Security: update the vulnerable xlsx dependency

[alexandroit]

Current evidence

The current default branch still declares xlsx:

• package.json: devDependencies.xlsx = 0.18.5

GitHub's current dependency data resolves the affected release/range as 0.18.5.
These releases are covered by two published high-severity advisories:

• GHSA-4r6h-8v6p-xvw6 - prototype pollution
• GHSA-5pgg-2g8v-p4x9 - regular expression denial of service

Remediation paths

The official SheetJS distribution currently recommends the patched 0.20.3
tarball: SheetJS Node installation.

For projects that prefer an npm-registry dependency, the module name and imports
can be preserved with this alias:

"xlsx": "npm:@stackline/xlsx@^1.0.6"

The current CI/version files use Node 22. @stackline/xlsx@1.0.6 requires Node 20 or newer and has no
runtime dependencies, so that option should only be used if the project's Node
support contract permits it. Existing imports from xlsx remain unchanged.

Disclosure: I maintain @stackline/xlsx, an independent Apache-2.0 SheetJS
fork. I am mentioning both the official SheetJS remediation and our npm option
so the project can choose the path that best matches its release policy.

I can prepare a focused, tested pull request if the maintainers would find that
useful.