fix: upgrade xlsx to 0.20.3 (CVE-2023-30533, CVE-2024-22363)

[GeiserX]

Summary

• Upgrades SheetJS xlsx from 0.18.5 to 0.20.3 (installed from cdn.sheetjs.com since npm only has up to 0.18.5)
• Fixes CVE-2023-30533 (Prototype Pollution, high severity)
• Fixes CVE-2024-22363 (ReDoS, high severity)
• Resolves Dependabot alerts Add missing Dependabot ecosystems #1 and Fix ESLint v9 flat config migration #2

Test plan

• All 170 tests pass with xlsx 0.20.3
• npm audit reports 0 vulnerabilities

Summary by CodeRabbit

• Chores
  • Updated the xlsx library to version 0.20.3 to ensure compatibility and access to latest improvements.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: f2462fbc-67c4-4103-a676-ab1a10de2933

📥 Commits

Reviewing files that changed from the base of the PR and between f67930f and 353b109.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json, !**/package-lock.json

📒 Files selected for processing (1)

• package.json

---

📝 Walkthrough

Walkthrough

The xlsx dependency in package.json was updated from a semver version constraint (^0.18.5) to a direct tarball URL (https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz), changing the package resolution method.

Changes

Cohort / File(s)	Summary
Dependency Configuration package.json	Updated xlsx dependency from semver range to explicit tarball URL pointing to version 0.20.3.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: upgrading xlsx to 0.20.3 and specifies the security vulnerabilities being addressed, directly matching the PR's primary objective.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/xlsx-security

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 54.63%. Comparing base (f67930f) to head (353b109).

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #16   +/-   ##
=======================================
  Coverage   54.63%   54.63%           
=======================================
  Files          28       28           
  Lines        2978     2978           
  Branches      445      445           
=======================================
  Hits         1627     1627           
  Misses       1350     1350           
  Partials        1        1           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.