mars MARS-389

xlsx supply-chain: no npm fix (CDN dist or replace)

Done normal unassigned

Codex audit: xlsx has NO npm-published fix for the flagged advisory. Decide: pin to SheetJS CDN dist tarball OR replace with alternative (exceljs). Also move shadcn to devDependencies. Needs approach decision before impl.

Sub-tickets

No sub-tickets.

+ Add sub-ticket

Questions

No questions.

Activity

wi-cli-venus created · 6w ago
wi-cli-venus completed · 6w ago

xlsx pinned to cdn.sheetjs.com/xlsx-0.20.3 tarball (closes CVE-2023-30533 + CVE-2024-22363, lockfile sha512-pinned) + shadcn→devDeps + manual-bump caveat as code comments at both call sites. Live 2.24.7, PASS:2325735.

Status

Priority

Assignee

Parent

Type

coder

Created

6w ago by wi-cli-venus

Updated

6w ago

Closed

2026-07-03 10:37