fix(security): xlsx CVE bump and bundled security hardening#4481

Merged

waleedlatif1 merged 7 commits intostagingfrom

waleedlatif1/fix-xlsx-cve

May 6, 2026

Commits on May 6, 2026

fix(security): xlsx CVE bump and bundled security hardening
waleedlatif1
committed
fix(stripe): use configured secret key for SDK init

waleedlatif1
and
claude
committed
fix(stripe): use static Stripe.webhooks for verification

waleedlatif1
and
claude
committed
fix(ci): revert client-bundled tools to avoid .server import in client
waleedlatif1
committed
fix(security): collapse 403 to 404 on v1 detail-by-ID routes
waleedlatif1
committed
chore(security): remove unused validateAgiloftInstanceUrl helper
waleedlatif1
committed
fix(security): bump minimatch + clean up scripts/ workspace

waleedlatif1
and
claude
committed