search

helpers / handlebars-helpers

188 handlebars helpers in ~20 categories. Can be used with Assemble, Ghost, YUI, express.js etc.
http://assemble.io/helpers/
MIT License
2.22k stars 364 forks source link

npm audit issue with underscore.string #342

Open cfjedimaster opened 5 years ago

cfjedimaster commented 5 years ago

Not sure if this is an issue with this package to deal with or one lower, but I figured I'd start here. :) npm audit reveals two issues with this package related to underscore.string:

handlebars-helpers > helper-markdown > remarkable > argparse > underscore.string
jonschlinkert commented 5 years ago

This should really be fixed in argparse. If they release a simple patch, all libraries in the ecosystem that see that message will be fixed. Otherwise, we'll need to keep to keep hacking at the leaves.

edit: FWIW, we'll fix if we determine for sure that the maintainers of argparse are not willing or able to fix it. thanks for reporting

cfjedimaster commented 5 years ago

From what I saw, argparse no longer uses it.

cfjedimaster commented 5 years ago

Ahah - I think it is remarkable. They are not using 1.0.0 of argparse, so the blame is with them. I think. ;)

cfjedimaster commented 5 years ago

And there is already a bug for it - https://github.com/jonschlinkert/remarkable/issues/321. Question is - and this is maybe meta - if remarkable refuses to fix it, does blame go to helper-markdown?

jonschlinkert commented 5 years ago

They are not using 1.0.0 of argparse, so the blame is with them. I think. ;)

argparse > underscore.string

The problem is without a doubt with argparse.

Newer versions of argparse might not be using underscore.string, but they should (and can easily) do a patch of an older version of argparse so that all users receive the patch. If it's patched in argparse, then it will automatically be used in all downstream libraries unless they are version locked.

cfjedimaster commented 5 years ago

So you would file an issue with argparse?

jonschlinkert commented 5 years ago

Yes, one would file an issue with argparse. If it's not fixed in argparse, then every single minor and major version of every package that uses argparse will need to release a patch.

Edit: also, to be clear, this issue does not have any impact on handlebars-helpers, since the affected code is not used (argparse is only used in the remarkable CLI, which is not exposed anywhere on the API)