fix(deps): update dependency video.js to v8 by squiggler-app[bot] · Pull Request #1388 · sanity-io/plugins

squiggler-app · 2026-06-22T12:08:54Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
video.js (source)	`^7.21.7` → `^8.23.9`

Release Notes

videojs/video.js (video.js)

`v8.23.9`

Compare Source

Bug Fixes

audio-tracks: missing AD icon in Safari (#9153) (c625b0b)
player: strip stale layout class when breakpoints() is re-set (#9205) (0054c0b)
track-button: properly remove event listeners on dispose to prevent leaks and runtime errors (#9101) (00440ee)
types: 'Cannot find name Player' error in type generation (#9162) (69ea0e0)

Chores

update @videojs/http-streaming to 3.17.5, vhs-utils to 4.1.2, mpd-parser to 1.4.0 (91423aa)

`v8.23.8`

Compare Source

Chores

Convert PR title action to module (#9152) (6dec037)
package: update vhs to 3.17.4 (#9151) (6ec1314)

`v8.23.7`

Compare Source

Bug Fixes

Allow use in jsdom environments without window.CSS (#9137) (08f3ee3)
Broken menu button setIcon type (#9089) (93ecc35)
convert Tracklist length to a getter and fix event docs (#9142) (46779e8)
lang: improve finnish lang support (#9114) (9cc0b34)
lang: updated translations for gl (#9026) (553253c)
prevent current time display showing 0:00 during seek (#9135) (ec33990)

Chores

package: update vhs to v3.17.3 (#9147) (e27bb32)
tags and version changes into main (#9123) (67ba442)
update prod dependencies (#9129) (d203eab)

Documentation

Clarify copyright and project stewardship (#9104) (20f8d76)

`v8.23.6`

Compare Source

Bug Fixes

revert minor change to test trusted publishing workflow e2e sans npm token in release.yml (f3de5f3)

`v8.23.5`

Compare Source

Bug Fixes

minor change to test trusted publishing workflow e2e (836d8cb)

Documentation

Clarify copyright and project stewardship (#9104) (20f8d76)

`v8.23.4`

Compare Source

Bug Fixes

Component.js string arg type for for removeChild (#9070) (31f8d7c)

Chores

package: update VHS to v3.17.2 (#9079) (c3e4f6b)

Documentation

Update README.md w/ v10 news link (#9037) (09eb715)

`v8.23.3`

Compare Source

Bug Fixes

update release workflow discussion permission (#9031) (1a09554)

`v8.23.2`

Compare Source

Bug Fixes

update release workfow permissions (#9027) (e0b2521)

`v8.23.1`

Compare Source

Bug Fixes

controlText for text track modal (#8989) (751ac56)
only change focus from BPB if not tap or mouse click (#9015) (76aadfe)
update text-track-cue styles on useractive (#9023) (8e1889c)

`v8.23.0`

Compare Source

Features

Improve SmartTV scrubbing behavior (#8988) (77c99d2)
toJSON methods for text track serialization (#8998) (1c282a3)

Bug Fixes

Improve getFileExtension() readability and handle leading dot extensions. (#8980) (5b9795d)

Code Refactoring

types: track and track list types generation (#8978) (8842d37), closes #8486 /github.com/videojs/video.js/pull/8486/files#r1635782771

`v8.22.0`

Compare Source

Features

Make seek bar keyboard skip increment configurable (#8919) (f2311c8), closes 1000#0
package: Update to @videojs/http-streaming v3.17.0 (#8976) (88aa1e7)

Bug Fixes

hide mouse tooltip on touch devices when not scrubbing (#8945) (4661aa7)
registering new player component (#8932) (f8e9bfc), closes #8925

Chores

Enable supply chain security through npm provenance attestation (#8911) (c1a8cbf), closes 1000#0
Update sass and change colour syntax (#8894) (55bb0fd)

8.21.1 (2024-12-05)

Chores

lang: update zh-TW translations (#8929) (b6cec4f), closes 1000#0
update Occitan locale file (#8927) (a0ca168)

`v8.21.1`

Compare Source

Features

Make seek bar keyboard skip increment configurable (#8919) (f2311c8), closes 1000#0
package: Update to @videojs/http-streaming v3.17.0 (#8976) (88aa1e7)

Bug Fixes

hide mouse tooltip on touch devices when not scrubbing (#8945) (4661aa7)
registering new player component (#8932) (f8e9bfc), closes #8925

Chores

Enable supply chain security through npm provenance attestation (#8911) (c1a8cbf), closes 1000#0
Update sass and change colour syntax (#8894) (55bb0fd)

8.21.1 (2024-12-05)

Chores

lang: update zh-TW translations (#8929) (b6cec4f), closes 1000#0
update Occitan locale file (#8927) (a0ca168)

`v8.21.0`

Compare Source

Features

Make seek bar keyboard skip increment configurable (#8919) (f2311c8), closes 1000#0
package: Update to @videojs/http-streaming v3.17.0 (#8976) (88aa1e7)

Bug Fixes

hide mouse tooltip on touch devices when not scrubbing (#8945) (4661aa7)
registering new player component (#8932) (f8e9bfc), closes #8925

Chores

Enable supply chain security through npm provenance attestation (#8911) (c1a8cbf), closes 1000#0
Update sass and change colour syntax (#8894) (55bb0fd)

8.21.1 (2024-12-05)

Chores

lang: update zh-TW translations (#8929) (b6cec4f), closes 1000#0
update Occitan locale file (#8927) (a0ca168)

`v8.20.0`

Compare Source

Chores

Correct changelog for 8.19.2 (#8918) (964c40e)
package: Update @videojs/http-streaming to 3.16.0 (#8921) (7420467), closes 1000#0

8.19.2 (2024-11-14)

Bug Fixes

change http to https in examples (#8905) (079cbe1)
Fix Escape handling in menus (#8916) (d0cf139)
text-track-settings: localization not correctly applied (#8904) (ecef37c)

8.19.1 (2024-10-10)

Chores

package: update http-streaming to v3.15.0 (#8889) (84f4905)
update mpd-parser to v1.3.1 (#8888) (7c17d75)

`v8.19.2`

Compare Source

Chores

Correct changelog for 8.19.2 (#8918) (964c40e)
package: Update @videojs/http-streaming to 3.16.0 (#8921) (7420467), closes 1000#0

8.19.2 (2024-11-14)

Bug Fixes

change http to https in examples (#8905) (079cbe1)
Fix Escape handling in menus (#8916) (d0cf139)
text-track-settings: localization not correctly applied (#8904) (ecef37c)

8.19.1 (2024-10-10)

Chores

package: update http-streaming to v3.15.0 (#8889) (84f4905)
update mpd-parser to v1.3.1 (#8888) (7c17d75)

`v8.19.1`

Compare Source

Chores

Correct changelog for 8.19.2 (#8918) (964c40e)
package: Update @videojs/http-streaming to 3.16.0 (#8921) (7420467), closes 1000#0

8.19.2 (2024-11-14)

Bug Fixes

change http to https in examples (#8905) (079cbe1)
Fix Escape handling in menus (#8916) (d0cf139)
text-track-settings: localization not correctly applied (#8904) (ecef37c)

8.19.1 (2024-10-10)

Chores

package: update http-streaming to v3.15.0 (#8889) (84f4905)
update mpd-parser to v1.3.1 (#8888) (7c17d75)

`v8.19.0`

Compare Source

Chores

Correct changelog for 8.19.2 (#8918) (964c40e)
package: Update @videojs/http-streaming to 3.16.0 (#8921) (7420467), closes 1000#0

8.19.2 (2024-11-14)

Bug Fixes

change http to https in examples (#8905) (079cbe1)
Fix Escape handling in menus (#8916) (d0cf139)
text-track-settings: localization not correctly applied (#8904) (ecef37c)

8.19.1 (2024-10-10)

Chores

package: update http-streaming to v3.15.0 (#8889) (84f4905)
update mpd-parser to v1.3.1 (#8888) (7c17d75)

`v8.18.1`

Compare Source

Features

Add methods to add and remove elements (#8886) (eddda97), closes #8886

Bug Fixes

Don't request fullscreen from document PIP window (#8881) (077077b), closes #8877

Chores

package: Update to VHS v3.14.2 (#8869) (89eb454)

8.18.1 (2024-09-17)

Chores

package: Update to VHS v3.14.2 (#8869) (89eb454)

`v8.18.0`

Compare Source

Features

Add methods to add and remove elements (#8886) (eddda97), closes #8886

Bug Fixes

Don't request fullscreen from document PIP window (#8881) (077077b), closes #8877

Chores

package: Update to VHS v3.14.2 (#8869) (89eb454)

8.18.1 (2024-09-17)

Chores

package: Update to VHS v3.14.2 (#8869) (89eb454)

`v8.17.4`

Compare Source

Features

add class to normalise time control display (#8833) (5e6b536), closes #8534 1000#0

Bug Fixes

check for closeable() before calling in spatialnavigation (#8832) (8c56e31)
lang: Update el.json (#8848) (1e2ea61), closes 1000#0
update VHS to v3.14.1 (#8860) (c8e546f), closes 1000#0

Chores

update version number in readme on release (#8840) (5fac9e1)
Update VHS to 3.14.0, and its dependencies (#8839) (1128425), closes 1000#0

8.17.4 (2024-08-27)

Bug Fixes

allow captions in devices that use old chrome to be shown (#8826) (3e9e4e8), closes 1000#0
Change requestNamedAnimationFrame to apply last change per frame instead of first (#8799) (e715145), closes #8633 #8782 1000#0
ensure spatial navigation starts without error without an ErrorD… (#8830) (73db132), closes 1000#0
types: Add has|usingPlugin to typedef by adding stubs which are removed from builds (#8811) (820ef38), closes 1000#0
types: ensure toggleClass's second arg is optional (#8829) (65f8546), closes 1000#0
use backup styles when inset is not supported (#8844) (1d771d9)

Chores

Remove safe-json-parse (#8790) (3380d33), closes 1000#0
update http-streaming to v3.13.3 (#8827) (790078b)

Code Refactoring

Reorder SASS styles to address deprecation (#8821) (57c27f8), closes 1000#0

Documentation

Refresh README.md and point other docs to admin repo (#8837) (f0db8f1)

8.17.3 (2024-07-30)

Bug Fixes

Listen to taps on track controls (#8809) (86d29cd), closes #8808 1000#0
Refactor evented to make mincompatable with Chrome 53 (#8810) (a7c9f26), closes /github.com/videojs/video.js/blob/e78bcc7b2d829fce01451cf105b918d8feec4548/src/js/mixins/evented.js#L165-L195 #8783 1000#0
spatial-navigation: focus lost in error modal (#8817) (daf40bd), closes 1000#0
spatial-navigation: keep navigation going when player has an error (#8805) (76e99b7), closes 1000#0
spatial-navigation: refocus available also to the close button of the error modal (#8819) (45570d9), closes 1000#0

8.17.2 (2024-07-22)

Chores

update vhs version 3.13.2 (#8812) (49151ee), closes 1000#0

8.17.1 (2024-07-15)

Bug Fixes

ensure transient button event listeners are removed on dispose (#8796) (0a836e1), closes #8795 1000#0

`v8.17.3`

Compare Source

Features

add class to normalise time control display (#8833) (5e6b536), closes #8534 1000#0

Bug Fixes

check for closeable() before calling in spatialnavigation (#8832) (8c56e31)
lang: Update el.json (#8848) (1e2ea61), closes 1000#0
update VHS to v3.14.1 (#8860) (c8e546f), closes 1000#0

Chores

update version number in readme on release (#8840) (5fac9e1)
Update VHS to 3.14.0, and its dependencies (#8839) (1128425), closes 1000#0

8.17.4 (2024-08-27)

Bug Fixes

allow captions in devices that use old chrome to be shown (#8826) (3e9e4e8), closes 1000#0
Change requestNamedAnimationFrame to apply last change per frame instead of first (#8799) (e715145), closes #8633 #8782 1000#0
ensure spatial navigation starts without error without an ErrorD… (#8830) (73db132), closes 1000#0
types: Add has|usingPlugin to typedef by adding stubs which are removed from builds (#8811) (820ef38), closes 1000#0
types: ensure toggleClass's second arg is optional (#8829) (65f8546), closes 1000#0
use backup styles when inset is not supported (#8844) (1d771d9)

Chores

Remove safe-json-parse (#8790) (3380d33), closes 1000#0
update http-streaming to v3.13.3 (#8827) (790078b)

Code Refactoring

Reorder SASS styles to address deprecation (#8821) (57c27f8), closes 1000#0

Documentation

Refresh README.md and point other docs to admin repo (#8837) (f0db8f1)

8.17.3 (2024-07-30)

Bug Fixes

Listen to taps on track controls (#8809) (86d29cd), closes #8808 1000#0
Refactor evented to make mincompatable with Chrome 53 (#8810) (a7c9f26), closes /github.com/videojs/video.js/blob/e78bcc7b2d829fce01451cf105b918d8feec4548/src/js/mixins/evented.js#L165-L195 #8783 1000#0
spatial-navigation: focus lost in error modal (#8817) (daf40bd), closes 1000#0
spatial-navigation: keep navigation going when player has an error (#8805) (76e99b7), closes 1000#0
spatial-navigation: refocus available also to the close button of the error modal (#8819) (45570d9), closes 1000#0

8.17.2 (2024-07-22)

Chores

update vhs version 3.13.2 (#8812) (49151ee), closes 1000#0

8.17.1 (2024-07-15)

Bug Fixes

ensure transient button event listeners are removed on dispose (#8796) (0a836e1), closes #8795 1000#0

`v8.17.2`

Compare Source

Features

add class to normalise time control display (#8833) (5e6b536), closes #8534 1000#0

Bug Fixes

check for closeable() before calling in spatialnavigation (#8832) (8c56e31)
lang: Update el.json (#8848) (1e2ea61), closes 1000#0
update VHS to v3.14.1 (#8860) (c8e546f), closes 1000#0

Chores

update version number in readme on release (#8840) (5fac9e1)
Update VHS to 3.14.0, and its dependencies (#8839) (1128425), closes 1000#0

8.17.4 (2024-08-27)

Bug Fixes

allow captions in devices that use old chrome to be shown (#8826) (3e9e4e8), closes 1000#0
Change requestNamedAnimationFrame to apply last change per frame instead of first (#8799) (e715145), closes #8633 #8782 1000#0
ensure spatial navigation starts without error without an ErrorD… (#8830) (73db132), closes 1000#0
types: Add has|usingPlugin to typedef by adding stubs which are removed from builds (#8811) (820ef38), closes 1000#0
types: ensure toggleClass's second arg is optional (#8829) (65f8546), closes 1000#0
use backup styles when inset is not supported (#8844) (1d771d9)

Chores

Remove safe-json-parse (#8790) (3380d33), closes 1000#0
update http-streaming to v3.13.3 (#8827) (790078b)

Code Refactoring

Reorder SASS styles to address deprecation (#8821) (57c27f8), closes 1000#0

Documentation

Refresh README.md and point other docs to admin repo (#8837) (f0db8f1)

8.17.3 (2024-07-30)

Bug Fixes

Listen to taps on track controls (#8809) (86d29cd), closes #8808 1000#0
Refactor evented to make mincompatable with Chrome 53 (#8810) (a7c9f26), closes /github.com/videojs/video.js/blob/e78bcc7b2d829fce01451cf105b918d8feec4548/src/js/mixins/evented.js#L165-L195 #8783 1000#0
spatial-navigation: focus lost in error modal (#8817) (daf40bd), closes 1000#0
spatial-navigation: keep navigation going when player has an error (#8805) (76e99b7), closes 1000#0
spatial-navigation: refocus available also to the close button of the error modal (#8819) (45570d9), closes 1000#0

8.17.2 (2024-07-22)

Chores

update vhs version 3.13.2 (#8812) (49151ee), closes 1000#0

8.17.1 (2024-07-15)

Bug Fixes

ensure transient button event listeners are removed on dispose (#8796) (0a836e1), closes #8795 1000#0

`v8.17.1`

Compare Source

Features

add class to normalise time control display (#8833) (5e6b536), closes #8534 1000#0

Bug Fixes

check for closeable() before calling in spatialnavigation (#8832) (8c56e31)
lang: Update el.json (#8848) (1e2ea61), closes 1000#0
update VHS to v3.14.1 (#8860) (c8e546f), closes 1000#0

Chores

update version number in readme on release (#8840) (5fac9e1)
Update VHS to 3.14.0, and its dependencies (#8839) (1128425), closes 1000#0

8.17.4 (2024-08-27)

Bug Fixes

allow captions in devices that use old chrome to be shown (#8826) (3e9e4e8), closes 1000#0
Change requestNamedAnimationFrame to apply last change per frame instead of first (#8799) (e715145), closes #8633 #8782 1000#0
ensure spatial navigation starts without error without an ErrorD… (#8830) (73db132), closes 1000#0
types: Add has|usingPlugin to typedef by adding stubs which are removed from builds (#8811) (820ef38), closes 1000#0
types: ensure toggleClass's second arg is optional (#8829) (65f8546), closes 1000#0
use backup styles when inset is not supported (#8844) (1d771d9)

Chores

Remove safe-json-parse (#8790) (3380d33), closes 1000#0
update http-streaming to v3.13.3 (#8827) (790078b)

Code Refactoring

Reorder SASS styles to address deprecation (#8821) (57c27f8), closes 1000#0

Documentation

Refresh README.md and point other docs to admin repo (#8837) (f0db8f1)

8.17.3 (2024-07-30)

Bug Fixes

Listen to taps on track controls (#8809) (86d29cd), closes #8808 1000#0
Refactor evented to make mincompatable with Chrome 53 (#8810) (a7c9f26), closes /github.com/videojs/video.js/blob/e78bcc7b2d829fce01451cf105b918d8feec4548/src/js/mixins/evented.js#L165-L195 #8783 1000#0
spatial-navigation: focus lost in error modal (#8817) (daf40bd), closes 1000#0
spatial-navigation: keep navigation going when player has an error (#8805) (76e99b7), closes 1000#0
spatial-navigation: refocus available also to the close button of the error modal (#8819) (45570d9), closes 1000#0

8.17.2 (2024-07-22)

Chores

update vhs version 3.13.2 (#8812) (49151ee), closes 1000#0

8.17.1 (2024-07-15)

Bug Fixes

ensure transient button event listeners are removed on dispose (#8796) (0a836e1), closes #8795 1000#0

`v8.17.0`

Compare Source

Features

add class to normalise time control display (#8833) (5e6b536), closes #8534 1000#0

Bug Fixes

check for closeable() before calling in spatialnavigation (#8832) (8c56e31)
lang: Update el.json (#8848) (1e2ea61), closes 1000#0
update VHS to v3.14.1 (#8860) (c8e546f), closes 1000#0

Chores

update version number in readme on release (#8840) (5fac9e1)
Update VHS to 3.14.0, and its dependencies (#8839) (1128425), closes 1000#0

8.17.4 (2024-08-27)

Bug Fixes

allow captions in devices that use old chrome to be shown ([#8826](https://redirect.github.com/videojs/video.js/issue

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate using a curated preset maintained by . View repository job log here

Note

Medium Risk
Major-version dependency bump affects video preview in two plugins without code adaptations; worth smoke-testing HLS/MP4 previews and checking for v8 type or runtime API issues.

Overview
Bumps the workspace video.js catalog from 7.21.7 to 8.23.9 and refreshes pnpm-lock.yaml, pulling in v8-aligned @videojs/http-streaming, mux.js, mpd-parser, and related packages (plus videojs-contrib-quality-levels). A changeset records patch releases for sanity-plugin-bynder-input and sanity-plugin-shopify-assets, which consume video.js via the catalog for in-studio previews.

There are no plugin source edits in this diff; regression risk is mainly playback/preview behavior under the major player upgrade and any v7 → v8 API mismatches (both plugins still use @types/video.js v7).

^{Reviewed by Cursor Bugbot for commit e62bd37. Bugbot is set up for automated code reviews on this repo. Configure here.}

changeset-bot · 2026-06-22T12:08:59Z

🦋 Changeset detected

Latest commit: e62bd37

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
sanity-plugin-bynder-input	Patch
sanity-plugin-shopify-assets	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

vercel · 2026-06-22T12:09:01Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
plugins-studio	Ready	Preview, Comment	Jul 14, 2026 6:37pm

socket-security · 2026-06-22T12:10:09Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `@videojs/http-streaming` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/video.js@8.23.9` → `npm/@videojs/http-streaming@3.17.5` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@videojs/http-streaming@3.17.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `@videojs/http-streaming` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/video.js@8.23.9` → `npm/@videojs/http-streaming@3.17.5` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@videojs/http-streaming@3.17.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `@videojs/vhs-utils` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/video.js@8.23.9` → `npm/@videojs/vhs-utils@4.1.2` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@videojs/vhs-utils@4.1.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `aes-decrypter` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/video.js@8.23.9` → `npm/aes-decrypter@4.0.2` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/aes-decrypter@4.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `mux.js` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/video.js@8.23.9` → `npm/mux.js@7.1.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/mux.js@7.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9822d6a. Configure here.}

socket-security · 2026-07-03T14:14:53Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/video.js@8.23.9

View full report

squiggler-app · 2026-07-14T18:53:06Z

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 8.x releases. But if you manually upgrade to 8.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

squiggler-app Bot requested a review from a team as a code owner June 22, 2026 12:08

squiggler-app Bot added ⚠️ major 📦 deps 🤖 bot labels Jun 22, 2026

squiggler-app Bot requested review from bjoerge and removed request for a team June 22, 2026 12:08

squiggler-app Bot enabled auto-merge (squash) June 22, 2026 12:08

vercel Bot deployed to Preview June 22, 2026 12:09 View deployment

squiggler-app Bot force-pushed the renovate/video.js-8.x branch from 41df899 to eeceb8b Compare June 22, 2026 12:39

vercel Bot deployed to Preview June 22, 2026 12:41 View deployment

squiggler-app Bot force-pushed the renovate/video.js-8.x branch from a41a740 to 386712f Compare June 22, 2026 13:06

vercel Bot deployed to Preview June 22, 2026 13:07 View deployment

squiggler-app Bot force-pushed the renovate/video.js-8.x branch from 29d6f45 to fca8d50 Compare June 22, 2026 15:48

vercel Bot deployed to Preview June 22, 2026 15:48 View deployment

bjoerge previously approved these changes Jun 22, 2026

View reviewed changes

squiggler-app Bot dismissed bjoerge’s stale review via b9d15d7 June 22, 2026 17:40

squiggler-app Bot force-pushed the renovate/video.js-8.x branch from 3d9527d to b9d15d7 Compare June 22, 2026 17:40

vercel Bot deployed to Preview June 22, 2026 17:41 View deployment

squiggler-app Bot force-pushed the renovate/video.js-8.x branch from c114399 to 31b4e18 Compare June 22, 2026 21:00

vercel Bot deployed to Preview June 22, 2026 21:01 View deployment

squiggler-app Bot force-pushed the renovate/video.js-8.x branch from 7bbf72e to 3aaaa7c Compare June 23, 2026 10:33

vercel Bot deployed to Preview June 23, 2026 10:34 View deployment

squiggler-app Bot force-pushed the renovate/video.js-8.x branch from 7d9eafb to bb71991 Compare June 23, 2026 13:02

vercel Bot deployed to Preview June 23, 2026 13:03 View deployment

squiggler-app Bot force-pushed the renovate/video.js-8.x branch from 29e65da to 9ee20f9 Compare June 23, 2026 15:26

vercel Bot deployed to Preview June 23, 2026 15:27 View deployment

squiggler-app Bot force-pushed the renovate/video.js-8.x branch from 40cdc01 to cf934e3 Compare June 23, 2026 16:58

squiggler-app Bot force-pushed the renovate/video.js-8.x branch from d87ad6e to 35ef1c9 Compare June 26, 2026 05:54

vercel Bot deployed to Preview June 26, 2026 05:55 View deployment

squiggler-app Bot force-pushed the renovate/video.js-8.x branch from 70f15e5 to cdd0776 Compare June 26, 2026 06:03

vercel Bot deployed to Preview June 26, 2026 06:04 View deployment

squiggler-app Bot force-pushed the renovate/video.js-8.x branch from 5b73ef8 to 2498f06 Compare June 26, 2026 08:01

vercel Bot deployed to Preview June 26, 2026 08:03 View deployment

squiggler-app Bot force-pushed the renovate/video.js-8.x branch from a7d9d56 to 544155a Compare June 26, 2026 09:17

vercel Bot deployed to Preview June 26, 2026 09:18 View deployment

squiggler-app Bot force-pushed the renovate/video.js-8.x branch from 58a28df to 6c6084f Compare June 26, 2026 11:10

vercel Bot deployed to Preview June 26, 2026 11:11 View deployment

squiggler-app Bot force-pushed the renovate/video.js-8.x branch from 05f77a1 to 8e29c2a Compare June 26, 2026 11:39

vercel Bot deployed to Preview June 26, 2026 11:40 View deployment

squiggler-app Bot force-pushed the renovate/video.js-8.x branch from f67baac to ae986fc Compare June 26, 2026 11:49

vercel Bot deployed to Preview June 26, 2026 11:51 View deployment

squiggler-app Bot force-pushed the renovate/video.js-8.x branch from cfa4bf6 to ec19e29 Compare June 26, 2026 12:28

vercel Bot deployed to Preview June 26, 2026 12:29 View deployment

squiggler-app Bot force-pushed the renovate/video.js-8.x branch from be056b2 to 6a144fd Compare June 26, 2026 12:55

vercel Bot deployed to Preview June 26, 2026 12:56 View deployment

squiggler-app Bot force-pushed the renovate/video.js-8.x branch from 87114e6 to 709471a Compare June 26, 2026 14:08

vercel Bot deployed to Preview June 26, 2026 14:09 View deployment

cursor Bot reviewed Jun 26, 2026

View reviewed changes

Comment thread pnpm-workspace.yaml

squiggler-app Bot force-pushed the renovate/video.js-8.x branch from 9822d6a to 844fd18 Compare June 26, 2026 16:52

vercel Bot deployed to Preview June 26, 2026 16:52 View deployment

squiggler-app Bot force-pushed the renovate/video.js-8.x branch from 3ab04bf to 311a0a4 Compare June 26, 2026 23:59

vercel Bot deployed to Preview June 27, 2026 00:00 View deployment

squiggler-app Bot force-pushed the renovate/video.js-8.x branch from ba2c53e to df0e160 Compare June 27, 2026 01:00

squiggler-app Bot added 2 commits July 14, 2026 18:36

fix(deps): update dependency video.js to v8

ee65270

chore(deps): changeset for dependency update

e62bd37

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(deps): update dependency video.js to v8#1388

fix(deps): update dependency video.js to v8#1388
squiggler-app[bot] wants to merge 2 commits into
mainfrom
renovate/video.js-8.x

squiggler-app Bot commented Jun 22, 2026 •

edited by cursor Bot

Loading

Uh oh!

changeset-bot Bot commented Jun 22, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Jun 22, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jun 22, 2026 •

edited

Loading

Uh oh!

cursor Bot left a comment

Uh oh!

Uh oh!

socket-security Bot commented Jul 3, 2026 •

edited

Loading

Uh oh!

squiggler-app Bot commented Jul 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

squiggler-app Bot commented Jun 22, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Bug Fixes

Chores

Chores

Bug Fixes

Chores

Documentation

Bug Fixes

Bug Fixes

Documentation

Bug Fixes

Chores

Documentation

Bug Fixes

Bug Fixes

Bug Fixes

Features

Bug Fixes

Code Refactoring

Features

Bug Fixes

Chores

8.21.1 (2024-12-05)

Chores

Features

Bug Fixes

Chores

8.21.1 (2024-12-05)

Chores

Features

Bug Fixes

Chores

8.21.1 (2024-12-05)

Chores

Chores

8.19.2 (2024-11-14)

Bug Fixes

8.19.1 (2024-10-10)

Chores

Chores

8.19.2 (2024-11-14)

Bug Fixes

8.19.1 (2024-10-10)

Chores

Chores

8.19.2 (2024-11-14)

Bug Fixes

8.19.1 (2024-10-10)

Chores

Chores

8.19.2 (2024-11-14)

Bug Fixes

8.19.1 (2024-10-10)

Chores

Features

Bug Fixes

Chores

8.18.1 (2024-09-17)

Chores

Features

Bug Fixes

Chores

8.18.1 (2024-09-17)

Chores

Features

Bug Fixes

Chores

8.17.4 (2024-08-27)

Bug Fixes

Chores

Code Refactoring

Documentation

8.17.3 (2024-07-30)

Bug Fixes

8.17.2 (2024-07-22)

Chores

squiggler-app Bot commented Jun 22, 2026 •

edited by cursor Bot

Loading