Skip to content

Replace unmaintained useragent dependency with ua-parser-js#67

Closed
johnwatson484 wants to merge 3 commits intohapijs:masterfrom
johnwatson484:alternative
Closed

Replace unmaintained useragent dependency with ua-parser-js#67
johnwatson484 wants to merge 3 commits intohapijs:masterfrom
johnwatson484:alternative

Conversation

@johnwatson484
Copy link
Contributor

useragent is no longer actively maintained and has several outstanding vulnerabilities within itself and an outdated version of tmp.

This PR replaces useragent with highly popular ua-parser-js.

This PR is proposed as an alternative to #65 where a successor fork of useragent, useragent-ng was proposed.

Unfortunately useragent-ng does not currently support Windows. An issue has been raised to clarify this -> schmod/useragent-ng#8

As ua-parser-js returns a different response structure than useragent, an adapter function has been added to preserve the current Scooter contract to avoid breaking current consumers.

To ensure that the adapter is maintaining the contract as expected, a more comprehensive set of tests have been added covering all properties of the current contract.

@damusix
Copy link

damusix commented Mar 10, 2026

@johnwatson484 merging this might introduce some liability on the users of this library for non-open-source usages

https://github.com/faisalman/ua-parser-js/blob/master/CHANGELOG.md#whats-breaking
https://socket.dev/blog/ua-parser-js-drops-mit-license
faisalman/ua-parser-js#680

Perhaps, we may want to go with something else? https://github.com/mcollina/my-ua-parser

@johnwatson484
Copy link
Contributor Author

@johnwatson484 merging this might introduce some liability on the users of this library for non-open-source usages

https://github.com/faisalman/ua-parser-js/blob/master/CHANGELOG.md#whats-breaking https://socket.dev/blog/ua-parser-js-drops-mit-license faisalman/ua-parser-js#680

Perhaps, we may want to go with something else? https://github.com/mcollina/my-ua-parser

@damusix - good suggestion.

I've created PR #68 that uses my-ua-parser for your review.

Like ua-parser-js it does still require a translation function to maintain the existing contract to avoid this being a breaking change.

@Marsup
Copy link
Contributor

Marsup commented Mar 15, 2026

I think it's safe to say we can close this one now.

@Marsup Marsup closed this Mar 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants