@nlpjs/xtables depends on vulnerable version of xlsx

[ahitrov]

[Security] Prototype Pollution in sheetJS

GHSA-4r6h-8v6p-xvw6

Affected version: 0.19.3

Description
All versions of SheetJS CE through 0.19.2 are vulnerable to "Prototype Pollution" when reading specially crafted files. Workflows that do not read arbitrary files (for example, exporting data to spreadsheet files) are unaffected.

References
https://nvd.nist.gov/vuln/detail/CVE-2023-30533
https://cdn.sheetjs.com/advisories/CVE-2023-30533
https://git.sheetjs.com/sheetjs/sheetjs/src/branch/master/CHANGELOG.md

[Mitko-Kerezov]

This is currently heavily affecting us also as npm audit does not pass and it is marked as a high severity security issue.

Could we get an update on this?

[kibertoad]

@ericzon Can we help with this?

[kibertoad]

@ericzon We've created an npm version for a newer version of XLSX (which is distributed with Apache 2 license over CDN): https://www.npmjs.com/package/@lokalise/xlsx

It should resolve the security issue in question.