npm audit issue with underscore.string

Question

npm audit issue with underscore.string

cfjedimaster opened this issue 6 years ago · 7 comments

Not sure if this is an issue with this package to deal with or one lower, but I figured I'd start here. :) npm audit reveals two issues with this package related to underscore.string:

handlebars-helpers > helper-markdown > remarkable > argparse > underscore.string

Answer 1 · 2019-02-12T20:25:19.000Z

This should really be fixed in argparse. If they release a simple patch, all libraries in the ecosystem that see that message will be fixed. Otherwise, we'll need to keep to keep hacking at the leaves.

edit: FWIW, we'll fix if we determine for sure that the maintainers of argparse are not willing or able to fix it. thanks for reporting

Answer 2 · 2019-02-12T20:49:08.000Z

From what I saw, argparse no longer uses it.

Answer 3 · 2019-02-12T20:54:21.000Z

Ahah - I think it is remarkable. They are not using 1.0.0 of argparse, so the blame is with them. I think. ;)

Answer 4 · 2019-02-12T20:55:27.000Z

And there is already a bug for it - jonschlinkert/remarkable#321. Question is - and this is maybe meta - if remarkable refuses to fix it, does blame go to helper-markdown?

Answer 5 · 2019-02-12T20:58:06.000Z

They are not using 1.0.0 of argparse, so the blame is with them. I think. ;)

argparse > underscore.string

The problem is without a doubt with argparse.

Newer versions of argparse might not be using underscore.string, but they should (and can easily) do a patch of an older version of argparse so that all users receive the patch. If it's patched in argparse, then it will automatically be used in all downstream libraries unless they are version locked.

Answer 6 · 2019-02-12T21:00:36.000Z

So you would file an issue with argparse?

Answer 7 · 2019-02-12T21:12:12.000Z

Yes, one would file an issue with argparse. If it's not fixed in argparse, then every single minor and major version of every package that uses argparse will need to release a patch.

Edit: also, to be clear, this issue does not have any impact on handlebars-helpers, since the affected code is not used (argparse is only used in the remarkable CLI, which is not exposed anywhere on the API)