feat: upgrades to xlsx@0.20.3 via CDN

[matthewhartstonge]

Fixes:

• CVE-2023-30533
• CVE-2024-22363

[matthewhartstonge]

• build: updates import paths for addon compatibility. #47
• feat: upgrades to xlsx@0.20.3 via CDN #46 👈
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

Join @matthewhartstonge and the rest of your teammates on Graphite

[matthewhartstonge]

@hero-david @pauln what are your thoughts on migrating to a git based dep...? 🤢

I'm not really a fan of pulling in a git repo, but it is pinned in the lock file to a specific commit hash. Sheetjs have yeeted themselves into their own world (gitea self hosted git) and removed themselves from pushing the dep up to npm :/

Refer: https://github.com/SheetJS/sheetjs/tree/github?tab=readme-ov-file#thank-you-clippy

Tl;DR: Removes a couple of CVEs.

[matthewhartstonge]

The other options are:

• vendor in the dependency and manually update as CVEs arise..?
• use their CDN (https://docs.sheetjs.com/docs/getting-started/installation/nodejs/#vendoring)

They are supporting versions of node back to 0.8 and Angular v1.X clients, which is why they had to move away from npmjs.

[matthewhartstonge]

Decision over chats was to move forward with using the CDN 👍

[hero-david]

Decision over chats was to move forward with using the CDN 👍

I didn't realise that git was an option 👀 Feels nicer than a tgz

[matthewhartstonge]

yarp - give 7b63ce7 a cheeky peep 👀

Can change back to git on a v0.16 or as part of the move to a v2 ember addon 👍