chore(security): replace SheetJS xlsx with exceljs (#2945)

## Summary

Resolves the only outstanding **high/critical** Dependabot security
alerts in the repository, both against the SheetJS `xlsx` package:

| Advisory | Severity | Issue |
| --- | --- | --- |
|
[GHSA-4r6h-8v6p-xvw6](GHSA-4r6h-8v6p-xvw6)
| High (CVSS 7.8) | Prototype Pollution in SheetJS |
|
[GHSA-5pgg-2g8v-p4x9](GHSA-5pgg-2g8v-p4x9)
| High (CVSS 7.5) | SheetJS Regular Expression Denial of Service (ReDoS)
|

### Why a version bump can't fix this

Both advisories are recorded with `introduced: 0` and **no fixed
version** in the npm ecosystem. SheetJS stopped publishing to the npm
registry after `0.18.5`; patched builds live only on the SheetJS CDN.
The repo already pinned the CDN-hosted, patched `xlsx@0.20.3`, but
Dependabot/GHSA still flag it because there is no registry release that
clears the advisory range. The only durable remediation is to stop
depending on `xlsx`.

### Change

- **`apps/api/src/lib/file-extract.ts`** — migrate knowledge-base
spreadsheet extraction from `xlsx` to the actively-maintained
[`exceljs`](https://www.npmjs.com/package/exceljs) (no open
high/critical advisories). Each worksheet is converted to CSV with
standard field quoting (commas, quotes, and newlines are escaped).
- **`apps/api/package.json` / `pnpm-lock.yaml`** — drop `xlsx`, add
`exceljs@4.4.0`.
- **`apps/playground/.../projects-page-client.tsx`** — stop advertising
legacy binary `.xls` in the upload picker.
- **`file-extract.spec.ts`** — build fixtures with `exceljs`; add a
CSV-quoting case and a case asserting unreadable spreadsheet data is
rejected.

### Behavior note

`exceljs` reads modern `.xlsx` but cannot parse the legacy binary `.xls`
(BIFF) format. `.xlsx` extraction is unchanged. Legacy `.xls` uploads
(rare; Excel has defaulted to `.xlsx` since 2007) are no longer
advertised in the picker and are rejected cleanly by the existing upload
error path rather than being indexed as garbage.

## Verification

- `osv-scanner` on the updated lockfile: **0 high/critical** remaining
(previously 2).
- `pnpm format` — clean
- `turbo run build` (full monorepo) — passes
- `apps/api` unit tests (`file-extract.spec.ts`) — 6/6 pass; `tsc
--noEmit` clean

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---
_Generated by [Claude
Code](https://claude.ai/code/session_015JboNg5ryVipY8M6nzJykR)_

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Improved spreadsheet upload handling for modern `.xlsx` files,
including workbooks with multiple sheets (combined output with sheet
names).
* **Bug Fixes**
* CSV generation now properly escapes fields (commas, quotes, and
newlines).
* Invalid/unreadable spreadsheet inputs are rejected instead of
returning incorrect results.
* **Chores**
* Updated the supported upload formats by removing legacy `.xls` from
the upload flow.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: Claude <noreply@anthropic.com>

Author: steebchen

apps/api/package.json

@@ -41,6 +41,7 @@
 		"disposable-email-domains-js": "1.20.0",
 		"dotenv": "17.4.2",
 		"drizzle-zod": "0.8.3",
+		"exceljs": "4.4.0",
 		"gateway": "workspace:*",
 		"hono": "^4.12.25",
 		"hono-openapi": "^1.1.1",
@@ -52,7 +53,6 @@
 		"resend": "6.8.0",
 		"stripe": "18.1.1",
 		"unpdf": "1.6.2",
-		"xlsx": "https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz",
 		"zod": "3.25.75",
 		"zod-openapi": "^5.4.3"
 	}

apps/api/src/lib/file-extract.spec.ts

@@ -1,8 +1,18 @@
+import ExcelJS from "exceljs";
 import { describe, expect, it } from "vitest";
-import * as XLSX from "xlsx";
 
 import { extractFileText } from "./file-extract.js";
 
+async function buildXlsx(
+	sheetName: string,
+	rows: (string | number)[][],
+): Promise<Buffer> {
+	const workbook = new ExcelJS.Workbook();
+	const sheet = workbook.addWorksheet(sheetName);
+	sheet.addRows(rows);
+	return Buffer.from(await workbook.xlsx.writeBuffer());
+}
+
 describe("extractFileText", () => {
 	it("passes plain text through as UTF-8", async () => {
 		const text = await extractFileText(
@@ -14,16 +24,10 @@ describe("extractFileText", () => {
 	});
 
 	it("converts spreadsheet sheets to CSV with sheet headers", async () => {
-		const workbook = XLSX.utils.book_new();
-		const sheet = XLSX.utils.aoa_to_sheet([
+		const buffer = await buildXlsx("Team", [
 			["name", "role"],
 			["Ada", "engineer"],
 		]);
-		XLSX.utils.book_append_sheet(workbook, sheet, "Team");
-		const buffer = XLSX.write(workbook, {
-			type: "buffer",
-			bookType: "xlsx",
-		}) as Buffer;
 
 		const text = await extractFileText(
 			"team.xlsx",
@@ -35,25 +39,28 @@ describe("extractFileText", () => {
 		expect(text).toContain("Ada,engineer");
 	});
 
-	it("converts legacy .xls workbooks to CSV", async () => {
-		const workbook = XLSX.utils.book_new();
-		const sheet = XLSX.utils.aoa_to_sheet([
+	it("quotes CSV fields containing commas", async () => {
+		const buffer = await buildXlsx("Places", [
 			["city", "country"],
-			["Lund", "Sweden"],
+			["Lund, Skåne", "Sweden"],
 		]);
-		XLSX.utils.book_append_sheet(workbook, sheet, "Places");
-		const buffer = XLSX.write(workbook, {
-			type: "buffer",
-			bookType: "xls",
-		}) as Buffer;
 
 		const text = await extractFileText(
-			"places.xls",
-			"application/vnd.ms-excel",
+			"places.xlsx",
+			"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
 			buffer,
 		);
-		expect(text).toContain("# Places");
-		expect(text).toContain("Lund,Sweden");
+		expect(text).toContain('"Lund, Skåne",Sweden');
+	});
+
+	it("rejects unreadable spreadsheet data", async () => {
+		await expect(
+			extractFileText(
+				"legacy.xls",
+				"application/vnd.ms-excel",
+				Buffer.from("not a real spreadsheet"),
+			),
+		).rejects.toThrow();
 	});
 
 	it("rejects buffers over the extraction size cap", async () => {

apps/api/src/lib/file-extract.ts

@@ -1,5 +1,5 @@
+import ExcelJS from "exceljs";
 import { extractText, getDocumentProxy } from "unpdf";
-import * as XLSX from "xlsx";
 
 // Defensive cap mirroring the upload route's base64 limit, so the extractor
 // stays safe even if called from a new code path without an upstream guard.
@@ -20,6 +20,28 @@ function isSpreadsheet(name: string, mimeType: string) {
 	);
 }
 
+// Quote a CSV field when it contains a delimiter, quote, or newline, doubling
+// any embedded quotes — matching standard CSV escaping.
+function csvEscape(value: string) {
+	if (/[",\n\r]/.test(value)) {
+		return `"${value.replace(/"/g, '""')}"`;
+	}
+	return value;
+}
+
+function sheetToCsv(worksheet: ExcelJS.Worksheet) {
+	const columnCount = worksheet.columnCount;
+	const lines: string[] = [];
+	worksheet.eachRow({ includeEmpty: true }, (row) => {
+		const cells: string[] = [];
+		for (let col = 1; col <= columnCount; col++) {
+			cells.push(csvEscape(row.getCell(col).text ?? ""));
+		}
+		lines.push(cells.join(","));
+	});
+	return lines.join("\n");
+}
+
 // Extract plain text from an uploaded knowledge base file. PDFs are parsed
 // with unpdf (pdf.js), spreadsheets are converted sheet-by-sheet to CSV, and
 // anything else is treated as UTF-8 text.
@@ -39,11 +61,14 @@ export async function extractFileText(
 	}
 
 	if (isSpreadsheet(name, mimeType)) {
-		const workbook = XLSX.read(buffer, { type: "buffer" });
-		return workbook.SheetNames.map((sheetName) => {
-			const csv = XLSX.utils.sheet_to_csv(workbook.Sheets[sheetName]);
-			return `# ${sheetName}\n${csv}`;
-		}).join("\n\n");
+		const workbook = new ExcelJS.Workbook();
+		// exceljs's bundled types declare `Buffer extends ArrayBuffer`, which is
+		// incompatible with Node's Buffer type; the loader accepts a Node Buffer
+		// at runtime, so cast for the type checker only.
+		await workbook.xlsx.load(buffer as unknown as ArrayBuffer);
+		return workbook.worksheets
+			.map((worksheet) => `# ${worksheet.name}\n${sheetToCsv(worksheet)}`)
+			.join("\n\n");
 	}
 
 	return buffer.toString("utf8");

apps/playground/src/components/playground/projects-page-client.tsx

@@ -67,9 +67,9 @@ import type { Organization } from "@/lib/types";
 // Text-based formats are read client-side; PDF and Excel files are sent as
 // base64 and their text is extracted server-side.
 const ACCEPTED_FILE_EXTENSIONS =
-	".txt,.md,.markdown,.mdx,.csv,.tsv,.json,.yaml,.yml,.xml,.html,.log,.js,.jsx,.ts,.tsx,.py,.rb,.go,.rs,.java,.c,.cpp,.h,.css,.pdf,.xlsx,.xls";
+	".txt,.md,.markdown,.mdx,.csv,.tsv,.json,.yaml,.yml,.xml,.html,.log,.js,.jsx,.ts,.tsx,.py,.rb,.go,.rs,.java,.c,.cpp,.h,.css,.pdf,.xlsx";
 
-const BINARY_FILE_EXTENSIONS = [".pdf", ".xlsx", ".xls"];
+const BINARY_FILE_EXTENSIONS = [".pdf", ".xlsx"];
 
 function isBinaryKnowledgeFile(name: string) {
 	const lower = name.toLowerCase();