@nlpjs/xtables depends on vulnerable version of xlsx

[ahitrov]

[Security] Prototype Pollution in sheetJS

https://github.com/advisories/GHSA-4r6h-8v6p-xvw6

Affected version: 0.19.3

Description All versions of SheetJS CE through 0.19.2 are vulnerable to "Prototype Pollution" when reading specially crafted files. Workflows that do not read arbitrary files (for example, exporting data to spreadsheet files) are unaffected.

References https://nvd.nist.gov/vuln/detail/CVE-2023-30533 https://cdn.sheetjs.com/advisories/CVE-2023-30533 https://git.sheetjs.com/sheetjs/sheetjs/src/branch/master/CHANGELOG.md

[Mitko-Kerezov]

This is currently heavily affecting us also as npm audit does not pass and it is marked as a high severity security issue.

Could we get an update on this?

[kibertoad]

@ericzon Can we help with this?

[kibertoad]

@ericzon We've created an npm version for a newer version of XLSX (which is distributed with Apache 2 license over CDN): https://www.npmjs.com/package/@lokalise/xlsx

It should resolve the security issue in question.