chore(deps): update dependency yt-dlp/yt-dlp to v2026

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
yt-dlp/yt-dlp	major	2025.10.14 → 2026.07.04

---

Release Notes

yt-dlp/yt-dlp (yt-dlp/yt-dlp)

v2026.07.04

Compare Source

Important changes

• The minimum recommended Python version has been raised to 3.11
  - Since Python 3.10 will reach its end-of-life in October 2026, support for it will be dropped soon. Read more
• The official Windows release binaries will soon require Windows 10 or later. Read more
• Security: [CVE-2026-55404] Downstream command injection via improper sanitization of --write-link output
  - Shortcut file data is now properly validated and sanitized when the --write-link options are used

Core changes

• Always include warnings in debug output (#​17059) by bashonly
• Fix allow-unsafe-ext compat option (#​16920) by bashonly
• Raise minimum recommended Python version to 3.11 (#​17034) by bashonly
• Validate and escape values in --write-link output by bashonly
• cookies: Use ' instead of " for SQL string quoting (#​17078) by Grub4K
• utils
  • Deprecate make_dir in favor of make_parent_dirs (#​16931) by doe1080
  • HTTPHeaderDict: Fix __ior__ (#​16930) by doe1080
  • parse_duration: Return int when appropriate (#​13899) by doe1080
  • parse_resolution: Support fps suffixes (#​17073) by doe1080
  • pkcs1pad: Fix invalid PKCS#1 v1.5 padding bytes (#​17035) by doe1080
  • qualities: Avoid repeated index lookups (#​17025) by doe1080
  • random_user_agent: Bump version range 143-149 => 144-150 (#​17117) by bashonly, dlp-bot

Extractor changes

• Always include id in request error output (#​17068) by bashonly, HybridDog
• Fix request logging (#​17072) by bashonly
• arte: Fix playlist support (#​13191) by 1100101
• bandcamp: weekly: Fix extractor (#​16925) by bashonly (With fixes in 9055188)
• bilibili: Fix API extraction (#​13730) by grqz
• instagram
  • Detect when cookies are invalidated (#​17126) by bashonly
  • Rework extractor (#​17075) by bashonly (With fixes in 8b8e3e3)
• linkedin: Remove broken login support (#​17039) by 0xvd
• mgtv: Fix VIP stream extraction (#​16982) by longcharmroeun
• mxplayer
  • Fix extractors (#​16988) by 0xvd
  • Rework extractors (#​17018) by doe1080
• niconico
  • Fix error detection (#​16991) by doe1080
  • Support shorts (#​16992) by doe1080
• omnyfm: Add extractors (#​15942) by doe1080
• openrec: Rework extractors (#​16857) by doe1080 (With fixes in 6694ef8)
• patreon: Support new URL format (#​16926) by 0xvd
• peertube: Support password-protected videos (#​16873) by selfhoster1312
• periscope: Improve metadata extraction (#​16084) by doe1080
• reddit: Remove broken login support (#​17038) by 0xvd
• soundcloud
  • Extract uploader_url for playlists (#​16842) by noseb13eds
  • Extract comments (#​16938) by 0xvd
  • Improve metadata extraction (#​17088) by noseb13eds
• streaks: Fix extractor (#​16413) by doe1080
• svt: Fix extractor (#​16288) by billauer, dirkf
• telewebion: Fix extractor (#​16986) by BOplaid
• trovo: Remove dead extractors (#​16353) by doe1080
• truth: Support share URLs (#​16096) by InvalidUsernameException
• tviplayer: Fix extractor (#​16527) by FranciscoPombal
• unsupported: Update unsupported sites (#​17085) by bashonly
• wrestleuniverse: vod: Fix extractor (#​16685) by 0xvd, bashonly, Sec-Wayne, tewhalen
• youtube
  • Fix extract_relative_time for abbreviated units (#​16687) by dialmaster
  • Fix detection of forced preroll wait time (#​17062) by bashonly
  • Fix minor issues (#​17060) by doe1080
  • Support live adaptive formats (#​16771) by dreammu
  • tab
    • Fix flat extraction of collaborators (#​17045) by bashonly
    • Fix flat playlist metadata extraction (#​16965) by bashonly
    • Fix metadata extraction (#​16976) by bashonly
    • Fix pagination (#​16948) by bashonly
• zan: Add extractor (#​16086) by doe1080
• zdf: Detect livestreams (#​16954) by InvalidUsernameException
• zoom: clips: Add extractor (#​17005) by Bnyro

Downloader changes

• external
  • Fix resuming downloads with aria2c (#​11698) by tcely
  • curl: Support development versions (#​16922) by syphyr
• mhtml: Fix storyboard content-length calculation (#​13998) by Masterjun3

Misc. changes

• build
  • Update 17 dependencies (#​17014) by dlp-bot
  • Update 6 dependencies (#​17086) by dlp-bot
• ci
  • Add label handler workflow (#​17128) by bashonly
  • Bump actions/checkout v6.0.3 => v7.0.0 (#​17015) by dlp-bot
  • Update 5 actions in 8 workflows (#​17024) by dlp-bot
• cleanup
  • Fix invalid info dict fields (#​17007) by seproDev
  • Fix minor mistakes (#​17083) by doe1080
  • Remove RTSP and MMS support (#​17030) by seproDev
  • Replace dead example/test URL (#​17061) by bashonly
  • Miscellaneous: 997fa14 by bashonly, seproDev
• docs: Make "No AI / No LLM Policy" abundantly clear (#​16285) by bashonly

v2026.06.09

Compare Source

Important changes

• The minimum supported versions of Deno, Node, and Bun have been raised.
  The minimum required version of Deno is now v2.3.0; supported Node versions are v22 and up; Bun support has been deprecated and limited to versions 1.2.11 through 1.3.14.
• Security
  • Usage of vulnerable conversions (e.g. %()s) with the --exec option is an all-too-common pitfall. To remedy this, --exec now only allows safe conversions in its command templates.
    • Most users can simply replace %(...)s with %(...)q in their --exec argument(s). Numeric conversions are unaffected by this change. Using unsafe conversions with --exec poses a significant security risk. Read more
  • [CVE-2026-50019] File Downloader cookie leak with curl
    • Impact is limited to users of --downloader curl; cookies are now properly passed to curl so that it respects their scope
  • [CVE-2026-50023] Dangerous file type creation via insufficient filename sanitization
    • Writing files with the extensions .desktop, .url, or .webloc is now only allowed in the context of --write-link functionality
  • [CVE-2026-50574] Arbitrary code execution via manifest downloads with aria2c
    • Impact is limited to users of --downloader aria2c
    • Support for downloading HLS and DASH formats with aria2c has been removed. Users affected by this change should migrate to use -N for concurrent fragment downloads via the native downloader

Core changes

• Add lockfile and pinned extras (#​16421) by bashonly, Grub4K (With fixes in 88c8a68 by bashonly)
• Fix default extra for ios platforms (#​16376) by bashonly
• Remove url, desktop and webloc from safe extensions by Grub4K
• update: Bump GitHub REST API version to 2026-03-10 (#​16435) by bashonly
• utils
  • random_user_agent
    • Bump version range 137-143 => 142-148 (#​16588) by dlp-bot
    • Bump version range 142-148 => 143-149 (#​16906) by dlp-bot

Extractor changes

• Extract supplemental codecs from DASH manifests (#​16827) by chrisellsworth
• _resolve_nuxt_array: Handle Pinia skipHydrate (#​16447) by doe1080
• abematv: Extract subtitles (#​16502) by garret1317
• ard: Support new ardsounds domain (#​16381) by evilpie
• bandcamp: weekly: Fix extractor (#​16373) by bashonly
• iwara: Fix extractors (#​16014) by vpertys
• monstercat: Support older URLs (#​16780) by AnAwesomGuy
• onsen: Fix extraction (#​16830) by doe1080
• pornhub: Support browser impersonation (#​16794) by 0xvd
• reddit: Fix unauthenticated extraction (#​16839) by 0xvd, bashonly, jdesgats
• rtp: Support multi-part episodes and --no-playlist (#​16299) by bashonly
• s4c: Extract more metadata (#​16813) by Suntooth
• soop: Adapt extractors to new domain (#​16436) by thematuu
• soundcloud
  • Improve error handling (#​16602) by bashonly
  • Support --extractor-retries for original formats (#​16690) by HarmfulBreeze
• thisoldhouse: Fix extractor (#​16909) by bashonly, dirkf
• twitch
  • Remove dead rechat subtitles (#​16660) by kasper93
  • clips: Fix extractor (#​16466) by Ventriduct
• twitter: Fix view_count extraction (#​16814) by MemoKing34
• wikimedia: Rework extractor (#​15413) by seproDev
• youtube
  • Drop support for bun<1.2.11 and bun>1.3.14 (#​16786) by bashonly
  • Drop support for deno<2.3.0 (#​16788) by bashonly
  • Drop support for node<22 (#​16787) by bashonly
  • Fix PO token sanitization for Python 3.15 (#​16884) by Grub4K
  • Fix PO token sanitization for Python>=3.14.4 (#​16453) by syphyr
  • Fix outdated quickjs-ng warning (#​16437) by bashonly

Downloader changes

• external
  • aria2c: Remove support for m3u8/dash protocols by bashonly
  • curl: Fix cookie leak on redirect by Grub4K
• ffmpeg: Use info dict http_headers for direct merge downloads (#​15456) by bashonly

Postprocessor changes

• exec: Restrict --exec template usage to safe conversions (#​16883) by bashonly
• ffmpegmetadata: Avoid erroneous ISO 639 conversions (#​16046) by bashonly

Networking changes

• Request Handler
  • curl_cffi
    • Add actual reason to response (#​16818) by antorlovsky
    • Fix supported impersonate targets (#​16440) by bashonly
    • Support curl_cffi 0.15.x (#​16429) by bashonly

Misc. changes

• build
  • Harden build/release workflows (#​16358) by bashonly, Grub4K (With fixes in cdc465a by bashonly)
  • Harden release workflow (#​16444) by bashonly
  • Rename requirements files to clean up dependency graph (#​16740) by bashonly
  • Update 12 dependencies (#​16903) by dlp-bot
  • Update 14 dependencies (#​16589) by dlp-bot
  • Update 28 dependencies (#​16467) by bashonly
  • Upgrade all Linux binaries to Python 3.14 (#​16738) by bashonly
• ci
  • Bump pytest to 9.x (#​16470) by bashonly, Grub4K
  • Test with Python 3.15 (#​16896) by bashonly
  • Update 2 actions in 2 workflows (#​16743) by dlp-bot
  • Update 3 actions in 9 workflows (#​16782) by dlp-bot
  • Update 8 actions in 7 workflows (#​16384) by bashonly
  • Update wiki via this repository (#​16446) by bashonly (With fixes in 9f0fc9a)
• cleanup
  • Remove dead extractors (#​16137) by bashonly, doe1080
  • Miscellaneous
    • 35684c1, 3a12be7 by bashonly
    • 821bef0 by bashonly, Grub4K
• devscripts
  • Handle ejs updates for requirements files (#​16374) by bashonly, Grub4K
  • update_requirements: Add reporting functionality (#​16454) by bashonly, Grub4K
• docs: Update badges (#​14893) by seproDev
• test: Add default and curl-cffi extras to hatch-test env (#​16397) by JSubelj

v2026.03.17

Compare Source

Extractor changes

• youtube
  • Always respect webpage_client extractor-arg (#​16250) by bashonly
  • Fix --live-from-start support (#​16254) by bashonly
  • Update ejs to 0.8.0 (#​16269) by bashonly, Grub4K

Misc. changes

• build: Use PyInstaller v6.19.0 for Windows (#​16265) by bashonly
• ci: Bump actions pins (#​16252) by bashonly
• docs: Fix player_client extractor-arg documentation (#​16235) by bashonly
• test: networking: Mark all CurlCFFIRH tests as flaky for any OS (#​16266) by bashonly

v2026.03.13

Compare Source

Extractor changes

• tiktok: Fix challenge solving (#​16223) by bashonly
• youtube
  • Fix android_vr player client (#​16168) by gamer191
  • Fix use_ad_playback_context extractor-arg (#​16196) by bashonly
  • Fix web_embedded player client (#​16177) by bashonly, SparseOrnament15
  • Request web_safari & web_creator client configs (#​16198) by bashonly
  • Update ejs to 0.7.0 (#​16231) by bashonly, Grub4K
  • tab
    • Fix album extraction (#​16041) by FriederHannenheim
    • Improve description extraction (#​16057) by Peter-Devine

v2026.03.03

Compare Source

Extractor changes

• aenetworks: Fix extraction (#​16036) by bashonly
• patreon: Fix extractors (#​16112) by bashonly
• thechosen: Rework extractor (#​16021) by 0xvd
• youtube
  • Force player 9f4cc5e4 (#​16123) by bashonly
  • Skip webpage player response by default (#​16126) by bashonly
• zapiks: Improve extraction (#​16030) by doe1080

v2026.02.21

Compare Source

Important changes

• Security: [CVE-2026-26331] Arbitrary command injection with the --netrc-cmd option
  • The argument passed to the command in --netrc-cmd is now limited to a safe subset of characters

Core changes

• cookies: Ignore cookies with control characters (#​15862) by bashonly, syphyr
• jsinterp
  • Fix bitwise operations (#​15985) by bashonly
  • Stringify bracket notation keys in object access (#​15989) by bashonly
  • Support string concatenation with + and += (#​15990) by bashonly

Extractor changes

• Add browser impersonation support to more extractors (#​16029) by bashonly
• Limit netrc_machine parameter to shell-safe characters by Grub4K
• 1tv: Extract chapters (#​15848) by hunter-gatherer8
• aenetworks: Fix extractor (#​14959) by Sipherdrakon
• applepodcasts: Fix extractor (#​15901) by coreywright
• dailymotion: Fix extraction (#​15995) by bashonly
• facebook: ads: Fix extractor (#​16002) by bashonly
• gem.cbc.ca: Support standalone, series & Olympics URLs (#​15878) by 0xvd, bashonly, makew0rld
• learningonscreen: Fix extractor (#​16028) by 0xvd, bashonly
• locipo: Add extractors (#​15486) by doe1080, gravesducking
• matchitv: Add extractor (#​15204) by gseddon
• odnoklassniki: Fix inefficient regular expression (#​15974) by bashonly
• opencast: Support oc-p.uni-jena.de URLs (#​16026) by LordMZTE
• pornhub: Fix extractor (#​15858) by beacdeac
• saucepluschannel: Add extractor (#​15830) by regulad
• soundcloud
  • Fix client ID extraction (#​16019) by bashonly
  • Support browser impersonation (#​16020) by bashonly
• spankbang
  • Fix playlist title extraction (#​14132) by blauerdorf
  • Support browser impersonation (#​14130) by blauerdorf
• steam: Fix extractor (#​15028) by doe1080
• tele5: Fix extractor (#​16005) by bashonly
• tver: olympic: Add extractor (#​15885) by doe1080
• tvo: Add extractor (#​15903) by doe1080
• twitter: Fix error handling (#​15993) by bashonly (With fixes in 7722109)
• visir: Add extractor (#​15811) by doe1080
• vk: Solve JS challenges using native JS interpreter (#​15992) by 0xvd, bashonly
• xhamster: Fix extractor (#​15831) by 0xvd
• youtube
  • Add more known player JS variants (#​15975) by bashonly
  • Extract live adaptive incomplete formats (#​15937) by bashonly, CanOfSocks
  • Update ejs to 0.5.0 (#​16031) by bashonly
  • date, search: Remove broken ytsearchdate support (#​15959) by stastix

Networking changes

• Request Handler: curl_cffi: Deprioritize unreliable impersonate targets (#​16018) by bashonly

Misc. changes

• cleanup
  • Bump ruff to 0.15.x (#​15951) by Grub4K
  • Miscellaneous: 646bb31 by Grub4K

v2026.02.04

Compare Source

Extractor changes

• unsupported: Update unsupported URLs (#​15812) by doe1080
• youtube: Default to tv player JS variant (#​15818) by bashonly

v2026.01.31

Compare Source

Extractor changes

• soop: Support subscription-only VODs (#​15523) by thematuu
• unsupported: Update unsupported URLs (#​15410) by bashonly
• whyp: Extract more metadata (#​15757) by azdlonky
• youtube
  • Add web_embedded fallback for android_vr client ([#​15785](https://redirect.github.com/y

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.