chore(deps): update dependency video.js to v7 [security] #313

renovate · 2023-05-28T10:03:55Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
video.js (source)	`6.9.0` -> `7.14.3`

GitHub Vulnerability Alerts

CVE-2021-23414

This affects the package video.js before 7.14.3.
The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code.

Release Notes

videojs/video.js (video.js)

`v7.14.3`

Compare Source

Bug Fixes

don't add anchor to DOM for getAbsoluteURL (#7336) (b483a76)
remove IE8 url parsing workaround (#7334) (b3acf66)

`v7.14.2`

Compare Source

Bug Fixes

dom: in removeClass, check element for null in case of a disposed player (#6701) (2990cc7)

`v7.14.1`

Compare Source

Bug Fixes

package: update to VHS 2.9.2 (#7320) (fff0611)
all !important properties of vjs-lock-showing (#7312) (508a424)
properly return promise from requestFullscreen and exitFullscreen (#7299) (3921b7f), closes #7298
remove loading spinner on ended (#7311) (14da28d), closes videojs/http-streaming#1156

Chores

use setup-node cache and remove individual cache step (#7310) (fab6e87)

Documentation

react: Added a functional React component using React.useEffect (#7203) (2360236)

`v7.14.0`

Compare Source

Features

add ended getter middleware (#7287) (c74c27d)

7.13.4 (2021-06-30)

Bug Fixes

lang: add some translations to es.json (#6822) (fbcfb7b)
throw error on muted resolution rejection during autoplay (#7293) (f9fb1d3)
event: event polyfill detection compatibility with react-native-web (#7286) (a221be1), closes #7259
lang: improve Hungarian translation (#7289) (0f70787)

Chores

add a code coverage ci workflow (#7282) (4cecbda)

7.13.3 (2021-06-23)

Chores

republish with VHS 2.9.1 (4b50f82)

7.13.2 (2021-06-22)

Bug Fixes

package: update to VHS 2.9.1 (#7284) (cee5fa3), closes #7230

7.13.1 (2021-06-14)

Bug Fixes

do a null check on playbackRates player method (#7273) (6888798)

`v7.13.4`

Compare Source

Bug Fixes

lang: add some translations to es.json (#6822) (fbcfb7b)
throw error on muted resolution rejection during autoplay (#7293) (f9fb1d3)
event: event polyfill detection compatibility with react-native-web (#7286) (a221be1), closes #7259
lang: improve Hungarian translation (#7289) (0f70787)

Chores

add a code coverage ci workflow (#7282) (4cecbda)

`v7.13.3`

Compare Source

Chores

republish with VHS 2.9.1 (4b50f82)

`v7.13.2`

Compare Source

Bug Fixes

package: update to VHS 2.9.1 (#7284) (cee5fa3), closes #7230

`v7.13.1`

Compare Source

Bug Fixes

do a null check on playbackRates player method (#7273) (6888798)

`v7.13.0`

Compare Source

Features

Add helper classes for 9:16 and 1:1 (#7219) (35ad17a)
Add normalizeAutoplay option to treat autoplay: true as autoplay: "play" (#7190) (b4ad93a)
Add option to use full window mode instead of using tech's fullscreen (#7218) (b86f083)
update to VHS@2.9.0 and mpd-parser@0.17.0 (#7269) (2ea05b4)
package: add VHS deps as Video.js deps (#7263) (39de502), closes #7091 #7209 #7144 #7109
player: Add playbackRates() method (#7228) (6259ef7), closes #7198

Documentation

Fix typo in CONTRIBUTING.md (#7260) (380a9b5)

7.12.4 (2021-06-02)

Bug Fixes

allow Video.js to be required in an env without setTimeout (#7247) (8082c5a)
player: accept data for fullscreenchange and error events from the tech (#7254) (41d5eb3)
seek-bar: remove event listener on dispose (#7258) (c70c298)

Chores

component: update comment around triggering ready in component (#7256) (11ac0b9)
Update sass and remove now deprecated / for division. (#7253) (b3503c9), closes #7244

7.12.3 (2021-05-20)

Bug Fixes

update to VHS 2.8.2 (#7242) (f528767), closes #7240

Chores

revert back to gh-release@3.5.0 for now (#7241) (a4c9b12)

7.12.2 (2021-05-19)

Bug Fixes

update to VHS 2.8.1 (#7238) (c4cfa55)
utils: add try and catch for computedStyle (#7214) (90ce2d7)
Better text for exit fullscreen (#7183) (0e46624)
Don't hide menus with one item and a title (#7215) (d4a08de)
exit full window mode with Esc key (#7224) (e9953e5)
incorrect focus styles on selected MenuItem (#7202) (06cdb6f), closes #7200
make Playback Rate control work better with screen readers (#7193) (17919ce), closes #7121
silence play promise in the play toggle. (#7189) (2c6e439), closes #6998
user and programmatic seeks with live streams (#7210) (39485fc)

Chores

update 'global' package in dependencies (#7213) (cb1d29b)
update node/nvmrc and various dependencies (#7221) (90f3e39), closes #7216 #6933 #6924 #7179

7.12.1 (2021-04-13)

Bug Fixes

package: remove remove (#7177) (9abba58), closes #7176
package: update vtt.js to allow server-side-rendering (#7178) (a3bfeb7)
package: upgrade VHS to 2.7.1 (#7174) (f0d69cd)

`v7.12.4`

Compare Source

Bug Fixes

allow Video.js to be required in an env without setTimeout (#7247) (8082c5a)
player: accept data for fullscreenchange and error events from the tech (#7254) (41d5eb3)
seek-bar: remove event listener on dispose (#7258) (c70c298)

Chores

component: update comment around triggering ready in component (#7256) (11ac0b9)
Update sass and remove now deprecated / for division. (#7253) (b3503c9), closes #7244

`v7.12.3`

Compare Source

Bug Fixes

update to VHS 2.8.2 (#7242) (f528767), closes #7240

Chores

revert back to gh-release@3.5.0 for now (#7241) (a4c9b12)

`v7.12.2`

Compare Source

Bug Fixes

update to VHS 2.8.1 (#7238) (c4cfa55)
utils: add try and catch for computedStyle (#7214) (90ce2d7)
Better text for exit fullscreen (#7183) (0e46624)
Don't hide menus with one item and a title (#7215) (d4a08de)
exit full window mode with Esc key (#7224) (e9953e5)
incorrect focus styles on selected MenuItem (#7202) (06cdb6f), closes #7200
make Playback Rate control work better with screen readers (#7193) (17919ce), closes #7121
silence play promise in the play toggle. (#7189) (2c6e439), closes #6998
user and programmatic seeks with live streams (#7210) (39485fc)

Chores

update 'global' package in dependencies (#7213) (cb1d29b)
update node/nvmrc and various dependencies (#7221) (90f3e39), closes #7216 #6933 #6924 #7179

`v7.12.1`

Compare Source

Bug Fixes

package: remove remove (#7177) (9abba58), closes #7176
package: update vtt.js to allow server-side-rendering (#7178) (a3bfeb7)
package: upgrade VHS to 2.7.1 (#7174) (f0d69cd)

`v7.12.0`

Compare Source

Features

package: update VHS to 2.7.0 (#7164) (0d47306)
Add a mouse volume tooltip (#6824) (b2edfd2)
Add a player option noUITitleAttributes to prevent title attributes in the UI (#7134) (5f59391), closes #6767
enable responsive controls on fullscreen (#7098) (239c9a1)
retry on error (#7038) (22e9843), closes #1805

Bug Fixes

always have an enabled audio track when switching (#7163) (4707ce8)

Chores

never skip github actions workflows in main (#7169) (b6412a3)

Performance Improvements

wrap prototype methods in handlers in an arrow function (#7060) (17a6147)

7.11.8 (2021-03-23)

Bug Fixes

remove extra timeupdate event when progress controls is disabled (#7142) (b2336aa)

Documentation

update note about accessing tech (#7141) (7d46f44)

7.11.7 (2021-03-12)

Bug Fixes

package: update to Video.js HTTP Streaming 2.6.4 (#7136) (5f765ad)

7.11.6 (2021-03-09)

Bug Fixes

add display block to all buttons icon placeholder (#7094) (45eef66), closes #6989
clear progress control related rAFs when tab is hidden (#7099) (134f039), closes #7086
do not preload default text track if preloadTextTracks is false (#7021) (b76e816), closes #7019
focus-visible shouldn't change background styles (#7113) (1b52e7b)
package: update to videojs/http-streaming 2.6.3 (#7129) (8d0c601)
try enabling liveui on canplay (#7114) (3d676d6), closes #7034

Chores

update rollup for upcoming vhs changes (#7075) (0b46704)
video.js debug build (#7082) (ba47953)

Documentation

Add liveTracker options to options guide (#7097) (6336e57)
fix broken blogpost urls (#7106) (dd0c675)

Tests

a couple of minor fixes, tweak CI config, swap rollup replace plugin (#7128) (fbf34e3)

7.11.5 (2021-02-04)

Bug Fixes

dom: account for translated parent in pointer position on iOS (#7079) (542cead)
dom: stop findPosition at a fullscreenElement (#7074) (541f2e5)

7.11.4 (2021-01-26)

Bug Fixes

evented: log an error on invalid type (#7067) (85575db), closes #6982

7.11.3 (2021-01-25)

Bug Fixes

lang: Update nn.json (#7054) (4a9e1ab)
only preventDefault if event is cancelable (#7063) (b13cb07)
fs: make sure handlers are unique per player (#7035) (dceedb6), closes #7013
time-display: fix IE11 appending times instead of replacing (#7059) (ed3c54d)
better evented validation and error messages (#6982) (ffb690a)
prevent dispose error and text track duplicate listeners (#6984) (db46578)

Chores

netlify ci demo and docs (#7045) (9574bb4)

Documentation

change master to main (#7050) (e240396)

7.11.2 (2021-01-14)

Bug Fixes

set liveWindow to 0 liveCurrentTime is Infinity (#7034) (330c82c)
player: Ensure fluid works when dimensions not initially known (#7023) (661962c), closes #6939

Chores

package: update to @videojs/http-streaming@2.4.2 (#7042) (f672af8)

Documentation

Add note to legacy notes (#7022) (f87297b)
faq: fixup autoplay blogpost url (#7027) (a000fed), closes #6905

Tests

update ci workflow to prevent install failures (#7041) (5904ec2)

7.11.1 (2020-12-22)

Features

lang: add Slovene language translation (#6959) (8476abd)

Bug Fixes

MapSham: fix set method to use map property (#7000) (a35a121)
package: update to @videojs/http-streaming@2.4.1 (#7010) (ead775b)
clear readyQueue with dispose (#6967) (11d37e2)
package: update to @videojs/http-streaming@2.4.0 (#6986) (0631f03)
time-display: add a null check for text node (#6977) (3e30f83), closes #6699 #6700
play progress time tooltip from jittering during live (#6968) (799616d)
rollup: browser globals shouldn't be external (#6954) (63752f3), closes #6443 #6272 #6212 #5680

Chores

move unit test build right below main for faster watch (#6953) (5a13e90)

Documentation

Remove Flash (#6994) (503141c)

`v7.11.8`

Compare Source

Bug Fixes

remove extra timeupdate event when progress controls is disabled (#7142) (b2336aa)

Documentation

update note about accessing tech (#7141) (7d46f44)

`v7.11.7`

Compare Source

Bug Fixes

package: update to Video.js HTTP Streaming 2.6.4 (#7136) (5f765ad)

`v7.11.6`

Compare Source

Bug Fixes

add display block to all buttons icon placeholder (#7094) (45eef66), closes #6989
clear progress control related rAFs when tab is hidden (#7099) (134f039), closes #7086
do not preload default text track if preloadTextTracks is false (#7021) (b76e816), closes #7019
focus-visible shouldn't change background styles (#7113) (1b52e7b)
package: update to videojs/http-streaming 2.6.3 (#7129) (8d0c601)
try enabling liveui on canplay (#7114) (3d676d6), closes #7034

Chores

update rollup for upcoming vhs changes (#7075) (0b46704)
video.js debug build (#7082) (ba47953)

Documentation

Add liveTracker options to options guide (#7097) (6336e57)
fix broken blogpost urls (#7106) (dd0c675)

Tests

a couple of minor fixes, tweak CI config, swap rollup replace plugin (#7128) (fbf34e3)

`v7.11.5`

Compare Source

Bug Fixes

dom: account for translated parent in pointer position on iOS (#7079) (542cead)
dom: stop findPosition at a fullscreenElement (#7074) (541f2e5)

`v7.11.4`

Compare Source

Bug Fixes

evented: log an error on invalid type (#7067) (85575db), closes #6982

`v7.11.3`

Compare Source

Bug Fixes

lang: Update nn.json (#7054) (4a9e1ab)
only preventDefault if event is cancelable (#7063) (b13cb07)
fs: make sure handlers are unique per player (#7035) (dceedb6), closes #7013
time-display: fix IE11 appending times instead of replacing (#7059) (ed3c54d)
better evented validation and error messages (#6982) (ffb690a)
prevent dispose error and text track duplicate listeners (#6984) (db46578)

Chores

netlify ci demo and docs (#7045) (9574bb4)

Documentation

change master to main (#7050) (e240396)

`v7.11.2`

Compare Source

Bug Fixes

set liveWindow to 0 liveCurrentTime is Infinity (#7034) (330c82c)
player: Ensure fluid works when dimensions not initially known (#7023) (661962c), closes #6939

Chores

package: update to @videojs/http-streaming@2.4.2 (#7042) (f672af8)

Documentation

Add note to legacy notes (#7022) (f87297b)
faq: fixup autoplay blogpost url (#7027) (a000fed), closes #6905

Tests

update ci workflow to prevent install failures (#7041) (5904ec2)

`v7.11.1`

Compare Source

Features

lang: add Slovene language translation (#6959) (8476abd)

Bug Fixes

MapSham: fix set method to use map property (#7000) (a35a121)
package: update to @videojs/http-streaming@2.4.1 (#7010) (ead775b)
clear readyQueue with dispose (#6967) (11d37e2)
package: update to @videojs/http-streaming@2.4.0 (#6986) (0631f03)
time-display: add a null check for text node (#6977) (3e30f83), closes #6699 #6700
play progress time tooltip from jittering during live (#6968) (799616d)
rollup: browser globals shouldn't be external (#6954) (63752f3), closes #6443 #6272 #6212 #5680

Chores

move unit test build right below main for faster watch (#6953) (5a13e90)

Documentation

Remove Flash (#6994) (503141c)

`v7.11.0`

Compare Source

Features

lang: add thai language translations (#6945) (464b971)
tech: add a scrubbing getter. (#6920) (a803484)
track: make label property mutable and fire a labelchange event when the label is changed (#6928) (ee0637c)
trigger languagechange event on a language change (#6891) (a0d09c1)

Bug Fixes

cast TOUCH_ENABLED to boolean (#6943) (dcce0e9)
css: set seek to live button's align-items prop to center (#6942) (3901ab0)
always set tabIndex to restore keydown a11y (#6871) (0140b28), closes #6145 #6870
menu: focus correct MenuItem on keyboard open (#6914) (694fe0f), closes #6912
package: update to @videojs/http-streaming@2.3.0 (#6941) (f74e45b)

Chores

sandbox: switch all urls to https (#6946) (ca2d78f)
setup Github CI (#6940) (6a28562)

Documentation

change blog links to most recent blog version, fix typo (#6904) (8617530)

7.10.2 (2020-11-04)

Bug Fixes

package: update to VHS 2.2.4 (#6925) (9d9bbfe), closes #6909

7.10.1 (2020-10-15)

`v7.10.2`

Compare Source

Bug Fixes

package: update to VHS 2.2.4 (#6925) (9d9bbfe), closes #6909

`v7.10.1`

Compare Source

7.10.1 (2020-10-15)

`v7.10.0`

Compare Source

Features

update to @videojs/http-streaming@2.2.3 (#6867) (4a6a46a)

7.9.7 (2020-10-06)

Bug Fixes

text-track: don't overlap captions when font-size changes (#6874) (affc061), closes /github.com/videojs/video.js/commit/4e5c28cc561487ff29394d19dce3a420675e4f9d#diff-8169d53aa7eee6cab5f85b6641ef3117R176

7.9.6 (2020-10-01)

Bug Fixes

dom: vertical getPointerPosition value (#6864) (1963086), closes #5773 #6863

Documentation

Fix simple typo, intial -> initial (#6851) (f22ead1)

7.9.5 (2020-09-10)

7.9.4 (2020-09-10)

Bug Fixes

Better mouse position handling (#5773) (c4c8fc1), closes #6726 #1102

Chores

package: Update @videojs/http-streaming to 1.13.4 (#6839) (7192be6), closes #6812

7.9.3 (2020-08-17)

Bug Fixes

lang: Add PiP to de (#6803) (88850e9)
tech: add abstract setScrubbing in tech.js (#6808) (c91b510)

Documentation

README: fix link to getting Video.js from npm (#6761) (efa839b)
fix typo (#6760) (1761fa5)

7.9.2 (2020-07-20)

Bug Fixes

tech: add abstract crossOrigin method on Tech (#6765) (245efac), closes #6588

7.9.1 (2020-07-13)

Bug Fixes

limit fastSeek to Safari based browsers only (#6752) (94bea35), closes #6722

Bug Fixes

dom: vertical getPointerPosition value (#6864) (1963086), closes #5773 #6863

Documentation

Fix simple typo, intial -> initial (#6851) (f22ead1)

`v7.9.5`

Compare Source

7.9.5 (2020-09-10)

`v7.9.4`

Compare Source

Bug Fixes

Better mouse position handling (#5773) (c4c8fc1), closes #6726 #1102

Chores

package: Update @videojs/http-streaming to 1.13.4 (#6839) (7192be6), closes #6812

`v7.9.3`

Compare Source

Bug Fixes

lang: Add PiP to de (#6803) (88850e9)
tech: add abstract setScrubbing in tech.js (#6808) (c91b510)

Documentation

README: fix link to getting Video.js from npm (#6761) (efa839b)
fix typo (#6760) (1761fa5)

`v7.9.2`

Compare Source

Bug Fixes

tech: add abstract crossOrigin method on Tech (#6765) (245efac), closes #6588

`v7.9.1`

Compare Source

Bug Fixes

limit fastSeek to Safari based browsers only ([#6752](https://redirect.github.com/videojs/video.js

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2023-05-28T10:03:57Z

⚠ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: npm-shrinkwrap.json

chore(deps): update dependency video.js to v7 [security]

24eb0cd

renovate bot changed the title ~~chore(deps): update dependency video.js to v7 [security]~~ chore(deps): update dependency video.js to v7 [security] - autoclosed Dec 8, 2024

renovate bot closed this Dec 8, 2024

renovate bot deleted the renovate/npm-video.js-vulnerability branch December 8, 2024 18:54

renovate bot changed the title ~~chore(deps): update dependency video.js to v7 [security] - autoclosed~~ chore(deps): update dependency video.js to v7 [security] Dec 8, 2024

renovate bot reopened this Dec 8, 2024

renovate bot force-pushed the renovate/npm-video.js-vulnerability branch from 11b53c2 to 24eb0cd Compare December 8, 2024 22:54

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update dependency video.js to v7 [security] #313

chore(deps): update dependency video.js to v7 [security] #313

renovate bot commented May 28, 2023 •

edited

Loading

renovate bot commented May 28, 2023

chore(deps): update dependency video.js to v7 [security] #313

Are you sure you want to change the base?

chore(deps): update dependency video.js to v7 [security] #313

Conversation

renovate bot commented May 28, 2023 • edited Loading

GitHub Vulnerability Alerts

Release Notes

Bug Fixes

Bug Fixes

Bug Fixes

Chores

Documentation

Features

7.13.4 (2021-06-30)

Bug Fixes

Chores

7.13.3 (2021-06-23)

Chores

7.13.2 (2021-06-22)

Bug Fixes

7.13.1 (2021-06-14)

Bug Fixes

Bug Fixes

Chores

Chores

Bug Fixes

Bug Fixes

Features

Documentation

7.12.4 (2021-06-02)

Bug Fixes

Chores

7.12.3 (2021-05-20)

Bug Fixes

Chores

7.12.2 (2021-05-19)

Bug Fixes

Chores

7.12.1 (2021-04-13)

Bug Fixes

Bug Fixes

Chores

Bug Fixes

Chores

Bug Fixes

Chores

Bug Fixes

Features

Bug Fixes

Chores

Performance Improvements

7.11.8 (2021-03-23)

Bug Fixes

Documentation

7.11.7 (2021-03-12)

Bug Fixes

7.11.6 (2021-03-09)

Bug Fixes

Chores

Documentation

Tests

7.11.5 (2021-02-04)

Bug Fixes

7.11.4 (2021-01-26)

Bug Fixes

7.11.3 (2021-01-25)

Bug Fixes

Chores

Documentation

7.11.2 (2021-01-14)

Bug Fixes

Chores

Documentation

Tests

7.11.1 (2020-12-22)

Features

Bug Fixes

Chores

Documentation

Bug Fixes

renovate bot commented May 28, 2023 •

edited

Loading