[javierarams]

Description

vhs-utils still uses Node 10 and a v1 lockfile, so a new release needs a toolchain update first. The steps are the same as in videojs/video.js#9231 and videojs/video.js#9232:

1. Update Node.
2. Regenerate the lockfile.
3. Run the audit pass.

Before, using

• node: v10.24.1
• npm: 6.14.12

npm audit showed:

found 355 vulnerabilities (25 low, 118 moderate, 184 high, 28 critical) in 1107 scanned packages

npm 11 counts vulnerabilities per package, not per path. With npm 11, the same lockfile shows 88 vulnerabilities (8 low, 18 moderate, 51 high, 11 critical).

Now, using

• node: v24.21.0
• npm: 11.19.0

npm audit shows 19 vulnerabilities (7 moderate, 12 high). Two advisories cause all of them, and neither advisory has a patched release. Both affect only dev dependencies.

The runtime dependency ranges do not change. The runtime advisories in @babel/runtime and min-document have fixes inside the current ranges. npm audit --omit=dev now shows 0 vulnerabilities.

Replaces #47 with the same rollup update.

Specific Changes proposed

Each commit passes lint, the build, karma, the node tests and prepublishOnly by itself.

• Updated Node to 24 in .nvmrc, CI and engines. The engines value is the same as in video.js.
  • npm 11 regenerated the lockfile as v3 and kept the resolved versions.
• Added CHANGELOG.md to files in package.json. npm 7 and later do not add it to the package automatically.
  • The releases made with npm 6 included it. Release 4.1.2 was made with npm 10 and does not include it.
• Updated the workflow actions to versions with Node 24 runtimes. GitHub deprecated the node12 and node20 action runtimes.
  • Removed xvfb, because headless browsers do not need it.
• Ran npm audit fix. Result: 40 vulnerabilities (6 low, 10 moderate, 21 high, 3 critical)
• Updated karma to 6. Karma 5 depends on vulnerable socket.io, engine.io and ua-parser-js versions.
• Updated rollup to ^2.80.0 and added an override for serialize-javascript.
  • rollup-plugin-terser requires serialize-javascript 4.x, which has a known vulnerability. The override forces a fixed version.
• Updated @videojs/generator-helpers to 3.2. Version 2 brings doctoc 1, which depends on vulnerable underscore and trim versions.
  • Husky 7 ignores the hooks in package.json. The pre-commit hook moved to .husky/pre-commit, and the prepare script installs it.
  • Version 3 removes conventional-changelog-cli and not-prerelease. The version and update-changelog scripts now use vjs-update-changelog.
  • For version 4.1.3, the generated changelog has 0 differences from the old command. Prereleases still skip the changelog.
  • vjsverify 3 cannot parse the npm pack --json output when prepare writes to stdout. videojs-generator-verify 4 keeps prepublishOnly working.
• Added an override for uuid. conventional-changelog-cli 2 uses tempfile 3, which depends on a vulnerable uuid version.
  • tempfile only calls uuid.v4(), and uuid 11 keeps that function.
• Updated videojs-standard to 9.1, the version that video.js and mpd-parser use. Version 8 uses eslint 5, which depends on vulnerable flatted, tmp and trim versions.
  • The eslint 7 rules reject one trailing comma in a test. This PR removes it.

Built files:

• dist/vhs-utils.min.js is byte identical to the build from main and to the published 4.1.2 file.
• dist/vhs-utils.js and all files in es/ have only format differences from newer Babel and rollup versions. Their ASTs are identical.
• @babel/core 7.29 changes the generated code in cjs/. Exports now get their value at the declaration, and cjs/index.js inlines one Babel helper.
• The full test suite passes against the old cjs/ and against the new cjs/. The exports of each cjs/ file are identical.
• bin/parse-format.js gives the same output for all 756 test fixtures.
• npm pack --dry-run gives the same file list as the published 4.1.1 package.

Follow-up items:

• braces GHSA-vfj7-8cjw-p6xm (high) has no fixed version. It comes from karma, lint-staged, @babel/cli and es-check.
• sprintf-js GHSA-hp3w-g68c-fv3c (moderate) has no fixed version. It comes from eslint 7 in videojs-standard.
• A full sprintf-js fix needs a videojs-standard release with a newer eslint.
• CI on main failed on the 4.1.2 push. The old CI logs are no longer available.
• Pull requests from forks pass, and they do not get the BrowserStack secrets. If CI on main still fails, try the change from chore(ci): run karma on local headless browsers instead of BrowserStack http-streaming#1612. It removes BrowserStack from the ci job.

Requirements Checklist

• Feature implemented / Bug fixed
• If necessary, more likely in a feature request than a bug fix
  • Change has been verified in an actual browser (Chrome, Firefox, IE)
  • Unit Tests updated or fixed
  • Docs/guides updated
  • Example created (starter template on JSBin)
• Reviewed by Two Core Contributors