chore(deps): update dependency video.js to v7 [security]

[renovate[bot]]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
video.js (source)	5.19.2 -> 7.14.3

GitHub Vulnerability Alerts

CVE-2021-23414

This affects the package video.js before 7.14.3. The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code.

---

Release Notes

videojs/video.js (video.js)

v7.14.3

Compare Source

Bug Fixes

• don't add anchor to DOM for getAbsoluteURL (#​7336) (b483a76)
• remove IE8 url parsing workaround (#​7334) (b3acf66)

v7.14.2

Compare Source

Bug Fixes

• dom: in removeClass, check element for null in case of a disposed player (#​6701) (2990cc7)

v7.14.1

Compare Source

Bug Fixes

• package: update to VHS 2.9.2 (#​7320) (fff0611)
• all !important properties of vjs-lock-showing (#​7312) (508a424)
• properly return promise from requestFullscreen and exitFullscreen (#​7299) (3921b7f), closes #​7298
• remove loading spinner on ended (#​7311) (14da28d), closes videojs/http-streaming#1156

Chores

• use setup-node cache and remove individual cache step (#​7310) (fab6e87)

Documentation

• react: Added a functional React component using React.useEffect (#​7203) (2360236)

v7.14.0

Compare Source

Features

• add ended getter middleware (#​7287) (c74c27d)

7.13.4 (2021-06-30)

Bug Fixes

• lang: add some translations to es.json (#​6822) (fbcfb7b)
• throw error on muted resolution rejection during autoplay (#​7293) (f9fb1d3)
• event: event polyfill detection compatibility with react-native-web (#​7286) (a221be1), closes #​7259
• lang: improve Hungarian translation (#​7289) (0f70787)

Chores

• add a code coverage ci workflow (#​7282) (4cecbda)

7.13.3 (2021-06-23)

Chores

• republish with VHS 2.9.1 (4b50f82)

7.13.2 (2021-06-22)

Bug Fixes

• package: update to VHS 2.9.1 (#​7284) (cee5fa3), closes #​7230

7.13.1 (2021-06-14)

Bug Fixes

• do a null check on playbackRates player method (#​7273) (6888798)

v7.13.4

Compare Source

Bug Fixes

• lang: add some translations to es.json (#​6822) (fbcfb7b)
• throw error on muted resolution rejection during autoplay (#​7293) (f9fb1d3)
• event: event polyfill detection compatibility with react-native-web (#​7286) (a221be1), closes #​7259
• lang: improve Hungarian translation (#​7289) (0f70787)

Chores

• add a code coverage ci workflow (#​7282) (4cecbda)

v7.13.3

Compare Source

Chores

• republish with VHS 2.9.1 (4b50f82)

v7.13.2

Compare Source

Bug Fixes

• package: update to VHS 2.9.1 (#​7284) (cee5fa3), closes #​7230

v7.13.1

Compare Source

Bug Fixes

• do a null check on playbackRates player method (#​7273) (6888798)

v7.13.0

Compare Source

Features

• Add helper classes for 9:16 and 1:1 (#​7219) (35ad17a)
• Add normalizeAutoplay option to treat autoplay: true as autoplay: "play" (#​7190) (b4ad93a)
• Add option to use full window mode instead of using tech's fullscreen (#​7218) (b86f083)
• update to VHS@​2.9.0 and mpd-parser@​0.17.0 (#​7269) (2ea05b4)
• package: add VHS deps as Video.js deps (#​7263) (39de502), closes #​7091 #​7209 #​7144 #​7109
• player: Add playbackRates() method (#​7228) (6259ef7), closes #​7198

Documentation

• Fix typo in CONTRIBUTING.md (#​7260) (380a9b5)

7.12.4 (2021-06-02)

Bug Fixes

• allow Video.js to be required in an env without setTimeout (#​7247) (8082c5a)
• player: accept data for fullscreenchange and error events from the tech (#​7254) (41d5eb3)
• seek-bar: remove event listener on dispose (#​7258) (c70c298)

Chores

• component: update comment around triggering ready in component (#​7256) (11ac0b9)
• Update sass and remove now deprecated / for division. (#​7253) (b3503c9), closes #​7244

7.12.3 (2021-05-20)

Bug Fixes

• update to VHS 2.8.2 (#​7242) (f528767), closes #​7240

Chores

• revert back to gh-release@​3.5.0 for now (#​7241) (a4c9b12)

7.12.2 (2021-05-19)

Bug Fixes

• update to VHS 2.8.1 (#​7238) (c4cfa55)
• utils: add try and catch for computedStyle (#​7214) (90ce2d7)
• Better text for exit fullscreen (#​7183) (0e46624)
• Don't hide menus with one item and a title (#​7215) (d4a08de)
• exit full window mode with Esc key (#​7224) (e9953e5)
• incorrect focus styles on selected MenuItem (#​7202) (06cdb6f), closes #​7200
• make Playback Rate control work better with screen readers (#​7193) (17919ce), closes #​7121
• silence play promise in the play toggle. (#​7189) (2c6e439), closes #​6998
• user and programmatic seeks with live streams (#​7210) (39485fc)

Chores

• update 'global' package in dependencies (#​7213) (cb1d29b)
• update node/nvmrc and various dependencies (#​7221) (90f3e39), closes #​7216 #​6933 #​6924 #​7179

7.12.1 (2021-04-13)

Bug Fixes

• package: remove remove (#​7177) (9abba58), closes #​7176
• package: update vtt.js to allow server-side-rendering (#​7178) (a3bfeb7)
• package: upgrade VHS to 2.7.1 (#​7174) (f0d69cd)

v7.12.4

Compare Source

Bug Fixes

• allow Video.js to be required in an env without setTimeout (#​7247) (8082c5a)
• player: accept data for fullscreenchange and error events from the tech (#​7254) (41d5eb3)
• seek-bar: remove event listener on dispose (#​7258) (c70c298)

Chores

• component: update comment around triggering ready in component (#​7256) (11ac0b9)
• Update sass and remove now deprecated / for division. (#​7253) (b3503c9), closes #​7244

v7.12.3

Compare Source

Bug Fixes

• update to VHS 2.8.2 (#​7242) (f528767), closes #​7240

Chores

• revert back to gh-release@​3.5.0 for now (#​7241) (a4c9b12)

v7.12.2

Compare Source

Bug Fixes

• update to VHS 2.8.1 (#​7238) (c4cfa55)
• utils: add try and catch for computedStyle (#​7214) (90ce2d7)
• Better text for exit fullscreen (#​7183) (0e46624)
• Don't hide menus with one item and a title (#​7215) (d4a08de)
• exit full window mode with Esc key (#​7224) (e9953e5)
• incorrect focus styles on selected MenuItem (#​7202) (06cdb6f), closes #​7200
• make Playback Rate control work better with screen readers (#​7193) (17919ce), closes #​7121
• silence play promise in the play toggle. (#​7189) (2c6e439), closes #​6998
• user and programmatic seeks with live streams (#​7210) (39485fc)

Chores

• update 'global' package in dependencies (#​7213) (cb1d29b)
• update node/nvmrc and various dependencies (#​7221) (90f3e39), closes #​7216 #​6933 #​6924 #​7179

v7.12.1

Compare Source

Bug Fixes

• package: remove remove (#​7177) (9abba58), closes #​7176
• package: update vtt.js to allow server-side-rendering (#​7178) (a3bfeb7)
• package: upgrade VHS to 2.7.1 (#​7174) (f0d69cd)

v7.12.0

Compare Source

Features

• package: update VHS to 2.7.0 (#​7164) (0d47306)
• Add a mouse volume tooltip (#​6824) (b2edfd2)
• Add a player option noUITitleAttributes to prevent title attributes in the UI (#​7134) (5f59391), closes #​6767
• enable responsive controls on fullscreen (#​7098) (239c9a1)
• retry on error (#​7038) (22e9843), closes #​1805

Bug Fixes

• always have an enabled audio track when switching (#​7163) (4707ce8)

Chores

• never skip github actions workflows in main (#​7169) (b6412a3)

Performance Improvements

• wrap prototype methods in handlers in an arrow function (#​7060) (17a6147)

7.11.8 (2021-03-23)

Bug Fixes

• remove extra timeupdate event when progress controls is disabled (#​7142) (b2336aa)

Documentation

• update note about accessing tech (#​7141) (7d46f44)

7.11.7 (2021-03-12)

Bug Fixes

• package: update to Video.js HTTP Streaming 2.6.4 (#​7136) (5f765ad)

7.11.6 (2021-03-09)

Bug Fixes

• add display block to all buttons icon placeholder (#​7094) (45eef66), closes #​6989
• clear progress control related rAFs when tab is hidden (#​7099) (134f039), closes #​7086
• do not preload default text track if preloadTextTracks is false (#​7021) (b76e816), closes #​7019
• focus-visible shouldn't change background styles (#​7113) (1b52e7b)
• package: update to videojs/http-streaming 2.6.3 (#​7129) (8d0c601)
• try enabling liveui on canplay (#​7114) (3d676d6), closes #​7034

Chores

• update rollup for upcoming vhs changes (#​7075) (0b46704)
• video.js debug build (#​7082) (ba47953)

Documentation

• Add liveTracker options to options guide (#​7097) (6336e57)
• fix broken blogpost urls (#​7106) (dd0c675)

Tests

• a couple of minor fixes, tweak CI config, swap rollup replace plugin (#​7128) (fbf34e3)

7.11.5 (2021-02-04)

Bug Fixes

• dom: account for translated parent in pointer position on iOS (#​7079) (542cead)
• dom: stop findPosition at a fullscreenElement (#​7074) (541f2e5)

7.11.4 (2021-01-26)

Bug Fixes

• evented: log an error on invalid type (#​7067) (85575db), closes #​6982

7.11.3 (2021-01-25)

Bug Fixes

• lang: Update nn.json (#​7054) (4a9e1ab)
• only preventDefault if event is cancelable (#​7063) (b13cb07)
• fs: make sure handlers are unique per player (#​7035) (dceedb6), closes #​7013
• time-display: fix IE11 appending times instead of replacing (#​7059) (ed3c54d)
• better evented validation and error messages (#​6982) (ffb690a)
• prevent dispose error and text track duplicate listeners (#​6984) (db46578)

Chores

• netlify ci demo and docs (#​7045) (9574bb4)

Documentation

• change master to main (#​7050) (e240396)

7.11.2 (2021-01-14)

Bug Fixes

• set liveWindow to 0 liveCurrentTime is Infinity (#​7034) (330c82c)
• player: Ensure fluid works when dimensions not initially known (#​7023) (661962c), closes #​6939

Chores

• package: update to @​videojs/http-streaming@​2.4.2 (#​7042) (f672af8)

Documentation

• Add note to legacy notes (#​7022) (f87297b)
• faq: fixup autoplay blogpost url (#​7027) (a000fed), closes #​6905

Tests

• update ci workflow to prevent install failures (#​7041) (5904ec2)

7.11.1 (2020-12-22)

Features

• lang: add Slovene language translation (#​6959) (8476abd)

Bug Fixes

• MapSham: fix set method to use map property (#​7000) (a35a121)
• package: update to @​videojs/http-streaming@​2.4.1 (#​7010) (ead775b)
• clear readyQueue with dispose (#​6967) (11d37e2)
• package: update to @​videojs/http-streaming@​2.4.0 (#​6986) (0631f03)
• time-display: add a null check for text node (#​6977) (3e30f83), closes #​6699 #​6700
• play progress time tooltip from jittering during live (#​6968) (799616d)
• rollup: browser globals shouldn't be external (#​6954) (63752f3), closes #​6443 #​6272 #​6212 #​5680

Chores

• move unit test build right below main for faster watch (#​6953) (5a13e90)

Documentation

• Remove Flash (#​6994) (503141c)

v7.11.8

Compare Source

Bug Fixes

• remove extra timeupdate event when progress controls is disabled (#​7142) (b2336aa)

Documentation

• update note about accessing tech (#​7141) (7d46f44)

v7.11.7

Compare Source

Bug Fixes

• package: update to Video.js HTTP Streaming 2.6.4 (#​7136) (5f765ad)

v7.11.6

Compare Source

Bug Fixes

• add display block to all buttons icon placeholder (#​7094) (45eef66), closes #​6989
• clear progress control related rAFs when tab is hidden (#​7099) (134f039), closes #​7086
• do not preload default text track if preloadTextTracks is false (#​7021) (b76e816), closes #​7019
• focus-visible shouldn't change background styles (#​7113) (1b52e7b)
• package: update to videojs/http-streaming 2.6.3 (#​7129) (8d0c601)
• try enabling liveui on canplay (#​7114) (3d676d6), closes #​7034

Chores

• update rollup for upcoming vhs changes (#​7075) (0b46704)
• video.js debug build (#​7082) (ba47953)

Documentation

• Add liveTracker options to options guide (#​7097) (6336e57)
• fix broken blogpost urls (#​7106) (dd0c675)

Tests

• a couple of minor fixes, tweak CI config, swap rollup replace plugin (#​7128) (fbf34e3)

v7.11.5

Compare Source

Bug Fixes

• dom: account for translated parent in pointer position on iOS (#​7079) (542cead)
• dom: stop findPosition at a fullscreenElement (#​7074) (541f2e5)

v7.11.4

Compare Source

Bug Fixes

• evented: log an error on invalid type (#​7067) (85575db), closes #​6982

v7.11.3

Compare Source

Bug Fixes

• lang: Update nn.json (#​7054) (4a9e1ab)
• only preventDefault if event is cancelable (#​7063) (b13cb07)
• fs: make sure handlers are unique per player (#​7035) (dceedb6), closes #​7013
• time-display: fix IE11 appending times instead of replacing (#​7059) (ed3c54d)
• better evented validation and error messages (#​6982) (ffb690a)
• prevent dispose error and text track duplicate listeners (#​6984) (db46578)

Chores

• netlify ci demo and docs (#​7045) (9574bb4)

Documentation

• change master to main (#​7050) (e240396)

v7.11.2

Compare Source

Bug Fixes

• set liveWindow to 0 liveCurrentTime is Infinity (#​7034) (330c82c)
• player: Ensure fluid works when dimensions not initially known (#​7023) (661962c), closes #​6939

Chores

• package: update to @​videojs/http-streaming@​2.4.2 (#​7042) (f672af8)

Documentation

• Add note to legacy notes (#​7022) (f87297b)
• faq: fixup autoplay blogpost url (#​7027) (a000fed), closes #​6905

Tests

• update ci workflow to prevent install failures (#​7041) (5904ec2)

v7.11.1

Compare Source

Features

• lang: add Slovene language translation (#​6959) (8476abd)

Bug Fixes

• MapSham: fix set method to use map property (#​7000) (a35a121)
• package: update to @​videojs/http-streaming@​2.4.1 (#​7010) (ead775b)
• clear readyQueue with dispose (#​6967) (11d37e2)
• package: update to @​videojs/http-streaming@​2.4.0 (#​6986) (0631f03)
• time-display: add a null check for text node (#​6977) (3e30f83), closes #​6699 #​6700
• play progress time tooltip from jittering during live (#​6968) (799616d)
• rollup: browser globals shouldn't be external (#​6954) (63752f3), closes #​6443 #​6272 #​6212 #​5680

Chores

• move unit test build right below main for faster watch (#​6953) (5a13e90)

Documentation

• Remove Flash (#​6994) (503141c)

v7.11.0

Compare Source

Features

• lang: add thai language translations (#​6945) (464b971)
• tech: add a scrubbing getter. (#​6920) (a803484)
• track: make label property mutable and fire a labelchange event when the label is changed (#​6928) (ee0637c)
• trigger languagechange event on a language change (#​6891) (a0d09c1)

Bug Fixes

• cast TOUCH_ENABLED to boolean (#​6943) (dcce0e9)
• css: set seek to live button's align-items prop to center (#​6942) (3901ab0)
• always set tabIndex to restore keydown a11y (#​6871) (0140b28), closes #​6145 #​6870
• menu: focus correct MenuItem on keyboard open (#​6914) (694fe0f), closes #​6912
• package: update to @​videojs/http-streaming@​2.3.0 (#​6941) (f74e45b)

Chores

• sandbox: switch all urls to https (#​6946) (ca2d78f)
• setup Github CI (#​6940) (6a28562)

Documentation

• change blog links to most recent blog version, fix typo (#​6904) (8617530)

7.10.2 (2020-11-04)

Bug Fixes

• package: update to VHS 2.2.4 (#​6925) (9d9bbfe), closes #​6909

7.10.1 (2020-10-15)

v7.10.2

Compare Source

Bug Fixes

• package: update to VHS 2.2.4 (#​6925) (9d9bbfe), closes #​6909

v7.10.1

Compare Source

7.10.1 (2020-10-15)

v7.10.0

Compare Source

Features

• update to @​videojs/http-streaming@​2.2.3 (#​6867) (4a6a46a)

7.9.7 (2020-10-06)

Bug Fixes

• text-track: don't overlap captions when font-size changes (#​6874) (affc061), closes /github.com/videojs/video.js/commit/4e5c28cc561487ff29394d19dce3a420675e4f9d#diff-8169d53aa7eee6cab5f85b6641ef3117R176

7.9.6 (2020-10-01)

Bug Fixes

• dom: vertical getPointerPosition value (#​6864) (1963086), closes #​5773 #​6863

Documentation

• Fix simple typo, intial -> initial (#​6851) (f22ead1)

7.9.5 (2020-09-10)

7.9.4 (2020-09-10)

Bug Fixes

• Better mouse position handling (#​5773) (c4c8fc1), closes #​6726 #​1102

Chores

• package: Update @​videojs/http-streaming to 1.13.4 (#​6839) (7192be6), closes #​6812

7.9.3 (2020-08-17)

Bug Fixes

• lang: Add PiP to de (#​6803) (88850e9)
• tech: add abstract setScrubbing in tech.js (#​6808) (c91b510)

Documentation

• README: fix link to getting Video.js from npm (#​6761) (efa839b)
• fix typo (#​6760) (1761fa5)

7.9.2 (2020-07-20)

Bug Fixes

• tech: add abstract crossOrigin method on Tech (#​6765) (245efac), closes #​6588

7.9.1 (2020-07-13)

Bug Fixes

• limit fastSeek to Safari based browsers only (#​6752) (94bea35), closes #​6722

v7.9.7

Compare Source

Bug Fixes

• text-track: don't overlap captions when font-size changes (#​6874) (affc061), closes /github.com/videojs/video.js/commit/4e5c28cc561487ff29394d19dce3a420675e4f9d#diff-8169d53aa7eee6cab5f85b6641ef3117R176

v7.9.6

Compare Source

Bug Fixes

• dom: vertical getPointerPosition value (#​6864) (1963086), closes #​5773 #​6863

Documentation

• Fix simple typo, intial -> initial (#​6851) (f22ead1)

v7.9.5

Compare Source

7.9.5 (2020-09-10)

v7.9.4

Compare Source

Bug Fixes

• Better mouse position handling (#​5773) (c4c8fc1), closes #​6726 #​1102

Chores

• package: Update @​videojs/http-streaming to 1.13.4 (#​6839) (7192be6), closes #​6812

v7.9.3

Compare Source

Bug Fixes

• lang: Add PiP to de (#​6803) (88850e9)
• tech: add abstract setScrubbing in tech.js (#​6808) (c91b510)

Documentation

• README: fix link to getting Video.js from npm (#​6761) (efa839b)
• fix typo (#​6760) (1761fa5)

v7.9.2

Compare Source

Bug Fixes

• tech: add abstract crossOrigin method on Tech (#​6765) (245efac), closes #​6588

v7.9.1

Compare Source

Bug Fixes

• limit fastSeek to Safari based browsers only (#​6752) (94bea35), closes #​6722

v7.9.0

Compare Source

Features

• Add a default, plugin-specific logger to advanced plugins (#​6693) (f6a66e6)
• add debug mode (#​6687) (3d505ef)
• Add named requestAnimationFrame to prevent performance issues (#​6627) (6e7cc75), closes #​5937
• Add support for CAF, FLAC and WAV formats in known mimetypes (#​6657) (8d462bc), closes #​5982
• adds disablePictureInPicture method to the player API. (#​6378) (dbd5203)
• support fastSeek during scrubbing if available (#​6525) (8c66c58)

Bug Fixes

• add PiP to zh-CN.json (#​6680) (d90569f)
• addChild with index should allow for children that are elements (#​6644) (0b91f74), closes #​6297
• Disable PIP if tech doesn't support it (#​6678) (907d1cd), closes #​6398
• Fullscreen broken in iOS (#​6735) (fdd807b), closes #​6707 #​6684 #​6645
• Use clamp correctly in progress control (#​6625) (cad9114)
• fs: don't set player element css props on native fullscreen (#​6673) (d6b07f0), closes #​6640
• lang: Update pt-BR.json (#​6598) (90e2b0f)
• package: update to @​videojs/http-streaming@​1.13.3 (#​6610) (f779bad)
• text-tracks: set withCredentials on XHR if crossOrigin='use-credentials' (#​6588) (a4ea1f9), closes #​6587

Chores

• Remove "flash" and add "dash" in keywords about video.js (#​6692) (4d9e1bc), closes #​6603

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• [ ] If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.