René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Vulnerability in underscore dependency","articleBody":"**Environment**\r\nProvide version numbers for the following components (information can be retrieved by running `tns info` in your project folder or by inspecting the `package.json` of the project:\r\n - CLI: 7.2.0\r\n - Cross-platform modules: 7.3.0\r\n - Android Runtime: 7.0.1\r\n - iOS Runtime: 7.2.0\r\n - Plugin(s): 6.1.3\r\n\r\n**Describe the bug**\r\nThe GitHub Dependabot reports that the \"underscore\" depenency of \"nativescript-dev-appium\" has a vulnerability:\r\nThe package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Execution via the template function, particularly when a variable property is passed as an argument as it is not sanitized.\r\nMore info at:\r\nhttps://github.com/advisories/GHSA-cf4h-3jhx-xvhq\r\n\r\n**To Reproduce**\r\nAdd nativescript-dev-appium to a NativeScript project.\r\nLook in package-lock to see dependency chain:\r\n\"nativescript-dev-appium\" version 6.1.3 uses\r\n\"frame-comparer\": \"^2.0.1\" which uses\r\n\"blink-diff\": \"^1.0.13\" which uses\r\n\"pngjs-image\": \"~0.11.5\" which uses\r\n\"underscore\": \"1.7.0\"\r\n\r\n**Expected behavior**\r\nDependency chain using \"underscore\" version 1.12.1 or newer (as per the github advisory link above).\r\n\r\n**Sample project**\r\n\r\n\r\n**Additional context**\r\n\r\n","author":{"url":"https://github.com/matt-cooper","@type":"Person","name":"matt-cooper"},"datePublished":"2021-05-10T15:35:50.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/294/nativescript-dev-appium/issues/294"}