build(deps): bump ua-parser-js from 1.0.2 to 1.0.33 in /packages/browser-sync by dependabot[bot] · Pull Request #2007 · BrowserSync/browser-sync

dependabot · 2023-01-24T15:38:09Z

Bumps ua-parser-js from 1.0.2 to 1.0.33.

Changelog

Sourced from ua-parser-js's changelog.

Version 0.7.31 / 1.0.2

Fix OPPO Reno A5 incorrect detection

Fix TypeError Bug

Use AST to extract regexes and verify them with safe-regex

Version 0.7.32 / 1.0.32

Add new browser : DuckDuckGo, Huawei Browser, LinkedIn

Add new OS : HarmonyOS

Add some Huawei models

Add Sharp Aquos TV

Improve detection Xiaomi Mi CC9

Fix Sony Xperia 1 III misidentified as Acer tablet

Fix Detect Sony BRAVIA as SmartTV

Fix Detect Xiaomi Mi TV as SmartTV

Fix Detect Galaxy Tab S8 as tablet

Fix WeGame mistakenly identified as WeChat

Fix included commas in Safari / Mobile Safari version

Increase UA_MAX_LENGTH to 350

Version 0.7.33 / 1.0.33

Add new browser : Cobalt

Identify Macintosh as an Apple device

Fix ReDoS vulnerability

Version 0.8

Version 0.8 was created by accident. This version is now deprecated and no longer maintained, please update to version 0.7 / 1.0.

Commits

67005e3 Update patch version to 1.0.33 as a mirror of 0.7.33
f2d0db0 Bump version 0.7.33
a6140a1 Remove unsafe regex in trim() function
a886604 Fix #605 - Identify Macintosh as Apple device
b814bcd Merge pull request #606 from rileyjshaw/patch-1
7f71024 Fix documentation
c239ac5 Merge pull request #604 from obecerra3/master
8d3c2d3 Add new browser: Cobalt
a2b2e80 Update patch version to 1.0.32 as a mirror of 0.7.32
d11fc47 Bump version 0.7.32
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
@dependabot use these labels will set the current labels as the default for future PRs for this repo and language
@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [ua-parser-js](https://github.com/faisalman/ua-parser-js) from 1.0.2 to 1.0.33. - [Release notes](https://github.com/faisalman/ua-parser-js/releases) - [Changelog](https://github.com/faisalman/ua-parser-js/blob/master/changelog.md) - [Commits](faisalman/ua-parser-js@1.0.2...1.0.33) --- updated-dependencies: - dependency-name: ua-parser-js dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

citkane

Fixes downstream security alerts

anton-x-t

As @citkane noted. Fixes downstream security alerts.

louisgcom

No breaking changes

dependabot · 2023-02-03T15:45:53Z

Sorry, only users with push access can use that command.

anton-x-t · 2023-02-03T16:15:19Z

@shakyShane Thank you for your earlier work with this repository Shane!! Can you please approve this pull request? :)

thejamescollins · 2023-02-08T07:18:19Z

This PR should fix #2009

anton-x-t · 2023-02-08T07:57:45Z

Thank you guys for earlier work. Can someone of you approve this PR? :) @emgeee @PaulKinlan @brutaldev @shakyShane

PauloKoglin · 2023-02-23T10:47:54Z

Please, can somebody with write access approve this PR? :)

iwt-philipzeh

lgtm! :D

anton-x-t · 2023-02-23T12:25:43Z

@shakyShane Can you please approve this pull request? You seem to be the only one with write access.

shakyShane · 2023-02-23T12:28:52Z

on it

lachieh · 2023-02-23T12:31:03Z

@anton-x-t it is super unprofessional and incredibly disrespectful to spam everyone who has ever contributed to the project.
Especially since only the project maintainers can actually merge the change. You've effectively blasted ~100 people for absolutely no reason.

Second to that, this vulnerability only affects projects that are actually hosted, and browser-sync is a development tool. NPM's audit tools are designed for hosted, publicly accessible node projects and no one should be using browser-sync in that way.

https://overreacted.io/npm-audit-broken-by-design/

anton-x-t · 2023-02-23T12:46:00Z

@shakyShane Thank you very much for approving and merging! Appreciate it!! And I think many developers will appreciate this without knowing. Thanks a bunch!!

shakyShane · 2023-02-23T12:52:48Z

Yeah dependabot can cause these types of issues - I'm pretty sure 99% of the 'security vulnerabilities' that I've fixed are not actually vulnerabilities for any Browsersync uses (as @lachieh alludes to above)

Regardless, I am the sole maintainer with write access and this project is used widely, so I should be on top of these things.

In the future, to prevent blasting notifications to everyone here, you can always just reach out on twitter instead 💪🏻

anton-x-t · 2023-02-23T12:54:11Z

Thank you for explaining! @shakyShane

anton-x-t · 2023-02-23T13:03:21Z

I'm sorry @lachieh

citkane · 2023-02-27T11:39:19Z

Thanks @shakyShane for your work, which is best in its class (IMHO).

@lachieh , you are correct that browser-sync is a development tool.
Development tools however can, and do, carry downstream.
In my case, I am launching a new Open Source product, and the first thing new users would experience is a security alert.
Most people will not spend the time to evaluate the philosophy of security frameworks and understand this specific context - they will just ditch the product on the matter of failure to trust.
This, for many use cases, becomes a user experience issue, and this really, really matters.

I worked around the matter by writing a NPM publish script which strips out all dev dependencies (which includes browser-sync) from package.json. It is effective, but just another extra step to maintain and break into the future.

shakyShane · 2023-02-27T11:51:21Z

Thanks @citkane - that's a valuable perspective that I will consider more going forward :)

dependabot Bot added the dependencies Pull requests that update a dependency file label Jan 24, 2023

citkane approved these changes Jan 25, 2023

View reviewed changes

anton-x-t approved these changes Jan 26, 2023

View reviewed changes

jakebathman approved these changes Jan 30, 2023

View reviewed changes

louisgcom reviewed Feb 3, 2023

View reviewed changes

louisgcom approved these changes Feb 8, 2023

View reviewed changes

ojvribeiro approved these changes Feb 13, 2023

View reviewed changes

LoganTFox approved these changes Feb 14, 2023

View reviewed changes

strarsis approved these changes Feb 23, 2023

View reviewed changes

iwt-philipzeh approved these changes Feb 23, 2023

View reviewed changes

shakyShane merged commit 769c4df into master Feb 23, 2023

ojvribeiro mentioned this pull request Feb 23, 2023

Dependency on specific version of ua-parser-js prevents vulnerabilities in downstream projects from being fixed #2009

Closed

10 tasks

Conversation

dependabot Bot commented on behalf of github Jan 24, 2023

Version 0.7.31 / 1.0.2

Version 0.7.32 / 1.0.32

Version 0.7.33 / 1.0.33

Version 0.8

Uh oh!

citkane left a comment

Choose a reason for hiding this comment

Uh oh!

anton-x-t left a comment

Choose a reason for hiding this comment

Uh oh!

louisgcom left a comment

Choose a reason for hiding this comment

Uh oh!

dependabot Bot commented on behalf of github Feb 3, 2023

Uh oh!

anton-x-t commented Feb 3, 2023

Uh oh!

thejamescollins commented Feb 8, 2023

Uh oh!

anton-x-t commented Feb 8, 2023

Uh oh!

PauloKoglin commented Feb 23, 2023

Uh oh!

iwt-philipzeh left a comment

Choose a reason for hiding this comment

Uh oh!

anton-x-t commented Feb 23, 2023

Uh oh!

shakyShane commented Feb 23, 2023

Uh oh!

lachieh commented Feb 23, 2023

Uh oh!

anton-x-t commented Feb 23, 2023

Uh oh!

shakyShane commented Feb 23, 2023

Uh oh!

anton-x-t commented Feb 23, 2023

Uh oh!

anton-x-t commented Feb 23, 2023

Uh oh!

citkane commented Feb 27, 2023

Uh oh!

shakyShane commented Feb 27, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

12 participants