v3.6.0

What's Changed

Bug Fixes

• Fix autoplay prop not working (#265) — autoplay now loads the iframe immediately on mount so YouTube's autoplay=1 parameter is actually respected. Previously the iframe only loaded on click, making autoplay a no-op. Note: browsers require muted for unmuted autoplay (browser autoplay policy). Thanks to @virasasan for the detailed report and reproduction case.

• Fix params prop TypeScript type (#257) — params now correctly accepts both string and Record<string, string | number> as the documentation always stated. The TypeScript type was incorrectly narrowed to string only. Thanks to @SKOLZ for the report.

• Fix npm provenance attestation in release CI (#256) — The publish-npm workflow step was missing NODE_AUTH_TOKEN, causing CI publishes to fail silently and packages to be published manually (without provenance). Going forward all releases will include cryptographic provenance attestation verifiable via npm audit signatures.

Contributors

Thank you to everyone who reported issues and helped improve this package:

• @virasasan — reported autoplay behavior (#265)
• @SKOLZ — reported params type mismatch (#257)

Full Changelog: v3.5.1...v3.6.0