Thanks so much -- I'm enthusiastic about removing the underscore dependency :D
On 8/24/26 9:46 PM, "Vozza, Stefano" <[email protected]> wrote:
I’ve raised the PR here: https://github.com/apache/avro/pull/3970. I mentioned
it in the PR body but I think the best solution is refactoring the validator
code to use native methods instead of underscore. Most of the underscore usages
are for type checking that could easily be inlined and the only place I think
could be a bit work is where _.isEqual is used to compare nested objects. I am
happy to raise a follow up PR to do this after 1.12.3 goes out.
Stefano
From: Vozza, Stefano <[email protected]>
Date: Monday, 24 August 2026 at 20:06
To: [email protected] <[email protected]>
Subject: RE: [EXT UNVERIFIED SENDER] avro-js 1.12.2 npm package is unusable —
missing underscore dependency
CAUTION: Email security compliance checks failed. Do not reply to this email,
click links or open attachments unless you can confirm the sender. For more
information, search for DMARC on Amazon's IT Portal at it.amazon.com
Thank you for the prompt response! I didn’t create a JIRA account in the end
but definitely happy to provide a PR.
Stefano
From: [email protected] <[email protected]>
Date: Monday, 24 August 2026 at 19:42
To: [email protected] <[email protected]>
Subject: RE: [EXTERNAL] avro-js 1.12.2 npm package is unusable — missing
underscore dependency
CAUTION: This email originated from outside of the organization. Do not click
links or open attachments unless you can confirm the sender and know the
content is safe.
Oh wow, thanks for finding this -- my validation for npm was far too simplistic (I just
checked "npm install [email protected]" worked)
Well, it looks like we'll need a 1.12.3 for this, but I'm reasonably sure that
we can do this quickly since we've gotten everything in place for the 1.12.2
recently.
I created https://issues.apache.org/jira/browse/AVRO-4350 to track this. If
you end up creating a JIRA account, I'll be sure to assign reporter credit to
you. A PR to fix this would be welcome, and I've updated my release process to
include your one-liner.
If you find any other issues with the javascript implementation please don't
hesitate to reach out!
All my best, Ryan
On 8/24/26 11:15 AM, "Vozza, Stefano" <[email protected]> wrote:
> Hi there,
> There appears to be a problem with the new avro-js 1.12.2 release. On the
project Jira page, it says to use the mailing list but if this is better of being
a Jira issue, I can create an account and file it there.
>
> It looks like the underscore dependency was removed as part of a security patch
but there is still a file in the project that tries to require it
(https://github.com/apache/avro/blob/2b5fe02502b77fc33c7b2f1a1f8184d46d7700d4/lang/js/etc/deprecated/validator.js#L16).
This causes an "Cannot find module 'underscore’ “ error whenever you try to do a
clean install.
>
> You can do a repro with this one liner:
>
> mkdir test && cd test && npm init -y && npm i [email protected] && node -e
"require('avro-js')”
>
> Happy to contribute a PR to fix this if required.
>
> Stefano
>
>
>
> Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg,
R.C.S. Luxembourg B186284
>
> Amazon Web Services EMEA SARL, Irish Branch, One Burlington Plaza, Burlington
Road, Dublin 4, Ireland, branch registration number 908705
>
>
>
>
Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg,
R.C.S. Luxembourg B186284
Amazon Web Services EMEA SARL, Irish Branch, One Burlington Plaza, Burlington
Road, Dublin 4, Ireland, branch registration number 908705
Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg,
R.C.S. Luxembourg B186284
Amazon Web Services EMEA SARL, Irish Branch, One Burlington Plaza, Burlington
Road, Dublin 4, Ireland, branch registration number 908705
