How to exclude remote script loading (CDN) from vidstack build?

[iftecodeconfig]

Hey vidstack team,
I'm building a self-hosted WordPress video player plugin and I'd like to avoid any remote script loading from the vidstack bundle for privacy/security reasons (CSP compliance, GDPR, self-hosted environments).

When inspecting the prod build, I found these remote URLs are loaded dynamically at runtime:

1. https://www.gstatic.com/cv/js/sender/v1/cast_sender.js?loadCastFramework=1 — Google Cast SDK
2. ${JS_DELIVR_CDN}/npm/dashjs@4.7.4/dist/dash.all.debug.js — DASH.js player
3. ${JS_DELIVR_CDN}/npm/hls.js@^1.5.0/dist/hls.js — HLS.js player
4. https://vimeo.com/api/oembed.json — Vimeo oEmbed

Questions:

• Is there a way to exclude these providers (Google Cast, DASH.js, HLS.js, Vimeo) from the build via tree-shaking or import configuration?
• Can these scripts be self-hosted or served from a local path instead of CDN?
• Are there any recommended approaches for CSP environments where external script loading is blocked?

Thanks!

[abhiramshaji-cyber]

None of those four are loaded eagerly, so you mostly do not need to strip them from the build. Each one only loads when the player actually needs it, and HLS/DASH can be pointed at a local copy.

When each URL is requested

• hls.js: only when the selected source is HLS (.m3u8 / HLS mime type). The HLS provider then loads provider.library, which defaults to the jsDelivr URL (hls/provider.ts#L66).
• dash.js: same thing, only for DASH sources (dash/provider.ts#L64).
• Vimeo oEmbed: only for Vimeo sources, from the Vimeo provider (vimeo/utils.ts#L26).
• Google Cast SDK: only inside requestGoogleCast(), i.e. when someone clicks the cast button. The loader module itself is a dynamic import there (media-request-manager.ts#L470-L490, google-cast/loader.ts#L131).

They show up in your bundle because the source selector instantiates every provider loader up front (source-select.ts#L51-L56), so there is no import level switch to tree shake them out. But their code paths stay dormant unless a matching source or a cast click happens.

Self host hls.js / dash.js

Set library in the provider-change event (that is the documented place; provider-setup is too late, see media-events.ts#L410-L425). It accepts a URL string, a constructor, or a dynamic import:

import { isHLSProvider, isDASHProvider } from 'vidstack'

player.addEventListener('provider-change', (event) => {
  const provider = event.detail

  if (isHLSProvider(provider)) {
    provider.library = myPluginUrl + '/vendor/hls.min.js'
    // or with a bundler: provider.library = () => import('hls.js')
  }

  if (isDASHProvider(provider)) {
    provider.library = myPluginUrl + '/vendor/dash.all.min.js'
  }
})

If you use a URL, ship the UMD builds: the loader injects a script tag and then expects window.Hls / window.dashjs.MediaPlayer to exist (hls/lib-loader.ts#L160-L170, dash/lib-loader.ts#L176-L178). If you only serve MP4/WebM, nothing is fetched at all.

Google Cast

The SDK has to come from gstatic, so for CSP or GDPR the clean option is to remove the trigger. In the default layout the button is a media-google-cast-button wrapped in .vds-google-cast-tooltip, so hide the wrapper:

.vds-google-cast-tooltip { display: none !important; }

With the button gone nothing calls requestGoogleCast(), so cast_sender.js is never requested. If you build a custom layout, just do not render <media-google-cast-button>.

Vimeo / YouTube

These are iframe embeds, so they inherently talk to the third party. If you do not want that, do not accept Vimeo/YouTube sources in the plugin; with only self hosted files the oEmbed call never happens.

For CSP, that leaves script-src 'self' working as long as hls/dash are self hosted and the cast button is hidden.