[javierarams]

Description

http-streaming already uses Node 22 and a v3 lockfile, but npm audit shows many vulnerabilities in the dev toolchain. This change does the same steps as videojs/video.js#9231 and videojs/video.js#9232:

1. Update Node.
2. Update the CI workflow actions.
3. Run the audit pass.

Before, using

• node: v22.23.3
• npm: 10.9.9

npm audit showed:

60 vulnerabilities (7 low, 16 moderate, 32 high, 5 critical)

Now, using

• node: v24.21.0
• npm: 11.19.0

npm audit shows 18 vulnerabilities (7 moderate, 11 high). Two advisories cause all of them, and neither advisory has a patched release. Both affect only dev dependencies.

The runtime dependency ranges do not change. The runtime advisories in @xmldom/xmldom, @babel/runtime and min-document have fixes inside the current ranges.

Specific Changes proposed

Each commit passes lint, the build and the karma unit tests in Chrome headless. The last commit also passes the playback, playback-min and coverage tests.

• Changed the request hook tests to use the page origin instead of localhost:9999.
  • When a different process uses port 9999, karma starts on a different port, and 8 tests fail.
• Added CHANGELOG.md to files in package.json.
  • npm 7 and later do not add it to the package automatically. The packages for 3.17.3 and earlier included it, but 3.17.4 and 3.17.5 do not.
• Updated Node to 24 in .nvmrc and engines. CI reads the Node version from .nvmrc.
  • The engines value is the same as in video.js and mpd-parser.
  • The lockfile stays v3, and npm 11 keeps the resolved versions.
• Updated the workflow actions to versions with Node 24 runtimes. GitHub deprecated the node16 and node20 action runtimes.
  • coactions/setup-xvfb has only a node16 runtime. The ci job now calls xvfb-run directly, because the karma config starts browsers that need a display. The runner image includes xvfb.
• Ran npm audit fix. Result: 29 vulnerabilities (11 moderate, 18 high)
  • All versions stay inside the declared ranges. This removes all critical and low findings.
• Updated rollup to ^2.80.0 and added an override for serialize-javascript.
  • rollup versions before 2.80.0 have known vulnerabilities.
  • rollup-plugin-terser requires serialize-javascript 4.x, which has a known vulnerability. The override forces a fixed version. The plugin only calls serialize(options), and 7.x keeps that function.
• Excluded docs/api/ from the npm package.
  • docs:api writes the generated pages to docs/api, and files includes docs/. Without the exclusion, a publish after npm run docs includes those pages.
• Fixed the docs:api script. jsdoc has no -g option, so the script failed and made no files.
  • The markdown plugin now loads from .jsdoc.json.
• Updated jsdoc to 4. jsdoc 3 depends on vulnerable taffydb and markdown-it versions, and taffydb has no fixed version.
  • jsdoc 4 makes the same 52 pages.
• Added an override for axios in water-plant-uml. water-plant-uml 2.0.2 is the latest release, and it requires axios 0.21.x, which has known vulnerabilities.
  • The override applies only to water-plant-uml.
  • With axios 0.34, the exported diagrams are byte identical.
• Added an override for uuid. conventional-changelog-cli 2 uses tempfile 3, which depends on a vulnerable uuid version.
  • tempfile only calls uuid.v4(), and uuid 11 keeps that function.
  • The changelog output does not change.
• Removed the old-index files from the netlify deploy script. chore: remove old-index since IE is no longer supported #1308 removed these files, so shelljs showed an error for each missing file.

Built files:

• The built files of the first 4 commits are byte identical to the build from main. The worker comments contain the absolute build path, so the comparison removes that path first.
• npm audit fix changes the built files. Only the commit that runs it changes them.
  • videojs-http-streaming.cjs.js has only format differences. Its AST is identical.
  • The other files have format differences from newer Babel and rollup versions, also inside the inlined worker source strings. In the es bundle, rollup puts one import list in a different order.
  • The UMD, sync-workers and min bundles inline the _extends helper from @babel/runtime 7.29, which fixes the runtime advisory. The helper behavior does not change.
• xmldom is still external in the bundles.

Package checks:

• npm pack --dry-run gives the same file list as main, plus CHANGELOG.md.
• npm run prepublishOnly passes.
• The pre-commit hook still works. @videojs/generator-helpers 3.1 uses husky 4, which reads the husky.hooks block in package.json.

Follow-up items

• braces GHSA-vfj7-8cjw-p6xm (high) has no fixed version. It comes from karma, @babel/cli, lint-staged and water-plant-uml.
• sprintf-js GHSA-hp3w-g68c-fv3c (moderate) has no fixed version. It comes from eslint 7 in videojs-standard.
• A full sprintf-js fix needs a videojs-standard release with a newer eslint.
• CI on main fails since 3.17.5, because the BrowserStack sessions do not start. chore(ci): run karma on local headless browsers instead of BrowserStack #1612 fixes this. This change does not touch the BrowserStack settings, so the two PRs merge in any order.
• The npm release step of the release workflow failed for 3.17.3, 3.17.4 and 3.17.5. The logs are no longer available. Before the next release, a maintainer must examine the npm publish setup.
• The global onResponse hook tests in test/videojs-http-streaming.test.js fail sometimes. They also fail on main. In 2 of 27 karma unit runs, 3 of these tests failed, and the next run passed. In the failed runs, the hooks also got the main.m3u8 response, so a global hook set was already in place before the test started.
• @videojs/generator-helpers 3.2 moves to husky 7. That update needs .husky/pre-commit, a prepare script and videojs-generator-verify 4, as in mpd-parser. No audit finding needs it, so this change keeps 3.1.

Requirements Checklist

• Feature implemented / Bug fixed
• If necessary, more likely in a feature request than a bug fix
  • Change has been verified in an actual browser (Chrome, Firefox, IE)
  • Unit Tests updated or fixed
  • Docs/guides updated
  • Example created (starter template on JSBin)
• Reviewed by Two Core Contributors

[welcome]

💖 Thanks for opening this pull request! 💖

Things that will help get your PR across the finish line:

• Run npm run lint -- --errors locally to catch formatting errors earlier.
• Include tests when adding/changing behavior.
• Include screenshots and animated GIFs whenever possible.

We get a lot of pull requests on this repo, so please be patient and we will get back to you as soon as we can.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.00%. Comparing base (a9f9d7a) to head (7bfda22).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1617   +/-   ##
=======================================
  Coverage   84.00%   84.00%           
=======================================
  Files          44       44           
  Lines       11713    11713           
  Branches     2625     2625           
=======================================
  Hits         9840     9840           
  Misses       1873     1873           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.