All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

• mastodon:iframe setting (off by default). Mastodon oEmbed html (blockquote.mastodon-embed with data-embed-url) becomes a sandboxed <iframe> to the post's /embed page, so no embed.js is needed. Only same-host https embed URLs are used
• Bilibili adapter: bilibili.com/video/BV... and av... URLs (also b23.tv short links) get a player.bilibili.com iframe built from the URL. The title, description and image of Bilibili's error pages ("出错啦!" and "视频去哪了呢？") are ignored, and so is a description template that was never filled #243
• Youku adapter: v.youku.com/v_show/id_<ID>.html URLs get a player.youku.com/embed iframe built from the URL #243
• NetEase Music adapter: songs, albums and playlists on music.163.com get an outchain/player iframe, and the author is read from the description. URLs with a #/ route are requested without it. MV pages (/mv?id= and /#/mv?id=) get metadata only, because NetEase has no official embeddable MV player #243
• Extractor::normalizeUri(), used by adapters to rewrite a URL before it is requested

• TLS verification is on by default. CurlClient now sends CURLOPT_SSL_VERIFYPEER true and CURLOPT_SSL_VERIFYHOST 2 unless told otherwise, so self-signed, expired and wrong-host certificates are rejected (curl error 60). Before, both checks were off when the settings were missing #575
• A null ssl_verify_peer or ssl_verify_host now means the default (verification on). Explicit 0, false, '0' and '' still disable it

To disable verification, which is not recommended, pass the existing settings:

$client = new Embed\Http\CurlClient();
$client->setSettings(['ssl_verify_peer' => false, 'ssl_verify_host' => 0]);
$embed = new Embed\Embed(new Embed\Http\Crawler($client));

• Kick adapter. Channel pages embed https://player.kick.com/<slug> (16:9). Video pages read the title, thumbnail and author name from Kick's public API. Clips have no embed code because Kick does not document a clip player

• An Open Graph video served as HLS (.m3u8, application/x-mpegURL or application/vnd.apple.mpegurl, also read from og:video:type) no longer produces an <iframe> pointing to the playlist
• Twitch video iframes use the documented video=v<ID> parameter instead of id
• Twitch clip URLs (clips.twitch.tv/<slug> and twitch.tv/<channel>/clip/<slug>) produce a clips.twitch.tv/embed iframe when twitch:parent is set

• oEmbed responses of type photo without html now produce an <img> embed code from their url, width and height #584

• JSON-LD remote contexts are never fetched. A page-supplied @context is not requested, so it cannot bypass the URL policy or follow redirects. schema.org contexts are resolved from a bundled vocabulary; any other remote context is skipped #573

• Block requests to non-public addresses before they are sent, including redirects, page-declared oEmbed endpoints, adapter APIs, and meta-refresh targets. Private and loopback URLs are rejected unless UrlPolicy::allowPrivateNetworks() or withAllowedHosts() is used #573

• Embed\Http\UrlPolicy and Embed\Http\BlockedRequestException, configurable from Crawler::setUrlPolicy()

• A negative max_redirs, which curl treated as unlimited, now follows at most 50 redirects
• Reaching that limit is still curl error 47. The message is Number of redirects hit maximum amount rather than curl's Maximum (N) redirects followed

• resolveUri() dropped the port of the base URL
• Read every curl_multi_info_read message in the parallel client instead of only one per iteration

• Access tokens are now optional with Meta (Facebook & Instagram) #577

• Updated tests

• Add PHPStan Static Analysis (Level Max + Strict Rules) #562
• Add support for Facebook reel URLs #572
• Update oEmbed endpoints #574

• Make snapshot updates possible without modifying test code #564

• Remove support for discontinued services (chirb.it and sassmeister.com) #565

• Add PHPStan generic type annotations and simplify detector implementations #563
• Update fixtures to pass PHPUnit #559
• wrong mb_encoding_aliases() handling for PHP 8.0+ #560
• Remove calls to curl_close and curl_multi_close on PHP 8.0 and later #569
• Add phpstan.dist.neon to export-ignore in .gitattributes #571

• Adapters hostname detection #556.

• Adapters hostname detection #555.

• Type bug #553.

• Php 8.4 support #551.

• Php 8.4 support #548.

• X.com (Twitter) #540
• Updated oembed resources.

• Updated oEmbed entry points #537

• PHP 7.4 support
• Use correct method for string length #529

• Performance and memory leak issues #525, #527.

• Support for psr/http-message@2 #514, #515

• Href attributes with undefined values #501, #502
• Deprecated warning for var interpolation in PHP 8.2 #506
• Prevent unsupported operand types exception #507

• Some code issues detected by phpstan: #495, #496, #497, #498.
• Fix for quotation marks in redirect URL #499

• Updated oembed endpoints #494

• Error getting data from Linked data #481.

• PHP 8.1 deprecation notice #480.

• Options to customize the CurlClient to perform http queries #474.

• PHP 8.1 deprecation notice #473.

• New settings option twitter:token to use Twitter API to get the data #364 #468.

• Headers not sent properly by curl #466, #467.

• Updated oEmbed endpoints
• Fixed embed code for Instagram #456, #459

• Fixed a possible XML Quadratic Blowup vulnerability.

• Urls of images should include the same url for the $info->image value. #452

• Facebook embed redirects to /login. #450, #451

• Add configured oEmbed query parameters to all oEmbed endpoints #437
• Updated oEmbed endpoints.
• Replaced Travis with Github workflows for testing

• Support for binary files (video, audio, images, etc) #412 #413

• Oembed for facebook photos #405 #406
• Oembed for facebook videos #432 #433
• Added more ways to detect data using meta tags #427
• Bandcamp provider name #429 #430

• New function $embed->setSettings() to pass the settings before get the site info

• PHP 8 compatibility #394
• Facebook and Instagram adapted to the new API changes #392 #399

• New option twitch:parent to fix Twitch embed with iframes #384

• Added datePublished check to PublishedTime extractor #385 #386
• Added @property-read for IDE suppport #387 #388

• Code width and height when the provided value is not numeric (ex: 100%) #380

• Github TypeError exception with some urls #375

• Ignore invalid urls instead throw an exception
• Updated oembed list of endpoints

• Suppport for other non-latin alphabets such Persian or Arabic #366

• Provided a fallback for oEmbed compatible sites like Instagram that redirects to login page #357

• Redirect urls like t.co.

• Added the ignored_errors settings to ignore some curls errors instead throw an exception #355
• Support for Twitch embeds #332

• Ignored linkedData errors #356

• Updated oembed endpoints from oembed.com
• Add support for tiktok.com

• Ability to send settings to CurlClient. Added the cookies_path setting to customize the file used for cookies. #345
• Document::selectCss() function to select elements using css selectors instead xpath (it requires symfony/css-selector)
• Document::removeCss() function to remove elements using css selectors instead xpath (it requires symfony/css-selector)
• Ability to configure OEmbed parameters from the outside using the oembed:query_parameters setting #346

Full library refactoring.

• Support for multiple parallel request with curl_multi
• Support for PSR-7 Http Messages, PSR-17 Http Factories and PSR-18 Http Client
• cms value
• language to detect the page language
• languages to detect urls to versions in different languages
• favicon to detect small favicons (16 or 32px)
• icon to detect big icons (from 48px)

• Changed providers (oEmbed, Html, OpenGraph etc) by independent detectors (title, url, language etc).
• The tags value is renamed to keywords
• Use Psr standards instead custom interfaces.
• Improved tests using cached responses.

• Support for PHP<7.4
• type value (is was very confusing)
• images value
• providerImage (use favicon or icon instead)
• Support for files (pdf, jpg, video, etc).