Update to PHPOffice/PhpSpreadsheet 2.3.5

Needs review.

@mably would you consider marking older releases of the module as unsupported? This triggers special treatment on /admin/reports/updates which makes site admins take the available new release as a higher priority.

I don't think there is a way to mark older releases as unsupported. Branches can be marked as unsupported, but not releases.

I can confirm:

@mably thanks for the clarification. I'm not sure whether there should be a security advisory here; not trying to add extra work - I just want Drupal to be as secure as possible.

No advisory is needed from Drupal as we're not the vendor. There are tons of 3rd party software that get integrated with Drupal and have vulnerabilities regularly that we don't issue advisories for. Some past advisories reinforcing this practice are https://www.drupal.org/psa-2024-06-26 →

Looks like another security patch has been backported to version 2.3.6.

Will update the composer.json file accordingly.

Looks like another security patch has been backported to version 2.3.7.

Will update the composer.json file accordingly.