dapps icon indicating copy to clipboard operation
dapps copied to clipboard
verified publisher icon MetaMask

Bump ua-parser-js from 0.7.24 to 0.7.35

Open dependabot[bot] opened this issue 2 years ago • 1 comments

Bumps ua-parser-js from 0.7.24 to 0.7.35.

Changelog

Sourced from ua-parser-js's changelog.

Version 0.7.35 / 1.0.35

  • Fix result from user-supplied user-agent being altered
  • Add new browser: Heytap, TikTok
  • Add new engine: LibWeb
  • Add new OS: SerenityOS
  • Improve browser detection: Yandex
  • Improve device detection: iPhone, Amazon Echo
  • Improve OS detection: iOS

Version 0.7.34 / 1.0.34

  • Fix Sharp Mobile detected as Huawei Tablet
  • Fix IE8 bug
  • Add new devices : Kobo e-Reader, Apple Watch, and some new SmartTV devices
  • Add new OS : watchOS
  • Improve browser detection : Kakao, Naver, Brave
  • Improve device detection : Oculus, iPad
  • Improve OS detection : Chrome OS
  • Using navigator.userAgentData as fallback for device.type & os.name

Version 0.7.33 / 1.0.33

  • Add new browser : Cobalt
  • Identify Macintosh as an Apple device
  • Fix ReDoS vulnerability

Version 0.7.32 / 1.0.32

  • Add new browser : DuckDuckGo, Huawei Browser, LinkedIn
  • Add new OS : HarmonyOS
  • Add some Huawei models
  • Add Sharp Aquos TV
  • Improve detection Xiaomi Mi CC9
  • Fix Sony Xperia 1 III misidentified as Acer tablet
  • Fix Detect Sony BRAVIA as SmartTV
  • Fix Detect Xiaomi Mi TV as SmartTV
  • Fix Detect Galaxy Tab S8 as tablet
  • Fix WeGame mistakenly identified as WeChat
  • Fix included commas in Safari / Mobile Safari version
  • Increase UA_MAX_LENGTH to 350

Version 0.7.31 / 1.0.2

  • Fix OPPO Reno A5 incorrect detection
  • Fix TypeError Bug
  • Use AST to extract regexes and verify them with safe-regex

Version 0.7.30 / 1.0.1

  • Add new browser : Obigo, UP.Browser, Klar
  • Add new device : Oculus, Roku

... (truncated)

Commits
  • 32d326b Update readme
  • 786d502 Bump version 0.7.35
  • 5b8adfe Backport - Prevent altering the result when supplied user-agent is different ...
  • 2e06a34 Backport - Add new browser: TikTok
  • bf9ac43 Backport - Add new engine: LibWeb + Add new OS: SerenityOS
  • 3f8b5ba Backport - Add new browser: Heytap
  • 1747707 Backport - Fix #678 - Improve Yandex detection
  • d414045 Backport - Fix #519 #521 #616 - Improve iPhone & iOS detection
  • ba067bd Backport - Fix #624 - Detect Amazon Echo
  • 3218051 Bump version 0.7.34
  • Additional commits viewable in compare view

Dependabot compatibility score

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the Security Alerts page.
> **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

dependabot[bot] avatar May 01 '23 01:05 dependabot[bot]

New dependency changes detected. Learn more about Socket for GitHub ↗︎

🚨 Potential security issues found in this pull request. To accept the risk, merge this PR and you will not be notified again.

Bot Commands

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore [email protected] bar@* or ignore all packages with @SocketSecurity ignore-all

⚠️ Chronological version anomaly

Semantic versions published out of chronological order.

This could either indicate dependency confusion or a patched vulnerability.

Package Previous Chronological Previous Semver Source
[email protected] (upgraded) [email protected] (3/29/2023, 11:03:42 AM) [email protected] (3/5/2023, 2:21:07 PM) package.json via [email protected]
Pull request alert summary
Issue Status
Critical CVE ✅ 0 issues
CVE ✅ 0 issues
Mild CVE ✅ 0 issues
Install scripts ✅ 0 issues
Native code ✅ 0 issues
Bin script confusion ✅ 0 issues
Bin script shell injection ✅ 0 issues
Filesystem access ✅ 0 issues
Network access ✅ 0 issues
Shell access ✅ 0 issues
Debug access ✅ 0 issues
Long strings ✅ 0 issues
High entropy strings ✅ 0 issues
URL strings ✅ 0 issues
Uses eval ✅ 0 issues
Dynamic require ✅ 0 issues
Environment variable access ✅ 0 issues
Missing dependency ✅ 0 issues
Unused dependency ✅ 0 issues
Peer dependency ✅ 0 issues
Uncaught optional dependency ✅ 0 issues
Unresolved require ✅ 0 issues
Extraneous dependency ✅ 0 issues
Obfuscated require ✅ 0 issues
Obfuscated code ✅ 0 issues
Minified code ✅ 0 issues
Bidirectional unicode control characters ✅ 0 issues
Zero width unicode chars ✅ 0 issues
Bad text encoding ✅ 0 issues
Unicode homoglyphs ✅ 0 issues
Invisible chars ✅ 0 issues
Suspicious strings ✅ 0 issues
Invalid package.json ✅ 0 issues
HTTP dependency ✅ 0 issues
Git dependency ✅ 0 issues
GitHub dependency ✅ 0 issues
File dependency ✅ 0 issues
No tests ✅ 0 issues
No repository ✅ 0 issues
Bad semver ✅ 0 issues
Bad dependency semver ✅ 0 issues
No v1 ✅ 0 issues
No website ✅ 0 issues
No bug tracker ✅ 0 issues
No contributors or author data ✅ 0 issues
CommonJS depending on ESModule ✅ 0 issues
Empty package ✅ 0 issues
Trivial Package ✅ 0 issues
No README ✅ 0 issues
Deprecated ✅ 0 issues
Chronological version anomaly ⚠️ 1 issue
Semver anomaly ✅ 0 issues
New author ✅ 0 issues
Unstable ownership ✅ 0 issues
Non-existent author ✅ 0 issues
Unmaintained ✅ 0 issues
Unpublished package ✅ 0 issues
Major refactor ✅ 0 issues
Missing package tarball ✅ 0 issues
Unsafe copyright ✅ 0 issues
License change ✅ 0 issues
Non OSI license ✅ 0 issues
Deprecated license ✅ 0 issues
Missing license ✅ 0 issues
Non SPDX license ✅ 0 issues
Unclear license ✅ 0 issues
Mixed license ✅ 0 issues
Legal notice ✅ 0 issues
Modified license ✅ 0 issues
Modified license exception ✅ 0 issues
License exception ✅ 0 issues
Deprecated SPDX exception ✅ 0 issues
Potential typo squat ✅ 0 issues
Known Malware ✅ 0 issues
Telemetry ✅ 0 issues
Protestware/Troll package ✅ 0 issues
AI detected security risk ✅ 0 issues
AI warning ✅ 0 issues

socket-security[bot] avatar May 01 '23 01:05 socket-security[bot]

Superseded by #216.

dependabot[bot] avatar Aug 24 '24 07:08 dependabot[bot]