There is also a downstream dependency vulnerability for inflight through the following dependencies of exceljs:

1. exceljs@4.4.0 › archiver@5.3.2 › archiver-utils@2.1.0 › glob@7.2.3 › inflight@1.0.6
2. exceljs@4.4.0 › tmp@0.2.1 › rimraf@3.0.2 › glob@7.2.3 › inflight@1.0.6
3. exceljs@4.4.0 › archiver@5.3.2 › zip-stream@4.1.1 › archiver-utils@3.0.4 › glob@7.2.3 › inflight@1.0.6
4. exceljs@4.4.0 › unzipper@0.10.14 › fstream@1.0.12 › rimraf@2.7.1 › glob@7.2.3 › inflight@1.0.6

Reference: https://security.snyk.io/vuln/SNYK-JS-INFLIGHT-6095116

I found a fix. For yarn users, add resolutions block to the root of your package.json.

{
  "name": "...",
  "resolutions": {
    "exceljs/**/archiver": "^7.0.1",
    "exceljs/**/unzipper": "^0.12.3"
  },
  "dependencies": {
    "exceljs": "^4.4.0"
  }
}

After running yarn install, verify the inflight package is no longer a dependency by running yarn list --pattern inflight.

For npm users, you may use overrides.

{
  "name": "...",
  "dependencies": {
    "exceljs": "^4.4.0"
  },
  "overrides": {
    "exceljs": {
      "archiver": "^7.0.1",
      "unzipper": "^0.12.3"
    }
  }
}

I tested it in my project and no issues were raised nor any content changes in the generated excel files after the upgrade.

I found a fix. For yarn users, add resolutions block to the root of your package.json.

{
  "name": "...",
  "resolutions": {
    "exceljs/**/archiver": "^7.0.1",
    "exceljs/**/unzipper": "^0.12.3"
  },
  "dependencies": {
    "exceljs": "^4.4.0"
  }
}

After running yarn install, verify the inflight package is no longer a dependency by running yarn list --pattern inflight.

For npm users, you may use overrides.

{
  "name": "...",
  "dependencies": {
    "exceljs": "^4.4.0"
  },
  "overrides": {
    "exceljs": {
      "archiver": "^7.0.1",
      "unzipper": "^0.12.3"
    }
  }
}

I tested it in my project and no issues were raised nor any content changes in the generated excel files after the upgrade.

This is the solution we went with in our project using pnpm as well.

any update on this issue? in the meantime, I'm also using @henryfung3a27 solution as a workaround. thanks!