Underscore.js Change in Qlik Sense Client May Require Update in Extensions and Mashups

[Jeffrey_Goldberg]

Do you use mashups or extensions in your Qlik Sense deployment? If so, your code may be using a version of underscore.js provided by Qlik. Read on to learn more about the upgrade to this library we're applying to Qlik's client code and how it may impact you.

[Jeffrey_Goldberg]

Issue:

Due to a security issue with underscore.js, an AMD module exposed in the Qlik Sense client, we are updating the library in our codebase from version 1.5 to version 1.13. This may result in minor breaking changes to extensions and mashups that use the available library. Below is a summarized list of potential changes between underscore.js versions if you used specific properties or methods of the library.

Impacted Products:

• Qlik Sense Client Managed from June 2021 forward
• SaaS editions of Qlik Sense (Business and Enterprise)

Background:

For more information, please review the [full underscore.js changelog]( https://underscorejs.org/#changelog).

Summary:

Properties and methods removed from underscore.js between version 1.5 and version 1.13:

• The `unzip` method is removed. Use `_.zip.apply(_, list) instead.
• The `_.escape` function no longer escapes ‘/’.
• Deprecated `_.matches`. It's now known by a more harmonious name - `_.matcher`.