I’ve raised the PR here: https://github.com/apache/avro/pull/3970. I mentioned it in the PR body but I think the best solution is refactoring the validator code to use native methods instead of underscore. Most of the underscore usages are for type checking that could easily be inlined and the only place I think could be a bit work is where _.isEqual is used to compare nested objects. I am happy to raise a follow up PR to do this after 1.12.3 goes out.
Stefano From: Vozza, Stefano <[email protected]> Date: Monday, 24 August 2026 at 20:06 To: [email protected] <[email protected]> Subject: RE: [EXT UNVERIFIED SENDER] avro-js 1.12.2 npm package is unusable — missing underscore dependency CAUTION: Email security compliance checks failed. Do not reply to this email, click links or open attachments unless you can confirm the sender. For more information, search for DMARC on Amazon's IT Portal at it.amazon.com Thank you for the prompt response! I didn’t create a JIRA account in the end but definitely happy to provide a PR. Stefano From: [email protected] <[email protected]> Date: Monday, 24 August 2026 at 19:42 To: [email protected] <[email protected]> Subject: RE: [EXTERNAL] avro-js 1.12.2 npm package is unusable — missing underscore dependency CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe. Oh wow, thanks for finding this -- my validation for npm was far too simplistic (I just checked "npm install [email protected]" worked) Well, it looks like we'll need a 1.12.3 for this, but I'm reasonably sure that we can do this quickly since we've gotten everything in place for the 1.12.2 recently. I created https://issues.apache.org/jira/browse/AVRO-4350 to track this. If you end up creating a JIRA account, I'll be sure to assign reporter credit to you. A PR to fix this would be welcome, and I've updated my release process to include your one-liner. If you find any other issues with the javascript implementation please don't hesitate to reach out! All my best, Ryan On 8/24/26 11:15 AM, "Vozza, Stefano" <[email protected]> wrote: > Hi there, > There appears to be a problem with the new avro-js 1.12.2 release. On the > project Jira page, it says to use the mailing list but if this is better of > being a Jira issue, I can create an account and file it there. > > It looks like the underscore dependency was removed as part of a security > patch but there is still a file in the project that tries to require it > (https://github.com/apache/avro/blob/2b5fe02502b77fc33c7b2f1a1f8184d46d7700d4/lang/js/etc/deprecated/validator.js#L16). > This causes an "Cannot find module 'underscore’ “ error whenever you try to > do a clean install. > > You can do a repro with this one liner: > > mkdir test && cd test && npm init -y && npm i [email protected] && node -e > "require('avro-js')” > > Happy to contribute a PR to fix this if required. > > Stefano > > > > Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg, > R.C.S. Luxembourg B186284 > > Amazon Web Services EMEA SARL, Irish Branch, One Burlington Plaza, Burlington > Road, Dublin 4, Ireland, branch registration number 908705 > > > > Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg, R.C.S. Luxembourg B186284 Amazon Web Services EMEA SARL, Irish Branch, One Burlington Plaza, Burlington Road, Dublin 4, Ireland, branch registration number 908705 Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg, R.C.S. Luxembourg B186284 Amazon Web Services EMEA SARL, Irish Branch, One Burlington Plaza, Burlington Road, Dublin 4, Ireland, branch registration number 908705
