Problem with useragent package

[davidjamesstone]

Hi @nlf

This isn't an issue with blankie per-se, more its dependencies but I thought I'd raise it with you and that you'd be interested.

The problem comes from the dependency chain blankie -> @hapi/scooter -> useragent -> semver.

Firstly, the useragent package doesn't look like it is maintained anymore, if fact just a couple of days ago someone began a fork of it.

My problem in using blankie comes from the fact that useragent defines semver as a devDep.
In production, we run npm prune --production. This removes sermver and breaks the application.

There's an open PR for this on the useragent repo from back in 2020.

Anyway, like I say - not an issue with your excellent hapi plugin but a downstream problem but unfortunately means I can't use it.

Best wishes

[sana-fathima-mck]

I have a similar issue wrt. security vulnerability with useragent - 3rd-Eden/useragent#178.
As mentioned by @davidjamesstone, useragent is not maintained anymore which is why updating to a different dependency or its forks as mentioned here may help address this vulnerability. Additionally, a workaround is mentioned here.
Also, recommendations on alternate CSP plugins for hapi that do not use useragent are welcome.