Recent Commits to Mobile-Detect

  • 24/05/2026 9:32

    fix(cache): bound in-memory Cache to prevent unbounded growth (GHSA-m…

    fix(cache): bound in-memory Cache to prevent unbounded growth (GHSA-mgj4-qjmw-v56v)
    
    The bundled Detection\Cache\Cache is now bounded by default (1000 entries,
    FIFO eviction). Prevents unbounded in-memory growth when one MobileDetect
    instance is reused across many distinct User-Agents in a long-running PHP
    runtime (RoadRunner, Laravel Octane, FrankenPHP worker mode, Swoole,
    ReactPHP, queue workers).
    
    Classic PHP-FPM / mod_php deployments are not affected (cache dies with
    the request). Custom PSR-16 adapters (Redis, APCu, Memcached, Filesystem)
    are unaffected; their eviction policy is the operator's responsibility.
    
    The README "Long-Running Processes" worker example now uses clear() instead
    of evictExpired() — the latter is a no-op against fresh entries under the
    default 86400s TTL and was misleading users into thinking it bounded the
    cache by cardinality.
    
    - Cache::__construct(int $maxEntries = Cache::DEFAULT_MAX_ENTRIES)
    - Cache::getMaxEntries() accessor
    - evictExpired() docblock clarified (bounds by TTL only, not cardinality)
    - Regression tests in CacheTest + MobileDetectWithCacheTest mirroring the
      advisory PoC
    - README-EXAMPLES.md "Long-Running Processes" rewritten
    - Version bumped to 4.11.0
    Tags:

Log in