fix(cache): bound in-memory Cache to prevent unbounded growth (GHSA-mgj4-qjmw-v56v)
The bundled Detection\Cache\Cache is now bounded by default (1000 entries,
FIFO eviction). Prevents unbounded in-memory growth when one MobileDetect
instance is reused across many distinct User-Agents in a long-running PHP
runtime (RoadRunner, Laravel Octane, FrankenPHP worker mode, Swoole,
ReactPHP, queue workers).
Classic PHP-FPM / mod_php deployments are not affected (cache dies with
the request). Custom PSR-16 adapters (Redis, APCu, Memcached, Filesystem)
are unaffected; their eviction policy is the operator's responsibility.
The README "Long-Running Processes" worker example now uses clear() instead
of evictExpired() — the latter is a no-op against fresh entries under the
default 86400s TTL and was misleading users into thinking it bounded the
cache by cardinality.
- Cache::__construct(int $maxEntries = Cache::DEFAULT_MAX_ENTRIES)
- Cache::getMaxEntries() accessor
- evictExpired() docblock clarified (bounds by TTL only, not cardinality)
- Regression tests in CacheTest + MobileDetectWithCacheTest mirroring the
advisory PoC
- README-EXAMPLES.md "Long-Running Processes" rewritten
- Version bumped to 4.11.0
