You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@avro.apache.org by "Ryan Skraba (Jira)" <ji...@apache.org> on 2026/08/24 18:13:00 UTC
[jira] [Updated] (AVRO-4350) [javascript] npm avrojs@1.12.2 missing underscore
[ https://issues.apache.org/jira/browse/AVRO-4350?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Ryan Skraba updated AVRO-4350:
------------------------------
Description:
(from https://lists.apache.org/thread/7xlfdryn99vln4ybsx1yhs257pk9hlcl)
It looks like the underscore dependency was removed as part of a security patch but there is still a file in the project that tries to require it ([https://github.com/apache/avro/blob/2b5fe02502b77fc33c7b2f1a1f8184d46d7700d4/lang/js/etc/deprecated/validator.js#L16]). This causes an "Cannot find module 'underscore’ “ error whenever you try to do a clean install.
You can do a repro with this one liner:
mkdir test && cd test && npm init -y && npm i avro-js@1.12.2 && node -e "require('avro-js')”
or
docker run -it node:10 bash -c "npm install avro-js@1.12.2 && node -e \"require('avro-js')\""
was:
It looks like the underscore dependency was removed as part of a security patch but there is still a file in the project that tries to require it (https://github.com/apache/avro/blob/2b5fe02502b77fc33c7b2f1a1f8184d46d7700d4/lang/js/etc/deprecated/validator.js#L16). This causes an "Cannot find module 'underscore’ “ error whenever you try to do a clean install.
You can do a repro with this one liner:
mkdir test && cd test && npm init -y && npm i avro-js@1.12.2 && node -e "require('avro-js')”
or
docker run -it node:10 bash -c "npm install avro-js@1.12.2 && node -e \"require('avro-js')\""
> [javascript] npm avrojs@1.12.2 missing underscore
> -------------------------------------------------
>
> Key: AVRO-4350
> URL: https://issues.apache.org/jira/browse/AVRO-4350
> Project: Apache Avro
> Issue Type: Bug
> Components: javascript
> Reporter: Ryan Skraba
> Priority: Major
>
> (from https://lists.apache.org/thread/7xlfdryn99vln4ybsx1yhs257pk9hlcl)
> It looks like the underscore dependency was removed as part of a security patch but there is still a file in the project that tries to require it ([https://github.com/apache/avro/blob/2b5fe02502b77fc33c7b2f1a1f8184d46d7700d4/lang/js/etc/deprecated/validator.js#L16]). This causes an "Cannot find module 'underscore’ “ error whenever you try to do a clean install.
> You can do a repro with this one liner:
> mkdir test && cd test && npm init -y && npm i avro-js@1.12.2 && node -e "require('avro-js')”
> or
> docker run -it node:10 bash -c "npm install avro-js@1.12.2 && node -e \"require('avro-js')\""
--
This message was sent by Atlassian Jira
(v8.20.10#820010)