Replace unmaintained `useragent` dependency

[johnwatson484]

Runtime

Node.js

Runtime version

24

Module version

7.0.0

Used with

Hapi.js

Any other relevant information

useragent is no longer actively maintained and has several outstanding vulnerabilities within itself and an outdated version of tmp.

I've raised a pull request for review to consider replacing it with a maintained fork.

#65

Appreciate your consideration.

What problem are you trying to solve?

Have several applications using Blankie and Scooter to provide content security headers with ease. useragent has vulnerabilities which require workarounds upstream.

Do you have a new or modified API suggestion to solve the problem?

I've raised a pull request for review to consider replacing it with a maintained fork.

#65

[johnwatson484]

As useragent-ng does not currently support Windows have raised this issue to clarify their future intent -> schmod/useragent-ng#8

Have raised alternative PR for consideration which switches to a far more popular library, albeit with the cost of a translation layer to preserve existing Scooter contract -> #67

[fbaldi6]

Hi @johnwatson484! Thanks so much for opening this and providing the PR, much appreciated! 🙏

Could you share an estimated timeline for a new release that includes this change?

[johnwatson484]

Hi @fbaldi6, I'm not a maintainer on this repo, so I can't control when (and if) it gets merged and released.

The approach I took with #65 isn't feasible at present as a change to useragent-ng prevents it working on Windows, which would also mean Scooter wouldn't work on Windows.

No response from them on the issue that I raised -> schmod/useragent-ng#8

However, the alternative approach proposed in #67 is feasible if the maintainers here are happy to add the complexity of the translation function required to avoid this becoming a breaking change.

The other approach could be to not have the translation function, but release the update as a breaking change as the Scooter contract would be different.

Personally I'd merge #67 as is, so teams who currently work around or tolerate the vulnerabilities have an easy upgrade path to protect their services.

A breaking change could be considered at a later date.

As an aside, here's an example PR where I've worked around the two vulnerabilities (at time of writing) within useragent -> DEFRA/fcp-mpdp-frontend#35

@kanongil have you had the opportunity to consider the approach suggested in #67?

[nouoxu]

This project has been marked as unmaintained. For JavaScript development and testing, check out JSBin (https://github.com/nouoxu/jsbin) - a modern online JavaScript playground that can help with quick prototyping and debugging!

[johnwatson484]

@nouoxu - fairly sure this comment is not human in origin as your account has posted 500+ comments on various issues in the last 24 hours followed by a jsbin advert.

But for any future readers, there is no "official" indication that Scooter is unmaintained.

Only the lack of engagement in addressing this issue is a clue that may be the case.

[damusix]

@johnwatson484 @fbaldi6 Looking into it soon..

[Marsup]

While I agree useragent is unmaintained, going for ua-parser-js v1 seems to put us roughly in the same spot, since we won't be able to upgrade to version 2, unless we make it very clear that it uses a non-free dependency, but pretty sure nobody will read that warning.

[johnwatson484]

Yes a fair comment.

Though I'd argue that it does at least mean that services using Scooter are no longer exposed to the significant threat vector useragent currently introduces.

Gives us more breathing space to assess the long term options?

[johnwatson484]

As suggested by @damusix, have drafted PR #68 as a further alternative for review.