react-bootstrap-table-next@4.0.3 requires underscore@1.9.1 The earliest fixed version is 1.12.1 - Dependabot alert

user_5805790 0
Viewed 487

Hi got dependabot alert

react-bootstrap-table-next@4.0.3 requires underscore@1.9.1 The earliest fixed version is 1.12.1 - Dependabot alert

To fix this in package.json added underscore: 1.12.1, but the problem is not solved as in package.lock.json still showing

"react-bootstrap-table-next": {
        "version": "4.0.3",
        "resolved": "https://registry.npmjs.org/react-bootstrap-table-next/-/react-bootstrap-table-next-4.0.3.tgz",
        "integrity": "sha512-uKxC73qUdUfusRf2uzDfMiF9LvTG5vuhTZa0lbAgHWSLLLaKTsI0iHf1e4+c7gP71q8dFsp7StvkP65SxC1JRg==",
        "requires": {
            "classnames": "^2.2.5",
            "react-transition-group": "^4.2.0",
            "underscore": "1.9.1"
        }

How to fix this kind of dependabot alerts where we cannot update library ex underscore which is required by another library react-bootstrap-table-next and we cannot update react-bootstrap-table-next as react-bootstrap-table-next is already latest which we cannot update.

Or else shall we have to wait for next release of react-bootstrap-table-next

reactjs underscore.js github security javascript
2 Answers

Here is generic solution how-do-i-fix-a-vulnerable-npm-package-in-my-package-lock-json-that-isnt-listed

In this case when dependent package needs to be updated we need to check if parent package has already fixed it and we can install new parent package.

For example in above case underscore is required by react-bootstrap-table-next so we can go ahead and check if react-bootstrap-table-next has already fixed the alert and update underscore package if they have update we can install latest react-bootstrap-table-next if not updated we can either wait for the next release of choose other alternative package

user_58057900

I'm having the same issue along with other projects. It appears that they have not yet decided on updating their dependencies at this time. It is known that there's a vulnerability issue with their current 1.9.1 version. We need version 12 or better. Until then we just have to hold our breaths.

Follow updates here... https://github.com/react-bootstrap-table/react-bootstrap-table2/issues/1605

user_183356790
Related