posibility of a 1.4.18 release with less strict jszip version dependency

Hi, @mwilliamson,

Issue Description

I noticed that a vulnerability is introduced in mammoth@1.4.17: Vulnerability CVE-2021-23413 affects package jszip (versions:❤️.7.0): https://snyk.io/vuln/SNYK-JS-JSZIP-1251497 The above vulnerable package is referenced by mammoth@1.4.17 via: mammoth@1.4.17 ➔ jszip@2.5.0

Since mammoth@1.4.17 (10,434 downloads per week) is referenced by 41 downstream projects (e.g., @accordproject/markdown-cli 0.14.0 (latest version), @accordproject/markdown-docx 0.14.0 (latest version), @accordproject/markdown-transform 0.14.0 (latest version), @secrecy/front-utils 1.0.682 (latest version), @accordproject/ui-contract-editor 0.97.0 (latest version)), the vulnerability CVE-2021-23413 can be propagated into these downstream projects and expose security threats to them via the following package dependency paths: (1)@accordproject/markdown-cli@0.14.0 ➔ @accordproject/markdown-transform@0.14.0 ➔ @accordproject/markdown-docx@0.14.0 ➔ mammoth@1.4.17 ➔ jszip@2.5.0 (2)@secrecy/front-utils@1.0.682 ➔ mammoth@1.4.17 ➔ jszip@2.5.0 …

If mammoth@1.4.* removes the vulnerable package from the above version, then its fixed version can help downstream users decrease their pain.

Given the large number of downstream users, could you help update your package to remove the vulnerability from mammoth@1.4.17 ?

Fixing suggestions

In mammoth@1.4.18, you can kindly try to perform the following upgrade : jszip ~2.5.0 ➔ ~3.7.0;

Note: jszip@3.7.0(>=3.7.0) has fixed the vulnerability CVE-2021-23413. Of course, you are welcome to share other ways to resolve the issue.

Thank you for your attention to this issue.^_^

[mwilliamson]

This should be addressed in 1.4.18.

[NL33]

Just ran $ npm i mammoth again–installing mammoth 1.4.18–and can confirm no vulnerabilities reported. Thanks very much, @mwilliamson .