Gathering detailed insights and metrics for shaka-player
Gathering detailed insights and metrics for shaka-player
JavaScript player library / DASH & HLS client / MSE-EME player
Installations
npm install shaka-playerDeveloper
shaka-project
Developer Guide
BETA
Module System
CommonJS
Min. Node Version
>=14
Typescript Support
Yes
Node Version
16.20.2
NPM Version
8.19.4
Statistics
7,229 Stars
6,373 Commits
1,341 Forks
220 Watching
38 Branches
242 Contributors
Updated on 28 Nov 2024
Bundle Size
652.94 kB
Minified
206.30 kB
Minified + Gzipped
Languages
JavaScript (96.99%)
Python (2.1%)
Less (0.56%)
HTML (0.27%)
Shell (0.07%)
Dockerfile (0.01%)
Total Downloads
Cumulative downloads
Total Downloads
45,533,034
Last day
1.2%
50,696
Compared to previous day
Last week
10.4%
270,150
Compared to previous week
Last month
0.4%
1,094,947
Compared to previous month
Last year
16.4%
12,480,052
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
Dependencies
1
Dev Dependencies
51
jimplesscajonjsdockarmawhicheslintrimrafcore-jsesprimajs-yamlssim.jshtmlhinttippy.jspwacompatstylelintsprintf-js@babel/coreawesompletejasmine-ajaxlcevc_dec.jspostcss-lessclean-packagecode-prettifykarma-jasmine@teppeis/clutzcodem-isoboxerfontfaceonloadkarma-coverage@babel/polyfilldialog-polyfillopen-sans-fonts@babel/preset-envkarma-jasmine-ajaxgoogle-closure-depskarma-spec-reporteres6-promise-polyfilleslint-config-googlekarma-opera-launchermaterial-design-litebabel-plugin-istanbulless-plugin-clean-cssgoogle-closure-librarykarma-sourcemap-loaderkarma-local-wd-launcherkarma-webdriver-launchereslint-plugin-shaka-rulesstylelint-config-standardgoogle-closure-compiler-java@joeyparrish/karma-babel-preprocessorcolor-themes-for-google-code-prettify
Versions
Shaka Player is an open-source JavaScript library for adaptive media. It plays adaptive media formats (such as DASH, HLS and MSS) in a browser, without using plugins or Flash. Instead, Shaka Player uses the open web standards MediaSource Extensions and Encrypted Media Extensions.
Shaka Player also supports offline storage and playback of media using IndexedDB. Content can be stored on any browser. Storage of licenses depends on browser support.
Our main goal is to make it as easy as possible to stream adaptive bitrate video and audio using modern browser technologies. We try to keep the library light, simple, and free from third-party dependencies. Everything you need to build and deploy is in the sources.
For details on what's coming next, see our development roadmap.
Maintained branches
See maintained-branches.md for the up-to-date list of maintained branches of Shaka Player.
Platform and browser support matrix
| Browser | Windows | Mac | Linux | Android | iOS >= 9 | iOS >= 17.1 | iPadOS >= 13 | ChromeOS | Other |
|---|---|---|---|---|---|---|---|---|---|
| Chrome¹ | Y | Y | Y | Y | Native | Native | Native | Y | - |
| Firefox¹ | Y | Y | Y | untested⁵ | Native | Native | Native | - | - |
| Edge¹ | Y | - | - | - | - | - | - | - | - |
| Edge Chromium | Y | Y | Y | untested⁵ | Native | Native | Native | - | - |
| IE | N | - | - | - | - | - | - | - | - |
| Safari¹ | - | Y | - | - | Native | Y | Y | - | - |
| Opera¹ | Y | Y | Y | untested⁵ | Native | - | - | - | - |
| Chromecast². | - | - | - | - | - | - | - | - | Y |
| Tizen TV³ | - | - | - | - | - | - | - | - | Y |
| WebOS⁶ | - | - | - | - | - | - | - | - | Y |
| Hisense⁷ | - | - | - | - | - | - | - | - | Y |
| Xbox One | - | - | - | - | - | - | - | - | Y |
| Playstation 4⁷ | - | - | - | - | - | - | - | - | Y |
| Playstation 5⁷ | - | - | - | - | - | - | - | - | Y |
NOTES:
- ¹: On macOS, only Safari 9+ is supported. On iOS, only iOS 9+ is supported. Older versions will be rejected.
- ²: The latest stable Chromecast firmware is tested. Both sender and receiver can be implemented with Shaka Player.
- ³: Tizen 2017 model is actively tested and supported by the Shaka Player team. Tizen 2016 model is community-supported and untested by us.
- ⁵: These are expected to work, but are not actively tested by the Shaka Player team.
- ⁶: These are expected to work, but are community-supported and untested by
us.
- Official support for LG WebOS TV: https://github.com/shaka-project/shaka-player/issues/1330
- ⁷: These are expected to work, but are community-supported and untested by us.
NOTES for iOS and iPadOS:
- We support iOS 9+ through Apple's native HLS player. We provide the same
top-level API, but we just set the video's
srcelement to the manifest/media. So we are dependent on the browser supporting the manifests. - Since iPadOS 13 MediaSource Extensions is supported
- Since iPadOS 17 and iOS 17.1 ManagedMediaSource Extensions is supported
Manifest format support matrix
| Format | Video On-Demand | Live | Event | In-Progress Recording |
|---|---|---|---|---|
| DASH | Y | Y | - | Y |
| HLS | Y | Y | Y | - |
| MSS | Y | - | - | - |
You can also create a manifest parser plugin to support custom manifest formats.
DASH features
DASH features supported:
- VOD, Live, and In-Progress Recordings (dynamic VOD content)
- MPD@timeShiftBufferDepth for seeking backward in Live streams
- Multi-period content (static and dynamic)
- Xlink elements (actuate=onLoad only, resolve-to-zero, fallback content)
- All forms of segment index info: SegmentBase@indexRange, SegmentTimeline, SegmentTemplate@duration, SegmentTemplate@index, SegmentList
- Multi-codec/multi-container manifests (we will negotiate support with the browser and choose the best ones)
- Encrypted content (including custom ContentProtection schemas, PSSH in the manifest)
- Key rotation
- Trick mode tracks
- WebVTT and TTML
- CEA-608/708 captions
- Multi-codec variants (on platforms with changeType support)
- MPD chaining
- MPD Patch updates for SegmentTemplate with $Number$, SegmentTimeline with $Number$ and SegmentTimeline with $Time$
DASH features not supported:
- Xlink with actuate=onRequest
- Manifests without any segment info: https://github.com/shaka-project/shaka-player/issues/1088
- Multiple trick mode tracks for the same resolution at varying framerates or bitrates
- Timescales so large that timestamps cannot be represented as integers in JavaScript (2^53): https://github.com/shaka-project/shaka-player/issues/1667
- Modifying elements with an @schemeIdUri attribute via MPD Patch
- Xlink dereferencing with MPD Patch
HLS features
HLS features supported:
- VOD, Live, and Event types
- Low-latency streaming with partial segments, preload hints, delta updates and blocking playlist reload
- Discontinuity
- ISO-BMFF / MP4 / CMAF support
- MPEG-2 TS support
- WebVTT and TTML
- CEA-608/708 captions
- Encrypted content with PlayReady and Widevine
- Encrypted content with FairPlay (Safari on macOS and iOS 9+ only)
- AES-128, AES-256 and AES-256-CTR support on browsers with Web Crypto API support
- SAMPLE-AES and SAMPLE-AES-CTR (identity) support on browsers with ClearKey support
- Key rotation
- Raw AAC, MP3, AC-3 and EC-3 (without an MP4 container)
- I-frame-only playlists (for trick play and thumbnails)
- #EXT-X-IMAGE-STREAM-INF for thumbnails
- Interstitials
- Container change during the playback (eg: MP4 to TS, or AAC to TS)
HLS features not supported:
- X-SNAP attribute in interstitials
Supported HLS tags
For details on the HLS format and these tags' meanings, see https://datatracker.ietf.org/doc/html/draft-pantos-hls-rfc8216bis
Multivariant Playlist tags
#EXT-X-STREAM-INF:<attribute-list><URI>#EXT-X-MEDIA:<attribute-list>#EXT-X-IMAGE-STREAM-INF:<attribute-list>#EXT-X-I-FRAME-STREAM-INF:<attribute-list>#EXT-X-SESSION-DATA:<attribute-list>#EXT-X-SESSION-KEY:<attribute-list>EME Key-System selection and preloading#EXT-X-START:TIME-OFFSET=<n>#EXT-X-CONTENT-STEERING:<attribute-list>Content Steering#EXT-X-DEFINE:<attribute-list>Variable Substitution (NAME,VALUE,QUERYPARAMattributes)
Media Playlist tags
#EXTM3U#EXTINF:<duration>,[<title>]#EXT-X-PLAYLIST-TYPE:<type#EXT-X-ENDLIST#EXT-X-MEDIA-SEQUENCE=<n>#EXT-X-TARGETDURATION=<n>#EXT-X-DISCONTINUITY#EXT-X-DISCONTINUITY-SEQUENCE=<n>#EXT-X-BYTERANGE=<n>[@<o>]#EXT-X-MAP:<attribute-list>#EXT-X-KEY:<attribute-list>(KEYFORMAT="identity",METHOD=SAMPLE-AESis only supports with MP4 segments)#EXT-X-PROGRAM-DATE-TIME:<attribute-list>#EXT-X-START:TIME-OFFSET=<n>#EXT-X-SERVER-CONTROL:<attribute-list>#EXT-X-PART-INF:PART-TARGET=<n>#EXT-X-PART:<attribute-list>#EXT-X-SKIP:<attribute-list>Delta Playlists#EXT-X-DATERANGE:<attribute-list>Metadata#EXT-X-DEFINE:<attribute-list>Variable Import and Substitution (NAME,VALUE,IMPORT,QUERYPARAMattributes)#EXT-X-GAP#EXT-X-PRELOAD-HINT:<attribute-list>#EXT-X-BITRATE
MPEG-5 Part2 LCEVC Support
Only supported on browsers with Media Source Extensions SourceBuffer support
-
MPEG-5 Part2 LCEVC decoding support (decoding provided by lcevc_dec.js, must be separately included)
-
Integration documentation : docs
-
More on MPEG-5 Part2 LCEVC
MSS features
MSS features supported:
- VOD
- AAC and H.264
- Encrypted content (PlayReady)
- TTML/DFXP
- Only supported with codem-isoboxer
MSS features not supported:
- Live
DRM support matrix
| Browser | Widevine | PlayReady | FairPlay | ClearKey⁶ |
|---|---|---|---|---|
| Chrome¹ | Y | - | - | Y |
| Firefox² | Y | - | - | Y |
| Edge³ | - | Y | - | - |
| Edge Chromium | Y | Y | - | Y |
| Safari | - | - | Y | - |
| Opera | Y | - | - | Y |
| Chromecast | Y | Y | - | Y |
| Tizen TV | Y | Y | - | Y |
| WebOS⁷ | untested⁷ | untested⁷ | - | untested⁷ |
| Hisense⁷ | untested⁷ | untested⁷ | - | untested⁷ |
| Xbox One | - | Y | - | - |
| Playstation 4⁷ | - | untested⁷ | - | untested⁷ |
| Playstation 5⁷ | - | untested⁷ | - | untested⁷ |
Other DRM systems should work out of the box if they are interoperable and compliant to the EME spec.
NOTES:
- ¹: Only official Chrome builds contain the Widevine CDM. Chromium built from source does not support DRM.
- ²: DRM must be enabled by the user. The first time a Firefox user visits a site with encrypted media, the user will be prompted to enable DRM.
- ³: PlayReady in Edge does not seem to work on a VM or over Remote Desktop.
- ⁶: ClearKey is a useful tool for debugging, and does not provide actual content security.
- ⁷: These are expected to work, but are community-supported and untested by us.
| Manifest | Widevine | PlayReady | FairPlay | ClearKey |
|---|---|---|---|---|
| DASH | Y | Y | - | Y |
| HLS | Y | Y | Y ¹ | - |
| MSS | - | Y | - | - |
NOTES:
- ¹: By default, FairPlay is handled using Apple's native HLS player, when on
Safari. We do support FairPlay through MSE/EME, however. See the
streaming.useNativeHlsForFairPlayconfiguration value.
Media container and subtitle support
Shaka Player supports:
- ISO-BMFF / CMAF / MP4
- Depends on browser support for the container via MediaSource
- Can parse "sidx" box for DASH's SegmentBase@indexRange and SegmentTemplate@index
- Can find and parse "tfdt" box to find segment start time in HLS
- For MSS, codem-isoboxer v0.3.7+ is required
- WebM
- Depends on browser support for the container via MediaSource
- Can parse cueing data elements for DASH's SegmentBase@indexRange and SegmentTemplate@index
- Not supported in HLS
- MPEG-2 TS
- Can be played on any browser which supports MP4
- Can find and parse timestamps to find segment start time in HLS
- WebVTT
- Supported in both text form and embedded in MP4
- TTML
- Supported in both XML form and embedded in MP4
- CEA-608
- Supported embedded in MP4 and TS
- CEA-708
- Supported embedded in MP4 and TS
- Raw AAC
- Supported in raw AAC container and transmuxing to AAC in MP4 container (depends on browser support via MediaSource).
- Raw MP3
- Supported in raw MP3 container and transmuxing to MP3 in MP4 container (depends on browser support via MediaSource).
- Raw AC-3
- Supported in raw AC-3 container and transmuxing to AC-3 in MP4 container (depends on browser support via MediaSource).
- Raw EC-3
- Supported in raw EC-3 container and transmuxing to EC-3 in MP4 container (depends on browser support via MediaSource).
- SubRip (SRT)
- UTF-8 encoding only
- LyRiCs (LRC)
- UTF-8 encoding only
- SubStation Alpha (SSA, ASS)
- UTF-8 encoding only
- SubViewer (SBV)
- UTF-8 encoding only
Subtitles are rendered by the browser by default. Applications can create a text display plugin for customer rendering to go beyond browser-supported attributes.
Transmuxer support
Shaka Player supports:
- Raw AAC to AAC in MP4
- Raw MP3 to MP3 in MP4
- Raw AC-3 to AC-3 in MP4
- Raw EC-3 to EC-3 in MP4
- AAC in MPEG-2 TS to AAC in MP4
- AC-3 in MPEG-2 TS to AC-3 in MP4
- EC-3 in MPEG-2 TS to EC-3 in MP4
- MP3 in MPEG-2 TS to MP3 in MP4
- MP3 in MPEG-2 TS to raw MP3
- Opus in MPEG-2 TS to MP3 in MP4
- H.264 in MPEG-2 TS to H.264 in MP4
- H.265 in MPEG-2 TS to H.265 in MP4
- Muxed content in MPEG-2 TS with the previous codecs
Thumbnails support
Shaka Player supports:
- Internal DASH thumbnails. Using DASH-IF IOP Image Adaptation Set
- Internal HLS thumbnails. Using HLS Image Media Playlist
- Internal HLS thumbnails. Using I-frame-only playlists with mjpg codec
- External WebVTT with images/sprites (only for VoD)
Monetization with Ads
Shaka Player supports:
- IMA SDK for Client-Side Ad Insertion
- IMA DAI SDK for Server-Side Ad Insertion
- AWS MediaTailor for Client-Side
- AWS MediaTailor for Server-Side
- AWS MediaTailor overlays
- HLS interstitials
- DASH Media Presentation Insertion (MPD alternate)
- Custom Interstitials
- Basic support of VAST and VMAP without IMA (playback without tracking)
Content Steering support
Shaka Player supports Content Steering (v1) in DASH and HLS.
Content Steering features supported:
- TTL, if missing, the default value is 300 seconds.
- RELOAD-URI, if missing we use the url provided in the manifest as fallback.
- PATHWAY-PRIORITY only HOST replacement
Content Steering features not supported:
- PATHWAY-CLONES other replacements than HOST.
VR support
Shaka Player supports VR when:
- Content is automatically treated as VR if it fits the following criteria:
- HLS or DASH manifest
- fMP4 segments
- Init segment contains
prjiandhfovboxes
- Or, if it is manually enabled via the UI config.
VR modes supported:
- Equirectangular projection with 360 degrees of horizontal field of view.
- Cubemap projection with 360 degrees of horizontal field of view.
NOTES:
- VR is only supported for clear streams or HLS-AES stream. DRM prevents access to the video pixels for transformation.
Documentation & Important Links
- Demo(sources)
- Nightly Demo
- Demo index
- API documentation
- Tutorials
- Hosted builds on Google Hosted Libraries
- Hosted builds on jsDelivr
- Development roadmap
- Announcement list (join for infrequent announcements and surveys)
- Subscribe to releases by following instructions from this blog
FAQ
For general help and before filing any bugs, please read the FAQ.
Contributing
If you have improvements or fixes, we would love to have your contributions. Please read CONTRIBUTING.md for more information on the process we would like contributors to follow.
Framework Integrations
The Shaka team doesn't have the bandwidth and experience to provide guidance and support for integrating Shaka Player with specific frameworks, but some of our users have successfully done so and created tutorials to help other beginners.
Shaka + ReactJS Library
Shaka + ReactJS integrations:
- https://github.com/matvp91/shaka-player-react
- https://github.com/amit08255/shaka-player-react-with-ui-config
Shaka + Next.js integration:
Shaka + Vue.js integrations:
Shaka + Nuxt.js integration:
Shaka + video.js integration:
Shaka + Angular integration:
If you have published Shaka Integration code/tutorials, please feel free to submit PRs to add them to this list, we will gladly approve!
No vulnerabilities found.
Reason
30 commit(s) and 24 issue activity found in the last 90 days -- score normalized to 10
Reason
all changesets reviewed
Reason
no dangerous workflow patterns detected
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0
Reason
no binaries found in the repo
Reason
packaging workflow detected
Details
- Info: Project packages its releases by way of GitHub Actions.: .github/workflows/release-please.yaml:53
Reason
dependency not pinned by hash detected -- score normalized to 1
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/appspot.yaml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/appspot.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/appspot.yaml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/appspot.yaml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/appspot.yaml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/appspot.yaml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/appspot.yaml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/appspot.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-and-test.yaml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/build-and-test.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-and-test.yaml:104: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/build-and-test.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-and-test.yaml:170: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/build-and-test.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-and-test.yaml:222: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/build-and-test.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-and-test.yaml:238: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/build-and-test.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-and-test.yaml:256: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/build-and-test.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/demo-version-index.yaml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/demo-version-index.yaml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/demo-version-index.yaml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/demo-version-index.yaml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/demo-version-index.yaml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/demo-version-index.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nightly-demo.yaml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/nightly-demo.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nightly-demo.yaml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/nightly-demo.yaml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/nightly-demo.yaml:38: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/nightly-demo.yaml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/nightly-demo.yaml:42: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/nightly-demo.yaml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/release-please.yaml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/release-please.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-please.yaml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/release-please.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-please.yaml:58: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/release-please.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-please.yaml:64: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/release-please.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-please.yaml:131: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/release-please.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-please.yaml:137: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/release-please.yaml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/release-please.yaml:171: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/release-please.yaml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/release-please.yaml:175: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/release-please.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-please.yaml:186: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/release-please.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/report-incremental-coverage.yaml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/report-incremental-coverage.yaml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/selenium-lab-tests.yaml:66: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/selenium-lab-tests.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/selenium-lab-tests.yaml:84: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/selenium-lab-tests.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/selenium-lab-tests.yaml:149: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/selenium-lab-tests.yaml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/selenium-lab-tests.yaml:155: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/selenium-lab-tests.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/selenium-lab-tests.yaml:176: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/selenium-lab-tests.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/selenium-lab-tests.yaml:183: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/selenium-lab-tests.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/selenium-lab-tests.yaml:190: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/selenium-lab-tests.yaml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/selenium-lab-tests.yaml:200: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/selenium-lab-tests.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/selenium-lab-tests.yaml:226: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/selenium-lab-tests.yaml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/selenium-lab-tests.yaml:232: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/selenium-lab-tests.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/selenium-lab-tests.yaml:239: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/selenium-lab-tests.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/selenium-lab-tests.yaml:245: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/selenium-lab-tests.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/selenium-lab-tests.yaml:251: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/selenium-lab-tests.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/selenium-lab-tests.yaml:260: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/selenium-lab-tests.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/selenium-lab-tests.yaml:275: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/selenium-lab-tests.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/selenium-lab-tests.yaml:358: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/selenium-lab-tests.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/selenium-lab-tests.yaml:374: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/selenium-lab-tests.yaml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/selenium-lab-tests.yaml:390: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/selenium-lab-tests.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/sync-labels.yaml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/sync-labels.yaml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/sync-labels.yaml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/sync-labels.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/talk-to-shaka-bot.yaml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/talk-to-shaka-bot.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/update-issues.yaml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/update-issues.yaml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/update-screenshots.yaml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/update-screenshots.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/update-screenshots.yaml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/update-screenshots.yaml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/update-screenshots.yaml:38: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/update-screenshots.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/update-screenshots.yaml:61: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/update-screenshots.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/update-screenshots.yaml:66: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/update-screenshots.yaml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/update-screenshots.yaml:102: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/update-screenshots.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/update-screenshots.yaml:114: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/update-screenshots.yaml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/update-screenshots.yaml:141: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/update-screenshots.yaml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/validate-pr-title.yaml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/shaka-project/shaka-player/validate-pr-title.yaml/main?enable=pin
- Warn: containerImage not pinned by hash: build/docker/Dockerfile:8: pin your Docker image by updating alpine:3.18 to alpine:3.18@sha256:2995c82e8e723d9a5c8585cb8e901d1c50e3c2759031027d3bff577449435157
- Warn: npmCommand not pinned by hash: .github/workflows/build-and-test.yaml:127
- Warn: chocoCommand not pinned by hash: .github/workflows/build-and-test.yaml:143
- Info: 0 out of 38 GitHub-owned GitHubAction dependencies pinned
- Info: 1 out of 21 third-party GitHubAction dependencies pinned
- Info: 5 out of 6 npmCommand dependencies pinned
- Info: 0 out of 1 chocoCommand dependencies pinned
- Info: 0 out of 1 containerImage dependencies pinned
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: no topLevel permission defined: .github/workflows/appspot.yaml:1
- Warn: no topLevel permission defined: .github/workflows/build-and-test.yaml:1
- Warn: no topLevel permission defined: .github/workflows/deflake.yaml:1
- Warn: no topLevel permission defined: .github/workflows/demo-version-index.yaml:1
- Warn: no topLevel permission defined: .github/workflows/nightly-demo.yaml:1
- Warn: no topLevel permission defined: .github/workflows/release-please.yaml:1
- Warn: no topLevel permission defined: .github/workflows/report-incremental-coverage.yaml:1
- Warn: no topLevel permission defined: .github/workflows/selenium-lab-tests.yaml:1
- Warn: no topLevel permission defined: .github/workflows/sync-labels.yaml:1
- Warn: no topLevel permission defined: .github/workflows/talk-to-shaka-bot.yaml:1
- Warn: no topLevel permission defined: .github/workflows/update-screenshots.yaml:1
- Warn: no topLevel permission defined: .github/workflows/validate-pr-title.yaml:1
- Info: no jobLevel write permissions found
Reason
Project has not signed or included provenance with any releases.
Details
- Warn: release artifact v4.12.2 not signed: https://api.github.com/repos/shaka-project/shaka-player/releases/186395676
- Warn: release artifact v4.11.14 not signed: https://api.github.com/repos/shaka-project/shaka-player/releases/186393870
- Warn: release artifact v4.9.32 not signed: https://api.github.com/repos/shaka-project/shaka-player/releases/186392300
- Warn: release artifact v4.12.1 not signed: https://api.github.com/repos/shaka-project/shaka-player/releases/185890814
- Warn: release artifact v4.11.13 not signed: https://api.github.com/repos/shaka-project/shaka-player/releases/185889540
- Warn: release artifact v4.12.2 does not have provenance: https://api.github.com/repos/shaka-project/shaka-player/releases/186395676
- Warn: release artifact v4.11.14 does not have provenance: https://api.github.com/repos/shaka-project/shaka-player/releases/186393870
- Warn: release artifact v4.9.32 does not have provenance: https://api.github.com/repos/shaka-project/shaka-player/releases/186392300
- Warn: release artifact v4.12.1 does not have provenance: https://api.github.com/repos/shaka-project/shaka-player/releases/185890814
- Warn: release artifact v4.11.13 does not have provenance: https://api.github.com/repos/shaka-project/shaka-player/releases/185889540
Reason
security policy file not detected
Details
- Warn: no security policy file detected
- Warn: no security file to analyze
- Warn: no security file to analyze
- Warn: no security file to analyze
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 30 are checked with a SAST tool
Reason
13 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
- Warn: Project is vulnerable to: GHSA-fvqr-27wr-82fm
- Warn: Project is vulnerable to: GHSA-4xc9-xhrj-v574
- Warn: Project is vulnerable to: GHSA-x5rq-j2xg-h7qm
- Warn: Project is vulnerable to: GHSA-jf85-cpcp-j695
- Warn: Project is vulnerable to: GHSA-p6mc-m468-83gw
- Warn: Project is vulnerable to: GHSA-29mw-wpgm-hmr9
- Warn: Project is vulnerable to: GHSA-35jh-r3h4-6jhm
- Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
- Warn: Project is vulnerable to: GHSA-p8p7-x288-28g6
- Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw
- Warn: Project is vulnerable to: GHSA-mxhp-79qh-mcx6
- Warn: Project is vulnerable to: GHSA-72xf-g2v4-qvf3
Score
4.8
/10
Last Scanned on 2024-11-18
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More