xlsx is frozen at 0.18.5 on the npm registry (fixed versions are only published on the SheetJS CDN), so GHSA-4r6h-8v6p-xvw6 and GHSA-5pgg-2g8v-p4x9 remain flagged by pnpm audit. Mitigation is unchanged: admin-export-only usage behind a dynamic import.