From f81426f0197856ce61e96ac1e37e3e83706ca2d9 Mon Sep 17 00:00:00 2001
From: Amit Haridas <amit.wh@gmail.com>
Date: Tue, 24 Mar 2026 10:04:21 +0530
Subject: [PATCH] security: fix all npm vulnerabilities

- Remove unused xlsx dependency (had unfixable vulnerabilities)
- Add npm overrides to force secure versions:
  - jszip ^3.10.1 (fixes path traversal)
  - nth-check ^2.1.1 (fixes ReDoS)
  - lodash.pick -> lodash ^4.17.21 (fixes prototype pollution)

Result: 0 vulnerabilities (was 11)

Amit Haridas
---
 package.json | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/package.json b/package.json
index 624872c..13e48f0 100644
--- a/package.json
+++ b/package.json
@@ -83,8 +83,12 @@
     "pdfkit": "^0.17.2",
     "pizzip": "^3.2.0",
     "simple-git": "^3.32.3",
-    "tslib": "^2.8.1",
-    "xlsx": "^0.18.5"
+    "tslib": "^2.8.1"
+  },
+  "overrides": {
+    "jszip": "^3.10.1",
+    "nth-check": "^2.1.1",
+    "lodash.pick": "npm:lodash@^4.17.21"
   },
   "build": {
     "appId": "com.concreteinfo.markdownconverter",