Release Apache Fesod 2.1.0-incubating

## Release: Apache Fesod 2.1.0-incubating

**Release Manager:** Zhang Zhe
**Release train:** 2.x
**Base branch:** main
**Previous release:** [2.0.2-incubating](https://github.com/apache/fesod/releases/tag/2.0.2-incubating)

## In scope

95 merged PRs since `2.0.2-incubating` (2026-05-14).

### Features

- #916 feat: support freeze pane via @FreezePane or register WriteHandler on write ()
- #934 feat: split StringImageConverter into Pathname and Base64 ()
- #942 feat: add support for column index limit in ReadSheet ()
- #943 feat: add fluent header api for no-bean mode ()
- #948 feat: cache date and number formatters ()
- #981 feat: add support for column-based reading of XLS files ()
- #982 feat: add support for column-based reading of CSV files ()
- #1032 feat: add java.time.LocalTime converters ()
- #1035 feat: require an allowlist for remote URL images ()
- #1044 feat: registered EscapeHexCellWriteHandler in DefaultWriteHandlerLoader for XLSX ()
- #1046 feat: upgrade slf4j to 2.0.18 and replace logback with slf4j-simple (#905) ()

### Bug fixes

- #810 fix: fix error in using relativeHeadRowIndex for writing tables only ()
- #900 fix: correct SheetWriteHandler.afterSheetDispose to avoid repeated execution ()
- #911 fix: avoid recursive hashCode in write holder contexts ()
- #912 fix: support SQL date types in WriteCellData ()
- #954 fix: CsvCell crashes on java.sql.Date/Time due to unsupported toInstant() ()
- #957 fix: clone DataFormatData in WriteCellStyle.merge to avoid mutating cached annotation style ()
- #959 fix: XLS BIFF8 encryption not applied due to premature password clearing ()
- #961 fix: reset cached batch in PageReadListener between sheets to avoid duplicate rows ()
- #963 fix: remove redundant buffer copy in IoUtils.toByteArray(InputStream) ()
- #965 fix: descriptive error for unrecognized cell type attribute ()
- #972 fix: copy default read converter map to isolate per-reader custom converters ()
- #974 fix: mark CsvCell Calendar value as a date to avoid silent empty write ()
- #977 fix: remove indexFieldMap entry by field key, not running counter ()
- #990 fix: eliminate implicit numeric cast warning in date generation ()
- #991 fix: decode _xHHHH_ escapes when reading inline string cells ()
- #998 fix: remove the broken star history chart ()
- #1007 fix: prioritize subclass fields and ignore superclass annotations on field shadowing ()
- #1011 fix: read XLS literal error cells as errors instead of booleans ()
- #1034 fix: resolve Windows fill template copy failures (#1021) ()
- #1049 fix: finding issues during 2.1.0 RC ()
- #1052 fix: copy sheet-level read params to sheet holder ()
- #1054 fix: fall back to global 1904 windowing when @DateTimeFormat default is used (#1042) ()
- #1066 fix: bundle Incubating NOTICE with EasyExcel attribution in jars ()
- #1068 fix: make DataFormatter cache configuration-aware ()

### Documentation

- #910 docs(blog): add blog for migration with OpenRewrite ()
- #922 docs: update download page for release 2.0.2-incubating ()
- #933 docs(blog): add CVE-2026-49328 security advisory ()
- #958 docs: add Copilot repository and code review instructions ()
- #967 docs: Update the release version document ()
- #968 docs: upgrade website dependencies and CI ()
- #970 docs: update code-review instructions for HeadBuilder and wildcard imports ()
- #979 docs: expand the write/fill pages and replace their screenshots with grids ()
- #984 docs: bump npm dependencies to address component vulnerability risks ()
- #992 docs: remove redundant blank line ()
- #996 docs: remove redundant blank line in java code block ()
- #1008 docs: add both chinese and english versions of docs for the includeCo… ()
- #1041 docs: add class and module changes section to FastExcel migration guide (#857) ()
- #1043 docs: add License headers to website files and assets ()
- #1050 docs: maintain KEYS only in the release directory ()
- #1053 docs(website): upgrade admonition: caution to warning ()
- #1055 docs: update brand logos and maturity model assessment ()

### Other changes

- #901 [Test] Add testkit infrastructure and refactor unit tests with JUnit 5 parameterized patterns ()
- #928 refactor: manage password handling in Excel processing ()
- #930 chore: merge 2.0.2-incubating into main branch ()
- #938 chore(test): remove wildcard imports ()
- #939 chore: update copyright year to 2026 in footer and NOTICE files ()
- #945 test: Assert valid excel file with expected column count ()
- #949 Column Support Feat Docs ()
- #964 refactor: encapsulate xlsx boolean cell parsing in CellData ()
- #966 ci: add ASF allowlist check ()
- #983 style: redesign homepage hero as a spreadsheet grid ()
- #995 refactor: generate trivial accessors with Lombok ()
- #999 Test: expand unit coverage for scalar converters in ConverterTest ()
- #1001 test: add tests for EscapeHexCellWriteHandler ()
- #1003 refactor: simplify hex escape pattern scanning ()
- #1014 refactor: unify and overload readSheet methods for flexible usage ()
- #1015 refactor: replace includeColumnIndexes list lookup with ColumnIndexResolver ()
- #1022 Update dependabot configuration for GitHub Actions ()
- #1028 refactor: remove fesod-examples module ()
- #1030 chore: update pnpm action-setup to specific commit ()
- #1031 refactor: reuse Head#field in ModelBuildEventListener field-assignment fallback ()
- #1060 chore: remove unused mockserver-netty test dependency ()
- #1061 refactor: extract sanitisation part for improved readability ()
- #1067 chore: update gitattributes to exclude non-source files ()

### Dependencies

- #909 build: bump com.alibaba.fastjson2:fastjson2 from 2.0.61 to 2.0.62 ()
- #931 build: bump org.jacoco:jacoco-maven-plugin from 0.8.14 to 0.8.15 ()
- #969 dependency: upgrade assertj-core to 3.27.7 to fix XXE vulnerability ()
- #980 build: bump com.alibaba.fastjson2:fastjson2 from 2.0.62 to 2.0.63 ()
- #987 build: bump com.alibaba.fastjson2:fastjson2 from 2.0.63 to 2.0.64 ()
- #1013 build: bump org.apache.maven.wrapper:maven-wrapper from 3.1.0 to 3.1.1 ()
- #1023 build: bump actions/setup-node from 6 to 7 ()
- #1024 build: bump actions/upload-artifact from 4 to 7 ()
- #1025 build: bump nwtgck/actions-netlify from 3.0.0 to 4.0.0 ()
- #1026 build: bump DavidAnson/markdownlint-cli2-action from 24.1.0 to 24.2.0 ()
- #1027 build: bump github/codeql-action from 3 to 4 ()
- #1037 build: bump actions/stale from 10 to 11 ()
- #1038 build: bump actions/checkout from 5 to 7 ()
- #1039 build: bump actions/cache from 4 to 6 ()
- #1047 build: bump actions/setup-java from 5 to 6 ()
- #1071 build: bump org.slf4j:slf4j-api from 2.0.18 to 2.0.19 ()
- #1072 build: bump org.slf4j:log4j-over-slf4j from 2.0.18 to 2.0.19 ()
- #1073 build: bump org.slf4j:jcl-over-slf4j from 2.0.18 to 2.0.19 ()
- #1074 build: bump com.alibaba.fastjson2:fastjson2 from 2.0.64 to 2.0.65 ()
- #1081 build: bump org.slf4j:slf4j-simple from 2.0.18 to 2.0.19 ()

## Steps

- [x] Step 1: Planning issue open ← this issue
- [x] Step 2: Prep PR open (`release-prepare prep 2.1.0-incubating`)
- [x] Step 3: KEYS reconciliation (`release-keys-sync`)
- [x] Step 4–5: RC cut + stage (`release-rc-cut 2.1.0-incubating rc5`)
- [x] Step 6: Pre-flight verify (`release-verify-rc 2.1.0-incubating-rc5`)
- [ ] Step 7: `[VOTE]` thread (`release-vote-draft 2.1.0-incubating-rc5`)
- [ ] Step 8: Voting window
- [ ] Step 9: Tally (`release-vote-tally 2.1.0-incubating-rc5`)
- [ ] Step 10: Promote (`release-promote 2.1.0-incubating-rc5`)
- [ ] Step 11: Announce + site bump (`release-announce-draft 2.1.0-incubating`)
- [ ] Step 12: Archive sweep (`release-archive-sweep`)
- [ ] Step 13: Audit log (`release-audit-report 2.1.0-incubating`)
- [ ] Step 14: Post-release bump (`release-prepare post 2.1.0-incubating`)

## Artefacts

- Staging URL: (TBD)
- Tag URL: (TBD)
- RC artefact list: (TBD)

## Timestamps

- Planning issue opened:
- Prep PR opened: (TBD)
- RC staged: (TBD)
- Vote opened: (TBD)
- Vote closed: (TBD)
- Promote commit: (TBD)
- [ANNOUNCE] sent: (TBD)

Follow the checked release steps in this issue, starting with the pending [VOTE] thread and the 2.1.0-incubating-rc5 verification. Review the release procedures and generated artefacts after each command, then complete voting, tally, promotion, announcement, archive, audit, and post-release steps. Done means all checklist items are complete and the staging, tag, and artefact links are recorded.

Written by the indexing model from the issue text.