chore 🤖(deps): bump streamlink from 8.5.0 to 8.6.0

[dependabot]

Bumps streamlink from 8.5.0 to 8.6.0.

Release notes

Sourced from streamlink's releases.

Streamlink 8.6.0

• SECURITY: fixed arbitrary local file read via HTTP(S) redirection to file:// URL (CVE-2026-92164 / GHSA-vf2x-4v53-pm7v) (4b99c64d)
• SECURITY: fixed insecure cross-scheme redirection (HTTPS -> HTTP) (CVE-2026-92164 / GHSA-vf2x-4v53-pm7v) (4b99c64d)
• Added: official support for Python 3.15 (#7026)
• Added: support for HLS packed audio streams (#7083, #7082)
• Added: HLSSegment.{get,iter}_content() and HLSStreamWriter.{get,iter}_segment_content() for being able to modify segment data (#7059)
• Added: itsoffset option to FFMPEGMuxer (#7081)
• Added: nextjs_inline_rsc() to validate API (#7110)
• Fixed: HTTP server of --player-http/--player-continuous-http binding to all interfaces (#7051)
• Fixed: zero or negative duration values in HLS dateranges (#7074)
• Fixed: incorrect t attribute evaluation in DASH SegmentTimeline.S nodes (#7075)
• Updated plugins:
  • ard_live: removed plugin (#7091)
  • ard_mediathek: rewritten and fixed plugin (#7090)
  • atresplayer: refactored stream retrieval (#7062)
  • bigo: added MPEG-TS packet header decryption due to Bigo's web-protection (#7056, #7059)
  • bigo: worked around account requirements (#7106, #7109)
  • cdnbg: fixed player_url schema (#7036)
  • douyu: fixed API call failures on systems with unsynced clocks (#7065)
  • filmon: updated URL matcher and switched to v2 APIs (#7105)
  • goodgame: fixed stream retrieval (#7086)
  • kick: fixed VODs (#7108)
  • nimotv: fixed access to streams (#7111)
  • okru: fixed metadata schema (#7092)
  • piczel: removed plugin (#7102)
  • pluto: fixed URL matcher, channel ID resolver and VODs (#7048, #7100)
  • tiktok: rewritten and fixed stream data schema for access to origin streams (#7077)
  • twitch: added support for portrait-format streams (#7087)
  • twitch: fixed missing category stream metadata breaking all stream metadata (#7025)
  • vidio: rewritten and fixed plugin (#7063)
  • zdf_mediathek: rewritten and fixed plugin (#7093)
• Dependencies: bumped min. version requirement of lxml to 5.0.0 (#7029)

📦 Download and Installation

Please see the installation instructions for a list of available install methods and packages on the supported operating systems.

⚙️ Configuration and Usage

Please see the CLI documentation for how to configure and use Streamlink.

❤️ Support

If you think that Streamlink is useful and if you want to keep the project alive, then please consider supporting its maintainers by sending a small and optionally recurring tip via the available options.
Your support is very much appreciated, thank you!

🙏 Contributors

• 67: @​bastimeyer
• 3: @​Mehavoid

... (truncated)

Changelog

Sourced from streamlink's changelog.

streamlink 8.6.0 (2026-09-13)

• SECURITY: fixed arbitrary local file read via HTTP(S) redirection to file:// URL (CVE-2026-92164 / GHSA-vf2x-4v53-pm7v) (4b99c64d)
• SECURITY: fixed insecure cross-scheme redirection (HTTPS -> HTTP) (CVE-2026-92164 / GHSA-vf2x-4v53-pm7v) (4b99c64d)
• Added: official support for Python 3.15 (#7026)
• Added: support for HLS packed audio streams (#7083, #7082)
• Added: HLSSegment.{get,iter}_content() and HLSStreamWriter.{get,iter}_segment_content() for being able to modify segment data (#7059)
• Added: itsoffset option to FFMPEGMuxer (#7081)
• Added: nextjs_inline_rsc() to validate API (#7110)
• Fixed: HTTP server of --player-http/--player-continuous-http binding to all interfaces (#7051)
• Fixed: zero or negative duration values in HLS dateranges (#7074)
• Fixed: incorrect t attribute evaluation in DASH SegmentTimeline.S nodes (#7075)
• Updated plugins:
  • ard_live: removed plugin (#7091)
  • ard_mediathek: rewritten and fixed plugin (#7090)
  • atresplayer: refactored stream retrieval (#7062)
  • bigo: added MPEG-TS packet header decryption due to Bigo's web-protection (#7056, #7059)
  • bigo: worked around account requirements (#7106, #7109)
  • cdnbg: fixed player_url schema (#7036)
  • douyu: fixed API call failures on systems with unsynced clocks (#7065)
  • filmon: updated URL matcher and switched to v2 APIs (#7105)
  • goodgame: fixed stream retrieval (#7086)
  • kick: fixed VODs (#7108)
  • nimotv: fixed access to streams (#7111)
  • okru: fixed metadata schema (#7092)
  • piczel: removed plugin (#7102)
  • pluto: fixed URL matcher, channel ID resolver and VODs (#7048, #7100)
  • tiktok: rewritten and fixed stream data schema for access to origin streams (#7077)
  • twitch: added support for portrait-format streams (#7087)
  • twitch: fixed missing category stream metadata breaking all stream metadata (#7025)
  • vidio: rewritten and fixed plugin (#7063)
  • zdf_mediathek: rewritten and fixed plugin (#7093)
• Dependencies: bumped min. version requirement of lxml to 5.0.0 (#7029)

Full changelog

Commits

• c5edcab release: 8.6.0
• 04f7dff tests.session: fix test failure on macOS-py310
• 8506d2b tests.session.http: add FileAdapter test
• 4b99c64 session.http: fix HTTP redirects
• 46c9b28 docs: replace pipx section with uvx
• 3f0cdc5 plugins.nimotv: restore access for streams
• 6d856d6 plugins.piczel: remove plugin
• 48375bc plugins: switch to validate.nextjs_inline_rsc()
• 11b5084 validate: add nextjs_inline_rsc() validator
• 9d204e4 plugins.bigo: fix token
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 3d2a1478-368d-49b0-8d75-e60a23923697

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[dependabot]

Superseded by #653.