xlsx: switch dependency to SheetJS CDN tarball, regenerate both lockfiles

Sub-tickets

Activity

• researcher-mba-l-cc created · 1w ago
• coder03assistant-mba-l-ca assigned · 1w ago
  coder03assistant-mba-l-ca
• coder03assistant-mba-l-ca statusChanged · 1w ago
  Implementing the reviewed SheetJS tarball dependency and regenerating npm/pnpm locks.
• coder03assistant-mba-l-ca progress · 1w ago
  2026-10-05: Dependency work paused after my locked edits disappeared. Current shared checkout has package.json/package-lock staged only for version 5.6.164; no xlsx tarball change remains. Asked coder03 whether version ship is in progress before reapplying. No dependency diff left on disk.
• coder03assistant-mba-l-ca progress · 1w ago
  2026-10-05: package.json now pins xlsx to the SheetJS 0.20.2 CDN tarball; both lockfiles regenerated. lockfiles:check passes. npm audit on this tree has no xlsx advisory (GHSAs 4r6h-8v6p-xvw6 and 5pgg-2g8v-p4x9 absent); audit JSON saved /data-lezama/movilba/evidencia/MOVILBA-705/npm-audit-final.json. Overall audit remains 6 high/6 moderate from unrelated packages; CDN scanner compatibility remains unmeasured.
• audit-mba-l-cc audited · 1w ago
  audit pass: package.json xlsx dep swap to SheetJS CDN tarball, both lockfiles
  payload

  {"scope":"package.json xlsx dep swap to SheetJS CDN tarball, both lockfiles","outcome":"pass","evidence":"xlsx now cdn.sheetjs.com/xlsx-0.20.2/xlsx-0.20.2.tgz. lockfiles:check PASS (consistent). npm-audit-final.json (fresh, 15:59) confirms zero xlsx/brace-expansion entries; 6 high+6 moderate remain, all unrelated (eslint-next/fast-glob/micromatch/braces chain, drizzle-kit/esbuild, quill). Matches claimed GHSA-4r6h-8v6p-xvw6/GHSA-5pgg-2g8v-p4x9 clearance.","reportRef":null}

• audit-mba-l-cc audited · 1w ago
  audit fail: re-review per coder03's HOLD: pnpm install --frozen-lockfile, confirm xlsx 0.20.2 installed, re-run gates
  payload

  {"scope":"re-review per coder03's HOLD: pnpm install --frozen-lockfile, confirm xlsx 0.20.2 installed, re-run gates","outcome":"fail","evidence":"xlsx 0.20.2 confirmed installed (was 0.18.5 at my first PASS - that PASS is VOID, gates never touched the real package). pnpm test:source FAILS: src/lib/exports/rutap-libro.test.ts:66 - reading an Excel date cell now returns [2025,10,6] instead of [2025,10,7], a one-day westward shift. Test's own comment: 'la celda de Excel no lleva zona, y leerla en UTC la corre un dia... al oeste de Greenwich' - 0.20.2 changed cellDates local/UTC handling vs 0.18.5. Real regression from the version bump, blocks RUTAP libro date reads. coder03's HOLD was correct.","reportRef":null}

• coder03assistant-mba-l-ca progress · 1w ago
  2026-10-05: Following audit FAIL with xlsx 0.20.2 installed, date serialization now constructs UTC-midnight Date values so the XLSX date serial is an integer, avoiding the ART local-time fraction/day shift. Updated rutap-libro.test.ts to inspect the serialized numeric Excel date (2025-10-07 serial 45937) and format, not timezone-sensitive cellDates readback. node_modules/xlsx reports 0.20.2; diff check clean. Tests not run per lane handoff rule; audit rerun test:source against this exact tree.
• audit-mba-l-cc audited · 1w ago
  audit fail: re-review of UTC-midnight date fix (rutap-historico.ts:rutapCellValue)
  payload

  {"scope":"re-review of UTC-midnight date fix (rutap-historico.ts:rutapCellValue)","outcome":"fail","evidence":"typecheck now clean. test:source still FAILS, different assertion: rutap-libro.test.ts:63 expects serial 45937 (strictEqual), got 45936.875 - a fractional serial, 0.875 day short. The UTC-midnight Date now round-trips wrong through SheetJS's write path (date_to_serial), symmetric-opposite of the original read-path bug: this single flip (local->UTC) breaks write while fixing read, meaning SheetJS 0.20.2's write and read date conversions use DIFFERENT local/UTC conventions from each other, not just different from 0.18.5. Needs the actual asymmetry identified, not another blind flip.","reportRef":null}

• coder03assistant-mba-l-ca progress · 1w ago
  2026-10-05: Expanded the xlsx 0.20.2 timezone correction across all XLSX readers in src/ and tools/: XLSX.read/readFile and sheet_to_json now use UTC:true; rutapCellValue constructs UTC-midnight Date values so generated Excel serials remain integral in ART. rutap-libro.test.ts pins serial 45937 for 2025-10-07 and asserts cellDates:true+UTC:true returns UTC components [2025,10,7]. Source scan confirms all current readers are covered. Audit requested to run the date regression/test:source plus test:tools/typecheck under xlsx 0.20.2; no tests/lint/typecheck run by this lane.
• audit-mba-l-cc audited · 1w ago
  audit fail: root-cause pass on rutapCellValue UTC-midnight fix
  payload

  {"scope":"root-cause pass on rutapCellValue UTC-midnight fix","outcome":"fail","evidence":"SheetJS datenum() computes serial as (date.getTime() - basedate.getTime())/86400000 where basedate=new Date(1899,11,30) is LOCAL-constructed; both getTime() calls are absolute epoch ms. A LOCAL-midnight Date (original code) cancels the local TZ offset against basedate and yields a whole serial. A UTC-midnight Date (this fix) does not cancel it: ART is UTC-3, so serial comes out 0.125 day (3h) short -> 45936.875 instead of 45937, matching observed failure exactly. The write-side regression this 'fix' introduced is new; local-midnight construction must stay for WRITING. Whatever broke under xlsx 0.20.2 is on the READ/cellDates side and needs its own isolated repro, not a flip of the write-side convention.","reportRef":null}

• coder03assistant-mba-l-ca progress · 1w ago
  2026-10-05: Addressed audit FAIL: restored local-midnight Date construction in rutapCellValue because SheetJS datenum subtracts a local-based epoch; UTC midnight creates serial 45936.875 in ART. Kept UTC:true on all src/tools XLSX reads and sheet_to_json conversions. Regression asserts exact Excel serial 45937 and separately parses with cellDates:true, UTC:true to verify UTC components [2025,10,7]. Diff check clean; no tests/lint/typecheck run by this lane; re-audit requested against installed xlsx 0.20.2.
• audit-mba-l-cc audited · 1w ago
  audit fail: re-review after local-midnight revert + UTC:true reads
  payload

  {"scope":"re-review after local-midnight revert + UTC:true reads","outcome":"fail","evidence":"Date regression FIXED: rutap-libro.test.ts:65 now passes, serial 45937 exact. typecheck clean. test:source: 49/50 pass, 1 NEW failure unrelated to dates: rutap-libro.test.ts:21, sheet['!ref'] is 'A1:AM3' but test expects /^A2:AM3$/ (row1 meant to stay empty, A1 meant undefined) - this failure was already present in the prior run too (masked behind the date failure), so it's a second xlsx 0.20.2 regression in the same file, not yet addressed. Scope of coder03assistant's fix report did not mention it.","reportRef":null}

• coder03assistant-mba-l-ca progress · 1w ago
  2026-10-05: Addressed second SheetJS 0.20.2 audit failure in rutap-libro.test.ts. The blank first AOA row is still preserved (A1 undefined); 0.20 now includes that empty row in !ref, so the test expects A1:AM3 and reads the header from range:1 (worksheet row 2). Date serial and UTC parse assertions remain. Diff check clean; no tests run by this lane; audit requested.
• audit-mba-l-cc audited · 1w ago
  audit pass: local-midnight write restored, UTC:true on all reads, !ref test adapted to 0.20.2's real dimension
  payload

  {"scope":"local-midnight write restored, UTC:true on all reads, !ref test adapted to 0.20.2's real dimension","outcome":"pass","evidence":"pnpm install --frozen-lockfile: xlsx 0.20.2 confirmed installed. typecheck clean. test:source 50/50 pass incl. rutap-libro.test.ts serial=45937 exact and date UTC components [2025,10,7]. Exporter source (rutap-libro.ts) untouched - only the test's !ref/range assertions adapted to 0.20.2's real A1:AM3 dimension with A1 still genuinely undefined, confirmed via diff. test:tools still fails but on the unrelated carroceriaCategoria regex (colectivo-expediente.test.cjs:197), tracked under MOVILBA-349/546, not an xlsx issue.","reportRef":null}

• coder03assistant-mba-l-ca completed · 1w ago
  Live on PROD, DEV and pod at v5.6.165, commit 8d7bd2b5; pod serviceId 23516 (coder03 report 2026-10-05).