New requirement for yt-dlp

teckk · 2025-10-22 19:50:44

In case you haven't seen it.

yt-dlp will require a JavaScript runtime installed to download from youtube.

https://github.com/yt-dlp/yt-dlp/issues/14404
https://github.com/yt-dlp/yt-dlp/pull/14157

It is going to use this, it's in the repo.
https://deno.com/

It hasn't been implemented yet in yt-dlp, as you can read.

Upstream will have to fix yt-dlp before arch packages it.

In the meantime, You may want to get the code trees yourself as soon as yt-dlp get it ready, and make deno available to it.

seth · 2025-10-22 20:19:12

As a temporary(?) workaround you can also use

--extractor-args="youtube:player_js_version=actual"

(but this will limit and change the format indexes)

teckk · 2025-10-22 20:31:56

That does indeed work. I saw format 95 before, but it would not download. (Forbidden)

yt-dlp --extractor-args="youtube:player_js_version=actual" -F https://m.youtube.com/watch?v=uN76_LBipk8
...
sb3 mhtml 48x27        0 │                  mhtml │ images                storyboard
sb2 mhtml 80x45        0 │                  mhtml │ images                storyboard
sb1 mhtml 160x90       0 │                  mhtml │ images                storyboard
sb0 mhtml 320x180      0 │                  mhtml │ images                storyboard
91  mp4   256x144     25 │ ~ 14.23MiB  167k m3u8  │ avc1.4D400C mp4a.40.5 [en] Untested
92  mp4   426x240     25 │ ~ 24.85MiB  291k m3u8  │ avc1.4D4015 mp4a.40.5 [en] Untested
93  mp4   640x360     25 │ ~ 62.61MiB  734k m3u8  │ avc1.4D401E mp4a.40.2 [en] Untested
94  mp4   854x480     25 │ ~ 88.97MiB 1042k m3u8  │ avc1.4D401E mp4a.40.2 [en] Untested
95  mp4   1280x720    25 │ ~155.71MiB 1824k m3u8  │ avc1.4D401F mp4a.40.2 [en] Untested
96  mp4   1920x1080   25 │ ~418.52MiB 4903k m3u8  │ avc1.640028 mp4a.40.2 [en] Untested

yt-dlp --extractor-args="youtube:player_js_version=actual" -f 95 https://m.youtube.com/watch?v=uN76_LBipk8 -o PHHeadGasket.mp4
...
[info] uN76_LBipk8: Downloading 1 format(s): 95
[hlsnative] Downloading m3u8 manifest
[hlsnative] Total fragments: 133
[download] Destination: PHHeadGasket.mp4
[download] 100% of   76.75MiB in 00:00:08 at 9.09MiB/s
[FixupM3u8] Fixing MPEG-TS in MP4 container of "PHHeadGasket.mp4"

Thanks for the info. And for others looking.

cryptearth · 2025-10-22 22:12:10

I don't understand why google is even going this route
on one side: yes, they have to protect the content somehow
on the other side: as long as my browser can do the stuff any web client can
to me this is just a very bad implementation of "hanging the key next to the lock" - likely original came up with by some intern which had very bad misunderstanding of security back then - and aside from keep randomizing the challenge every now and then the scheme is kept alive

I "love" how industry works at big scale - have to deal with it every day with sap s/4 hana - it breaks down a bit more each day - where in live I got lost to be just the user of such crap earning minimum wage instead of a dev earning 3-5 times minimum wage and over a year only make it worse?

could I make it better? well - given that even back when realplayer was big already had a browser plugin to rip a stream directly from within the browsers buffer and thereby completely bypassing that scheme ... or if you go oldschool - like back to reel-to-reel tapes old - just start obs and capture the video in real time - there's nothin which would prevent this - and even if: get a cheap hdmi grabber card and a loop video and audio through that for recording via obs - fun fact: although many of the big streaming services tried to enforce like hdcp or lock-out linux users - using a KVM gets around all this (that's how I watch formula 1 although sky not native supporting linux)

I know - I get it - it's not to keep the 5% cracks out - but the 95% script kiddos - but with AI this shifts dramatically
funny how information compressors help us to break thier own security

seth · 2025-10-22 22:40:22

The changes might just be part of the general overhaul that is apparently going to bless us w/ a liquid-glass inspired UI.

teckk · 2025-10-23 14:20:47

Got the updated source tree. At time of writing it is yt-dlp 2025.10.22
https://github.com/yt-dlp/yt-dlp

Installed deno from arch repo.

Decompressed yt-dlp tree in to a directory.

/path/to/yt-dlp -F https://m.youtube.com/watch?v=uN76_LBipk8

/path/to/yt-dlp -f 18 https://m.youtube.com/watch?v=uN76_LBipk8 -o - | ffplay -

Yup, that works.

https://0x0.st/K28X.png

Back in action.

If this helps anyone else.

mpan · 2025-10-23 16:06:40

cryptearth, that is confusing cryptography and algorithms, with the general security. The first group lives in an idealized, mathematical world, where we can create nearly perfect solutions. The second is a complex, physical reality in which we must deal with a myriad of factors and at best hope to balance costs and benefits.

Alphabet manages the latter pretty well. Yes, the burden can be overcame. But it’s still a enormously greater burden to people circumventing it than to the ones deploying. Big enough to reach the intended goal. How big is plainly expressed by this very change: too big for the yt-dlp team to handle. The only reason the yt-dlp project still manages to circumvent YouTube’s changes is not the weakness of security, but the strength of yt-dlp developer’s ideological convictions.

Anubis’ success is a great example of the difference between cryptography and security. Breaking Anubis is absurdly trivial: just change the User-Agent in requests. Despite it’s so easy, the solution works as expected. Because changing User-Agent would incur too much losses to adversaries.

Content is also not what’s protected. That has to be protected only to the extent that makes IP owners silent enough. It’s not a high bar to reach, if court’s own computer literacy is the reference point to what constitutes circumventing effective security measures. But that goes against Alphabet’s own business goals too, so don’t expect any moves towards willingly controlling access to content. What needs protection is Alphabet’s access to your privacy and having control over your engangement with the platform. Yt-dlp and similar tools break that part.

Last edited by mpan (2025-10-23 16:12:15)

256 · 2025-10-24 10:18:19

yt-dlp doesn't just support Youtube, it supports plenty of other sites, so if Deno is added as a dependency it should be optional.

Hopefully a no-JS solution still continues to exist, even if it doesn't work very well, for people who don't want to run proprietary JS. Some Invidious instances can still be used without JS, for now.

Succulent of your garden · 2025-10-24 11:44:31

256 wrote:

Hopefully a no-JS solution still continues to exist, even if it doesn't work very well, for people who don't want to run proprietary JS. Some Invidious instances can still be used without JS, for now.

yt-dlp documentation issue wrote:

Official PyInstaller-bundled executable users (e.g. yt-dlp.exe, yt-dlp_macos, yt-dlp_linux, etc):
No additional action required (besides having Deno). All the necessary JavaScript components will be bundled with these executables.

For the binary it seems you will only need Deno. Does arch works with the binary release right ? I mean that would let me breath more easily just to know that in the background there are not npm packages being downloaded since the binary release does package all the java script code on it

cryptearth · 2025-10-24 11:48:24

256 wrote:

Hopefully a no-JS solution still continues to exist, even if it doesn't work very well, for people who don't want to run proprietary JS. Some Invidious instances can still be used without JS, for now.

fun fact: i implemented my own yt downloader in java - but as i'm too lazy to port what ever the few js lines do i just extracted them and ran them via javas rhino js runtime

256 · 2025-10-24 12:22:17

To be clear, when I said "proprietary JS" I meant the JS on Youtube's website, running in Deno. Also, I wonder how much fingerprinting Youtube could theoretically do of yt-dlp users with this. How much information about the machine does Deno make available?

cryptearth wrote:

fun fact: i implemented my own yt downloader in java - but as i'm too lazy to port what ever the few js lines do i just extracted them and ran them via javas rhino js runtime

How difficult was it? I've written a few downloader scripts for some websites but Youtube, even if you run the JS to some extent, always seemed too daunting to me.

seth · 2025-10-24 12:47:33

Upstream dependency is optional, https://github.com/yt-dlp/yt-dlp/issues/14404
https://gitlab.archlinux.org/archlinux/ … 77b2e0a63c hasn't added any dependencies to the package.

Succulent of your garden · 2025-10-24 13:06:26

seth wrote:

Upstream dependency is optional, https://github.com/yt-dlp/yt-dlp/issues/14404

But it seems for the binary you will need to have Deno. Or that's what I'm getting from this line in the link:

yt-dlp info wrote:

No additional action required (besides having Deno)

256 wrote:

Also, I wonder how much fingerprinting Youtube could theoretically do of yt-dlp users with this. How much information about the machine does Deno make available?

Not sure but I think that's is going to depend what packages are being used in Deno. I mean probably Deno is better if they were using npm before for doing some stuff before

Last edited by Succulent of your garden (2025-10-24 13:07:24)

seth · 2025-10-24 13:16:26

You'll require deno or some other supported JS engine to download youtube videos absent the workaround in #2 but it's not a dependency to run yt-dlp in general (to download from other services)
yt-dlp so far didn't use a full-blown JS engine to solve the YT challenges.

Succulent of your garden · 2025-10-24 13:25:13

So probably the only metadata that is going to be fetched is the ip address and the video that is being selected to watch.

cryptearth · 2025-10-24 13:57:58

256 wrote:

How difficult was it? I've written a few downloader scripts for some websites but Youtube, even if you run the JS to some extent, always seemed too daunting to me.

it's actual straight forward
all information are both in a big config list within the player page as welll as provided by an external file - and once you learn how to look for the few lines of js that handles the black magic you just run that to reconstruct the security token and get a regular that can be called with any http client
as said: yes, i could just port the js code to java to avoid running js code - but i'm lazy and just implement how a browser does the same

you also can setup a tls terminator as a local man in the middle and just grab the streams the browser uses

teckk · 2025-10-24 14:40:59

At this moment. The latest arch package 2025.10-22.1 does not work with youtube. I'm sure that it works for all of the other extractors.

The source tree from yt-dlp does work for yt, without a hiccup.
https://github.com/yt-dlp/yt-dlp
https://github.com/yt-dlp/yt-dlp/releas … dlp.tar.gz

The source tarball has a yt-dlp executable in the top directory.

yt-dlp works just like always with all of the other extractors. It is google that has been a problem trying to keep up with.

teckk · 2025-10-24 14:49:45

With the latest source tree from yt-dlp.

yt-dlp -f 18 https://m.youtube.com/watch?v=v9F6QBaZJ8k -o - | mpv --demuxer-max-bytes=2MiB -

I'm on an old machine as you can see by mpv's output. (Still works though)
https://0x0.st/K2av.png

Lone_Wolf · 2025-10-25 13:30:45

$ pacman -Q yt-dlp
yt-dlp 2025.10.22-1
$ yt-dlp https://www.youtube.com/watch?v=lcOxhH8N3Bo
[youtube] Extracting URL: https://www.youtube.com/watch?v=lcOxhH8N3Bo
[youtube] lcOxhH8N3Bo: Downloading webpage
[youtube] lcOxhH8N3Bo: Downloading android sdkless player API JSON
[youtube] lcOxhH8N3Bo: Downloading tv client config
[youtube] lcOxhH8N3Bo: Downloading player 6e4dbefe-main
[youtube] lcOxhH8N3Bo: Downloading tv player API JSON
[youtube] lcOxhH8N3Bo: Downloading web safari player API JSON
WARNING: [youtube] lcOxhH8N3Bo: Some tv client https formats have been skipped as they are missing a url. YouTube may have enabled the SABR-only or Server-Side Ad Placement experiment for the current session. See  https://github.com/yt-dlp/yt-dlp/issues/12482  for more details
WARNING: [youtube] lcOxhH8N3Bo: Some web_safari client https formats have been skipped as they are missing a url. YouTube is forcing SABR streaming for this client. See  https://github.com/yt-dlp/yt-dlp/issues/12482  for more details
WARNING: [youtube] lcOxhH8N3Bo: Some web client https formats have been skipped as they are missing a url. YouTube is forcing SABR streaming for this client. See  https://github.com/yt-dlp/yt-dlp/issues/12482  for more details
[youtube] lcOxhH8N3Bo: Downloading m3u8 information
[info] lcOxhH8N3Bo: Downloading 1 format(s): 401+251
[download] Sleeping 5.00 seconds as required by the site...
[download] Destination: Bonnie Tyler - Total Eclipse of the Heart (Turn Around) (Official Video) [lcOxhH8N3Bo].f401.mp4
[download] 100% of  191.10MiB in 00:00:09 at 20.55MiB/s
[download] Destination: Bonnie Tyler - Total Eclipse of the Heart (Turn Around) (Official Video) [lcOxhH8N3Bo].f251.webm
[download] 100% of    5.25MiB in 00:00:00 at 21.08MiB/s
[Merger] Merging formats into "Bonnie Tyler - Total Eclipse of the Heart (Turn Around) (Official Video) [lcOxhH8N3Bo].webm"
Deleting original file Bonnie Tyler - Total Eclipse of the Heart (Turn Around) (Official Video) [lcOxhH8N3Bo].f251.webm (pass -k to keep)
Deleting original file Bonnie Tyler - Total Eclipse of the Heart (Turn Around) (Official Video) [lcOxhH8N3Bo].f401.mp4 (pass -k to keep)
$

The download plays fine in firefox and vlc .

Looks to me like yt-dlp 2025.10-22.1 is still functional with youtube.

Arch Linux

#1 2025-10-22 19:50:44

New requirement for yt-dlp

#2 2025-10-22 20:19:12

Re: New requirement for yt-dlp

#3 2025-10-22 20:31:56

Re: New requirement for yt-dlp

#4 2025-10-22 22:12:10

Re: New requirement for yt-dlp

#5 2025-10-22 22:40:22

Re: New requirement for yt-dlp

#6 2025-10-23 14:20:47

Re: New requirement for yt-dlp

#7 2025-10-23 16:06:40

Re: New requirement for yt-dlp

#8 2025-10-24 10:18:19

Re: New requirement for yt-dlp

#9 2025-10-24 11:44:31

Re: New requirement for yt-dlp

#10 2025-10-24 11:48:24

Re: New requirement for yt-dlp

#11 2025-10-24 12:22:17

Re: New requirement for yt-dlp

#12 2025-10-24 12:47:33

Re: New requirement for yt-dlp

#13 2025-10-24 13:06:26

Re: New requirement for yt-dlp

#14 2025-10-24 13:16:26

Re: New requirement for yt-dlp

#15 2025-10-24 13:25:13

Re: New requirement for yt-dlp

#16 2025-10-24 13:57:58

Re: New requirement for yt-dlp

#17 2025-10-24 14:40:59

Re: New requirement for yt-dlp

#18 2025-10-24 14:49:45

Re: New requirement for yt-dlp

#19 2025-10-25 13:30:45

Re: New requirement for yt-dlp

Board footer