[javierarams]

Description

mux.js still uses Node 10 and a v1 lockfile, so a new release needs a toolchain update first. The steps are the same as in videojs/video.js#9231 and videojs/video.js#9232:

1. Update Node.
2. Regenerate the lockfile.
3. Run the audit pass.

Before, using

• node: v10.24.1
• npm: 6.14.12

npm audit showed:

found 301 vulnerabilities (25 low, 74 moderate, 179 high, 23 critical) in 1160 scanned packages

npm 11 counts vulnerabilities per package, not per path. With npm 11, the same lockfile shows 85 vulnerabilities (9 low, 16 moderate, 46 high, 14 critical).

Now, using

• node: v24.21.0
• npm: 11.19.0

npm audit shows 16 vulnerabilities (7 moderate, 9 high). Two advisories cause all of them, and neither advisory has a patched release. Both affect only dev dependencies.

The runtime dependency ranges do not change. The runtime advisories in @babel/runtime and min-document have fixes inside the current ranges.

Replaces #451 with the same rollup update. Please merge #453 before this PR or together with it. Without #453, the CI job waits for BrowserStack until it times out.

Specific Changes proposed

Each commit passes the build, karma, the node tests and prepublishOnly by itself.

• Updated Node to 24 in .nvmrc, CI and engines. The engines value is the same as in video.js.
  • npm 11 regenerated the lockfile as v3 and kept the resolved versions.
  • Added CHANGELOG.md to files in package.json. npm 7 and later do not add it to the package automatically, but the releases made with npm 6 included it.
• Updated the workflow actions in the CI and release workflows to versions with Node 24 runtimes. GitHub deprecated the node16 and node20 action runtimes.
  • Removed xvfb, because headless browsers do not need it.
• Kept global/window external in the browser bundles.
  • videojs-generate-rollup-config 6.2.2 and later inline global/window in dist/mux.js and dist/mux-mp4.js. This changes the UMD wrapper.
  • With rollup 2.63 and later, it also makes npm run build-prod fail with an "Unexpected early exit" error. The prepublishOnly script runs build-prod.
• Ran npm audit fix. Result: 44 vulnerabilities (6 low, 10 moderate, 20 high, 8 critical)
  • The fixed terser version minifies some expressions in a different way, so the .min.js files change.
• Updated karma to 6 and videojs-generate-karma-config to 8.1. Karma 5 depends on vulnerable socket.io, engine.io and ua-parser-js versions.
  • videojs-generate-karma-config 8.1 renames the BrowserStack Safari launchers, so scripts/karma.conf.js removes the new names.
• Updated rollup to ^2.80.0 and videojs-generate-rollup-config to 7.0.2. Added an override for serialize-javascript.
  • rollup 2.79.2 and earlier have a DOM clobbering vulnerability.
  • videojs-generate-rollup-config 7 uses rollup-plugin-istanbul 3, which removes the vulnerable babel-traverse.
  • rollup-plugin-terser requires serialize-javascript 4.x, which has a known vulnerability. The override forces a fixed version.
  • videojs-generate-rollup-config 7 uses @rollup/plugin-commonjs 21. Two test files change for it. The metadata stream test reads the default export of its worker, and the test worker is now an ES module.
• Updated @videojs/generator-helpers to 3.2. Version 2 brings doctoc 1, which depends on vulnerable underscore and trim versions.
  • After this change, npm audit shows 0 critical vulnerabilities.
  • Version 3 removes conventional-changelog-cli and not-prerelease. The version and update-changelog scripts now use vjs-update-changelog, like the release workflow.
  • For version 7.1.1, the generated changelog is byte identical to the output of the old command. Prereleases still skip the changelog.
  • Removed the husky block from package.json. Its pre-commit hook did nothing, and husky 7 ignores that block.
• Added an override for uuid. conventional-changelog-cli 2 uses tempfile 3, which depends on a vulnerable uuid version.
  • tempfile only calls uuid.v4(), and uuid 11 keeps that function.
• Updated videojs-standard to 9. Version 8 depends on vulnerable tmp, trim and flatted versions.
  • npm run lint does not run vjsstandard in this repo, so the lint result does not change.

Built files:

• cjs/ and es/ have the same syntax tree as the build from main. Only the format changed.
• The dist/ files are different. The fixed terser version minifies some expressions in a different way. @rollup/plugin-commonjs 21 changes the module wrappers. The bundles are 1 to 3 percent larger.
• The UMD wrapper is the same as in 7.1.0. It still loads global/window as a dependency.
• The transmuxer output does not change. A test script transmuxes all test segments with each dist/ file and with cjs/, and compares the results with the build from main. The script also runs the caption parser, the WebVTT parser, the probe functions and the inspectors.
• In Chrome, each dist/ file loaded with a <script> tag gives the same results as the build from main.
• debug/index.html plays test-segment.ts with MSE and shows the same MP4 structure as main.
• bin/transmux.js gives byte identical output for three test segments.
• npm pack --dry-run gives the same file list as the published mux.js 7.1.0 package.

Follow-up items:

• braces GHSA-vfj7-8cjw-p6xm (high) has no fixed version. It comes from karma, lint-staged and @babel/cli.
• sprintf-js GHSA-hp3w-g68c-fv3c (moderate) has no fixed version. It comes from eslint 7 in videojs-standard.
• A full sprintf-js fix needs a videojs-standard release with a newer eslint.
• Lint is off in this repo, because the lint script is ": vjsstandard". vjsstandard 9 reports about 10000 problems.
• GitHub has no stored CI runs for main. CI on recent PRs fails or waits for BrowserStack until it times out. chore(ci): run karma on local headless browsers instead of BrowserStack #453 fixes this.

Requirements Checklist

• Feature implemented / Bug fixed
• If necessary, more likely in a feature request than a bug fix
  • Change has been verified in an actual browser (Chrome, Firefox, IE)
  • Unit Tests updated or fixed
  • Docs/guides updated
  • Example created (starter template on JSBin)
• Reviewed by Two Core Contributors