Skip to content

chore(deps): bump yt-dlp from 2026.3.17 to 2026.6.9 - #7

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/yt-dlp-2026.6.9
Closed

chore(deps): bump yt-dlp from 2026.3.17 to 2026.6.9#7
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/yt-dlp-2026.6.9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 17, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps yt-dlp from 2026.3.17 to 2026.6.9.

Release notes

Sourced from yt-dlp's releases.

yt-dlp 2026.06.09

Installation Discord Donate Documentation Nightly Master

A description of the various files is in the README

The zipimport Unix executable contains code licensed under ISC and MIT. The PyInstaller-bundled executables are subject to these and other licenses, all of which are compiled in THIRD_PARTY_LICENSES.txt

Important changes

  • The minimum supported versions of Deno, Node, and Bun have been raised. The minimum required version of Deno is now v2.3.0; supported Node versions are v22 and up; Bun support has been deprecated and limited to versions 1.2.11 through 1.3.14.
  • Security
    • Usage of vulnerable conversions (e.g. %()s) with the --exec option is an all-too-common pitfall. To remedy this, --exec now only allows safe conversions in its command templates.
      • Most users can simply replace %(...)s with %(...)q in their --exec argument(s). Numeric conversions are unaffected by this change. Using unsafe conversions with --exec poses a significant security risk. Read more
    • [CVE-2026-50019] File Downloader cookie leak with curl
      • Impact is limited to users of --downloader curl; cookies are now properly passed to curl so that it respects their scope
    • [CVE-2026-50023] Dangerous file type creation via insufficient filename sanitization
      • Writing files with the extensions .desktop, .url, or .webloc is now only allowed in the context of --write-link functionality
    • [CVE-2026-50574] Arbitrary code execution via manifest downloads with aria2c
      • Impact is limited to users of --downloader aria2c
      • Support for downloading HLS and DASH formats with aria2c has been removed. Users affected by this change should migrate to use -N for concurrent fragment downloads via the native downloader

Core changes

Extractor changes

... (truncated)

Changelog

Sourced from yt-dlp's changelog.

Changelog

2026.07.04

Important changes

Core changes

Extractor changes

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Jun 17, 2026
@dependabot
chore(deps): bump yt-dlp from 2026.3.17 to 2026.6.9
b4dabd3 
Bumps [yt-dlp](https://github.com/yt-dlp/yt-dlp) from 2026.3.17 to 2026.6.9.
- [Release notes](https://github.com/yt-dlp/yt-dlp/releases)
- [Changelog](https://github.com/yt-dlp/yt-dlp/blob/master/Changelog.md)
- [Commits](yt-dlp/yt-dlp@2026.03.17...2026.06.09)

---
updated-dependencies:
- dependency-name: yt-dlp
  dependency-version: 2026.6.9
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/pip/yt-dlp-2026.6.9 branch from bd704a7 to b4dabd3 Compare July 14, 2026 00:41
@dependabot @github

dependabot Bot commented on behalf of github Jul 28, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #10.

@dependabot dependabot Bot closed this Jul 28, 2026
@dependabot
dependabot Bot deleted the dependabot/pip/yt-dlp-2026.6.9 branch July 28, 2026 12:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants