[dependabot]

Updates the requirements on streamlink to permit the latest version.

Release notes

Sourced from streamlink's releases.

Streamlink 8.6.3

• SECURITY: new minor release primarily for Streamlink's Windows / Linux AppImages builds, with brotli 1.2.1 (via uv.lock) (CVE-2026-111497)
• Fixed: --retry-streams and --retry-max in external/continuous HTTP output mode when re-fetching (#7165)
• Build: bumped pycryptodome version requirements to >=3.4.3,<5 (#7167)
• Tests: fixed race-conditions in HLS tests (#7174, #7176)

📦 Download and Installation

Please see the installation instructions for a list of available install methods and packages on the supported operating systems.

⚙️ Configuration and Usage

Please see the CLI documentation for how to configure and use Streamlink.

❤️ Support

If you think that Streamlink is useful and if you want to keep the project alive, then please consider supporting its maintainers by sending a small and optionally recurring tip via the available options.
Your support is very much appreciated, thank you!

🙏 Contributors

• 27: @​bastimeyer
• 1: @​SethurBlackcoat

🗒️ Full changelog

Sethur <sethur.blackcoat@gmail.com> (1):
      cli: fix retries in ext./cont. HTTP output
bastimeyer <mail@bastimeyer.de> (27):

docs: add back FreeBSD to install page

tools: bump coverage to 7.16.2

build: bump idna to 3.20

build: bump build, packaging and pyproject-hooks

build: bump transitive test dependencies

build: bump cffi to 2.1.1

build: bump pycparser to 3.11

ci.github: remove old temp dependency wheels

build: bump pycryptodome to 3.24.1

build: bump pycryptodome to >=3.4.3,<5

tools: bump ruff to 0.17.1

tools: bump ty to 0.0.89 and fix issues

ci.github: remove -dev suffix from 3.15 runners

build: bump certifi to 2026.10.19

build: bump pycryptodome to 4.1.0

ci.github: add pycryptodome cp314t temp wheels

tests.stream.hls: fix race in queue deadline tests

build: bump brotli to 1.2.1

ci.github: bump brotli 3.14t temp wheels to 1.2.1

</tr></table>

... (truncated)

Changelog

Sourced from streamlink's changelog.

streamlink 8.6.3 (2026-10-29)

• SECURITY: new minor release primarily for Streamlink's Windows / Linux AppImages builds, with brotli 1.2.1 (via uv.lock) (CVE-2026-111497)
• Fixed: --retry-streams and --retry-max in external/continuous HTTP output mode when re-fetching (#7165)
• Build: bumped pycryptodome version requirements to >=3.4.3,<5 (#7167)
• Tests: fixed race-conditions in HLS tests (#7174, #7176)

Full changelog

streamlink 8.6.2 (2026-10-07)

• SECURITY: fixed arbitrary local file read via file:// URLs in DASH Location tags (CVE-2026-TO-BE-ASSIGNED / GHSA-j7pf-m7gx-jr33) (98781761)
• Changed: validate.xml_xpath() and validate.xml_xpath_string() to include access to re:test(), re:match() and re:replace() regex functions (#7151)
• Changed: log format of deprecation warnings (#7141)
• Fixed: missing deprecation warnings for already deprecated CLI arguments (req. Python 3.13+) (#7141)
• Fixed: being able to close SegmentedStreamReader streams without opening them first, emitting log records on garbage collection (#7146)
• Updated plugins:
  • blazetv: fixed live streams (#7147)
  • cinergroup: fixed Bloomberg HT (#7132)
  • dogan: fixed plugin (#7138)
  • facebook: re-introduced plugin with new implementation (#7115)
  • vimeo: rewritten and fixed plugin (#7069)
  • youtvua: added new plugin (#7140)
• Docs: tightened rules about AI-assisted contributions and security vulnerability reports (#7136, #7152)

Full changelog

streamlink 8.6.1 (2026-09-16)

• Fixed: compatibility with urllib3 2.8.0 (#7117)

Full changelog

streamlink 8.6.0 (2026-09-13)

• SECURITY: fixed arbitrary local file read via HTTP(S) redirection to file:// URL (CVE-2026-92164 / GHSA-vf2x-4v53-pm7v) (4b99c64d)
• SECURITY: fixed insecure cross-scheme redirection (HTTPS -> HTTP) (CVE-2026-92164 / GHSA-vf2x-4v53-pm7v) (4b99c64d)
• Added: official support for Python 3.15 (#7026)
• Added: support for HLS packed audio streams (#7083, #7082)
• Added: HLSSegment.{get,iter}_content() and HLSStreamWriter.{get,iter}_segment_content() for being able to modify segment data (#7059)
• Added: itsoffset option to FFMPEGMuxer (#7081)
• Added: nextjs_inline_rsc() to validate API (#7110)
• Fixed: HTTP server of --player-http/--player-continuous-http binding to all interfaces (#7051)
• Fixed: zero or negative duration values in HLS dateranges (#7074)
• Fixed: incorrect t attribute evaluation in DASH SegmentTimeline.S nodes (#7075)
• Updated plugins:
  • ard_live: removed plugin (#7091)

... (truncated)

Commits

• a685512 release: 8.6.3
• 0045aae build: bump shtab to 1.13.0
• 9a5edc9 build: bump pycryptodome to 4.2.0
• a7f9e18 build: bump certifi to 2026.10.23
• 1d7edda build: bump pytest to 9.2.0
• 7d2b6d6 build: bump setuptools to 84.2.1
• 3cc6384 build: bump brotlicffi to 1.2.1.0
• 4835004 tools: bump ty to 0.0.92 and fix issues
• a7121dc chore: add ruff category style and fix issues
• 6142845 chore: add ruff category suspicious and fix issues
• Additional commits viewable in compare view