docs(rfc): use nonce instead of unsafe-inline

[sampotts]

No description provided.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
v10-sandbox	Ready	Preview, Comment	Mar 23, 2026 2:05am

[netlify]

✅ Deploy Preview for vjs10-site ready!

Name	Link
🔨 Latest commit	cd4309c
🔍 Latest deploy log	https://app.netlify.com/projects/vjs10-site/deploys/69c09fcbe73cda000846a825
😎 Deploy Preview	https://deploy-preview-1076--vjs10-site.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[Copilot]

Pull request overview

Adds an RFC proposing a player-scoped CSP nonce and a managed dynamic stylesheet system to remove the need for style-src 'unsafe-inline' while preserving dynamic styling in the HTML and React players.

Changes:

• Documents current inline-style usage across HTML and React players and why it conflicts with strict CSP.
• Evaluates multiple approaches (keep unsafe-inline, hashes, global nonce, fixed classes, player-scoped nonce + managed stylesheets).
• Recommends a concrete architecture and rollout plan (nonce via createPlayer, shared style helpers, scoped style targets).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

📦 Bundle Size Report

🎨 @videojs/html — no changes

Presets (7)

Entry	Size
/video (default)	23.37 kB
/video (default + hls)	153.84 kB
/video (minimal)	23.21 kB
/video (minimal + hls)	153.65 kB
/audio (default)	21.51 kB
/audio (minimal)	21.52 kB
/background	6.51 kB

Media (5)

Entry	Size
/media/background-video	1.03 kB
/media/container	1.59 kB
/media/dash-video	236.04 kB
/media/hls-video	131.57 kB
/media/simple-hls-video	12.33 kB

Players (3)

Entry	Size
/video/player	6.24 kB
/audio/player	6.23 kB
/background/player	6.22 kB

Skins (16)

Entry	Type	Size
/video/minimal-skin.css	css	3.25 kB
/video/skin.css	css	3.31 kB
/video/minimal-skin	js	22.40 kB
/video/minimal-skin.tailwind	js	22.82 kB
/video/skin	js	22.57 kB
/video/skin.tailwind	js	22.81 kB
/audio/minimal-skin.css	css	2.37 kB
/audio/skin.css	css	2.36 kB
/audio/minimal-skin	js	20.77 kB
/audio/minimal-skin.tailwind	js	21.10 kB
/audio/skin	js	20.73 kB
/audio/skin.tailwind	js	21.02 kB
/background/skin.css	css	117 B
/background/skin	js	1.13 kB
/base.css	css	157 B
/shared.css	css	86 B

UI Components (21)

Entry	Size
/ui/alert-dialog	2.16 kB
/ui/alert-dialog-close	1.60 kB
/ui/alert-dialog-description	1.52 kB
/ui/alert-dialog-title	1.50 kB
/ui/buffering-indicator	1.79 kB
/ui/captions-button	1.83 kB
/ui/controls	1.60 kB
/ui/fullscreen-button	1.82 kB
/ui/mute-button	1.81 kB
/ui/pip-button	1.81 kB
/ui/play-button	1.81 kB
/ui/playback-rate-button	1.83 kB
/ui/popover	3.29 kB
/ui/poster	1.70 kB
/ui/seek-button	1.80 kB
/ui/slider	2.00 kB
/ui/thumbnail	2.14 kB
/ui/time	1.62 kB
/ui/time-slider	2.12 kB
/ui/tooltip	2.42 kB
/ui/volume-slider	2.20 kB

Sizes are marginal over the root entry point.

⚛️ @videojs/react — no changes

Presets (7)

Entry	Size
/video (default)	18.95 kB
/video (default + hls)	149.81 kB
/video (minimal)	18.98 kB
/video (minimal + hls)	149.77 kB
/audio (default)	15.80 kB
/audio (minimal)	15.85 kB
/background	3.13 kB

Media (4)

Entry	Size
/media/background-video	476 B
/media/dash-video	236.19 kB
/media/hls-video	131.59 kB
/media/simple-hls-video	12.34 kB

Skins (14)

Entry	Type	Size
/video/minimal-skin.css	css	3.25 kB
/video/skin.css	css	3.31 kB
/video/minimal-skin	js	18.91 kB
/video/minimal-skin.tailwind	js	22.16 kB
/video/skin	js	18.89 kB
/video/skin.tailwind	js	22.13 kB
/audio/minimal-skin.css	css	2.37 kB
/audio/skin.css	css	2.36 kB
/audio/minimal-skin	js	15.78 kB
/audio/minimal-skin.tailwind	js	18.21 kB
/audio/skin	js	15.75 kB
/audio/skin.tailwind	js	18.12 kB
/background/skin.css	css	90 B
/background/skin	js	272 B

UI Components (18)

Entry	Size
/ui/alert-dialog	2.21 kB
/ui/buffering-indicator	2.20 kB
/ui/captions-button	2.25 kB
/ui/controls	2.23 kB
/ui/fullscreen-button	2.25 kB
/ui/mute-button	2.26 kB
/ui/pip-button	2.22 kB
/ui/play-button	2.25 kB
/ui/playback-rate-button	2.25 kB
/ui/popover	2.85 kB
/ui/poster	2.05 kB
/ui/seek-button	2.30 kB
/ui/slider	3.16 kB
/ui/thumbnail	2.01 kB
/ui/time	1.92 kB
/ui/time-slider	2.66 kB
/ui/tooltip	2.69 kB
/ui/volume-slider	2.68 kB

Sizes are marginal over the root entry point.

🧩 @videojs/core — no changes

Entries (6)

Entry	Size
.	4.81 kB
/dom	8.41 kB
/dom/media/custom-media-element	1.81 kB
/dom/media/dash	235.62 kB
/dom/media/hls	131.27 kB
/dom/media/simple-hls	11.85 kB

🏷️ @videojs/element — no changes

Entries (2)

Entry	Size
.	999 B
/context	943 B

📦 @videojs/store — no changes

Entries (3)

Entry	Size
.	1.32 kB
/html	700 B
/react	360 B

🔧 @videojs/utils — no changes

Entries (10)

Entry	Size
/array	104 B
/dom	1.25 kB
/events	227 B
/function	261 B
/object	119 B
/predicate	265 B
/string	148 B
/style	190 B
/time	478 B
/number	158 B

📦 @videojs/spf — no changes

Entries (3)

Entry	Size
.	40 B
/dom	10.04 kB
/playback-engine	9.94 kB

---

ℹ️ How to interpret

All sizes are standalone totals (minified + brotli).

Icon	Meaning
✅	No change
🔺	Increased ≤ 10%
🔴	Increased > 10%
🔽	Decreased
🆕	New (no baseline)

Run pnpm size locally to check current sizes.

[mihar-22]

This doc reads beautifully, thanks for creating it! I agree with almost everything in it, however I'm going to close to avoid merging a stale doc (we already have so many we need to either update/remove) and to avoid having to iterate on it.

You're more than welcome to follow-up with a PR directly to solve this because I agree we need a solution for CSP. I quite like the Base UI CSPProvider direction.