Vendor xlsx?

[ArnaudBarre]

Hi, thanks for the package, we are considering using it but I was surprised that xlsx is not published on npm and is just a raw link to a non shared cdn, so the attack vector is quite big I think. Given that the version is hardcoded anyway, did you tough about bundling the lib? It would require some work for bundling types too, but that would make things cleaner.