[alexandroit]

Related Ticket: Not applicable

Description of Changes

Replaces xlsx@^0.18.5 with @stackline/xlsx@^1.0.6 through an npm alias:

"xlsx": "npm:@stackline/xlsx@^1.0.6"

The dependency key remains xlsx, so the existing static and dynamic imports do
not change. The regenerated Yarn lockfile now resolves the alias to
@stackline/xlsx@1.0.6 and removes upstream xlsx@0.18.5 and its dependency
chain.

This addresses the advisories affecting the previous release:

• GHSA-4r6h-8v6p-xvw6 (prototype pollution)
• GHSA-5pgg-2g8v-p4x9 (ReDoS)

Disclosure: I maintain @stackline/xlsx, an independent Apache-2.0
SheetJS-compatible fork. It requires Node 20 or newer, which is within this
project's declared Node 24 runtime.

Notes & Questions About Changes

No application code or UI behavior changes. Both import('xlsx') and the
existing type import continue to resolve through the same module name.

Validation / Testing

Validated locally with Node 24.19.0 and Yarn 1.22.22:

• yarn install --frozen-lockfile --ignore-scripts
• yarn test --runInBand --silent (20 suites, 164 tests, 1 snapshot)
• yarn ts-check
• yarn lint (no errors; existing warnings remain)
• yarn buildlib
• dynamic import, XLSX write/read round trip, and unsafe-key pollution smoke test
• Yarn audit output contains neither affected advisory nor an xlsx finding

[netlify]

👷 Deploy request for veda-ui pending review.

Visit the deploys page to approve it

Name	Link
🔨 Latest commit	d6e9610