I have not tried the fix yet because it hasn’t passed all tests yet, but I understand that the onebox will now render like it previously did in the preview, i.e. like a non-video onebox?
What I don’t understand is why it rendered fine in the preview but not the final result.
With the number of onbox issues reported over the past weeks, my impression is that oneboxing is a rather fragile feature in discourse and although I’m not sure if anything can be done about this, it would be nice if this kind of raw html result could somehow be made impossible, i.e. to have some double checking going on that would notice if that happens and revert back to secure grounds.