Repository navigation
Bump yt-dlp from 2026.3.17 to 2026.8.19 - #835
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
🟡 Waiting for changesOutcome: reviewed Last updated: 2026-10-23 01:03 UTC |
rtibblesbot
left a comment
rtibblesbot
left a comment
There was a problem hiding this comment.
PR #835: the YouTube and Vimeo client changes in yt-dlp 2026.8.19 could alter download behavior for chefs on those sites. Please run one YouTube download through ricecooker/utils/youtube.py before merging.
Package: yt-dlp 2026.3.17 → 2026.8.19 (lockfile only; within the pyproject.toml range >=2024.12.23)
- Dependency type: production
- Breaking changes: none. The util helpers
number_of_digitsandrandom_uuidv4are deprecated. - Security fixes: none noted.
- Behavioral changes:
- YouTube:
android_vrremoved from default clients;visionosandweb_embeddedfallbacks added. - Vimeo:
iosandmacosclients removed. ardextractor removed.
- YouTube:
- Compatibility: the project uses
YoutubeDL,ExtractorError,PostProcessingErrorandDownloadError. None are affected. - CI: passing.
Only the 2026.08.19 notes were read, not those of intermediate releases. Nothing else blocks.
@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly
How was this generated?
Ran a dependency-update review pipeline over the version bump:
- Classified the bump by semver and dependency type
- Extracted the changelog and release notes across the version range
- Assessed compatibility with this project's usage
- Treated CI as the primary safety net
- Chose the verdict from semver risk, changelog findings, and CI status
ccfb184 to
41e78be
Compare
rtibblesbot
left a comment
rtibblesbot
left a comment
There was a problem hiding this comment.
PR #835: the YouTube client-default change is still unverified (1 of 1 prior findings open, advisory).
suggestion (still open): run one YouTube download through ricecooker/utils/youtube.py before merging.
yt-dlp 2026.3.17 → 2026.8.19 is a minor calver bump spanning 3 releases. It is a production dependency. Only the lockfile changes; the version stays inside yt-dlp>=2024.12.23. CI passes.
- Security: fixes CVE-2026-50019, CVE-2026-50023, CVE-2026-50574 (2026.06.09) and CVE-2026-55404 (2026.07.04). ricecooker uses none of curl, aria2c,
--execor--write-link. The filename-sanitization fix (50023) applies to every download. - Breaking: removes aria2c HLS/DASH, RTSP/MMS, dead extractors and the YouTube
android_vrdefault client. ricecooker sets noplayer_client, so it takes the new defaults. - Python: 3.11 is now the recommended minimum. 3.10 support will be dropped soon. ricecooker declares
>=3.10, so a later bump will force the floor up. - Monkeypatches: the yt-dlp internals patched at
ricecooker/utils/youtube.py:83-85are unchanged.Popen.rungainedinput=None;**kwargspasses it through. - Lockfile: dependabot's older uv downgraded
revisionto 3. It also droppedgroup-requires-python.uv lock --checkpasses. No other package changed.
Prior-finding status
UNADDRESSED — ricecooker/utils/youtube.py — run a live YouTube download before merging
Written by rtibblesbot, an LLM-based coding agent.
Bumps [yt-dlp](https://github.com/yt-dlp/yt-dlp) from 2026.3.17 to 2026.8.19. - [Release notes](https://github.com/yt-dlp/yt-dlp/releases) - [Changelog](https://github.com/yt-dlp/yt-dlp/blob/master/Changelog.md) - [Commits](yt-dlp/yt-dlp@2026.03.17...2026.08.19) --- updated-dependencies: - dependency-name: yt-dlp dependency-version: 2026.8.19 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
41e78be to
6d7f51c
Compare
rtibblesbot
left a comment
rtibblesbot
left a comment
There was a problem hiding this comment.
PR #835: CI is red on two infra timeouts, and one prior suggestion is still open.
- CI failing (infra):
ubuntu-latest3.11 and 3.13 timed out at 20m inInstall Ubuntu dependencies(run 39866694268). They never ran tests. The other 12 jobs passed. Re-run CI (close and reopen the PR ifgh run rerunis unavailable). - suggestion (open): run a live YouTube download through
ricecooker/utils/youtube.pybefore merging. It confirms the new default clients still work. yt-dlp2026.3.17 → 2026.8.19 is a production dependency (yt-dlp>=2024.12.23). It is calendar-versioned, so treat it as minor risk.- The lockfile now changes only the
yt-dlpentry. - Breaking:
android_vrwas removed from the default YouTube clients. It applies to us because ricecooker sets noplayer_client. - No security or peer-dependency changes.
Prior-finding status
UNADDRESSED — ricecooker/utils/youtube.py — run a live YouTube download before merging (android_vr default-client removal)
RESOLVED — uv.lock — lockfile revision downgraded to 3 and group-requires-python dropped
Written by rtibblesbot, an LLM-based coding agent.
Bumps yt-dlp from 2026.3.17 to 2026.8.19.
Release notes
Sourced from yt-dlp's releases.
... (truncated)
Changelog
Sourced from yt-dlp's changelog.
... (truncated)
Commits
3a08beaRelease 2026.08.19594bd50[cleanup] Misc (#17446)cf68b8f[ie/youtube:tab] Always extract channel metadata (#17386)d3ea2cf[ie/whyp] Fix extractor (#17467)ec9425f[ie/bandcamp] Support browser impersonation (#17422)2bbfb99[ie/twitter:broadcast] Fix events handling (#17323)537ed68[ie/BFMTV] Fix extractor (#16905)370f782[ie/vimeo] Remove brokenmacos_basicclient (#17481)2c0bf96[ie/tiktok] Re-implement impersonation support (#17480)1b00749[build] Update 11 dependencies (#17479)