Attributes removed from YouTube iFrame

[dansisan]

Many customers require a minimally permission sandbox attribute on iframe elements, including the YouTube embed iframe. When I add this attribute to the iframe, plyr overwrites the iframe without this attribute.

Expected behaviour

Any attributes on the iframe should be preserved. Alternatively maybe there could be a way to specify attributes in the constructor (I didn't see that if it exists).

Actual behaviour

The sandbox attribute was removed.

Steps to reproduce

Call the constructor on a parent div to the Youtube iframe.

Environment

• Browser: Chrome
• Version: 131.0.6778.140
• Operating System: OSX
• Version: 14.7.2

Console errors (if any)

No errors.

Link to where the bug is happening