chore 🤖(deps): bump streamlink from 8.6.1 to 8.6.2

[dependabot]

Bumps streamlink from 8.6.1 to 8.6.2.

Release notes

Sourced from streamlink's releases.

Streamlink 8.6.2

• SECURITY: fixed arbitrary local file read via file:// URLs in DASH Location tags (CVE-2026-TO-BE-ASSIGNED / GHSA-j7pf-m7gx-jr33) (98781761)
• Changed: validate.xml_xpath() and validate.xml_xpath_string() to include access to re:test(), re:match() and re:replace() regex functions (#7151)
• Changed: log format of deprecation warnings (#7141)
• Fixed: missing deprecation warnings for already deprecated CLI arguments (req. Python 3.13+) (#7141)
• Fixed: being able to close SegmentedStreamReader streams without opening them first, emitting log records on garbage collection (#7146)
• Updated plugins:
  • blazetv: fixed live streams (#7147)
  • cinergroup: fixed Bloomberg HT (#7132)
  • dogan: fixed plugin (#7138)
  • facebook: re-introduced plugin with new implementation (#7115)
  • vimeo: rewritten and fixed plugin (#7069)
  • youtvua: added new plugin (#7140)
• Docs: tightened rules about AI-assisted contributions and security vulnerability reports (#7136, #7152)

📦 Download and Installation

Please see the installation instructions for a list of available install methods and packages on the supported operating systems.

⚙️ Configuration and Usage

Please see the CLI documentation for how to configure and use Streamlink.

❤️ Support

If you think that Streamlink is useful and if you want to keep the project alive, then please consider supporting its maintainers by sending a small and optionally recurring tip via the available options.
Your support is very much appreciated, thank you!

🙏 Contributors

• 33: @​bastimeyer
• 2: @​fl-Henry
• 2: @​mrhard9090
• 1: @​YupCore
• 1: @​oliviernes
• 1: @​streamlinkbot

🗒️ Full changelog

YupCore <62990068+YupCore@users.noreply.github.com> (1):
      plugins.youtvua: add a new plugin
bastimeyer <mail@bastimeyer.de> (30):

docs: fix typo in 8.6.1 changelog

tools: bump ruff to 0.16.7

tools: bump ty to 0.0.81 and fix issues

build: bump types-docutils to 0.23.0.20260911

docs: add CVE-2026-92164 to 8.6.0 changelog

cli.argparser: refactor, set exit_on_error=False

</tr></table>

... (truncated)

Changelog

Sourced from streamlink's changelog.

streamlink 8.6.2 (2026-10-07)

• SECURITY: fixed arbitrary local file read via file:// URLs in DASH Location tags (CVE-2026-TO-BE-ASSIGNED / GHSA-j7pf-m7gx-jr33) (98781761)
• Changed: validate.xml_xpath() and validate.xml_xpath_string() to include access to re:test(), re:match() and re:replace() regex functions (#7151)
• Changed: log format of deprecation warnings (#7141)
• Fixed: missing deprecation warnings for already deprecated CLI arguments (req. Python 3.13+) (#7141)
• Fixed: being able to close SegmentedStreamReader streams without opening them first, emitting log records on garbage collection (#7146)
• Updated plugins:
  • blazetv: fixed live streams (#7147)
  • cinergroup: fixed Bloomberg HT (#7132)
  • dogan: fixed plugin (#7138)
  • facebook: re-introduced plugin with new implementation (#7115)
  • vimeo: rewritten and fixed plugin (#7069)
  • youtvua: added new plugin (#7140)
• Docs: tightened rules about AI-assisted contributions and security vulnerability reports (#7136, #7152)

Full changelog

Commits

• f330074 release: 8.6.2
• 9878176 stream.dash: add Location URL scheme check
• 8209b5b build: bump charset-normalizer to 3.5.2
• 3feab26 build: bump pycryptodome to 3.24.0
• 17fdb51 tools: bump mypy to 2.4.0
• 09222c4 tools: bump ty to 0.0.85 and fix issues
• 95f46f8 tools: bump ruff to 0.16.10
• a8a66ec plugins.blazetv: fix streams with new SimpleStream API
• 8429695 docs: add SECURITY.md
• c08892d validate: add the "re" namespace to XPath queries
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: dangeroustech/StreamDL/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: a69154f2-5d89-4adf-a060-da8878f4d5f2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}