Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove unused vulnerable dependency "xlsx" #17549

Open
4 tasks
mtrefzer opened this issue Jan 31, 2025 · 2 comments
Open
4 tasks

Remove unused vulnerable dependency "xlsx" #17549

mtrefzer opened this issue Jan 31, 2025 · 2 comments
Labels
Status: Needs Triage Issue will be reviewed by Core Team and a relevant label will be added as soon as possible

Comments

@mtrefzer
Copy link
Contributor

Describe the bug

The dependency "xlsx" is vulnerable and not used in the project, therefor it should be removed.

Pull Request Link

#17548

Reason for not contributing a PR

  • Lack of time
  • Unsure how to implement the fix/feature
  • Difficulty understanding the codebase
  • Other

Other Reason

No response

Reproducer

#17548

Environment

Ubuntu 24
node 22

Angular version

19

PrimeNG version

v19

Node version

22

Browser(s)

No response

Steps to reproduce the behavior

package.json contains "xlsx"

Expected behavior

package.json should not contain "xlsx"

@mtrefzer mtrefzer added the Status: Needs Triage Issue will be reviewed by Core Team and a relevant label will be added as soon as possible label Jan 31, 2025
@FranSalRod
Copy link

FranSalRod commented Jan 31, 2025

Hi!
If you have xlsx in your package.json is becouse you put it yourself. Primeng do not install xlsx.
If your project dont need it, and is vulnerable, just remove it.

@mtrefzer
Copy link
Contributor Author

It's a dependency in apps/showcase/package.json.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Status: Needs Triage Issue will be reviewed by Core Team and a relevant label will be added as soon as possible
Projects
None yet
Development

No branches or pull requests

2 participants