security vulnerability with using old version of underscore.string

[shiup]

✗ High severity vulnerability found on underscore.string@2.4.0

• desc: Regular Expression Denial of Service (ReDoS)
• info: https://snyk.io/vuln/npm:underscore.string:20170908

[robotsrule]

I ran into this using Snyk this week as well. I submitted a PR to update the package.json to use a non vulnerable version of argparse.

#312

[janotav]

We are affected by this issue as well - remarkable being dependency of grafana. Any chances of getting this merged & released in foreseeable future?

[shockey]

Chiming in from downstream - this is a concern for us over at Swagger UI as well (cc swagger-api/swagger-ui#5152)

[opatut]

The underscore.string dependency comes from argparse < 1.0.0, so argparse version needs to be upgraded. In 1.0.0 argparse switched to lodash and doesn't have this problem anymore. There seems to be no breaking changes for that argparse upgrade.

[uiteoi]

@opatut could you do a pull request to upgrade argparse to 1.0.0?

[opatut]

There you go ;) Bumped to 1.0.10 because -- why not? There are no reported breaking changes. I ran the tests, they are green.

[opatut]

Haha I just realized there are now 4 different PRs for that. One of them also fixed all the travis testing hikkup, so you might want to merge that one (#323) and get this thing green again.

[plroebuck]

When should we expect an updated release for this?

[prabuvenkat]

When can we expect an update release for this ?