devscripts/changelog_override.json - master - githubmirror/yt-dlp

devscripts/changelog_override.json
390 строк22 KB
bashonly
[ie/vimeo] Remove `ios` and `macos` clients (#17290)
23 июл 2026, 13:59
23 июл 2026, 13:5907591f6
[
    {
        "action": "add",
        "when": "29cb20bd563c02671b31dd840139e93dd37150a1",
        "short": "[priority] **A new release type has been added!**\n    * [`nightly`](https://github.com/yt-dlp/yt-dlp/releases/tag/nightly) builds will be made after each push, containing the latest fixes (but also possibly bugs).\n    * When using `--update`/`-U`, a release binary will only update to its current channel (either `stable` or `nightly`).\n    * The `--update-to` option has been added allowing the user more control over program upgrades (or downgrades).\n    * `--update-to` can change the release channel (`stable`, `nightly`) and also upgrade or downgrade to specific tags.\n    * **Usage**: `--update-to CHANNEL`, `--update-to TAG`, `--update-to CHANNEL@TAG`"
    },
    {
        "action": "add",
        "when": "5038f6d713303e0967d002216e7a88652401c22a",
        "short": "[priority] **YouTube throttling fixes!**"
    },
    {
        "action": "remove",
        "when": "2e023649ea4e11151545a34dc1360c114981a236"
    },
    {
        "action": "add",
        "when": "01aba2519a0884ef17d5f85608dbd2a455577147",
        "short": "[priority] YouTube: Improved throttling and signature fixes"
    },
    {
        "action": "change",
        "when": "c86e433c35fe5da6cb29f3539eef97497f84ed38",
        "short": "[extractor/niconico:series] Fix extraction (#6898)",
        "authors": ["sqrtNOT"]
    },
    {
        "action": "change",
        "when": "69a40e4a7f6caa5662527ebd2f3c4e8aa02857a2",
        "short": "[extractor/youtube:music_search_url] Extract title (#7102)",
        "authors": ["kangalio"]
    },
    {
        "action": "change",
        "when": "8417f26b8a819cd7ffcd4e000ca3e45033e670fb",
        "short": "Add option `--color` (#6904)",
        "authors": ["Grub4K"]
    },
    {
        "action": "change",
        "when": "b4e0d75848e9447cee2cd3646ce54d4744a7ff56",
        "short": "Improve `--download-sections`\n    - Support negative time-ranges\n    - Add `*from-url` to obey time-ranges in URL",
        "authors": ["pukkandan"]
    },
    {
        "action": "change",
        "when": "1e75d97db21152acc764b30a688e516f04b8a142",
        "short": "[extractor/youtube] Add `ios` to default clients used\n        - IOS is affected neither by 403 nor by nsig so helps mitigate them preemptively\n        - IOS also has higher bit-rate 'premium' formats though they are not labeled as such",
        "authors": ["pukkandan"]
    },
    {
        "action": "change",
        "when": "f2ff0f6f1914b82d4a51681a72cc0828115dcb4a",
        "short": "[extractor/motherless] Add gallery support, fix groups (#7211)",
        "authors": ["rexlambert22", "Ti4eeT4e"]
    },
    {
        "action": "change",
        "when": "a4486bfc1dc7057efca9dd3fe70d7fa25c56f700",
        "short": "[misc] Revert \"Add automatic duplicate issue detection\"",
        "authors": ["pukkandan"]
    },
    {
        "action": "add",
        "when": "1ceb657bdd254ad961489e5060f2ccc7d556b729",
        "short": "[priority] Security: [[CVE-2023-35934](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-35934)] Fix [Cookie leak](https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-v8mc-9377-rwjj)\n    - `--add-header Cookie:` is deprecated and auto-scoped to input URL domains\n    - Cookies are scoped when passed to external downloaders\n    - Add `cookies` field to info.json and deprecate `http_headers.Cookie`"
    },
    {
        "action": "change",
        "when": "b03fa7834579a01cc5fba48c0e73488a16683d48",
        "short": "[ie/twitter] Revert 92315c03774cfabb3a921884326beb4b981f786b",
        "authors": ["pukkandan"]
    },
    {
        "action": "change",
        "when": "fcd6a76adc49d5cd8783985c7ce35384b72e545f",
        "short": "[test] Add tests for socks proxies (#7908)",
        "authors": ["coletdjnz"]
    },
    {
        "action": "change",
        "when": "4bf912282a34b58b6b35d8f7e6be535770c89c76",
        "short": "[rh:urllib] Remove dot segments during URL normalization (#7662)",
        "authors": ["coletdjnz"]
    },
    {
        "action": "change",
        "when": "59e92b1f1833440bb2190f847eb735cf0f90bc85",
        "short": "[rh:urllib] Simplify gzip decoding (#7611)",
        "authors": ["Grub4K"]
    },
    {
        "action": "add",
        "when": "c1d71d0d9f41db5e4306c86af232f5f6220a130b",
        "short": "[priority] **The minimum *recommended* Python version has been raised to 3.8**\nSince Python 3.7 has reached end-of-life, support for it will be dropped soon. [Read more](https://github.com/yt-dlp/yt-dlp/issues/7803)"
    },
    {
        "action": "add",
        "when": "61bdf15fc7400601c3da1aa7a43917310a5bf391",
        "short": "[priority] Security: [[CVE-2023-40581](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40581)] [Prevent RCE when using `--exec` with `%q` on Windows](https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-42h4-v29r-42qg)\n    - The shell escape function is now using `\"\"` instead of `\\\"`.\n    - `utils.Popen` has been patched to properly quote commands."
    },
    {
        "action": "change",
        "when": "8a8b54523addf46dfd50ef599761a81bc22362e6",
        "short": "[rh:requests] Add handler for `requests` HTTP library (#3668)\n\n\tAdds support for HTTPS proxies and persistent connections (keep-alive)",
        "authors": ["bashonly", "coletdjnz", "Grub4K"]
    },
    {
        "action": "add",
        "when": "1d03633c5a1621b9f3a756f0a4f9dc61fab3aeaa",
        "short": "[priority] **The release channels have been adjusted!**\n\t* [`master`](https://github.com/yt-dlp/yt-dlp-master-builds) builds are made after each push, containing the latest fixes (but also possibly bugs). This was previously the `nightly` channel.\n\t* [`nightly`](https://github.com/yt-dlp/yt-dlp-nightly-builds) builds are now made once a day, if there were any changes."
    },
    {
        "action": "add",
        "when": "f04b5bedad7b281bee9814686bba1762bae092eb",
        "short": "[priority] Security: [[CVE-2023-46121](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46121)] Patch [Generic Extractor MITM Vulnerability via Arbitrary Proxy Injection](https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-3ch3-jhc6-5r8x)\n\t- Disallow smuggling of arbitrary `http_headers`; extractors now only use specific headers"
    },
    {
        "action": "change",
        "when": "15f22b4880b6b3f71f350c64d70976ae65b9f1ca",
        "short": "[webvtt] Allow spaces before newlines for CueBlock (#7681)",
        "authors": ["TSRBerry"]
    },
    {
        "action": "change",
        "when": "4ce57d3b873c2887814cbec03d029533e82f7db5",
        "short": "[ie] Support multi-period MPD streams (#6654)",
        "authors": ["alard", "pukkandan"]
    },
    {
        "action": "change",
        "when": "aa7e9ae4f48276bd5d0173966c77db9484f65a0a",
        "short": "[ie/xvideos] Support new URL format (#9502)",
        "authors": ["sta1us"]
    },
    {
        "action": "remove",
        "when": "22e4dfacb61f62dfbb3eb41b31c7b69ba1059b80"
    },
    {
        "action": "change",
        "when": "e3a3ed8a981d9395c4859b6ef56cd02bc3148db2",
        "short": "[cleanup:ie] No `from` stdlib imports in extractors",
        "authors": ["pukkandan"]
    },
    {
        "action": "add",
        "when": "9590cc6b4768e190183d7d071a6c78170889116a",
        "short": "[priority] Security: [[CVE-2024-22423](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22423)] [Prevent RCE when using `--exec` with `%q` on Windows](https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-hjq6-52gw-2g7p)\n    - The shell escape function now properly escapes `%`, `\\` and `\\n`.\n    - `utils.Popen` has been patched accordingly."
    },
    {
        "action": "change",
        "when": "41ba4a808b597a3afed78c89675a30deb6844450",
        "short": "[ie/tiktok] Extract via mobile API only if extractor-arg is passed (#9938)",
        "authors": ["bashonly"]
    },
    {
        "action": "remove",
        "when": "6e36d17f404556f0e3a43f441c477a71a91877d9"
    },
    {
        "action": "change",
        "when": "beaf832c7a9d57833f365ce18f6115b88071b296",
        "short": "[ie/soundcloud] Add `formats` extractor-arg (#10004)",
        "authors": ["bashonly", "Grub4K"]
    },
    {
        "action": "change",
        "when": "5c019f6328ad40d66561eac3c4de0b3cd070d0f6",
        "short": "[cleanup] Misc (#9765)",
        "authors": ["bashonly", "Grub4K", "seproDev"]
    },
    {
        "action": "change",
        "when": "e6a22834df1776ec4e486526f6df2bf53cb7e06f",
        "short": "[ie/orf:on] Add `prefer_segments_playlist` extractor-arg (#10314)",
        "authors": ["seproDev"]
    },
    {
        "action": "add",
        "when": "6aaf96a3d6e7d0d426e97e11a2fcf52fda00e733",
        "short": "[priority] Security: [[CVE-2024-38519](https://nvd.nist.gov/vuln/detail/CVE-2024-38519)] [Properly sanitize file-extension to prevent file system modification and RCE](https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-79w7-vh3h-8g4j)\n    - Unsafe extensions are now blocked from being downloaded"
    },
    {
        "action": "add",
        "when": "6075a029dba70a89675ae1250e7cdfd91f0eba41",
        "short": "[priority] Security: [[ie/douyutv] Do not use dangerous javascript source/URL](https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-3v33-3wmw-3785)\n    - A dependency on potentially malicious third-party JavaScript code has been removed from the Douyu extractors"
    },
    {
        "action": "add",
        "when": "fb8b7f226d251e521a89b23c415e249e5b788e5c",
        "short": "[priority] **The minimum *recommended* Python version has been raised to 3.9**\nSince Python 3.8 will reach end-of-life in October 2024, support for it will be dropped soon. [Read more](https://github.com/yt-dlp/yt-dlp/issues/10086)"
    },
    {
        "action": "change",
        "when": "b31b81d85f00601710d4fac590c3e4efb4133283",
        "short": "[ci] Rerun failed tests (#11143)",
        "authors": ["Grub4K"]
    },
    {
        "action": "add",
        "when": "a886cf3e900f4a2ec00af705f883539269545609",
        "short": "[priority] **py2exe is no longer supported**\nThis release's `yt-dlp_min.exe` will be the last, and it's actually a PyInstaller-bundled executable so that yt-dlp users updating their py2exe build with `-U` will be automatically migrated. [Read more](https://github.com/yt-dlp/yt-dlp/issues/10087)"
    },
    {
        "action": "add",
        "when": "a886cf3e900f4a2ec00af705f883539269545609",
        "short": "[priority] **Following this release, yt-dlp's Python dependencies *must* be installed using the `default` group**\nIf you're installing yt-dlp with pip/pipx or requiring yt-dlp in your own Python project, you'll need to specify `yt-dlp[default]` if you want to also install yt-dlp's optional dependencies (which were previously included by default). [Read more](https://github.com/yt-dlp/yt-dlp/pull/11255)"
    },
    {
        "action": "add",
        "when": "87884f15580910e4e0fe0e1db73508debc657471",
        "short": "[priority] **Beginning with this release, yt-dlp's Python dependencies *must* be installed using the `default` group**\nIf you're installing yt-dlp with pip/pipx or requiring yt-dlp in your own Python project, you'll need to specify `yt-dlp[default]` if you want to also install yt-dlp's optional dependencies (which were previously included by default). [Read more](https://github.com/yt-dlp/yt-dlp/pull/11255)"
    },
    {
        "action": "add",
        "when": "d784464399b600ba9516bbcec6286f11d68974dd",
        "short": "[priority] **The minimum *required* Python version has been raised to 3.9**\nPython 3.8 reached its end-of-life on 2024.10.07, and yt-dlp has now removed support for it. As an unfortunate side effect, the official `yt-dlp.exe` and `yt-dlp_x86.exe` binaries are no longer supported on Windows 7. [Read more](https://github.com/yt-dlp/yt-dlp/issues/10086)"
    },
    {
        "action": "change",
        "when": "914af9a0cf51c9a3f74aa88d952bee8334c67511",
        "short": "Expand paths in `--plugin-dirs` (#11334)",
        "authors": ["bashonly"]
    },
    {
        "action": "change",
        "when": "c29f5a7fae93a08f3cfbb6127b2faa75145b06a0",
        "short": "[ie/generic] Do not impersonate by default (#11336)",
        "authors": ["bashonly"]
    },
    {
        "action": "change",
        "when": "57212a5f97ce367590aaa5c3e9a135eead8f81f7",
        "short": "[ie/vimeo] Fix API retries (#11351)",
        "authors": ["bashonly"]
    },
    {
        "action": "add",
        "when": "52c0ffe40ad6e8404d93296f575007b05b04c686",
        "short": "[priority] **Login with OAuth is no longer supported for YouTube**\nDue to a change made by the site, yt-dlp is no longer able to support OAuth login for YouTube. [Read more](https://github.com/yt-dlp/yt-dlp/issues/11462#issuecomment-2471703090)"
    },
    {
        "action": "change",
        "when": "76ac023ff02f06e8c003d104f02a03deeddebdcd",
        "short": "[ie/youtube:tab] Improve shorts title extraction (#11997)",
        "authors": ["bashonly", "d3d9"]
    },
    {
        "action": "add",
        "when": "88eb1e7a9a2720ac89d653c0d0e40292388823bb",
        "short": "[priority] **New option `--preset-alias`/`-t` has been added**\nThis provides convenient predefined aliases for common use cases. Available presets include `mp4`, `mp3`, `mkv`, `aac`, and `sleep`. See [the README](https://github.com/yt-dlp/yt-dlp/blob/master/README.md#preset-aliases) for more details."
    },
    {
        "action": "remove",
        "when": "d596824c2f8428362c072518856065070616e348"
    },
    {
        "action": "remove",
        "when": "7b81634fb1d15999757e7a9883daa6ef09ea785b"
    },
    {
        "action": "remove",
        "when": "500761e41acb96953a5064e951d41d190c287e46"
    },
    {
        "action": "add",
        "when": "f3008bc5f89d2691f2f8dfc51b406ef4e25281c3",
        "short": "[priority] **Default behaviour changed from `--mtime` to `--no-mtime`**\nyt-dlp no longer applies the server modified time to downloaded files by default. [Read more](https://github.com/yt-dlp/yt-dlp/issues/12780)"
    },
    {
        "action": "add",
        "when": "959ac99e98c3215437e573c22d64be42d361e863",
        "short": "[priority] Security: [[CVE-2025-54072](https://nvd.nist.gov/vuln/detail/CVE-2025-54072)] [Fix `--exec` placeholder expansion on Windows](https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-45hg-7f49-5h56)\n    - When `--exec` is used on Windows, the filepath expanded from `{}` (or the default placeholder) is now properly escaped"
    },
    {
        "action": "change",
        "when": "b831406a1d3be34c159835079d12bae624c43610",
        "short": "[ie/rtve.es:program] Add extractor (#12955)",
        "authors": ["meGAmeS1", "seproDev"]
    },
    {
        "action": "add",
        "when": "23c658b9cbe34a151f8f921ab1320bb5d4e40a4d",
        "short": "[priority] **The minimum *recommended* Python version has been raised to 3.10**\nSince Python 3.9 will reach end-of-life in October 2025, support for it will be dropped soon. [Read more](https://github.com/yt-dlp/yt-dlp/issues/13858)"
    },
    {
        "action": "add",
        "when": "cc5a5caac5fbc0d605b52bde0778d6fd5f97b5ab",
        "short": "[priority] **darwin_legacy_exe builds are being discontinued**\nThis release's `yt-dlp_macos_legacy` binary will likely be the last one. [Read more](https://github.com/yt-dlp/yt-dlp/issues/13856)"
    },
    {
        "action": "add",
        "when": "c76ce28e06c816eb5b261dfb6aff6e69dd9b7382",
        "short": "[priority] **linux_armv7l_exe builds are being discontinued**\nThis release's `yt-dlp_linux_armv7l` binary could be the last one. [Read more](https://github.com/yt-dlp/yt-dlp/issues/13976)"
    },
    {
        "action": "add",
        "when": "08d78996831bd8e1e3c2592d740c3def00bbf548",
        "short": "[priority] **Several options have been deprecated**\nIn order to simplify the codebase and reduce maintenance burden, various options have been deprecated. Please remove them from your commands/configurations. [Read more](https://github.com/yt-dlp/yt-dlp/issues/14198)"
    },
    {
        "action": "add",
        "when": "4e6a693057cfaf1ce1f07b019ed3bfce2bf936f6",
        "short": "[priority] **The minimum *required* Python version has been raised to 3.10**\nPython 3.9 has reached its end-of-life as of October 2025, and yt-dlp has now removed support for it. [Read more](https://github.com/yt-dlp/yt-dlp/issues/13858)"
    },
    {
        "action": "add",
        "when": "2c9091e355a7ba5d1edb69796ecdca48199b77fb",
        "short": "[priority] **A stopgap release with a *TEMPORARY partial* fix for YouTube support**\nSome formats may still be unavailable, especially if cookies are passed to yt-dlp. The ***NEXT*** release, expected very soon, **will require an external JS runtime (e.g. Deno)** in order for YouTube downloads to work properly. [Read more](https://github.com/yt-dlp/yt-dlp/issues/14404)"
    },
    {
        "action": "change",
        "when": "8636a9bac3bed99984c1e297453660468ecf504b",
        "short": "Fix 6224a3898821965a7d6a2cb9cc2de40a0fd6e6bc",
        "authors": ["Grub4K"]
    },
    {
        "action": "add",
        "when": "6224a3898821965a7d6a2cb9cc2de40a0fd6e6bc",
        "short": "[priority] **An external JavaScript runtime is now required for full YouTube support**\nyt-dlp now requires users to have an external JavaScript runtime (e.g. Deno) installed in order to solve the JavaScript challenges presented by YouTube. [Read more](https://github.com/yt-dlp/yt-dlp/issues/15012)"
    },
    {
        "action": "change",
        "when": "c63b4e2a2b81cc78397c8709ef53ffd29bada213",
        "short": "[cleanup] Misc (#14767)",
        "authors": ["bashonly", "seproDev", "matyb08"]
    },
    {
        "action": "change",
        "when": "abf29e3e72e8a4dcae61e2ceaf37ce8405af61ab",
        "short": "[ie/youtube] Fix `player_skip=js` extractor-arg (#15428)",
        "authors": ["bashonly"]
    },
    {
        "action": "change",
        "when": "e2ea6bd6ab639f910b99e55add18856974ff4c3a",
        "short": "[ie] Fix prioritization of Youtube URL matching (#15596)",
        "authors": ["Grub4K"]
    },
    {
        "action": "add",
        "when": "1fbbe29b99dc61375bf6d786f824d9fcf6ea9c1a",
        "short": "[priority] Security: [[CVE-2026-26331](https://nvd.nist.gov/vuln/detail/CVE-2026-26331)] [Arbitrary command injection with the `--netrc-cmd` option](https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-g3gw-q23r-pgqm)\n    - The argument passed to the command in `--netrc-cmd` is now limited to a safe subset of characters"
    },
    {
        "action": "add",
        "when": "98e42eb04486e00bf86479b24dbfe19321f652ee",
        "short": "[priority] **The minimum supported versions of Deno, Node, and Bun have been raised.**\n The minimum required version of [Deno](https://github.com/yt-dlp/yt-dlp/issues/16767) is now `v2.3.0`; supported [Node](https://github.com/yt-dlp/yt-dlp/issues/16765) versions are `v22` and up; [Bun support has been deprecated](https://github.com/yt-dlp/yt-dlp/issues/16766) and limited to versions `1.2.11` through `1.3.14`."
    },
    {
        "action": "add",
        "when": "5faffa999fd33b373d47773e8ee639d072accec2",
        "short": "[priority] Security: Usage of vulnerable conversions (e.g. `%()s`) with the `--exec` option is an all-too-common pitfall. To remedy this, `--exec` now only allows safe conversions in its command templates.\n        - Most users can simply replace `%(...)s` with `%(...)q` in their `--exec` argument(s). Numeric conversions are unaffected by this change. Using unsafe conversions with `--exec` poses a significant security risk. [Read more](<https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-69qj-pvh9-c5wg>)"
    },
    {
        "action": "add",
        "when": "e578e265f7c6ca94a74b30e0d8d6196a4d19fb6a",
        "short": "[priority] Security: [[CVE-2026-50023](https://nvd.nist.gov/vuln/detail/CVE-2026-50023)] [Dangerous file type creation via insufficient filename sanitization](https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-c6mh-fpjc-4pr3)\n        - Writing files with the extensions `.desktop`, `.url`, or `.webloc` is now only allowed in the context of `--write-link` functionality"
    },
    {
        "action": "add",
        "when": "2726572520238356bcf64aba2040228648b44c82",
        "short": "[priority] Security: [[CVE-2026-50019](https://nvd.nist.gov/vuln/detail/CVE-2026-50019)] [File Downloader cookie leak with curl](https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-f7j3-774f-rfhj)\n        - Impact is limited to users of `--downloader curl`; cookies are now properly passed to curl so that it respects their scope"
    },
    {
        "action": "add",
        "when": "25056f0d2d47adbd235a8d422fa62d68d0be2bc2",
        "short": "[priority] Security: [[CVE-2026-50574](https://nvd.nist.gov/vuln/detail/CVE-2026-50574)] [Arbitrary code execution via manifest downloads with aria2c](https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-vx4q-3cr2-7cg2)\n        - Impact is limited to users of `--downloader aria2c`\n        - Support for downloading HLS and DASH formats with aria2c has been removed. Users affected by this change should migrate to use `-N` for concurrent fragment downloads via the native downloader"
    },
    {
        "action": "add",
        "when": "7b03011294c0210802ffc901390006c39152b999",
        "short": "[priority] **The minimum *recommended* Python version has been raised to 3.11**\n        - Since Python 3.10 will reach its end-of-life in October 2026, support for it will be dropped soon. [Read more](https://github.com/yt-dlp/yt-dlp/issues/16916)"
    },
    {
        "action": "add",
        "when": "7b03011294c0210802ffc901390006c39152b999",
        "short": "[priority] **The official Windows release binaries will soon require Windows 10 or later.** [Read more](https://github.com/yt-dlp/yt-dlp/issues/16917)"
    },
    {
        "action": "add",
        "when": "b6590aaa1e3808155d69c9a79a797ae484163789",
        "short": "[priority] Security: [[CVE-2026-55404](https://nvd.nist.gov/vuln/detail/CVE-2026-55404)] [Downstream command injection via improper sanitization of --write-link output](https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-6v4j-43gg-vj32)\n        - Shortcut file data is now properly validated and sanitized when the `--write-link` options are used"
    },
    {
        "action": "remove",
        "when": "a8be438aac1b90c3888e974056d967b8be90fa7e"
    }
]