diff --git a/package.json b/package.json
index 8456a2687..62972274e 100644
--- a/package.json
+++ b/package.json
@@ -113,7 +113,7 @@
     "validator": "^9.0.0",
     "vm2": "^3.9.2",
     "xlsx-populate": "^1.20.1",
-    "xlsx-stream-reader": "^1.1.0",
+    "xlsx-stream-reader": "^1.1.1",
     "xss": "^1.0.6",
     "migrate": "^1.6.2"
   },
diff --git a/yarn.lock b/yarn.lock
index 8ccfaa281..1d8140e26 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -4816,6 +4816,11 @@ graceful-fs@^4.2.0:
   resolved "https://registry.yarnpkg.com/graceful-fs/-/graceful-fs-4.2.4.tgz#2256bde14d3632958c465ebc96dc467ca07a29fb"
   integrity sha512-WjKPNJF79dtJAVniUlGGWHYGz2jWxT6VhN/4m1NdkbZ2nOsEF+cI1Edgql5zCRhs/VsQYRvrXctxktVXZUkixw==
 
+graceful-fs@^4.2.2:
+  version "4.2.11"
+  resolved "https://registry.yarnpkg.com/graceful-fs/-/graceful-fs-4.2.11.tgz#4183e4e8bf08bb6e05bbb2f7d2e0c8f712ca40e3"
+  integrity sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==
+
 "graceful-readlink@>= 1.0.0":
   version "1.0.1"
   resolved "https://registry.yarnpkg.com/graceful-readlink/-/graceful-readlink-1.0.1.tgz#4cafad76bc62f02fa039b2f94e9a3dd3a391a725"
@@ -9590,10 +9595,10 @@ sprintf-js@~1.0.2:
   resolved "https://registry.yarnpkg.com/sprintf-js/-/sprintf-js-1.0.3.tgz#04e6926f662895354f3dd015203633b857297e2c"
   integrity sha1-BOaSb2YolTVPPdAVIDYzuFcpfiw=
 
-ssf@^0.10.2:
-  version "0.10.3"
-  resolved "https://registry.yarnpkg.com/ssf/-/ssf-0.10.3.tgz#8eae1fc29c90a552e7921208f81892d6f77acb2b"
-  integrity sha512-pRuUdW0WwyB2doSqqjWyzwCD6PkfxpHAHdZp39K3dp/Hq7f+xfMwNAWIi16DyrRg4gg9c/RvLYkJTSawTPTm1w==
+ssf@^0.11.2:
+  version "0.11.2"
+  resolved "https://registry.yarnpkg.com/ssf/-/ssf-0.11.2.tgz#0b99698b237548d088fc43cdf2b70c1a7512c06c"
+  integrity sha512-+idbmIXoYET47hH+d7dfm2epdOMUDjqcB4648sTZ+t2JwoyBFL/insLfB/racrDmsKB3diwsDA696pZMieAC5g==
   dependencies:
     frac "~1.1.2"
 
@@ -10020,6 +10025,11 @@ tmp@^0.1.0:
   dependencies:
     rimraf "^2.6.3"
 
+tmp@^0.2.1:
+  version "0.2.3"
+  resolved "https://registry.yarnpkg.com/tmp/-/tmp-0.2.3.tgz#eb783cc22bc1e8bebd0671476d46ea4eb32a79ae"
+  integrity sha512-nZD7m9iCPC5g0pYmcaxogYKggSfLsdxl8of3Q/oIbqCqLLIO9IAF0GWjX1z9NZRHPiXv8Wex4yDCaZsgEw0Y8w==
+
 tmpl@1.0.x:
   version "1.0.4"
   resolved "https://registry.yarnpkg.com/tmpl/-/tmpl-1.0.4.tgz#23640dd7b42d00433911140820e5cf440e521dd1"
@@ -10429,10 +10439,10 @@ unset-value@^1.0.0:
     has-value "^0.3.1"
     isobject "^3.0.0"
 
-unzipper@^0.9.11:
-  version "0.9.15"
-  resolved "https://registry.yarnpkg.com/unzipper/-/unzipper-0.9.15.tgz#97d99203dad17698ee39882483c14e4845c7549c"
-  integrity sha512-2aaUvO4RAeHDvOCuEtth7jrHFaCKTSXPqUkXwADaLBzGbgZGzUDccoEdJ5lW+3RmfpOZYNx0Rw6F6PUzM6caIA==
+unzipper@^0.10.11:
+  version "0.10.14"
+  resolved "https://registry.yarnpkg.com/unzipper/-/unzipper-0.10.14.tgz#d2b33c977714da0fbc0f82774ad35470a7c962b1"
+  integrity sha512-ti4wZj+0bQTiX2KmKWuwj7lhV+2n//uXEotUmGuQqrbVZSEGFMbI68+c6JCQ8aAmUWYvtHEz2A8K6wXvueR/6g==
   dependencies:
     big-integer "^1.6.17"
     binary "~0.3.0"
@@ -10440,6 +10450,7 @@ unzipper@^0.9.11:
     buffer-indexof-polyfill "~1.0.0"
     duplexer2 "~0.1.4"
     fstream "^1.0.12"
+    graceful-fs "^4.2.2"
     listenercount "~1.0.1"
     readable-stream "~2.3.6"
     setimmediate "~1.0.4"
@@ -10827,15 +10838,15 @@ xlsx-populate@^1.20.1:
     lodash "^4.17.15"
     sax "^1.2.4"
 
-xlsx-stream-reader@^1.1.0:
-  version "1.1.0"
-  resolved "https://registry.yarnpkg.com/xlsx-stream-reader/-/xlsx-stream-reader-1.1.0.tgz#77305347eb1eec7199dac7d2ece4bb92f4c90f8e"
-  integrity sha512-SLX5YF9wn4WogWKSTSRjGitPIoK+ZtdkV1S60T0nwyKBdbIG7+PhREsend2VTL/ydWEur5LpTjwZklXmIPEVhw==
+xlsx-stream-reader@^1.1.1:
+  version "1.1.1"
+  resolved "https://registry.yarnpkg.com/xlsx-stream-reader/-/xlsx-stream-reader-1.1.1.tgz#ad2072a111c117f58b3cbcb68414f1ce1360e348"
+  integrity sha512-BRW8CJ6tQ2mRPUcFwAu+XSYKnxqKlBrhPw1r/L/dl0n/XW4tpSwKSg4v2ECCyQFzv6gZDmoVQxbEIVQMPH0uSQ==
   dependencies:
     sax "^1.2.4"
-    ssf "^0.10.2"
-    tmp "^0.1.0"
-    unzipper "^0.9.11"
+    ssf "^0.11.2"
+    tmp "^0.2.1"
+    unzipper "^0.10.11"
 
 xml-name-validator@^3.0.0:
   version "3.0.0"