Oh wow, thanks for finding this -- my validation for npm was far too simplistic (I just checked "npm install [email protected]" worked)
Well, it looks like we'll need a 1.12.3 for this, but I'm reasonably sure that we can do this quickly since we've gotten everything in place for the 1.12.2 recently. I created https://issues.apache.org/jira/browse/AVRO-4350 to track this. If you end up creating a JIRA account, I'll be sure to assign reporter credit to you. A PR to fix this would be welcome, and I've updated my release process to include your one-liner. If you find any other issues with the javascript implementation please don't hesitate to reach out! All my best, Ryan On 8/24/26 11:15 AM, "Vozza, Stefano" <[email protected]> wrote:
Hi there, There appears to be a problem with the new avro-js 1.12.2 release. On the project Jira page, it says to use the mailing list but if this is better of being a Jira issue, I can create an account and file it there. It looks like the underscore dependency was removed as part of a security patch but there is still a file in the project that tries to require it (https://github.com/apache/avro/blob/2b5fe02502b77fc33c7b2f1a1f8184d46d7700d4/lang/js/etc/deprecated/validator.js#L16). This causes an "Cannot find module 'underscore’ “ error whenever you try to do a clean install. You can do a repro with this one liner: mkdir test && cd test && npm init -y && npm i [email protected] && node -e "require('avro-js')” Happy to contribute a PR to fix this if required. Stefano Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg, R.C.S. Luxembourg B186284 Amazon Web Services EMEA SARL, Irish Branch, One Burlington Plaza, Burlington Road, Dublin 4, Ireland, branch registration number 908705
