Mediabunny 1.62.1 — media toolkit (read, write, convert MP4 / MOV / WebM / MKV…) in pure TypeScript
=====================================================================================================

Used by: /assets/js/tools/video-trimmer.js (Video Cutter). Loaded on demand with a dynamic
import() from that script (ES module, served from 'self'); it is never loaded on other pages.

Source        : npm package "mediabunny" 1.62.1 (https://www.npmjs.com/package/mediabunny,
                https://github.com/Vanilagy/mediabunny), author Vanilagy and contributors
Fetched       : 2026-11-03 (published 2026-10-22) with `npm pack mediabunny@1.62.1`
Tarball sha512: lYzeerDwo9QLhBCipqQDXOSV7InvaIFplllZQviPO5rPwH+IUr8M1uvumk1olIUgMRGkPiInRriv25WFErUgMw==
                (matches the npm registry "dist.integrity")
File kept     : dist/bundles/mediabunny.min.mjs, renamed mediabunny.min.js (so that every web
                server sends it with a JavaScript MIME type), content byte-for-byte identical
mediabunny.min.js sha256: b365395e7cd4b130553a1203fc23c52c035aedf6d1e07d6fedb4663745b5c790
Size          : 703 759 bytes, no source map reference

Licence: Mozilla Public License 2.0 (LICENSE.txt). Used unmodified; source code available at
https://github.com/Vanilagy/mediabunny and in the npm package (src/).

Security review (2026-11-03):
  - no eval, new Function, importScripts, fetch / XMLHttpRequest of remote resources, WebSocket;
  - no WebAssembly, no SharedArrayBuffer requirement (only `instanceof` checks), works without
    cross-origin isolation (no COOP/COEP needed);
  - creates small Web Workers from blob: URLs built from its own functions (timers that keep
    running in background tabs, and helpers): allowed by the site CSP (worker-src 'self' blob:);
  - creates hidden <canvas> / <video> elements and sets their style through the CSSOM (allowed);
  - the only URLs are documentation strings in error messages;
  - version choice: 1.62.1 (published 2026-10-22), the newest release at least ~10 days old
    when fetched (supply-chain caution: no same-day release); API used by the tool checked
    against 1.65.1 (same option names: copy.mode / boundaryPolicy, trim, quality, sinks).