Bump ua-parser-js from 2.0.9 to 2.0.10

[dependabot]

Bumps ua-parser-js from 2.0.9 to 2.0.10.

Release notes

Sourced from ua-parser-js's releases.

v2.0.10

Version 2.0.10

• Fix ReDoS vulnerability by limiting Client Hints input length (GHSA-9h5v-pfqq-x599)
• Add new method useExtension() in UAParser to extend custom detection rules
• Add new device vendor: Blackview, Coolpad, CUBOT, T-Mobile
• Improve browser detection: Huawei Browser, UCBrowser
• Improve OS detection: iOS
• Identify WebView user-agent as inapp browser
• extensions submodule:
  • Add new crawler: atlassian-bot, Audisto Crawler, AwarioBot, AwarioRssBot, AwarioSmartBot, BrightEdge Crawler, HubSpot Crawler, Meta-ExternalAds, Meta-WebIndexer, proximic, yacybot
  • Add new fetcher: Feedly, GoogleDocs, UptimeBot, virustotal
  • Add new library: phpcrawl
• helpers submodule:
  • Fix isElectron() function return itself

What's Changed

• Add Headline ev-crawler detection by @​Carel155 in faisalman/ua-parser-js#807
• [extensions] Add new crawlers: Meta-WebIndexer, Meta-ExternalAds by @​23tux in faisalman/ua-parser-js#824
• Fix: remove desktop from enums according to documentation by @​mksotto in faisalman/ua-parser-js#808
• Add sideEffects=false to package.json by @​denisx in faisalman/ua-parser-js#781

New Contributors

• @​Carel155 made their first contribution in faisalman/ua-parser-js#807
• @​23tux made their first contribution in faisalman/ua-parser-js#824
• @​mksotto made their first contribution in faisalman/ua-parser-js#808
• @​denisx made their first contribution in faisalman/ua-parser-js#781

Full Changelog: faisalman/ua-parser-js@2.0.9...2.0.10

Changelog

Sourced from ua-parser-js's changelog.

Version 2.0.10

• Fix ReDoS vulnerability by limiting Client Hints input length (GHSA-9h5v-pfqq-x599)
• Add new method useExtension() in UAParser to extend custom detection rules
• Add new device vendor: Blackview, Coolpad, CUBOT, T-Mobile
• Improve browser detection: Huawei Browser, UCBrowser
• Improve OS detection: iOS
• Identify WebView user-agent as inapp browser
• extensions submodule:
  • Add new crawler: atlassian-bot, Audisto Crawler, AwarioBot, AwarioRssBot, AwarioSmartBot, BrightEdge Crawler, HubSpot Crawler, Meta-ExternalAds, Meta-WebIndexer, proximic, yacybot
  • Add new fetcher: Feedly, GoogleDocs, UptimeBot, virustotal
  • Add new library: phpcrawl
• helpers submodule:
  • Fix isElectron() function return itself

Commits

• 4121c59 Build: Bump version 2.0.10
• 90354d3 Fix: Prevent ReDoS vulnerability by limiting Client Hints input length (GHSA-...
• 3baa3bc Test: Increase nyc timeout to fix timeout error
• 18d39b5 CI: Add GitHub Actions workflow to publish to Docker Hub
• 58b5a0c Build: Add Dockerfile for container image build
• 965c20d CI: Update fuzz test
• ad97fea Build: Set sideEffects=false in package.json for tree shaking (#781)
• 312598f CI: Add AI and spam detection to pull request workflow
• 8f9e4dc Test: Fix relative path and update done() callback in CLI test spec
• eb809ec Chore(license): Add THIRD_PARTY_NOTICES.md for third-party assets
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	ua-parser-js@​2.0.10
	@​iconify-json/​carbon@​1.2.23
	vite@​6.4.3
	daisyui@​5.5.23
	honox@​0.1.56
	tailwindcss@​4.3.1
	turbo@​2.9.18
	tailwind-merge@​3.6.0
	spacetime@​7.12.1
	@​tailwindcss/​vite@​4.3.1
	wrangler@​4.100.0
	@​tailwindcss/​typography@​0.5.20
	hono@​4.12.25
	@​cloudflare/​workers-types@​4.20260616.1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @emnapi/runtime is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/honox@0.1.56 → npm/wrangler@4.100.0 → npm/@hono/vite-dev-server@0.18.3 → npm/@emnapi/runtime@1.11.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/runtime@1.11.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report