null af20d8de07 fix(deps)!: clear both high-severity vulns; CI audit gate raised to high ... - nodemailer 8 -> 9 (GHSA-p6gq-j5cr-w38f, raw-option file-read/SSRF; we never use the raw option — notificationDelivery tests 13/13) - xlsx -> official SheetJS dist 0.20.3 (prototype pollution GHSA-4r6h-8v6p-xvw6 + ReDoS GHSA-5pgg-2g8v-p4x9; npm registry line is abandoned at 0.18.5 with no fix). API-identical for our 8 call sites; import/export round-trip tests green. NOTE: the lockfile now pins https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz — CI runners and Docker builds need egress to cdn.sheetjs.com - CI: npm audit --audit-level critical -> high (0 vulns as of this commit; highs can no longer pass silently — QA-B0-02) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>		2026-07-10 17:34:51 -05:00
..
ci.yml	fix(deps)!: clear both high-severity vulns; CI audit gate raised to high	2026-07-10 17:34:51 -05:00