[yt-dlp] update to 2025.11.12

[alvinhochun]

Package name

yt-dlp

New version number

2025.11.12

Other information that may be useful

As per yt-dlp/yt-dlp#15012, yt-dlp now requires an external JavaScript runtime for YouTube support (but otherwise optional). A companion package yt-dlp-ejs is also needed for this. (See "Notes to package maintainers" in linked page.)

Of the supported JavaScript runtimes, it seems Node.js (v24) is the only one that has already been packaged by MSYS2. yt-dlp strongly recommends using Deno for security reasons; for Node.js, version 25 is strongly recommended also for security reasons.

To update yt-dlp, it seems the following will be needed:

• Package Deno (requested in Add mingw-w64-deno #20081)
• (or:) Update Node.js (no issue/PR yet)
• Package yt-dlp-ejs and a required dependency, or just include it in the same package?
• Make Deno or Node.js an optional dependency

Are you willing to submit a PR?

Eh... probably not

[lazka]

See #26374 for a start

[lazka]

$ pacman -S "$MINGW_PACKAGE_PREFIX-yt-dlp-ejs"
$ yt-dlp --js-runtime node "https://www.youtube.com/watch?v=..."

Remaining questions:

• Make it a dep instead of optional? Or only when it starts breaking?
• Patch it to default to node since we don't have any other runtime? Or only when we upgrade to node v25? Or not at all?

[alvinhochun]

• Make it a dep instead of optional? Or only when it starts breaking?

I would assume most people use it for youtube, so it probably makes sense to be non-optional to reduce confusion. However, it's not very useful as long as yt-dlp does not enable node.js by default (see the next point)

• Patch it to default to node since we don't have any other runtime? Or only when we upgrade to node v25? Or not at all?

Given the security implications of running 3rd-party code, it seems like a bad idea to default to node.js < v25.
Though I wonder why yt-dlp doesn't attempt to detect for the node.js version and automatically enable it for >= v25 – does it still have worse security than Deno, or is it only because the devs want to avoid doing the extra detection?

[lazka]

does it still have worse security than Deno, or is it only because the devs want to avoid doing the extra detection?

I think so, to quote https://nodejs.org/api/permissions.html#permission-model

The permission model implements a "seat belt" approach, which prevents trusted code from unintentionally changing files or using resources that access has not explicitly been granted to. It does not provide security guarantees in the presence of malicious code. Malicious code can bypass the permission model and execute arbitrary code without the restrictions imposed by the permission model.

I middle ground could be to enable node by default, but have yt-dlp ask the user to trust an origin: "Trying to execute code from https://youtube.googleapis.com. Allow? [N/y]"

[alvinhochun]

What about Deno, is it too difficult to package?
Alternatively, should the nodejs dependency be optional in case the user prefers to use an external Deno install?

[ognevny]

What about Deno, is it too difficult to package?

yes

[ognevny]

What about Deno, is it too difficult to package?

yes

in #26410 you can see how it is hard actually...

[lazka]

I'm closing this for now.

Once the js engine is required we can move ejs from an optional dep to a normal dep.

Alternatively, should the nodejs dependency be optional in case the user prefers to use an external Deno install?

I think most users will never notice that optional deps are missing and will give up, so I'd rather install more things by default.