[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
xgplayer-flv	3.0.26 → 3.0.27

---

Release Notes

bytedance/xgplayer (xgplayer-flv)

v3.0.27

Compare Source

Features

• mp3: Add standalone MP3 MSE playback with Range seek and native fallback. (65f8649)
• mp4: xgplayer-mp4 can now play on MSE/ManagedMediaSource (iOS 17.1+) via preferMMS, instead of always degrading to native video. (322888e), closes #​1932
• range请求，增加 数据范围是否匹配检测 (03a109c)
• support dynamic-timeout timeoutRatio, xhr fix endless request because of unpected net response (2c89a2c)
• 优化range请求时，返回200状态码问题 (e43c93b)

Bug Fixes

• dash: parse MPD durations with any combination of H, M and S (f9c8ad2)
• hls: preserve playlist path for query-only URIs (5af9e7d)
• hls: Prevent fixture values from being interpreted as HTML. (202d5f6)
• monorepo: Harden cast lifecycle handling and TypeScript buffer compatibility. (2f135fc)
• monorepo: Include package changelogs in npm distributions. (87cf0de)
• monorepo: Keep package changelogs and published archives consistent across tag-driven releases. (6af6c83)
• monorepo: Reject outdated release tags before generating package metadata. (f3d83ce)
• mp4: Fix fragmented MP4 playback, source switching, buffer eviction, and stall recovery in xgplayer-mp4. (3c417a5), closes #​1875 #​1911 #​1932 #​1935
• transmuxer: accept minimum 4-byte UTF-8 sequence U+10000 (ea781cd)
• transmuxer: Avoid emitting zero-duration video samples for PES data without timestamps. (65b6a0e)
• transmuxer: Fix HEVC decode failures across implicit stream discontinuities. (d72119a)
• transmuxer: Keep video samples after timestamp recovery. (4aabb65)
• xgplayer-mp3: Add MP3 range-loading playback support with safer teardown and native fallback behavior. (613c02b)
• xgplayer-mp3: Fix MP3 completion, backward seeking, source preprocessing, native fallback state, and VBR seek metadata. (fe8049c)
• xgplayer-mp3: Fix MP3 range loading, seeking, duration correction, and playNext lifecycle edge cases. (df01285)
• xgplayer-mp3: Improve xgplayer-mp3 diagnostics, cross-origin loading fallback, and fixture usability. (8132182)
• xgplayer-streaming-shared: Expose ManagedMediaSource buffer eviction changes for playback recovery plugins. (6ef9a38)
• xgplayer-transmuxer: Drop malformed AAC ADTS frames with no payload and avoid using malformed leading audio samples as gap-fill fallback. (9bd0e3f)
• xgplayer-transmuxer: Fix Exp-Golomb reads at buffer boundaries. (ba30105)
• xgplayer-transmuxer: Improve transmuxer TypeScript declaration coverage for codec and package entry exports. (4a1ae54)
• xgplayer: clear playback cache during state reset (921c238)
• xgplayer: correct plugin hook handler invocation (78af75a), closes #​1934
• xgplayer: fix deepcopy deepMerge 潜在的原型链污染问题 (82d3e29)
• xgplayer: Fixed blurry or missing progress-preview borders at fractional display scales. (5300ca3)
• xgplayer: guard missing screen orientation (52eaa3f)

---

Configuration

📅 Schedule: (in timezone Asia/Singapore)

• Branch creation
  • "before 12pm on friday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: d3c9bd80-af40-4557-a1f6-b2d5f089b625

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/xgplayer-flv	3.0.27	🟢 5.8	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Code-Review 🟢 8 Found 9/11 approved changesets -- score normalized to 8 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Security-Policy ⚠️ 0 security policy file not detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST 🟢 8 SAST tool is not run on all commits -- score normalized to 8
npm/xgplayer-streaming-shared	3.0.27	🟢 5.8	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Code-Review 🟢 8 Found 9/11 approved changesets -- score normalized to 8 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Security-Policy ⚠️ 0 security policy file not detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST 🟢 8 SAST tool is not run on all commits -- score normalized to 8
npm/xgplayer-transmuxer	3.0.27	🟢 5.8	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Code-Review 🟢 8 Found 9/11 approved changesets -- score normalized to 8 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Security-Policy ⚠️ 0 security policy file not detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST 🟢 8 SAST tool is not run on all commits -- score normalized to 8

Scanned Files

• pnpm-lock.yaml