[javierarams]

Description

vhs-utils still uses Node 10 and a v1 lockfile, so a new release needs a toolchain update first. The steps are the same as in videojs/video.js#9231 and videojs/video.js#9232:

1. Update Node.
2. Regenerate the lockfile.
3. Run the audit pass.

Before, using

• node: v10.24.1
• npm: 6.14.12

npm audit showed:

found 355 vulnerabilities (25 low, 118 moderate, 184 high, 28 critical) in 1107 scanned packages

npm 11 counts vulnerabilities per package, not per path. With npm 11, the same lockfile shows 88 vulnerabilities (8 low, 18 moderate, 51 high, 11 critical).

Now, using

• node: v24.21.0
• npm: 11.19.0

npm audit shows 19 vulnerabilities (7 moderate, 12 high). Two advisories cause all of them, and neither advisory has a patched release. Both affect only dev dependencies.

The runtime dependency ranges do not change. The runtime advisories in @babel/runtime and min-document have fixes inside the current ranges. npm audit --omit=dev now shows 0 vulnerabilities.

Replaces #47 with the same rollup update.

Specific Changes proposed

Each commit passes lint, the build, karma, the node tests and prepublishOnly by itself.

• Updated Node to 24 in .nvmrc, CI and engines. The engines value is the same as in video.js.
  • npm 11 regenerated the lockfile as v3 and kept the resolved versions.
• Added CHANGELOG.md to files in package.json. npm 7 and later do not add it to the package automatically.
  • The releases made with npm 6 included it. Release 4.1.2 was made with npm 10 and does not include it.
• Updated the workflow actions to versions with Node 24 runtimes. GitHub deprecated the node12 and node20 action runtimes.
  • Removed xvfb, because headless browsers do not need it.
• Ran npm audit fix. Result: 40 vulnerabilities (6 low, 10 moderate, 21 high, 3 critical)
• Updated karma to 6. Karma 5 depends on vulnerable socket.io, engine.io and ua-parser-js versions.
• Updated rollup to ^2.80.0 and added an override for serialize-javascript.
  • rollup-plugin-terser requires serialize-javascript 4.x, which has a known vulnerability. The override forces a fixed version.
• Updated @videojs/generator-helpers to 3.2. Version 2 brings doctoc 1, which depends on vulnerable underscore and trim versions.
  • Husky 7 ignores the hooks in package.json. The pre-commit hook moved to .husky/pre-commit, and the prepare script installs it.
  • Version 3 removes conventional-changelog-cli and not-prerelease. The version and update-changelog scripts now use vjs-update-changelog.
  • For version 4.1.3, the generated changelog has 0 differences from the old command. Prereleases still skip the changelog.
  • vjsverify 3 cannot parse the npm pack --json output when prepare writes to stdout. videojs-generator-verify 4 keeps prepublishOnly working.
• Added an override for uuid. conventional-changelog-cli 2 uses tempfile 3, which depends on a vulnerable uuid version.
  • tempfile only calls uuid.v4(), and uuid 11 keeps that function.
• Updated videojs-standard to 9.1, the version that video.js and mpd-parser use. Version 8 uses eslint 5, which depends on vulnerable flatted, tmp and trim versions.
  • The eslint 7 rules reject one trailing comma in a test. This PR removes it.
• Changed CI to run karma on the local headless browsers of the runner, not on BrowserStack. chore(ci): run karma on local headless browsers instead of BrowserStack http-streaming#1612 and chore(ci): run karma on local headless browsers instead of BrowserStack mux.js#453 have the same change.
  • The ci jobs of this PR stopped after the BrowserStack tunnel download. GitHub cancelled them after 6 hours.
  • Removed the BROWSER_STACK_* variables from the ci job. Without them, karma finds and uses the local browsers.
  • The browsers filter in scripts/karma.conf.js removes the local Safari and Chromium launchers. Safari cannot start headless, and Chromium gives the same coverage as Chrome.
  • The BrowserStack launchers do not change. When the secrets work again, add the two variables back to use BrowserStack again.

Built files:

• dist/vhs-utils.min.js is byte identical to the build from main and to the published 4.1.2 file.
• dist/vhs-utils.js and all files in es/ have only format differences from newer Babel and rollup versions. Their ASTs are identical.
• @babel/core 7.29 changes the generated code in cjs/. Exports now get their value at the declaration, and cjs/index.js inlines one Babel helper.
• The full test suite passes against the old cjs/ and against the new cjs/. The exports of each cjs/ file are identical.
• bin/parse-format.js gives the same output for all 756 test fixtures.
• npm pack --dry-run gives the same file list as the published 4.1.1 package.

Follow-up items:

• braces GHSA-vfj7-8cjw-p6xm (high) has no fixed version. It comes from karma, lint-staged, @babel/cli and es-check.
• sprintf-js GHSA-hp3w-g68c-fv3c (moderate) has no fixed version. It comes from eslint 7 in videojs-standard.
• A full sprintf-js fix needs a videojs-standard release with a newer eslint.
• CI does not test Safari now. The BrowserStack set had Safari 15 (Monterey) and Safari 17 (Sonoma). To test Safari again, make the BrowserStack secrets work and add the two variables back.

Requirements Checklist

• Feature implemented / Bug fixed
• If necessary, more likely in a feature request than a bug fix
  • Change has been verified in an actual browser (Chrome, Firefox, IE)
  • Unit Tests updated or fixed
  • Docs/guides updated
  • Example created (starter template on JSBin)
• Reviewed by Two Core Contributors

[spuppo-mux]

Diff looks good, lets try to fix CI before approving though

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.80%. Comparing base (4833fd2) to head (7f33884).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #48   +/-   ##
=======================================
  Coverage   87.80%   87.80%           
=======================================
  Files          18       18           
  Lines        1279     1279           
  Branches      338      338           
=======================================
  Hits         1123     1123           
  Misses        156      156           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[spuppo-mux]

LGTM!