Actually nevermind, I looked at the exports and can see that they are exported so they are still part of the public API.
Stefano From: Vozza, Stefano <[email protected]> Date: Tuesday, 25 August 2026 at 17:33 To: [email protected] <[email protected]> Subject: RE: [EXT UNVERIFIED SENDER] avro-js 1.12.2 npm package is unusable — missing underscore dependency CAUTION: Email security compliance checks failed. Do not reply to this email, click links or open attachments unless you can confirm the sender. For more information, search for DMARC on Amazon's IT Portal at it.amazon.com Yeah, I don’t think it’s a big job really and agreed, alway nice to shed a dependency! Before, I do my plan though, can I just ask: the module that’s causing us all these problems lives in a folder called ‘deprecated’. Does that mean that it will be removed in the next major version or that it’s already been deprecated and it’s only there because of historical reasons. If it’s the later then we can just remove the whole folder and then we wouldn’t need Underscore. Stefano From: [email protected] <[email protected]> Date: Tuesday, 25 August 2026 at 17:13 To: [email protected] <[email protected]> Subject: RE: [EXTERNAL] avro-js 1.12.2 npm package is unusable — missing underscore dependency CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe. Thanks so much -- I'm enthusiastic about removing the underscore dependency :D On 8/24/26 9:46 PM, "Vozza, Stefano" <[email protected]> wrote: > I’ve raised the PR here: https://github.com/apache/avro/pull/3970. I > mentioned it in the PR body but I think the best solution is refactoring the > validator code to use native methods instead of underscore. Most of the > underscore usages are for type checking that could easily be inlined and the > only place I think could be a bit work is where _.isEqual is used to compare > nested objects. I am happy to raise a follow up PR to do this after 1.12.3 > goes out. > > Stefano > > From: Vozza, Stefano <[email protected]> > Date: Monday, 24 August 2026 at 20:06 > To: [email protected] <[email protected]> > Subject: RE: [EXT UNVERIFIED SENDER] avro-js 1.12.2 npm package is unusable — > missing underscore dependency > > CAUTION: Email security compliance checks failed. Do not reply to this email, > click links or open attachments unless you can confirm the sender. For more > information, search for DMARC on Amazon's IT Portal at it.amazon.com > > Thank you for the prompt response! I didn’t create a JIRA account in the end > but definitely happy to provide a PR. > > Stefano > > From: [email protected] <[email protected]> > Date: Monday, 24 August 2026 at 19:42 > To: [email protected] <[email protected]> > Subject: RE: [EXTERNAL] avro-js 1.12.2 npm package is unusable — missing > underscore dependency > > CAUTION: This email originated from outside of the organization. Do not click > links or open attachments unless you can confirm the sender and know the > content is safe. > > > > Oh wow, thanks for finding this -- my validation for npm was far too > simplistic (I just checked "npm install [email protected]" worked) > > Well, it looks like we'll need a 1.12.3 for this, but I'm reasonably sure > that we can do this quickly since we've gotten everything in place for the > 1.12.2 recently. > > I created https://issues.apache.org/jira/browse/AVRO-4350 to track this. If > you end up creating a JIRA account, I'll be sure to assign reporter credit to > you. A PR to fix this would be welcome, and I've updated my release process > to include your one-liner. > > If you find any other issues with the javascript implementation please don't > hesitate to reach out! > > All my best, Ryan > > > > > > > > > > On 8/24/26 11:15 AM, "Vozza, Stefano" <[email protected]> wrote: > > Hi there, > > There appears to be a problem with the new avro-js 1.12.2 release. On the > > project Jira page, it says to use the mailing list but if this is better of > > being a Jira issue, I can create an account and file it there. > > > > It looks like the underscore dependency was removed as part of a security > > patch but there is still a file in the project that tries to require it > > (https://github.com/apache/avro/blob/2b5fe02502b77fc33c7b2f1a1f8184d46d7700d4/lang/js/etc/deprecated/validator.js#L16). > > This causes an "Cannot find module 'underscore’ “ error whenever you try > > to do a clean install. > > > > You can do a repro with this one liner: > > > > mkdir test && cd test && npm init -y && npm i [email protected] && node -e > > "require('avro-js')” > > > > Happy to contribute a PR to fix this if required. > > > > Stefano > > > > > > > > Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 > > Luxembourg, R.C.S. Luxembourg B186284 > > > > Amazon Web Services EMEA SARL, Irish Branch, One Burlington Plaza, > > Burlington Road, Dublin 4, Ireland, branch registration number 908705 > > > > > > > > > > > > Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg, > R.C.S. Luxembourg B186284 > > Amazon Web Services EMEA SARL, Irish Branch, One Burlington Plaza, Burlington > Road, Dublin 4, Ireland, branch registration number 908705 > > > > > > Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg, > R.C.S. Luxembourg B186284 > > Amazon Web Services EMEA SARL, Irish Branch, One Burlington Plaza, Burlington > Road, Dublin 4, Ireland, branch registration number 908705 > > > > Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg, R.C.S. Luxembourg B186284 Amazon Web Services EMEA SARL, Irish Branch, One Burlington Plaza, Burlington Road, Dublin 4, Ireland, branch registration number 908705 Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg, R.C.S. Luxembourg B186284 Amazon Web Services EMEA SARL, Irish Branch, One Burlington Plaza, Burlington Road, Dublin 4, Ireland, branch registration number 908705
