bowser-js/bowser v2.15.0 on GitHub

Security

fix: polynomial ReDoS in the Firefox-on-iPad user-agent rule (GHSA-f9xq-72p3-q9fv). A crafted User-Agent could block the Node.js event loop for seconds per Bowser.parse() call. Thanks to @0xma1ware for the report.
fix: four more polynomial ReDoS patterns (Linespider, SlackBot and the generic fallback rule), found by CodeQL (#630).

New detections change reported browser names. HeyTap, Vivo and Ladybird users are now reported under their own names instead of Chrome, and Motorola Edge phones are no longer reported as Microsoft Edge. Dashboards that group by browser name will shift.
Bowser is now a dual package. require('bowser') still returns the same UMD build. import now resolves to a real ES module that also offers parse, getParser, BROWSER_MAP, ENGINE_MAP, OS_MAP and PLATFORMS_MAP as named exports. All published file paths still resolve.
bundled.js is ~11 KB larger gzipped (37 → 48 KB). It now uses current core-js 3 polyfills, whose fuller spec compliance makes them larger; it covers the same features as before. If you already ship polyfills, use es5.js (unchanged at ~7.5 KB gzipped) or the ES module build instead.

perf: trim bundled.js to the 2.14.1 polyfill set, fix stale docs @naorpeled (#635)
fix: expose the constant maps on the ESM namespace @lancedikson (#642)
fix: keep ESM consumers on ES5, enable tree-shaking, trim bundled.js @naorpeled (#634)
fix: bundled.js is not ES5 — restore ES5 output and guard it @naorpeled (#632)
fix: restore ES5 output for bundled.js, close exports-map gaps, and cover all build artifacts @naorpeled (#631)
fix: resolve open GitHub security findings @naorpeled (#630)
Dual packaging, without breaking existing consumers @naorpeled (#628)
feat: add Ladybird browser support @gmta (#627)
feat: add support for HeyTap Browser and Vivo Browser identification @mrswapnilsahu (#621)
fix: prevent Motorola Edge devices from being misidentified as Microsoft Edge @naorpeled (#612)
feat: add copyright comment to bundle @naorpeled (#605)
Add the ability to use an array of versions in Parser.satisfies() @Stas-tolpekin (#466)