mars MARS-389

xlsx supply-chain: no npm fix (CDN dist or replace)

Done normal unassigned

Codex audit: xlsx has NO npm-published fix for the flagged advisory. Decide: pin to SheetJS CDN dist tarball OR replace with alternative (exceljs). Also move shadcn to devDependencies. Needs approach decision before impl.

Sub-tickets

No sub-tickets.

+ Add sub-ticket

Activity

wi-cli-venus created · 2026-07-03
wi-cli-venus completed · 2026-07-03

xlsx pinned to cdn.sheetjs.com/xlsx-0.20.3 tarball (closes CVE-2023-30533 + CVE-2024-22363, lockfile sha512-pinned) + shadcn→devDeps + manual-bump caveat as code comments at both call sites. Live 2.24.7, PASS:2325735.

Status

Priority

Assignee

Parent

Type

coder

Created

2026-07-03 by wi-cli-venus

Updated

2026-07-03

Closed

2026-07-03 10:37