This would also solve #713 (comment) 👍🏻

The above linked PR removes the node-unzipper dependency with another one (see #2687). The reason for doing so was:

a) remove a security vulnerability in a transitive dependency of node-unzipper, and
b) remove a transitive dependency on a package with no licensing.

However, I believe what's suggested here is even better than using the yauzl-promise library (given it also addresses package size). Note that implementing zipping via the CompressionStream API would bump the required NodeJS version to version 18, but my above linked PR also does so.

I'm not even using this library, so I don't have the bandwidth to port this (and I'm not sure if it'll be merged, given the bump in minimum node version), but it'll probably be about a 4-8 hour patch?

@alubbe @Siemienik @Alanscut Could you please investigate this issue? The node-unzipper library is no longer maintained and has known vulnerabilities. Consequently, we cannot use the exceljs library in projects where security vulnerabilities are a significant concern.