Skip to content

Moshpit sites: video files play in @profullstack/player - #594

Merged
sh1pt-actions-fleet[bot] merged 2 commits into
mainfrom
feat/house-player-sites
Nov 2, 2026
Merged

sh1pt-actions-fleet[bot] merged 2 commits into
mainfrom
feat/house-player-sites

Conversation

@sh1pt-actions-fleet

Copy link
Copy Markdown
Contributor

On a name's published site (apps/pwa/src/lib/moshpit-site-page.mjs), a video post that is a direct media file now upgrades to @profullstack/player 0.17.0 (one control bar with auto-hide, fullscreen including iPhone).

  • apps/pwa/src/lib/player-bundle.mjs: Bun.build of the player into one same-origin ES module at /pf-player.js, plus /pf-player.css (the pit.world pattern; the player's dist imports hls.js/mpegts.js by bare name, so it cannot be served from node_modules as the other vendor files are).
  • apps/pwa/public/pf-player-init.js: hands the existing <video> to createPlayer via media; native controls stay as the fallback.
  • YouTube / Vimeo / PeerTube iframes are unchanged, as is the link-card fallback.
  • Checked locally under Bun: /pf-player.js 200 (contains pux-player), /pf-player.css 200. node --test 818/818.

🤖 Generated with Claude Code

A video post that is a direct media file now upgrades to the house player
(one control bar with auto-hide, fullscreen including iPhone) on a name's
published site. The player is bundled by the server on first request into
/pf-player.js + /pf-player.css (same origin, the pit.world pattern; the
dist's bare hls.js/mpegts.js imports rule out serving it from
node_modules). The <video controls> stays as the fallback. YouTube, Vimeo
and PeerTube iframes are unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@socket-security

socket-security Bot commented Nov 2, 2026 •

Copy link
Copy Markdown
Contributor

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Added@​profullstack/​player@​0.17.07810010096100

View full report

@github-actions

github-actions Bot commented Nov 2, 2026

Copy link
Copy Markdown

ThreatCrush Security Scan

0 finding(s) in the 9 file(s) this pull request changes.

Nothing in the files this pull request changes.

114 pre-existing finding(s) elsewhere in the repository — **HIGH/CRITICAL**: 8 | **MEDIUM**: 87 | **LOW**: 19

Not introduced by this pull request. The full set is in the Security tab.

Severity Rule Location
HIGH js-ssrf-outbound-request apps/pwa/public/sw.js:76
HIGH tls-verification-disabled apps/pwa/src/lib/moshpit-gateway.mjs:299
HIGH sh-remote-script-execution install.sh:87
HIGH sh-remote-script-execution install.sh:91
HIGH sh-remote-script-execution install.sh:259
HIGH sh-remote-script-execution install.sh:270
HIGH sh-remote-script-execution install.sh:276
HIGH tls-verification-disabled src/dns.mjs:823
MEDIUM js-unescaped-html-sink apps/pwa/public/herd/herd.js:117
MEDIUM sql-template-interpolation apps/pwa/src/lib/moshpit-certs.mjs:44
MEDIUM sql-template-interpolation apps/pwa/src/lib/moshpit-certs.mjs:82
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:139
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:153
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:179
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:373
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:377
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:422
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:674
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:870
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:872

…and 94 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

Regenerating pnpm-lock.yaml for the player also moved the 'latest'
footer to 0.6.19, which fails ring-footer.test.mjs; footers are not part
of this change.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@sh1pt-actions-fleet
sh1pt-actions-fleet Bot merged commit ab2185b into main Nov 2, 2026
7 checks passed
@sh1pt-actions-fleet
sh1pt-actions-fleet Bot deleted the feat/house-player-sites branch November 2, 2026 17:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant