Skip to content

Move shaka-player font patching into a webpack loader#8700

Merged
FreeTubeBot merged 1 commit intoFreeTubeApp:developmentfrom
absidue:shaka-player-loader
Feb 22, 2026
Merged

Move shaka-player font patching into a webpack loader#8700
FreeTubeBot merged 1 commit intoFreeTubeApp:developmentfrom
absidue:shaka-player-loader

Conversation

@absidue
Copy link
Member

@absidue absidue commented Feb 20, 2026

Pull Request Type

  • Other

Description

I originally placed the shaka-player patching in a postinstall script as it used to patch more things (adding export default shaka to the types -> shaka-player does that itself now and downloading the google material icons font -> shaka-player now uses SVG in JS for its icons), but now that it only need to do a find-and-replace to make shaka-player reference the Roboto font that is already in this repository rather than on Google Fonts, it doesn't need to be a script anymore.

In light of the Shai Hulud and Shai Hulud 2 security incidents in 2025, which along with other things, also injected malicious postinstall scripts into npm packages, people have started preventing postinstall scripts from running entirely or only allow listing specific ones. As none of the postinstall scripts that run in the FreeTube repository are essential, switching to a webpack loader will let us disable running postinstall scripts in our GitHub Actions pipelines.

Testing

  1. rm -rf node_modules/shaka-player
  2. yarn install --check-files
  3. yarn run pack:renderer
  4. npx prettier@2.8.8 --no-config --write dist/renderer.*.css
  5. Search for @font-face in the dist/renderer.*.css file (it should only include the one pointing to the local Roboto font)

Desktop

  • OS: Windows
  • OS Version: 11

@FreeTubeBot FreeTubeBot enabled auto-merge (squash) February 20, 2026 18:46
@github-actions github-actions bot added PR: dependencies Pull requests that update a dependency file PR: waiting for review For PRs that are complete, tested, and ready for review labels Feb 20, 2026
@FreeTubeBot FreeTubeBot merged commit 81a0fc8 into FreeTubeApp:development Feb 22, 2026
6 checks passed
@github-actions github-actions bot removed the PR: waiting for review For PRs that are complete, tested, and ready for review label Feb 22, 2026
@absidue absidue deleted the shaka-player-loader branch February 22, 2026 08:05
Pillowytuba pushed a commit to Pillowytuba/FreeTube that referenced this pull request Mar 19, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

PR: dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants