fix: upgrade underscore to 1.13.8 (CVE-2026-27601)

[anupamme]

Summary

Upgrade underscore from 1.13.7 to 1.13.8 to fix CVE-2026-27601.

Vulnerability

Field	Value
ID	CVE-2026-27601
Severity	HIGH
Scanner	trivy
Rule	CVE-2026-27601
File	bun.lock (dependency: underscore)
Assessment	Present in dependency tree, not confirmed reachable

Description: Underscore.js: Underscore.js: Denial of Service via recursive data structures in flatten and isEqual functions

Evidence

Scanner confirmation: trivy rule CVE-2026-27601 flagged this pattern.

Threat Model Context

This is a Node.js library - vulnerabilities affect downstream consumers who use this package.

Changes

• bun.lock
• package.json

Behavior Preservation

The change is scoped to 2 files on the vulnerable path; it only tightens handling of untrusted input and leaves valid inputs unaffected.

---

This change addresses a pattern flagged by static analysis. The code path handles user-influenced input and the fix reduces the attack surface against both manual and automated exploitation.

---

Automated security fix by OrbisAI Security

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	underscore@​1.13.8
	source-map@​0.8.0
	eslint@​9.39.4 ⏵ 10.8.1	+1			+2

View full report

[deepsource-io]

DeepSource Code Review

We reviewed changes in 84f431a...de70bb8 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
JavaScript		Aug 9, 2026 10:23p.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm underscore is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package.json → npm/underscore@1.13.8 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/underscore@1.13.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report