From 8469ec46776ea6ea5db3e67e970d6735733f78e9 Mon Sep 17 00:00:00 2001
From: Drew Slobodnjak <60050885+drew08t@users.noreply.github.com>
Date: Wed, 14 Aug 2024 12:25:46 -0700
Subject: [PATCH] [v9.5.x] Chore: Fix CVE-2024-22363 (#91927)

* Chore: Fix CVE-2024-22363 (#86738)

(cherry picked from commit 709d78b8b513e28f642cb24d939a108e6956362a)

# Conflicts:
#	package.json
#	yarn.lock

* revert whatwg-fetch changes

---------

Co-authored-by: Nathan Marrs <nathanielmarrs@gmail.com>
Co-authored-by: Adela Almasan <adela.almasan@grafana.com>
---
 package.json |  2 +-
 yarn.lock    | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/package.json b/package.json
index 89354350914..40ccc50f9e4 100644
--- a/package.json
+++ b/package.json
@@ -417,7 +417,7 @@
     "vendor": "link:./public/vendor",
     "visjs-network": "4.25.0",
     "whatwg-fetch": "3.6.2",
-    "xlsx": "https://cdn.sheetjs.com/xlsx-0.19.1/xlsx-0.19.1.tgz"
+    "xlsx": "https://cdn.sheetjs.com/xlsx-0.20.2/xlsx-0.20.2.tgz"
   },
   "resolutions": {
     "underscore": "1.13.6",
diff --git a/yarn.lock b/yarn.lock
index 269fe16c128..16d84d99314 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -20428,7 +20428,7 @@ __metadata:
     webpack-manifest-plugin: 5.0.0
     webpack-merge: 5.8.0
     whatwg-fetch: 3.6.2
-    xlsx: "https://cdn.sheetjs.com/xlsx-0.19.1/xlsx-0.19.1.tgz"
+    xlsx: "https://cdn.sheetjs.com/xlsx-0.20.2/xlsx-0.20.2.tgz"
     yargs: ^17.5.1
   languageName: unknown
   linkType: soft
@@ -37775,12 +37775,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"xlsx@https://cdn.sheetjs.com/xlsx-0.19.1/xlsx-0.19.1.tgz":
-  version: 0.19.1
-  resolution: "xlsx@https://cdn.sheetjs.com/xlsx-0.19.1/xlsx-0.19.1.tgz"
+"xlsx@https://cdn.sheetjs.com/xlsx-0.20.2/xlsx-0.20.2.tgz":
+  version: 0.20.2
+  resolution: "xlsx@https://cdn.sheetjs.com/xlsx-0.20.2/xlsx-0.20.2.tgz"
   bin:
     xlsx: ./bin/xlsx.njs
-  checksum: a7fa1b95dfc9a6923458e19f0dcd0c64d70ce49a5959c8f38c219fd232a4fdfd48d70115dbe01b0e58e80f336ce872495dcc3d12943c4d19b041c87f8eeb69c8
+  checksum: d6a7cce81cdf5f832311feaef08c8918cb51cdaac235efd29c7f6caf881f7aa797aa51cdbcb583a491ba82d1e7c2b97f92ed082eda754de05731a4558768e68d
   languageName: node
   linkType: hard