React-bootstrap-table2: Underscore version

Created on 16 Apr 2021 · 13Comments · Source: react-bootstrap-table/react-bootstrap-table2

Hello,

We are facing vulnerabilities with underscore library version, our security scan says that its version is outdated and suggests us to update it. Since we are not using underscore directly and it comes as a dependency from react-bootstrap-table-next we can't change it. We have been wondering if you still maintain react-bootstrap-table-next, because the last release is from almost a year ago and if you do will you bump underscore version in incoming releases?

Best Regards,
Nikolay

Source

nvasilev98

👍8

Most helpful comment

There was an arbitrary code execution notice posted for this Underscore version today: https://www.npmjs.com/advisories/1674

Any chance of updates?

sricks on 6 May 2021

👍8

All 13 comments

I face the same problem. I saw that the underscore dependency is explicitly set to version 1.9.1 so it is not possible to use a newer version (even if I install it as dependency of my package).
Underscore has a newer version (1.12.1) which does not have the vulnerability. Do you plan to update it?
By the way, I'm using react-bootstrap-table-next's version 3, I'd be very happy if you can bump underscore version in both v4 and v3. But if it's only in v4 then that's good too, at least I'll have a way to solve my problem.

pieceofsoft on 19 Apr 2021

I'm using Parcel 2 to build my React app and the current underscore 1.9.1 is breaking at runtime, because of Parcel's scope hoisting feature. I've checked that underscore 1.13.1 works fine with Parcel's scope hoisting functionality, so I'm really interested in this change.