Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bring xlsx up-to-date to prevent npm audit vulnerability report #8

Closed
chazzmoney opened this issue Oct 8, 2023 · 2 comments
Closed
Labels
bug Something isn't working

Comments

@chazzmoney
Copy link

Description

npm audit results in

% npm audit
# npm audit report

xlsx  *
Severity: high
Prototype Pollution in sheetJS - https://github.com/advisories/GHSA-4r6h-8v6p-xvw6
No fix available
node_modules/xlsx
  office-text-extractor  *
  Depends on vulnerable versions of xlsx
  node_modules/office-text-extractor

2 high severity vulnerabilities

Some issues need review, and may require choosing
a different dependency.

As per https://docs.sheetjs.com/docs/getting-started/installation/nodejs#legacy-endpoints, you can update the xlsx dependency in your project via:

pnpm rm xlsx
pnpm install https://cdn.sheetjs.com/xlsx-0.20.0/xlsx-0.20.0.tgz

This will remove the vulnerability error and bring xlsx up to date with the current published version.

Library version

^3.0.1

Node version

v20.3.1

Typescript version (if you are using it)

No response

@chazzmoney chazzmoney added the bug Something isn't working label Oct 8, 2023
@chazzmoney chazzmoney changed the title xlsx 0.18.5 contains vulnerabilities Bring xlsx up-to-date to prevent npm audit vulnerability report Oct 8, 2023
@gamemaker1
Copy link
Owner

Hi, thanks for reporting this! I've released v3.0.2 with the updated dependency.

@chazzmoney
Copy link
Author

I just wanted to say thank you and complement you for responding so very quickly. Well done; your hard work is greatly appreciated!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants