mirror of
https://gh-proxy.org/https://github.com/klinsmaya/sub2api.git
synced 2026-11-08 11:46:49 +08:00
xlsx is frozen at 0.18.5 on the npm registry (fixed versions are only published on the SheetJS CDN), so GHSA-4r6h-8v6p-xvw6 and GHSA-5pgg-2g8v-p4x9 remain flagged by pnpm audit. Mitigation is unchanged: admin-export-only usage behind a dynamic import.