Skip to content

build(deps): bump streamlink from 6.5.0 to 8.4.0 in /packages/clip-processor-py#596

Open
dependabot[bot] wants to merge 23 commits into
masterfrom
dependabot/uv/packages/clip-processor-py/streamlink-8.4.0
Open

build(deps): bump streamlink from 6.5.0 to 8.4.0 in /packages/clip-processor-py#596
dependabot[bot] wants to merge 23 commits into
masterfrom
dependabot/uv/packages/clip-processor-py/streamlink-8.4.0

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 21, 2026

Bumps streamlink from 6.5.0 to 8.4.0.

Release notes

Sourced from streamlink's releases.

Streamlink 8.4.0

  • SECURITY: fixed arbitrary local file read via file:// URI in HLS and DASH (CVE-2026-44353 / GHSA-hgqw-6m45-hw5f)
  • Added: --stream-passthrough-encrypted for passing through encrypted HLS/DASH segments to the output stream without any checks (#6896)
  • Fixed: --interface selection by name on macOS (#6908)
  • Fixed: --interface not being applied to adapters mounted after session init (#6915)
  • Updated plugins:
    • goltelevision: rewritten and fixed plugin (#6916)
    • twitcasting: improved ad segment filtering (#6910)

📦 Download and Installation

Please see the installation instructions for a list of available install methods and packages on the supported operating systems.

⚙️ Configuration and Usage

Please see the CLI documentation for how to configure and use Streamlink.

❤️ Support

If you think that Streamlink is useful and if you want to keep the project alive, then please consider supporting its maintainers by sending a small and optionally recurring tip via the available options.
Your support is very much appreciated, thank you!

🙏 Contributors

🗒️ Full changelog

3l3m3nt <jordan@dalleyfamily.net> (1):
      stream: add --stream-passthrough-encrypted

bastimeyer <mail@bastimeyer.de> (26):
tools: bump ty to 0.0.30 and fix issues
tools: bump mypy to 1.20.1
tools: bump ruff to 0.15.10
tests: add --stream-passthrough-encrypted tests
cli.argparser: fix type of session-option mapping
docs: fix sidebar-brand anchor color
ci.readthedocs: bump python to 3.14
tools: set ty.environment.python-platform to "all"
ci.github: add macos-latest runners
ci.github: update temp-dependencies install script
compat: add more OS-check constants
tests: add linux_only and darwin_only markers
session.http: fix set_interface on macOS
session.http: patch urllib3's set_socket_options
plugins.twitcasting: filter preroll on segment map
</tr></table>

... (truncated)

Changelog

Sourced from streamlink's changelog.

streamlink 8.4.0 (2026-05-06)

  • SECURITY: fixed arbitrary local file read via file:// URI in HLS and DASH (CVE-2026-44353 / GHSA-hgqw-6m45-hw5f)
  • Added: --stream-passthrough-encrypted for passing through encrypted HLS/DASH segments to the output stream without any checks (#6896)
  • Fixed: --interface selection by name on macOS (#6908)
  • Fixed: --interface not being applied to adapters mounted after session init (#6915)
  • Updated plugins:
    • goltelevision: rewritten and fixed plugin (#6916)
    • twitcasting: improved ad segment filtering (#6910)

Full changelog

streamlink 8.3.0 (2026-04-10)

  • Added: support for choosing the --interface by name on non-Windows systems, with optional prefixes, similar to curl (#6862)
  • Added: support for also checking stream segments in HLSStream.parse_variant_playlist() by setting check_streams="segments" (#6878)
  • Fixed: stdout/stderr streams in ProcessOutput not being fully line-buffered (#6868)
  • Updated plugins:
    • cdnbg: rewritten and fixed plugin (#6890)
    • nicolive: added websocket reconnect attempts on HLS decryption key retrieval failure (#6871)
    • soop: migrated to sooplive.com (#6876)
    • telefe: rewritten and fixed plugin (#6891)

Full changelog

streamlink 8.2.1 (2026-03-05)

  • Changed: HLS stream names using the "pixels" format to include framerate data, if available (#6848)
  • Deprecated: imports of re-exported attributes from streamlink.stream (#6821)
  • Fixed: plugin-related typing issues and missing typing annotations (#6822)
  • Updated plugins:
    • ceskatelevize: fixed sports streams (#6826)
    • nrk: updated to tv-player v9 (#6841)
    • pluto: updated to v2 API (#6851)
    • twitch: switched to Usher v2 API endpoints (#6840, #6847)
    • youtube: updated API clientVersion (#6853)

Full changelog

streamlink 8.2.0 (2026-02-09)

  • Added: --http-cookies-file CLI argument and http-cookies-files session option (#6796)
  • Changed: PluginError to also be raised when setting a plugin's url attribute to a value that doesn't match any of its URL matchers, not just when initializing the plugin class (#6810)
  • Deprecated: imports of re-exported module attributes from streamlink.utils (#6819)
  • Fixed: LogRecord missing the function name and stack info (#6788)
  • Fixed: custom network interface being reset when disabling Diffie-Hellman key exchange (#6795)
  • Fixed: broken logic when unsetting ipv4/ipv6 session options (#6795)

... (truncated)

Commits
  • a0cd8f7 release: 8.4.0
  • c9f3f0d stream.dash: check BaseURL and segment URI scheme
  • 805abf6 tests.stream.hls: decryption key w/ custom adapter
  • ef56b4f stream.hls: check segment/map/key/plist URI scheme
  • 0542a25 utils.url: add is_insecure_scheme
  • e110e03 docs: update Ubuntu package URL to Ubuntu 26.04
  • 0bffcf8 plugins.goltelevision: rewrite and fix plugin
  • 6e36892 session.http: also set interface on adapter mount
  • 6794b9d session.http_useragents: update useragents
  • ece43d0 tools: bump mypy to 1.20.2
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Geczy and others added 23 commits May 20, 2026 09:54
The dota job duplicated the services matrix job's buildx/login/build steps,
and every job computed 5-7 granular *_changed outputs that only ever fed one
OR condition repeated across four steps. Collapse to a single build matrix
(dota becomes a 4th entry with an extended paths regex) gated on one
should_build grep. 165 -> 75 lines, identical build/push/tag/label behavior.

Verified change-detection equivalence exhaustively: all 4096 changed-file
category combinations produce the same per-service build decision as before.
Also adds fail-fast: false so one service's failure no longer cancels others.
The minimap-blocker overlay is unused in production, but minimapParser.init
ran on every GSI tick for any beta_tester with the setting on — parsing
entity positions and serializing them over socket.io to nobody. Comment out
the per-tick block (and its now-unused import) so the work is skipped;
uncomment to revive. emitMinimapBlockerStatus (connect/event-driven, not
per-tick) is left intact.
Image builds were cold every run: the bake set overrode cache with empty
*.cache-from=/*.cache-to=, while docker-compose.yml still declared registry
cache refs the workflow ignored. The earlier GHA-cache attempt failed only
because it shared one scope across all services (scope=github.workflow), so
they clobbered each other (~0% hits).

Use type=gha scoped per matrix.service with mode=max (the bun install lives in
an intermediate stage, so mode=max is required to cache it). Remove the unused
x-bake registry cache blocks from compose so config matches reality. The 4
stale ghcr cache-* packages were deleted separately.
builder.yml: replace the dual hand-maintained path lists + last-commit-only
git diff with a single dorny/paths-filter pre-job that diffs the full push
range. Fixes two rebuild-skip bugs: multi-commit pushes where an earlier
commit touched a service, and root package.json/bun.lock changes that
previously rebuilt only dota. The build matrix is now derived from the
filter output, so only changed services spin up runners.

Add concurrency groups to builder.yml and ci.yml so superseded runs on a
branch are cancelled. Pin CI/health-check Bun to 1.3.14 to match the prod
image. Drop the unused profanity-filter Dockerfile.
A stale socket closing after a reconnect handoff clobbered the live
connection's status flag, so uptime monitors reported "disconnected"
while events kept flowing. twitch-chat now ignores closes from non-current
sockets and treats keepalives/notifications as liveness; twitch-events
derives connectedness from a connected-client count instead of a
clobberable boolean (and drops dead client-only socket handlers).
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: dependabot[bot] <support@github.com>
These commands still return real results, so the appended Oct 9 explainer is no longer needed.
Add offline tests across api_server (HTTP routes, image-serving security,
auth, stuck-request reset, stream requests), postgresql_client (match/draft
fetch, queue state, facet merge), dota_heroes helpers, clip_utils URL/error
paths, stream_processor state + backoff, and facet_detection seams.

Five tests fail intentionally to pin real bugs for follow-up:
- get_clip_result(_by_match_id) swallows a facets/player KeyError and returns
  None, silently invalidating an otherwise-valid cached result.
- extract_clip_id returns "" (not None) for path-bearing junk URLs, which can
  collide as a cache/queue-dedup key.
- get_clip_result(_by_match_id): guard facet merge with facets.get(team, [])
  and skip players/heroes missing team/position, so a partial or legacy facets
  payload no longer raises a swallowed KeyError that discarded the whole
  cached result and forced needless reprocessing.
- extract_clip_id: drop empty path segments so path-bearing junk URLs return
  None instead of "", which could collide as a cache/queue-dedup key.

Turns the five intentionally-failing tests from the prior commit green.
…, and dota

Wire up test infra (bunfig + test script + test:all) for twitch-events and
twitch-chat, which previously had no tests, and add offline/mocked suites:
- twitch-events: RateLimiter, isAuthenticated, runSubscriptionHealthCheck
- twitch-chat: handleChatMessage/sendTwitchChatMessage, bet/poll transforms
- shared-utils: conduitManager fetch/retry/cache
- dota: ranks math, subscription gating, and 27 chat commands

All suites run fully offline with zero skipped tests.
The facet-merge guards were copy-pasted verbatim across get_clip_result and
get_clip_result_by_match_id, so a future change had to be applied twice or
silently diverge. Extract a single _merge_facets_into_result helper used by
both. Also hoist the duplicated FakePortrait test double into a shared
_recording_portrait() helper.
Add a MongoDBSingleton mock to the twitch/lib test harness whose delayedGames
findOne returns a controllable state.delayedGame, unlocking the match-data
commands that read live game info from Mongo.
- assert real source constants (DBSettings, LOBBY_TYPE_RANKED) instead of literals
- distinguish ranked yes/no by message content rather than just reply count
- make the RateLimiter reset-wait test deterministic via a patched timer
- reset the handleChat dedupe cache between tests to prevent cross-test leakage
Draft alignment: the token-overlap match path was dead code -- tokens were
split from the already space-stripped normalized name, collapsing multi-word
names to a single token. Word-swapped names ("Team Liquid" / "Liquid Team")
fell below the difflib ratio threshold and went unmatched. Tokenize the raw
name (normalizing each word) so token overlap works as documented.

Queue dedup: a brand-new enqueue returns status 'pending', so it tripped the
"already in the processing queue" branch -- giving a misleading message AND
skipping start_worker_thread(). add_to_queue now flags real dedup hits with
'deduplicated', and the clip/stream paths branch on that instead of status.
With ENABLE_SPECTATE_FRIEND_GAME off, the non-spectator path returns the
Valve-disabled message before any Redis/steam call, so these cover notPlaying,
gameNotFound, the Valve-disabled branch, and alias routing without new mocks.
geo short-circuits to the Valve-disabled message before getAccountsFromMatch,
so its reachable paths are fully covered. gm/np/smurfs/lg only reach
getAccountsFromMatch (owned by gsiMocks) after an early steam32Id guard, so we
cover that collision-safe branch via a parametrized loop.
Bumps [streamlink](https://github.com/streamlink/streamlink) from 6.5.0 to 8.4.0.
- [Release notes](https://github.com/streamlink/streamlink/releases)
- [Changelog](https://github.com/streamlink/streamlink/blob/master/CHANGELOG.md)
- [Commits](streamlink/streamlink@6.5.0...8.4.0)

---
updated-dependencies:
- dependency-name: streamlink
  dependency-version: 8.4.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels May 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant