Review argparse dependency bringing in sprintf-js CVE-2026-97058
@Varun-S10 is already working on this.
Since Oct 19, 2026.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 22/100
- Issue type
- Refactor
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- javascript, typescript
- Domain
- build-system, security
Research direction
Start by checking which package.json in the tfjs monorepo declares argparse and whether it is a runtime dependency, using npm ls argparse sprintf-js to confirm the chain. Then review the argparse@^1.0.10 range and any newer compatible release that drops sprintf-js. Done means a documented maintainer decision on removing, making optional, or upgrading the dependency, not a code patch. Expect the discussion to need maintainer input.
Written by the indexing model from the issue text.
Description
TensorFlow.js 4.22.0 declares argparse@^1.0.10, which resolves to [email protected] and brings in [email protected]:
@tensorflow/[email protected] → [email protected] → [email protected]
sprintf-js versions through 1.1.3 are listed as affected by CVE-2026-97058. The upstream report is being discussed in sprintf-js issue #237.
We see this dependency chain in applications consuming TensorFlow.js. We are not asserting that TFJS exposes the vulnerable formatter to untrusted input in our usage. Could you assess whether argparse is required in this package’s runtime dependency set, and whether it can be removed, made optional, or updated to a compatible release that no longer depends on sprintf-js?
We prefer not to force an argparse major-version override in consuming applications without compatibility guidance. Please advise whether an upstream dependency change is planned.
- Dominant language
- TypeScript
- Stars
- 19.2k
- Forks
- 2k
- PR merge metrics
- No merged PRs in 30d
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from tensorflow/tfjs
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
tensorflow/tfjs#8754 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
tensorflow/tfjs#8753 ·
-
`@tensorflow/tfjs-node` installation issueMay be free again @nileshau-afk claimed this 29 days ago, and no pull request is open. Opentype:build/install
Difficulty 4/5 3-5 days Newbie friendliness 48/100
tensorflow/tfjs#8748 · 1 assignee ·
-
The package tfjs-node is not working in version 26.8.1 of NodeMay be free again @nileshau-afk claimed this 57 days ago, and no pull request is open. Opencomp:node.js type:bug
tensorflow/tfjs#8746 · 4 comments · 1 reaction · 1 assignee ·
-
I'm getting these npm errors while trying to install @tensorflow/tfjs-nodeMay be free again @Varun-S10 claimed this 87 days ago, and no pull request is open. Openstat:awaiting tensorflower type:build/install type:support
tensorflow/tfjs#8740 · 4 comments · 1 reaction · 1 assignee ·
Similar issues
-
content triage
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
tool-submission
Difficulty 1/5 Under an hour Newbie friendliness 83/100
BraveOPotato/NoSignups#2348 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
code-yeongyu/oh-my-openagent#12784 ·
Maintainers usually reply within 1 day
-
external-issue to-triage
Difficulty 2/5 1-3 hours Newbie friendliness 71/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
MomsBloomOrg/momsbloom-resources#84 ·
Maintainers usually reply within 1 day