Is it possible to remove keycode import in videojs8 ?

[joanliky]

For security request, my project has been scanned by Sonatype Nexus Lifecycle. Which comes out with two issues by keycode:

So, may i ask is it possible to remove keycode in videojs8?
if yes, may i ask how can i remove then?

[mister-ben]

Why would that package be a security issue? Your screen shot doesn't indicate that.

[mister-ben]

I saw an email notification of a reply that's apparently since been deleted that showed that it is mocha that's been flagged, which is a devDependency of keycode. That's a red herring in so far as a devDependency of a dependency of video.js won't be installed or executed by using video.js.

That said, we could probably remove keycode. That was useful when browsers were more inconsistent, but KeyboardEvent.key is supported by all browsers we support, so we could switch to that and remove the dependency. It would mean a refactor to use event.key.toLowerCase() === 'x' in place of keycode.isEventKey(event, 'x') etc.

[joanliky]

Thank so much for your reply.

so May i ask is it possible to remove that keycode at this stage? Or i should be waiting for next update?

[mister-ben]

#8735

Keycode has been removed in the next release.

[joanliky]

@mister-ben Thanks so much!

[joanliky]

I saw an email notification of a reply that's apparently since been deleted that showed that it is mocha that's been flagged, which is a devDependency of keycode. That's a red herring in so far as a devDependency of a dependency of video.js won't be installed or executed by using video.js.

That said, we could probably remove keycode. That was useful when browsers were more inconsistent, but KeyboardEvent.key is supported by all browsers we support, so we could switch to that and remove the dependency. It would mean a refactor to use event.key.toLowerCase() === 'x' in place of keycode.isEventKey(event, 'x') etc.

May i ask is it possible fix at this stage?