Changelog

Security hardening and lifecycle improvements for the Shaka Player Data SDK

Back to Changelog
JUN 30, 2026
ImprovementVideo Data

The Shaka Player Data SDK is now hardened against tampered third-party code and unsafe input, with cleaner player lifecycle management.

What’s new:

  • Subresource Integrity for the CDN script: the Shaka Player CDN script now ships with an SRI hash and a crossorigin attribute, so tampered third-party code will not execute.

  • Validated manifest URLs: user-provided manifest URLs are trimmed and validated before playback, and the test harness is hardened against SonarQube findings.

  • Safer global access: window references were replaced with globalThis for environment-agnostic global access.

  • Cleaner lifecycle handling: dedicated load and destroy controls with proper teardown prevent resource leaks.

  • Automated quality gates: Azure Pipelines and SonarQube static analysis were added to the build.