, pictures, data validation and conditional formatting.

inspect()

Plain JSON about a workbook: sheets, used ranges, the detected header row, column types with examples, formulas, defined names and warnings.

Writing

Styles, column widths, frozen panes, filters, rich text, links, notes, images, tables, sheet rules and print settings. The output is deterministic, except the random salt of a protection password.

Tasks in one call

readTable with schema validation, writeTable, CSV and JSON in both directions, editCells, appendRows, insertRows, deleteRows and diff.

Streaming

Read row by row and write rows pulled from an iterable, with Web Streams, so the worksheet cells are never all in memory.

Untrusted input

ZIP and XML limits, no DTDs or external entities, file data never used as object keys, CSV formula-injection protection. Every error has an XLV_E_* code, a location and a hint.

Command line

xlvane inspect, read, convert, create, edit, diff, validate, migrate and mcp, with --json output that follows documented schemas.

MCP server

@xlvane/mcp: tools for MCP clients to inspect, read, compare and validate workbooks, and with --allow-write to write, edit and convert them, only inside the directories given at start.

@xlvane/compat

The exceljs 4.4.0 API on top of xlvane, installed under the name exceljs. An independent project, not affiliated with exceljs.

Command line

xlvane                                    # what the tool does and the common commands
xlvane inspect report.xlsx                # sheets, used ranges, header rows, column types, warnings
xlvane read report.xlsx --sheet Sales     # a sheet as a table (first 50 rows; --limit, --range)
xlvane convert report.xlsx sales.csv      # XLSX to CSV or JSON, or CSV/JSON to XLSX
xlvane create data.json report.xlsx       # a formatted report from JSON or CSV
xlvane edit report.xlsx --set "Sales!B2=1250" -o updated.xlsx
xlvane diff report.xlsx updated.xlsx      # what changed; exit code 1 when they differ
xlvane validate report.xlsx --columns "Region:string,Revenue:number"
xlvane help edit                          # usage and examples of one command

Tested environments

The core API (reading, writing, inspect, tables, CSV, editing, diff, streaming with Web Streams) and @xlvane/compat are tested in Node.js 22, 24 and 26, Bun, Deno, Chromium (Playwright) and the Cloudflare Workers runtime (workerd), with the same test bundle (npm run test:runtimes). In Deno, import from npm:xlvane; in browsers and Workers, through a bundler such as Vite, esbuild or webpack. xlvane/node and the command line need Node.js. Reading is tested on 340 files of the Apache POI test corpus (written by Excel for Windows, Mac and the web, LibreOffice, ONLYOFFICE and others, and damaged files) and on files saved by LibreOffice; see tests/corpus/.

Version 1.2.2. Changes are listed in the changelog.