[Snyk] Security upgrade react-player from 2.11.0 to 3.3.1

[snyk-io]

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json
• package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Prototype Pollution SNYK-JS-DEEPMERGE-19964053	721

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution

[snyk-io]

The upgrade from react-player v2 to v3 is a major version with significant breaking changes, as it is a complete rewrite of the library and is not backwards compatible.

Key Breaking Changes in v3.0.0:

• Complete Rewrite: The library has been rewritten from the ground up using TypeScript and React function components, which may require significant refactoring of how the component is used.
• Build System Changes: Support for CJS (require()) and IIFE (<script> tag) bundles has been removed. You must use ES Modules (import) to use the library.
• Removed Media Providers: Several media providers are no longer included in the base package: Dailymotion, Facebook, Kaltura, MixCloud, SoundCloud, Streamable, Twitch, and Vidyard.
• React Suspense: Suspense is now enabled by default.

Source: GitHub Releases

Recommendation: This upgrade will require code modifications. Developers must review the official migration guide, update their import statements, ensure they are not using a removed media provider, and test thoroughly to adapt to the new component architecture.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[Copilot]

Copilot review overview

🟡 Changes recommended

Critical compatibility issues and stale license metadata remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 2 · 1

Open (3)

• Upgrade React type packages to satisfy react-player peer requirements · New
• Update media templates from react-player url prop to src · New
• Regenerate production license inventory for upgraded dependencies · New

What changed in this PR

Upgrades react-player from 2.11.0 to 3.3.1 to remediate a prototype-pollution vulnerability.

Changes:

• Updates the direct react-player dependency.
• Refreshes the lockfile dependency tree and removes deepmerge.

File	Summary
package.json	Dependency upgrade. Unresolved critical findings: update media call sites from url to src (3 votes) and align React type packages (1 vote). Nit: regenerate OSS_LICENSES.txt (2 votes).
package-lock.json	Locks the new dependency tree. Moderate finding: the React type peer dependency is incompatible with the current lockfile (2 votes).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.