Security issue with outdated phpoffice/phpspreadsheet (CVE-2024-45048, CVE-2024-45046)

[SomeBdyElse]

Google has reported two security advisories regarding phpoffice/phpspreadsheet < 2.2.1:

+-------------------+----------------------------------------------------------------------------------+
| Package           | phpoffice/phpspreadsheet                                                         |
| Severity          | high                                                                             |
| CVE               | CVE-2024-45048                                                                   |
| Title             | XXE in PHPSpreadsheet encoding is returned                                       |
| URL               | https://github.com/advisories/GHSA-ghg6-32f9-2jp7                                |
| Affected versions | <2.2.1                                                                           |
| Reported at       | 2024-08-29T17:58:27+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+
+-------------------+----------------------------------------------------------------------------------+
| Package           | phpoffice/phpspreadsheet                                                         |
| Severity          | medium                                                                           |
| CVE               | CVE-2024-45046                                                                   |
| Title             | PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style       |
|                   | information                                                                      |
| URL               | https://github.com/advisories/GHSA-wgmf-q9vr-vww6                                |
| Affected versions | <2.1.0                                                                           |
| Reported at       | 2024-08-29T17:56:56+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+

Packagist also displays warnings for all phpspreadsheet versions < 2.2.1.

ked all

This package requires "phpoffice/phpspreadsheet": "^1.22"
https://github.com/frappant/frp_form_answers/blob/master/composer.json#L8

Because of the version constraint, this package does not allow to update phpoffice/phpspreadsheet to a save 2.x version. I suggest to migrate to phpoffice/phpspreadsheet 2. There do not seem to be too many breaking changes.
https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.0.0