v0.3.0

The player no longer needs blob: in the host page's CSP.

The element starts a background worker for downloads and media extraction. Until now it always started it from a blob: URL. A page with worker-src 'self', or with script-src 'self' and no worker-src (common on locked-down sites), refuses that. Then nothing could download or extract: packages from a host without Range, and large deflated videos, never played.

What's new

• dist/h5p-jobs.js: the background worker as a file. If the page's policy refuses the blob: worker, the element falls back to this file next to itself. Bundlers (Vite, Rollup, webpack 5) copy it for you, like h5p-sw.js.

• jobs attribute: the URL of that file. With it set, the element skips the blob: attempt entirely, so no CSP violation report is logged on each load.

  <h5p-player src="…" jobs="/h5p-jobs.js"></h5p-player>

• If no worker script can start, the error now says so: error: no-worker, with a message naming the CSP fix. Before, the player waited for a worker that wasn't there.

The minimum host-page policy is now:

script-src 'self'; worker-src 'self'; frame-src 'self'; connect-src 'self' <your package hosts>

The content inside the player still gets its own generated CSP, which this policy doesn't affect.

Upgrading

• With a bundler: nothing to do.
• No build step (element from the CDN): download h5p-sw.js again so it matches the element; the console warns until you do. If your site's CSP refuses blob: workers, also download dist/h5p-jobs.js, put it next to h5p-sw.js, and point jobs at it. Workers can't load from a CDN.
• No other API changes.

Full Changelog: v0.2.0...v0.3.0