Conversation
Bumps [underscore](https://github.com/jashkenas/underscore) from 1.4.4 to 1.13.8. - [Commits](jashkenas/underscore@1.4.4...1.13.8) --- updated-dependencies: - dependency-name: underscore dependency-version: 1.13.8 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
dependencies
🗄️ Schema Change: No Changes ✅ |
🛠️ Item Splitting: No Changes ✅ |
|
Size Change: 0 B Total Size: 486 kB ℹ️ View Unchanged
|
npm Snapshot: PublishedGood news!! We've packaged up the latest commit from this PR (69611a0) and published it to npm. You Example: pnpm add @khanacademy/perseus@PR3342If you are working in Khan Academy's frontend, you can run the below command. ./dev/tools/bump_perseus_version.ts -t PR3342If you are working in Khan Academy's webapp, you can run the below command. ./dev/tools/bump_perseus_version.js -t PR3342 |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
| prop-types: 15.8.1 | ||
| tiny-invariant: 1.3.1 | ||
| underscore: 1.4.4 | ||
| underscore: 1.13.8 |
There was a problem hiding this comment.
🔴 The peerDeps catalog entry for underscore on line 62 still says ^1.4.4, but devDeps was bumped to 1.13.8. Per the convention documented in the file header (lines 21-23), peerDeps should be ^1.13.8 so the pinned devDeps version sits at the bottom of the peer range. This means consumers using underscore 1.4.4–1.13.7 would satisfy the peer dep despite being untested and still affected by the CVE this PR is meant to fix.
Extended reasoning...
What the bug is
This PR (generated by Dependabot) bumps underscore from 1.4.4 to 1.13.8 in the devDeps catalog (line 102 of pnpm-workspace.yaml), but does not update the corresponding peerDeps catalog entry on line 62, which still reads underscore: ^1.4.4.
The convention being violated
Lines 21–23 of pnpm-workspace.yaml explicitly document the project’s convention:
The sync-dependencies.ts script ensures that peer deps are always specified as a range, and the dev deps are always pinned to the version at the bottom of that range.
Every other package in the file follows this pattern. For example:
react: devDeps18.2.0/ peerDeps^18.2.0jquery: devDeps2.1.1/ peerDeps^2.1.1aphrodite: devDeps1.2.5/ peerDeps^1.2.5
After this PR, underscore is the only package where the convention is violated: devDeps 1.13.8 but peerDeps ^1.4.4.
Step-by-step proof of the issue
- A consumer installs
underscore@1.5.0in their project. - They depend on
@khanacademy/perseus(or any of the 5 other packages that usecatalog:peerDepsfor underscore: perseus-editor, kas, perseus-score, perseus-core, kmath). - pnpm resolves the peer dependency
underscore: ^1.4.4— version 1.5.0 satisfies this range. - No peer dependency warning is raised.
- However, Perseus was only tested against underscore 1.13.8. Version 1.5.0 may have different behavior (e.g.,
_.isEqualstack overflow bug fixed in 1.13.8, and the CVE-2026-27601 that this PR is specifically meant to address). - The consumer unknowingly runs with a vulnerable, untested version of underscore.
Why Dependabot missed this
Dependabot only knows about standard package.json dependency fields. It bumped the devDeps catalog entry in pnpm-workspace.yaml but has no awareness of the project-specific peerDeps catalog convention. The sync-dependencies.ts script mentioned in the file header is meant to handle this synchronization, but it wasn’t run as part of the Dependabot PR.
Impact
Six packages declare "underscore": "catalog:peerDeps" in their peerDependencies: perseus, perseus-editor, kas, perseus-score, perseus-core, and kmath. All of these would advertise ^1.4.4 as their accepted underscore range, silently allowing consumers to use vulnerable versions that were never tested against.
Fix
Update line 62 of pnpm-workspace.yaml from underscore: ^1.4.4 to underscore: ^1.13.8.
Bumps underscore from 1.4.4 to 1.13.8.
Commits
9374840Merge branch 'release/1.13.8'309ad7eRe-generate annotated sources and minified codemapsa1ac1d3Add links to diff and docs in 1.13.8 change log entryb579595Mention CVE-2026-27601 in comments and documentation (#3011)45ea015Revert obfuscations from 42823bb.4a4019eUpdate minified bundles1ccfdd0Add preliminary release notes for 1.13.842823bbTemporarily obfuscate commentsa6e23aeMake _.isEqual nonrecursivef2b5164Add regression test against stack overflow in _.isEqualMaintainer changes
This version was pushed to npm by jgonggrijp, a new releaser for underscore since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.