Fix media video parser ReDoS

[zbeyens]

• Auto release

🐛 Fixes CVE-2026-5986 exposure in @platejs/media
🟢 95-100% confidence

Phase	🧪 Tests	🌐 Browser
Reproduced	🔴 parseVideoUrl timing regression failed at ~360ms	➖ N/A
Verified	🟢 parser regression passed; ✅ pnpm check	➖ N/A
Release opt-in	🟢 helper tests + workflow syntax checks + ✅ pnpm check	➖ N/A

✅ Outcome

• Removed vulnerable js-video-url-parser from @platejs/media and pnpm-lock.yaml.
• Replaced it with URL API parsing for YouTube, Vimeo, Dailymotion, Youku, Coub.
• Added provider variant coverage, ReDoS timing regression, changeset, solution docs.
• Added a managed auto-release checkbox for every PR with a real .changeset/*.md file.
• Patch-only changesets are checked by default; any minor or major changeset starts unchecked.
• Taught task and major-task to put the block directly in PR descriptions instead of waiting for CI.
• If the checkbox is checked, the release workflow enables auto-merge on [Release] Version packages using API_TOKEN_GITHUB so the publish workflow can still trigger.

⚠️ Caveat

• pnpm check still prints the existing footnote hook warning and duplicate @platejs/core test notice; no errors.

🏗️ Design

• Parser fix point: parseVideoUrl; callers keep the same helper and metadata shape.
• Release opt-in point: top-of-description PR checkbox for visible author intent, workflow enforcement for machine-readable behavior.
• pull_request_target only checks out base-repo code and reads PR file names through the GitHub API.

🧪 Verified

• bun test packages/media/src/lib/media-embed/parseVideoUrl.spec.ts
• pnpm turbo build --filter=./packages/media
• pnpm turbo typecheck --filter=./packages/media
• bun test tooling/scripts/auto-release-pr.test.mjs
• node --check tooling/scripts/auto-release-pr.mjs && node --check tooling/scripts/auto-release-pr.test.mjs
• git diff --check
• YAML parse for .github/workflows/changeset-auto-release.yml and .github/workflows/release.yml
• pnpm install
• pnpm lint:fix
• pnpm check

[codesandbox]

Review or Edit in CodeSandbox

Open the branch in Web Editor • VS Code • Insiders

Open Preview

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
plate	Ready	Preview, Comment	Apr 25, 2026 11:27am

[changeset-bot]

🦋 Changeset detected

Latest commit: 18da92e

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@platejs/media	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1373d46ea3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Accept YouTube thumbnail hosts in parser

The new host gate for YouTube only allows youtube.com/*.youtube.com and youtu.be, which drops previously supported thumbnail URL forms such as img.youtube.com/vi/<id>/... and i.ytimg.com/vi/<id>/.... With this change, pasting those URLs now returns undefined instead of normalized embed data, so media insertion paths that relied on the old parser behavior regress. Please include the thumbnail host variants in YouTube provider detection.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Include Vimeo CDN host in Vimeo URL detection

parseVimeoId now only accepts vimeo.com/*.vimeo.com and vimeopro.com/*.vimeopro.com, which excludes i.vimeocdn.com/video/<id> URLs that were parsed before. This causes valid Vimeo inputs to stop resolving to embed metadata and breaks compatibility for users pasting CDN-style Vimeo links. Add vimeocdn.com to the Vimeo host checks to preserve prior behavior.

Useful? React with 👍 / 👎.