chore(deps): bump streamlink from 8.4.0 to 8.6.0

[dependabot]

Bumps streamlink from 8.4.0 to 8.6.0.

Release notes

Sourced from streamlink's releases.

Streamlink 8.6.0

• SECURITY: fixed arbitrary local file read via HTTP(S) redirection to file:// URL (CVE-2026-92164 / GHSA-vf2x-4v53-pm7v) (4b99c64d)
• SECURITY: fixed insecure cross-scheme redirection (HTTPS -> HTTP) (CVE-2026-92164 / GHSA-vf2x-4v53-pm7v) (4b99c64d)
• Added: official support for Python 3.15 (#7026)
• Added: support for HLS packed audio streams (#7083, #7082)
• Added: HLSSegment.{get,iter}_content() and HLSStreamWriter.{get,iter}_segment_content() for being able to modify segment data (#7059)
• Added: itsoffset option to FFMPEGMuxer (#7081)
• Added: nextjs_inline_rsc() to validate API (#7110)
• Fixed: HTTP server of --player-http/--player-continuous-http binding to all interfaces (#7051)
• Fixed: zero or negative duration values in HLS dateranges (#7074)
• Fixed: incorrect t attribute evaluation in DASH SegmentTimeline.S nodes (#7075)
• Updated plugins:
  • ard_live: removed plugin (#7091)
  • ard_mediathek: rewritten and fixed plugin (#7090)
  • atresplayer: refactored stream retrieval (#7062)
  • bigo: added MPEG-TS packet header decryption due to Bigo's web-protection (#7056, #7059)
  • bigo: worked around account requirements (#7106, #7109)
  • cdnbg: fixed player_url schema (#7036)
  • douyu: fixed API call failures on systems with unsynced clocks (#7065)
  • filmon: updated URL matcher and switched to v2 APIs (#7105)
  • goodgame: fixed stream retrieval (#7086)
  • kick: fixed VODs (#7108)
  • nimotv: fixed access to streams (#7111)
  • okru: fixed metadata schema (#7092)
  • piczel: removed plugin (#7102)
  • pluto: fixed URL matcher, channel ID resolver and VODs (#7048, #7100)
  • tiktok: rewritten and fixed stream data schema for access to origin streams (#7077)
  • twitch: added support for portrait-format streams (#7087)
  • twitch: fixed missing category stream metadata breaking all stream metadata (#7025)
  • vidio: rewritten and fixed plugin (#7063)
  • zdf_mediathek: rewritten and fixed plugin (#7093)
• Dependencies: bumped min. version requirement of lxml to 5.0.0 (#7029)

📦 Download and Installation

Please see the installation instructions for a list of available install methods and packages on the supported operating systems.

⚙️ Configuration and Usage

Please see the CLI documentation for how to configure and use Streamlink.

❤️ Support

If you think that Streamlink is useful and if you want to keep the project alive, then please consider supporting its maintainers by sending a small and optionally recurring tip via the available options.
Your support is very much appreciated, thank you!

🙏 Contributors

• 67: @​bastimeyer
• 3: @​Mehavoid

... (truncated)

Changelog

Sourced from streamlink's changelog.

streamlink 8.6.0 (2026-09-13)

• SECURITY: fixed arbitrary local file read via HTTP(S) redirection to file:// URL (CVE-2026-92164 / GHSA-vf2x-4v53-pm7v) (4b99c64d)
• SECURITY: fixed insecure cross-scheme redirection (HTTPS -> HTTP) (CVE-2026-92164 / GHSA-vf2x-4v53-pm7v) (4b99c64d)
• Added: official support for Python 3.15 (#7026)
• Added: support for HLS packed audio streams (#7083, #7082)
• Added: HLSSegment.{get,iter}_content() and HLSStreamWriter.{get,iter}_segment_content() for being able to modify segment data (#7059)
• Added: itsoffset option to FFMPEGMuxer (#7081)
• Added: nextjs_inline_rsc() to validate API (#7110)
• Fixed: HTTP server of --player-http/--player-continuous-http binding to all interfaces (#7051)
• Fixed: zero or negative duration values in HLS dateranges (#7074)
• Fixed: incorrect t attribute evaluation in DASH SegmentTimeline.S nodes (#7075)
• Updated plugins:
  • ard_live: removed plugin (#7091)
  • ard_mediathek: rewritten and fixed plugin (#7090)
  • atresplayer: refactored stream retrieval (#7062)
  • bigo: added MPEG-TS packet header decryption due to Bigo's web-protection (#7056, #7059)
  • bigo: worked around account requirements (#7106, #7109)
  • cdnbg: fixed player_url schema (#7036)
  • douyu: fixed API call failures on systems with unsynced clocks (#7065)
  • filmon: updated URL matcher and switched to v2 APIs (#7105)
  • goodgame: fixed stream retrieval (#7086)
  • kick: fixed VODs (#7108)
  • nimotv: fixed access to streams (#7111)
  • okru: fixed metadata schema (#7092)
  • piczel: removed plugin (#7102)
  • pluto: fixed URL matcher, channel ID resolver and VODs (#7048, #7100)
  • tiktok: rewritten and fixed stream data schema for access to origin streams (#7077)
  • twitch: added support for portrait-format streams (#7087)
  • twitch: fixed missing category stream metadata breaking all stream metadata (#7025)
  • vidio: rewritten and fixed plugin (#7063)
  • zdf_mediathek: rewritten and fixed plugin (#7093)
• Dependencies: bumped min. version requirement of lxml to 5.0.0 (#7029)

Full changelog

streamlink 8.5.0 (2026-08-01)

• Fixed: named-pipe player inputs not being cleaned up on pre-open failure (#6935)
• Fixed: stream start offsets being incorrectly cast to int in HLS (#6941)
• Fixed: hls-playlist-reload-time not accepting floats (#6957)
• Refactored: HTTPSession and fixed many typing issues (#6924)
• Refactored: MPDNode in DASH manifest parser to allow attribute namespaces (#6988)
• Updated plugins:
  • douyin: fixed validation schema (#6930)
  • douyu: re-introduced plugin with new implementation (#6959, #7003)
  • mdstrm: added support for VODs / embedded streams with access tokens (#6994)
  • nos: rewritten and fixed plugin (#6954)
  • radiko: fixed live_url value (#6962)

... (truncated)

Commits

• c5edcab release: 8.6.0
• 04f7dff tests.session: fix test failure on macOS-py310
• 8506d2b tests.session.http: add FileAdapter test
• 4b99c64 session.http: fix HTTP redirects
• 46c9b28 docs: replace pipx section with uvx
• 3f0cdc5 plugins.nimotv: restore access for streams
• 6d856d6 plugins.piczel: remove plugin
• 48375bc plugins: switch to validate.nextjs_inline_rsc()
• 11b5084 validate: add nextjs_inline_rsc() validator
• 9d204e4 plugins.bigo: fix token
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: dangeroustech/StreamDL/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 03edc311-cd2f-41db-92ee-a38eef0bfaaa

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}