I saw an email notification of a reply that's apparently since been deleted that showed that it is mocha that's been flagged, which is a devDependency of keycode. That's a red herring in so far as a devDependency of a dependency of video.js won't be installed or executed by using video.js.

That said, we could probably remove keycode. That was useful when browsers were more inconsistent, but KeyboardEvent.key is supported by all browsers we support, so we could switch to that and remove the dependency. It would mean a refactor to use event.key.toLowerCase() === 'x' in place of keycode.isEventKey(event, 'x') etc.

Thank so much for your reply.

so May i ask is it possible to remove that keycode at this stage? Or i should be waiting for next update?

@mister-ben Thanks so much!

#8735

Keycode has been removed in the next release.

Hello, May i ask when this version will update~?

v8.14.1 and newer.

Sorry for the confusion.
I mean may i ask when will the release ;')?