@silvermine/videojs-chromecast - npm Package Compare versions

Comparing version 1.0.0 to 1.0.1

package.json

 {
   "name": "@silvermine/videojs-chromecast",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "video.js plugin for casting to chromecast",
@@ -5,0 +5,0 @@ "main": "src/js/index.js",

README.md

@@ -57,12 +57,24 @@ # Silvermine VideoJS Chromecast Plugin
 * **`preloadWebComponents`** (default: `false`) - The Chromecast framework relies on the
-  `webcomponents.js` polyfill when a browser does not have `document.registerElement`.
-  If you are using jQuery, this polyfill must be loaded and initialized before jQuery is
-  initialized. Unfortunately, the Chromecast framework loads the `webcomponents.js`
-  polyfill via a dynamically created `<script>` tag. This causes a race condition (see
-  #17). Setting `preloadWebComponents` to `true` will make this plugin add the
-  `webcomponents.js` polyfill synchronously when the polyfill is needed. If you use the
-  `preloadWebComponents: true` option, you should make sure that this plugin is loaded
-  before jQuery. Then include the Chromecast framework after this plugin as you normally
-  would.
+  `webcomponents.js` polyfill when a browser does not have `document.registerElement` in
+  order to create the `<google-cast-button>` custom component (which is not used by this
+  plugin).  If you are using jQuery, this polyfill must be loaded and initialized before
+  jQuery is initialized. Unfortunately, the Chromecast framework loads the
+  `webcomponents.js` polyfill via a dynamically created `<script>` tag. This causes a race
+  condition (see #17). Also, including `webcomponents.js` anywhere on the page will break
+  jQuery's fix for bubbling some events to `document` (e.g. `onchange` events for
+  `<select>`, see #21).  Setting `preloadWebComponents` to `true` will "fix" these 2
+  problems by (1) making this plugin add the `webcomponents` polyfill synchronously when
+  the polyfill is needed and (2) using the `webcomponents-lite.js` version as it does not
+  include the shadow DOM polyfills, but still provides the `registerElement` polyfill that
+  the Chromecast framework needs. If you use the `preloadWebComponents: true` option, you
+  should make sure that this plugin is loaded before jQuery. Then include the Chromecast
+  framework after this plugin as you normally would.
 
+  **Note:** There is a caveat to using the `preloadWebComponents` setting.
+  Because the Chromecast plugin uses the shadow DOM to create the
+  `<google-cast-button>` custom component, **the `<google-cast-button>` custom
+  component may partly render, but it will not be functional**. This tag is not
+  used by this plugin. However if you must use this tag elsewhere, you should
+  not use the `preloadWebComponents` flag.
+
   tl;dr: if you use jQuery, you should use the `preloadWebComponents: true` option in
@@ -69,0 +81,0 @@ this plugin.

src/js/preloadWebComponents.js

@@ -11,2 +11,3 @@ 'use strict';
 // https://github.com/silvermine/videojs-chromecast/issues/17
+// https://github.com/silvermine/videojs-chromecast/issues/22
 
@@ -27,4 +28,10 @@ module.exports = function() {
       // by the Chromecast framework at the time this was added.
-      require('webcomponents.js'); // eslint-disable-line global-require
+      // We are using webcomponents-lite.js because it doesn't interfere with jQuery as
+      // badly (e.g. it doesn't interfere with jQuery's fix for consistently bubbling
+      // events, see #21). While the "lite" version does not include the shadow DOM
+      // polyfills that the Chromecast framework may need for the <google-cast-button>
+      // component to work properly, this plugin does not use the <google-cast-button>
+      // component.
+      require('webcomponents.js/webcomponents-lite.js'); // eslint-disable-line global-require
    }
 };

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Improved metrics

Number of package files

36

increased by2.86%

Number of lines in readme file

306

increased by4.08%

Number of medium supply chain risk alerts

5

decreased by-58.33%

Worsened metrics

Total package byte prevSize

475061

decreased by-47.16%

Lines of code

10739

decreased by-46.62%

No dependency changes