mirror of
https://github.com/Wei-Shaw/sub2api.git
synced 2026-09-24 16:05:44 +08:00
xlsx is frozen at 0.18.5 on the npm registry (fixed versions are only published on the SheetJS CDN), so GHSA-4r6h-8v6p-xvw6 and GHSA-5pgg-2g8v-p4x9 remain flagged by pnpm audit. Mitigation is unchanged: admin-export-only usage behind a dynamic import.