[Snyk] Upgrade webvr-polyfill from 0.9.35 to 0.10.12

[keiserjb]

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to upgrade webvr-polyfill from 0.9.35 to 0.10.12.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 19 versions ahead of your current version.

• The recommended version was released on 4 years ago.

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Code Injection SNYK-JS-LODASH-1040724	586	Proof of Concept
	Prototype Pollution SNYK-JS-LODASH-450202	586	Proof of Concept
	Prototype Pollution SNYK-JS-LODASH-567746	586	Proof of Concept
	Prototype Pollution SNYK-JS-LODASH-608086	586	Proof of Concept
	Prototype Pollution SNYK-JS-LODASH-6139239	586	Proof of Concept
	Prototype Pollution SNYK-JS-LODASH-73638	586	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	586	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-73639	586	Proof of Concept
	Prototype Pollution npm:lodash:20180130	586	Proof of Concept

Release notes

Package name: webvr-polyfill

• 0.10.12 - 2020-05-13
  

  0.10.12

• 0.10.11 - 2019-11-09
  

  Update cardboard-vr-display; 0.10.11

• 0.10.10 - 2018-12-11
  

  0.10.10

• 0.10.9 - 2018-12-11
  

  0.10.9

• 0.10.8 - 2018-10-17
  

  0.10.8

• 0.10.7 - 2018-08-30
  

  0.10.7

• 0.10.6 - 2018-05-25
  

  0.10.6

• 0.10.5 - 2018-03-22
  

  0.10.5

• 0.10.4 - 2018-03-16
  
  • Fix a rotation issue when starting from landcape orientation only when using the hotfix path for Chrome m65 from v0.10.3 release (#309)
• 0.10.3 - 2018-03-15
  

  We got reports (#307) of polyfill breakage (thanks @ dustinkerstein!) on newer versions of Chrome. In Chrome m65, a regression to devicemotion events doesn't provide rotationRate, breaking the head tracking in the polyfill, and m66 switching DeviceMotionEvent.rotationRate values to use degrees instead of radians to be aligned with the spec. Separately there's another issue where deviceorientation/devicemotion events are fired at 5-10hz in Chrome m65/m66. This doesn't consistently occur.

  This release includes an updated CardboardVRDisplay with fixes for the devicemotion Chrome m65 regression by using a deviceorientation fallback (immersive-web/cardboard-vr-display@d770e01)
  and does not take advantage of sensor fusion, and also includes a fix to handle Chrome m66's rotationRate unit change (immersive-web/cardboard-vr-display@75a6d51). The issue of lowered device motion rate in Chrome m65/m66 can be tracked at crbug.com/819413. With Sensor API (#10) now being supported instead of devicemotion, one temporary workaround is enabling sensors. Read here to learn more about enabling Sensor API.

  TLDR: If seeing issues in Chrome m65 and later versions, please update to the latest version of the WebVR Polyfill. There may be some stuttering in the pose due to platform issue on m65/m66, which can be solved locally by enabling chrome://flags/#enable-generic-sensor, and there could be a browser update to fix the low frequency rate of device events. Changes have been sent downstream to A-Frame (aframevr/aframe#3453). If upgrading from 0.9.x to 0.10.x, be sure to call the WebVRPolyfill constructor with your configuration object rather than using window.WebVRConfig (example).

  Other Noteworthy Fixes

  • Use Sensor API if available instead of devicemotion (#10)
  • Fires vrdisplayconnect on the polyfilled VRDisplay only if there are no native displays (#303)
  • Cache requestAnimationFrame incase consumer overwrites, fixes WebVR Unity Exporter issue (#308)
  • Limit console spam (immersive-web/cardboard-vr-display@5facde2)
  • Add device information in the DPDB for iPhone X (immersive-web/webvr-polyfill-dpdb#35)
• 0.10.2 - 2017-12-29
• 0.10.1 - 2017-12-29
• 0.10.0 - 2017-12-18
• 0.9.41 - 2017-12-14
• 0.9.40 - 2017-10-10
• 0.9.39 - 2017-09-26
• 0.9.38 - 2017-09-13
• 0.9.37 - 2017-09-12
• 0.9.36 - 2017-07-12
• 0.9.35 - 2017-06-23

from webvr-polyfill GitHub release notes

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.
• Max score is 1000. Note that the real score may have changed since the PR was raised.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs