[dependabot]

Bumps yt-dlp[curl-cffi,default] from 2026.7.4 to 2026.10.26.

Release notes

Sourced from yt-dlp[curl-cffi,default]'s releases.

yt-dlp 2026.10.26

A description of the various files is in the README

The zipimport Unix executable and release tarball contain code licensed under ISC and MIT. The PyInstaller-bundled executables are subject to these and other licenses, all of which are compiled in THIRD_PARTY_LICENSES.txt

---

Important changes

• The minimum required Python version has been raised to 3.11
  • Python 3.10 has reached its end-of-life as of October 2026, and yt-dlp has now removed support for it. Read more
• The official Windows release binaries now require Windows 10 or later. Read more
• Security: The recent brotli and certifi vulnerabilities have now been fully addressed in the executables
  • The brotli package bundled with the executables has been upgraded to version 1.2.1, and the curl-cffi package has been upgraded to version 0.17.0. These upgrades address the recent brotli security vulnerability
  • curl-cffi 0.17.0 also fully addresses the recent certifi security vulnerability that was already partially addressed by upgrading the certifi package bundled with the executables

Core changes

• Remove Python 3.10 support (#17160) by bashonly, doe1080, Grub4K

Extractor changes

• odnoklassniki: Fix boosty direct link extraction (#17749) by bashonly

Networking changes

• Request Handler: curl_cffi: Support curl_cffi 0.17.x (#17929) by bashonly (With fixes in 15262b0)

Misc. changes

• build
  • Always use latest Python version on Windows (#17901) by bashonly
  • Update 13 dependencies (#17924) by bashonly, dlp-bot
  • Update 3 dependencies (#17933) by dlp-bot
• ci
  • Test with PyPy 3.12 (#17926) by gamer191
  • Update 7 actions in 9 workflows (#17925) by bashonly, dlp-bot
• cleanup: Miscellaneous: 7e3644c by bashonly, doe1080
• docs: Add changelog entries for dropping Py3.10 & Win8 support (#17889) by bashonly

yt-dlp 2026.10.21

A description of the various files is in the README

The zipimport Unix executable and release tarball contain code licensed under ISC and MIT. The PyInstaller-bundled executables are subject to these and other licenses, all of which are compiled in THIRD_PARTY_LICENSES.txt

---

... (truncated)

Changelog

Sourced from yt-dlp[curl-cffi,default]'s changelog.

2026.10.26

Important changes

• The minimum required Python version has been raised to 3.11
  • Python 3.10 has reached its end-of-life as of October 2026, and yt-dlp has now removed support for it. Read more
• The official Windows release binaries now require Windows 10 or later. Read more
• Security: The recent brotli and certifi vulnerabilities have now been fully addressed in the executables
  • The brotli package bundled with the executables has been upgraded to version 1.2.1, and the curl-cffi package has been upgraded to version 0.17.0. These upgrades address the recent brotli security vulnerability
  • curl-cffi 0.17.0 also fully addresses the recent certifi security vulnerability that was already partially addressed by upgrading the certifi package bundled with the executables

Core changes

• Remove Python 3.10 support (#17160) by bashonly, doe1080, Grub4K

Extractor changes

• odnoklassniki: Fix boosty direct link extraction (#17749) by bashonly

Networking changes

• Request Handler: curl_cffi: Support curl_cffi 0.17.x (#17929) by bashonly (With fixes in 15262b0)

Misc. changes

• build
  • Always use latest Python version on Windows (#17901) by bashonly
  • Update 13 dependencies (#17924) by bashonly, dlp-bot
  • Update 3 dependencies (#17933) by dlp-bot
• ci
  • Test with PyPy 3.12 (#17926) by gamer191
  • Update 7 actions in 9 workflows (#17925) by bashonly, dlp-bot
• cleanup: Miscellaneous: 7e3644c by bashonly, doe1080
• docs: Add changelog entries for dropping Py3.10 & Win8 support (#17889) by bashonly

2026.10.21

Important changes

• Security: Old yt-dlp executables are vulnerable to man-in-the-middle attacks
  • A man-in-the-middle/MITM attack is when your internet traffic is intercepted by an attacker that impersonates the website(s) you browse and sends you malicious data instead.
  • If you think you may be targeted by such an attack, it is strongly recommended to avoid using the self-updater (e.g. the -U, --update, --update-to command-line options), and instead manually download and install this release's executable.
  • For more details, see the certifi security advisory

Core changes

• update
  • Detect GitHub error page responses (#17555) by bashonly
  • Remove bad advice (#17492) by bashonly
• utils
  • Improve Content-Disposition filename parsing (#17727) by doe1080
  • devalue: Improve binary type parsing (#16934) by doe1080
  • download_range_func: Improve __eq__ and __repr__ (#16393) by atsushi2965
  • setproctitle: Fix NUL termination (#17724) by doe1080
  • subs_list_to_dict: Fix empty value handling (#17311) by doe1080

Extractor changes

... (truncated)

Commits

• f264a6c Release 2026.10.26
• c91f8de [build] Update 3 dependencies (#17933)
• 7e3644c [cleanup] Misc (#17892)
• 755a017 [ci] Test with PyPy 3.12 (#17926)
• fd26888 [ci] Update 7 actions in 9 workflows (#17925)
• 7747073 [build] Update 13 dependencies (#17924)
• 15262b0 [test:networking] Fix supported impersonate targets test (#17931)
• 7f7106c [rh:curl_cffi] Support curl_cffi 0.17.x (#17929)
• fa98866 [ie/odnoklassniki] Fix boosty direct link extraction (#17749)
• 9b58cb3 [build] Always use latest Python version on Windows (#17901)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)