New requirement for yt-dlp

teckk · 2025-10-22 19:50:44

In case you haven't seen it.

yt-dlp will require a JavaScript runtime installed to download from youtube.

https://github.com/yt-dlp/yt-dlp/issues/14404
https://github.com/yt-dlp/yt-dlp/pull/14157

It is going to use this, it's in the repo.
https://deno.com/

It hasn't been implemented yet in yt-dlp, as you can read.

Upstream will have to fix yt-dlp before arch packages it.

In the meantime, You may want to get the code trees yourself as soon as yt-dlp get it ready, and make deno available to it.

seth · 2025-10-22 20:19:12

As a temporary(?) workaround you can also use

--extractor-args="youtube:player_js_version=actual"

(but this will limit and change the format indexes)

teckk · 2025-10-22 20:31:56

That does indeed work. I saw format 95 before, but it would not download. (Forbidden)

yt-dlp --extractor-args="youtube:player_js_version=actual" -F https://m.youtube.com/watch?v=uN76_LBipk8
...
sb3 mhtml 48x27        0 │                  mhtml │ images                storyboard
sb2 mhtml 80x45        0 │                  mhtml │ images                storyboard
sb1 mhtml 160x90       0 │                  mhtml │ images                storyboard
sb0 mhtml 320x180      0 │                  mhtml │ images                storyboard
91  mp4   256x144     25 │ ~ 14.23MiB  167k m3u8  │ avc1.4D400C mp4a.40.5 [en] Untested
92  mp4   426x240     25 │ ~ 24.85MiB  291k m3u8  │ avc1.4D4015 mp4a.40.5 [en] Untested
93  mp4   640x360     25 │ ~ 62.61MiB  734k m3u8  │ avc1.4D401E mp4a.40.2 [en] Untested
94  mp4   854x480     25 │ ~ 88.97MiB 1042k m3u8  │ avc1.4D401E mp4a.40.2 [en] Untested
95  mp4   1280x720    25 │ ~155.71MiB 1824k m3u8  │ avc1.4D401F mp4a.40.2 [en] Untested
96  mp4   1920x1080   25 │ ~418.52MiB 4903k m3u8  │ avc1.640028 mp4a.40.2 [en] Untested

yt-dlp --extractor-args="youtube:player_js_version=actual" -f 95 https://m.youtube.com/watch?v=uN76_LBipk8 -o PHHeadGasket.mp4
...
[info] uN76_LBipk8: Downloading 1 format(s): 95
[hlsnative] Downloading m3u8 manifest
[hlsnative] Total fragments: 133
[download] Destination: PHHeadGasket.mp4
[download] 100% of   76.75MiB in 00:00:08 at 9.09MiB/s
[FixupM3u8] Fixing MPEG-TS in MP4 container of "PHHeadGasket.mp4"

Thanks for the info. And for others looking.

cryptearth · 2025-10-22 22:12:10

I don't understand why google is even going this route
on one side: yes, they have to protect the content somehow
on the other side: as long as my browser can do the stuff any web client can
to me this is just a very bad implementation of "hanging the key next to the lock" - likely original came up with by some intern which had very bad misunderstanding of security back then - and aside from keep randomizing the challenge every now and then the scheme is kept alive

I "love" how industry works at big scale - have to deal with it every day with sap s/4 hana - it breaks down a bit more each day - where in live I got lost to be just the user of such crap earning minimum wage instead of a dev earning 3-5 times minimum wage and over a year only make it worse?

could I make it better? well - given that even back when realplayer was big already had a browser plugin to rip a stream directly from within the browsers buffer and thereby completely bypassing that scheme ... or if you go oldschool - like back to reel-to-reel tapes old - just start obs and capture the video in real time - there's nothin which would prevent this - and even if: get a cheap hdmi grabber card and a loop video and audio through that for recording via obs - fun fact: although many of the big streaming services tried to enforce like hdcp or lock-out linux users - using a KVM gets around all this (that's how I watch formula 1 although sky not native supporting linux)

I know - I get it - it's not to keep the 5% cracks out - but the 95% script kiddos - but with AI this shifts dramatically
funny how information compressors help us to break thier own security

seth · 2025-10-22 22:40:22

The changes might just be part of the general overhaul that is apparently going to bless us w/ a liquid-glass inspired UI.

teckk · 2025-10-23 14:20:47

Got the updated source tree. At time of writing it is yt-dlp 2025.10.22
https://github.com/yt-dlp/yt-dlp

Installed deno from arch repo.

Decompressed yt-dlp tree in to a directory.

/path/to/yt-dlp -F https://m.youtube.com/watch?v=uN76_LBipk8

/path/to/yt-dlp -f 18 https://m.youtube.com/watch?v=uN76_LBipk8 -o - | ffplay -

Yup, that works.

https://0x0.st/K28X.png

Back in action.

If this helps anyone else.

mpan · 2025-10-23 16:06:40

cryptearth, that is confusing cryptography and algorithms, with the general security. The first group lives in an idealized, mathematical world, where we can create nearly perfect solutions. The second is a complex, physical reality in which we must deal with a myriad of factors and at best hope to balance costs and benefits.

Alphabet manages the latter pretty well. Yes, the burden can be overcame. But it’s still a enormously greater burden to people circumventing it than to the ones deploying. Big enough to reach the intended goal. How big is plainly expressed by this very change: too big for the yt-dlp team to handle. The only reason the yt-dlp project still manages to circumvent YouTube’s changes is not the weakness of security, but the strength of yt-dlp developer’s ideological convictions.

Anubis’ success is a great example of the difference between cryptography and security. Breaking Anubis is absurdly trivial: just change the User-Agent in requests. Despite it’s so easy, the solution works as expected. Because changing User-Agent would incur too much losses to adversaries.

Content is also not what’s protected. That has to be protected only to the extent that makes IP owners silent enough. It’s not a high bar to reach, if court’s own computer literacy is the reference point to what constitutes circumventing effective security measures. But that goes against Alphabet’s own business goals too, so don’t expect any moves towards willingly controlling access to content. What needs protection is Alphabet’s access to your privacy and having control over your engangement with the platform. Yt-dlp and similar tools break that part.

Last edited by mpan (2025-10-23 16:12:15)

256 · 2025-10-24 10:18:19

yt-dlp doesn't just support Youtube, it supports plenty of other sites, so if Deno is added as a dependency it should be optional.

Hopefully a no-JS solution still continues to exist, even if it doesn't work very well, for people who don't want to run proprietary JS. Some Invidious instances can still be used without JS, for now.

Succulent of your garden · 2025-10-24 11:44:31

256 wrote:

Hopefully a no-JS solution still continues to exist, even if it doesn't work very well, for people who don't want to run proprietary JS. Some Invidious instances can still be used without JS, for now.

yt-dlp documentation issue wrote:

Official PyInstaller-bundled executable users (e.g. yt-dlp.exe, yt-dlp_macos, yt-dlp_linux, etc):
No additional action required (besides having Deno). All the necessary JavaScript components will be bundled with these executables.

For the binary it seems you will only need Deno. Does arch works with the binary release right ? I mean that would let me breath more easily just to know that in the background there are not npm packages being downloaded since the binary release does package all the java script code on it

cryptearth · 2025-10-24 11:48:24

256 wrote:

Hopefully a no-JS solution still continues to exist, even if it doesn't work very well, for people who don't want to run proprietary JS. Some Invidious instances can still be used without JS, for now.

fun fact: i implemented my own yt downloader in java - but as i'm too lazy to port what ever the few js lines do i just extracted them and ran them via javas rhino js runtime

256 · 2025-10-24 12:22:17

To be clear, when I said "proprietary JS" I meant the JS on Youtube's website, running in Deno. Also, I wonder how much fingerprinting Youtube could theoretically do of yt-dlp users with this. How much information about the machine does Deno make available?

cryptearth wrote:

fun fact: i implemented my own yt downloader in java - but as i'm too lazy to port what ever the few js lines do i just extracted them and ran them via javas rhino js runtime

How difficult was it? I've written a few downloader scripts for some websites but Youtube, even if you run the JS to some extent, always seemed too daunting to me.

seth · 2025-10-24 12:47:33

Upstream dependency is optional, https://github.com/yt-dlp/yt-dlp/issues/14404
https://gitlab.archlinux.org/archlinux/ … 77b2e0a63c hasn't added any dependencies to the package.

Succulent of your garden · 2025-10-24 13:06:26

seth wrote:

Upstream dependency is optional, https://github.com/yt-dlp/yt-dlp/issues/14404

But it seems for the binary you will need to have Deno. Or that's what I'm getting from this line in the link:

yt-dlp info wrote:

No additional action required (besides having Deno)

256 wrote:

Also, I wonder how much fingerprinting Youtube could theoretically do of yt-dlp users with this. How much information about the machine does Deno make available?

Not sure but I think that's is going to depend what packages are being used in Deno. I mean probably Deno is better if they were using npm before for doing some stuff before

Last edited by Succulent of your garden (2025-10-24 13:07:24)

seth · 2025-10-24 13:16:26

You'll require deno or some other supported JS engine to download youtube videos absent the workaround in #2 but it's not a dependency to run yt-dlp in general (to download from other services)
yt-dlp so far didn't use a full-blown JS engine to solve the YT challenges.

Succulent of your garden · 2025-10-24 13:25:13

So probably the only metadata that is going to be fetched is the ip address and the video that is being selected to watch.

cryptearth · 2025-10-24 13:57:58

256 wrote:

How difficult was it? I've written a few downloader scripts for some websites but Youtube, even if you run the JS to some extent, always seemed too daunting to me.

it's actual straight forward
all information are both in a big config list within the player page as welll as provided by an external file - and once you learn how to look for the few lines of js that handles the black magic you just run that to reconstruct the security token and get a regular that can be called with any http client
as said: yes, i could just port the js code to java to avoid running js code - but i'm lazy and just implement how a browser does the same

you also can setup a tls terminator as a local man in the middle and just grab the streams the browser uses

teckk · 2025-10-24 14:40:59

At this moment. The latest arch package 2025.10-22.1 does not work with youtube. I'm sure that it works for all of the other extractors.

The source tree from yt-dlp does work for yt, without a hiccup.
https://github.com/yt-dlp/yt-dlp
https://github.com/yt-dlp/yt-dlp/releas … dlp.tar.gz

The source tarball has a yt-dlp executable in the top directory.

yt-dlp works just like always with all of the other extractors. It is google that has been a problem trying to keep up with.

teckk · 2025-10-24 14:49:45

With the latest source tree from yt-dlp.

yt-dlp -f 18 https://m.youtube.com/watch?v=v9F6QBaZJ8k -o - | mpv --demuxer-max-bytes=2MiB -

I'm on an old machine as you can see by mpv's output. (Still works though)
https://0x0.st/K2av.png

Lone_Wolf · 2025-10-25 13:30:45

$ pacman -Q yt-dlp
yt-dlp 2025.10.22-1
$ yt-dlp https://www.youtube.com/watch?v=lcOxhH8N3Bo
[youtube] Extracting URL: https://www.youtube.com/watch?v=lcOxhH8N3Bo
[youtube] lcOxhH8N3Bo: Downloading webpage
[youtube] lcOxhH8N3Bo: Downloading android sdkless player API JSON
[youtube] lcOxhH8N3Bo: Downloading tv client config
[youtube] lcOxhH8N3Bo: Downloading player 6e4dbefe-main
[youtube] lcOxhH8N3Bo: Downloading tv player API JSON
[youtube] lcOxhH8N3Bo: Downloading web safari player API JSON
WARNING: [youtube] lcOxhH8N3Bo: Some tv client https formats have been skipped as they are missing a url. YouTube may have enabled the SABR-only or Server-Side Ad Placement experiment for the current session. See  https://github.com/yt-dlp/yt-dlp/issues/12482  for more details
WARNING: [youtube] lcOxhH8N3Bo: Some web_safari client https formats have been skipped as they are missing a url. YouTube is forcing SABR streaming for this client. See  https://github.com/yt-dlp/yt-dlp/issues/12482  for more details
WARNING: [youtube] lcOxhH8N3Bo: Some web client https formats have been skipped as they are missing a url. YouTube is forcing SABR streaming for this client. See  https://github.com/yt-dlp/yt-dlp/issues/12482  for more details
[youtube] lcOxhH8N3Bo: Downloading m3u8 information
[info] lcOxhH8N3Bo: Downloading 1 format(s): 401+251
[download] Sleeping 5.00 seconds as required by the site...
[download] Destination: Bonnie Tyler - Total Eclipse of the Heart (Turn Around) (Official Video) [lcOxhH8N3Bo].f401.mp4
[download] 100% of  191.10MiB in 00:00:09 at 20.55MiB/s
[download] Destination: Bonnie Tyler - Total Eclipse of the Heart (Turn Around) (Official Video) [lcOxhH8N3Bo].f251.webm
[download] 100% of    5.25MiB in 00:00:00 at 21.08MiB/s
[Merger] Merging formats into "Bonnie Tyler - Total Eclipse of the Heart (Turn Around) (Official Video) [lcOxhH8N3Bo].webm"
Deleting original file Bonnie Tyler - Total Eclipse of the Heart (Turn Around) (Official Video) [lcOxhH8N3Bo].f251.webm (pass -k to keep)
Deleting original file Bonnie Tyler - Total Eclipse of the Heart (Turn Around) (Official Video) [lcOxhH8N3Bo].f401.mp4 (pass -k to keep)
$

The download plays fine in firefox and vlc .

Looks to me like yt-dlp 2025.10-22.1 is still functional with youtube.

256 · 2026-01-30 09:07:38

A recent change erroneously made yt-dlp-ejs into a hard dependency instead of an optional one. The GitHub page says that it is optional, and only(?) useful for Youtube. I know that I personally have no need for it.

Can someone with an Arch GitLab account report this as a bug? I don't have an account there and apparently registering one takes a zillion years.

seth · 2026-01-30 12:32:15

Erroneously maybe, but also deliberate: https://gitlab.archlinux.org/archlinux/ … requests/2
=> Create a dummy package that simply provides yt-dlp-ejs

256 · 2026-01-30 13:43:40

I think this brings up a deeper question about packaging. If most users of package X need Y for their use case, should it be a hard dependency? I think it's easy to install an extra dependency if you need but more annoying to choose not to install one. You'd have to use --assume-installed or something.

How is this decision normally made?

seth · 2026-01-30 14:08:00

How is this decision normally made?

Package manager.

My 2¢ is that if something's optional it should™ be an optional dependency (d'uh ), but Shouldland aside: if you're bombarded with "bugs" because the average IQ of arch users has dropped by 50+ points in recent years (Trilby has a rant on that…) I can see why one could capitulate to the ὀχλοκρατία …

use --assume-installed

I'd always opt for explicit dummy packages - it integrates w/ the general the process and provides you w/ a reminder that you did this.

mpan · 2026-01-30 14:38:03

Given YouTube is now unusable without yt-dlp-ejs, and most use cases is accessing YouTube, and most users need to be pampered: making that a hard dependency sounds like a reasonable choice to me. It’s even worse: since issues may be transient and dependent on your locality, some people missing yt-dlp-ejs are wrongly convinced they didn’t need it and “it worked just fine.”

For people, who never use yt-dlp with YouTube and also don’t want yt-dlp-ejs and deno, a better option would be to have a dummy package that provides yt-dlp-ejs, without actually offering any functions.

I know this is not exactly Arch way. But some features are so expected, having them enabled by default and making disabling an option sounds more reasonable. This is not the first time either: for example kicad-library and kicad-library-3d also provide all optional libraries instead of letting the user choose the ones they actually need.

teckk · 2026-01-30 16:16:53

Given YouTube is now unusable without yt-dlp-ejs

I don't have that installed.

extra/yt-dlp 2025.12.08-1 [installed]
    A youtube-dl fork with additional features and fixes
extra/yt-dlp-ejs 0.3.2-1
    External JavaScript for yt-dlp supporting many runtimes

I'm not up to date as you can see.

I got the latest yt-dlp source tree yesterday, because some formats did not work. Put that into a directory. Because new version was not in repo yet.

I do have deno installed.

pacman -Ss deno
extra/deno 2.6.2-1 [installed]
    A secure runtime for JavaScript and TypeScript

yt-dlp works.

/path/to/tree/yt-dlp -F https://m.youtube.com/watch?v=nckDzW__5cE

yt-dlp -F https://m.youtube.com/watch?v=nckDzW__5cE
[youtube] Extracting URL: https://m.youtube.com/watch?v=nckDzW__5cE
[youtube] nckDzW__5cE: Downloading webpage
[youtube] nckDzW__5cE: Downloading android vr player API JSON
[youtube] nckDzW__5cE: Downloading ios downgraded player API JSON
[youtube] nckDzW__5cE: Downloading web safari player API JSON
[youtube] nckDzW__5cE: Downloading m3u8 information
[youtube] nckDzW__5cE: Downloading player 652bbb94-main
[youtube] [jsc:deno] Solving JS challenges using deno
[youtube] nckDzW__5cE: Downloading m3u8 information
[info] Available formats for nckDzW__5cE:
ID  EXT   RESOLUTION FPS CH │   FILESIZE   TBR PROTO │ VCODEC          VBR ACODEC      ABR ASR MORE INFO
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
sb3 mhtml 48x27        0    │                  mhtml │ images                                  storyboard
sb2 mhtml 80x45        0    │                  mhtml │ images                                  storyboard
sb1 mhtml 160x90       0    │                  mhtml │ images                                  storyboard
sb0 mhtml 320x180      0    │                  mhtml │ images                                  storyboard
233 mp4   audio only        │                  m3u8  │ audio only          unknown             [en] Untested, Default, low
234 mp4   audio only        │                  m3u8  │ audio only          unknown             [en] Untested, Default, high
139 m4a   audio only      2 │    6.45MiB   49k https │ audio only          mp4a.40.5   49k 22k [en] low, m4a_dash
249 webm  audio only
...

/path/to/tree/yt-dlp -f 136 https://m.youtube.com/watch?v=nckDzW__5cE -o - | mpv -

https://0x0.st/Pqac.png

Last edited by teckk (2026-01-30 16:18:13)

Arch Linux

#1 2025-10-22 19:50:44

New requirement for yt-dlp

#2 2025-10-22 20:19:12

Re: New requirement for yt-dlp

#3 2025-10-22 20:31:56

Re: New requirement for yt-dlp

#4 2025-10-22 22:12:10

Re: New requirement for yt-dlp

#5 2025-10-22 22:40:22

Re: New requirement for yt-dlp

#6 2025-10-23 14:20:47

Re: New requirement for yt-dlp

#7 2025-10-23 16:06:40

Re: New requirement for yt-dlp

#8 2025-10-24 10:18:19

Re: New requirement for yt-dlp

#9 2025-10-24 11:44:31

Re: New requirement for yt-dlp

#10 2025-10-24 11:48:24

Re: New requirement for yt-dlp

#11 2025-10-24 12:22:17

Re: New requirement for yt-dlp

#12 2025-10-24 12:47:33

Re: New requirement for yt-dlp

#13 2025-10-24 13:06:26

Re: New requirement for yt-dlp

#14 2025-10-24 13:16:26

Re: New requirement for yt-dlp

#15 2025-10-24 13:25:13

Re: New requirement for yt-dlp

#16 2025-10-24 13:57:58

Re: New requirement for yt-dlp

#17 2025-10-24 14:40:59

Re: New requirement for yt-dlp

#18 2025-10-24 14:49:45

Re: New requirement for yt-dlp

#19 2025-10-25 13:30:45

Re: New requirement for yt-dlp

#20 2026-01-30 09:07:38

Re: New requirement for yt-dlp

#21 2026-01-30 12:32:15

Re: New requirement for yt-dlp

#22 2026-01-30 13:43:40

Re: New requirement for yt-dlp

#23 2026-01-30 14:08:00

Re: New requirement for yt-dlp

#24 2026-01-30 14:38:03

Re: New requirement for yt-dlp

#25 2026-01-30 16:16:53

Re: New requirement for yt-dlp

Board footer