From a564051f8335f225e8085c8fd1a2bdd11158a161 Mon Sep 17 00:00:00 2001 From: shaw Date: Tue, 7 Jul 2026 08:38:30 +0800 Subject: [PATCH] chore: renew expired xlsx audit exceptions to 2026-10-06 xlsx is frozen at 0.18.5 on the npm registry (fixed versions are only published on the SheetJS CDN), so GHSA-4r6h-8v6p-xvw6 and GHSA-5pgg-2g8v-p4x9 remain flagged by pnpm audit. Mitigation is unchanged: admin-export-only usage behind a dynamic import. --- .github/audit-exceptions.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/audit-exceptions.yml b/.github/audit-exceptions.yml index 4e05aae66b..2a89dd0761 100644 --- a/.github/audit-exceptions.yml +++ b/.github/audit-exceptions.yml @@ -5,14 +5,14 @@ exceptions: severity: high reason: "Admin export only; switched to dynamic import to reduce exposure (CVE-2023-30533)" mitigation: "Load only on export; restrict export permissions and data scope" - expires_on: "2026-07-06" + expires_on: "2026-10-06" owner: "security@your-domain" - package: xlsx advisory: "GHSA-5pgg-2g8v-p4x9" severity: high reason: "Admin export only; switched to dynamic import to reduce exposure (CVE-2024-22363)" mitigation: "Load only on export; restrict export permissions and data scope" - expires_on: "2026-07-06" + expires_on: "2026-10-06" owner: "security@your-domain" - package: lodash advisory: "GHSA-r5fr-rjxr-66jc"