peter
b4bf71ea64
- The cut file is measured against what its owner has left, for a YouTube range (whose fetch never reads yt-dlp's size ceiling) and for a Plex clip (which fetches nothing), before the fetch and again before it is placed; a refusal leaves the asset pending for a Retry. - A silent Plex file is cut silent; a file the probe cannot read says so. - A second job on a failed or renamed clip gets the same YouTube diagnosis and the fetched title. - The "too long" refusal names the server's cap; a contract test holds the client's copies of the clip limits to clip.py; the shipped player clients are pinned against the installed yt-dlp. - One HDR transfer set and one rating_key lookup; job status words from JobStatus; the display-name guard sees subscript writes and the clip route; stale comments and types follow the clip job.
67 lines
1.9 KiB
Plaintext
67 lines
1.9 KiB
Plaintext
# Pinned dependency lock for reproducible builds (SEC-5). GENERATED — do not hand-edit.
|
|
# Source of truth is requirements.txt (the floor ranges); regenerate after editing it with:
|
|
# docker run --rm -v "$PWD":/b python:3.12-slim sh -c 'pip install -q -r /b/requirements.txt && pip freeze --exclude pip --exclude setuptools --exclude wheel' | sort
|
|
# The prod Dockerfile + Dockerfile.test install THIS file; the gate's pip-audit (scripts/check.sh)
|
|
# scans it, blocking. A security fix, or a yt-dlp release YouTube's changes force, may be ONE pin
|
|
# bumped in place instead of a full regeneration, which would move every other package too — then
|
|
# `pip install -r requirements.lock && pip check` must pass. In place so far: urllib3 2.7.0 -> 2.8.0 (PYSEC-2026-4175/4176/4177); yt-dlp 2026.7.4 -> 2026.8.19
|
|
# (it marks the clients that need a stream PO token, so the downloader stops fetching into a 403).
|
|
APScheduler==3.11.3
|
|
Authlib==1.7.2
|
|
Mako==1.4.1
|
|
MarkupSafe==3.0.3
|
|
PyYAML==6.0.3
|
|
Pygments==2.21.0
|
|
SQLAlchemy==2.0.52
|
|
alembic==1.19.1
|
|
annotated-doc==0.0.5
|
|
annotated-types==0.8.0
|
|
anyio==4.14.2
|
|
argon2-cffi-bindings==25.1.0
|
|
argon2-cffi==25.1.0
|
|
bgutil-ytdlp-pot-provider==1.3.1
|
|
brotli==1.2.0
|
|
certifi==2026.7.22
|
|
cffi==2.1.1
|
|
charset-normalizer==3.5.1
|
|
click==8.4.2
|
|
cryptography==50.0.0
|
|
curl_cffi==0.15.0
|
|
fastapi==0.141.1
|
|
feedparser-sgmllib==2.1.0
|
|
feedparser==6.0.14
|
|
greenlet==3.5.5
|
|
h11==0.16.0
|
|
httpcore==1.0.9
|
|
httptools==0.8.0
|
|
httpx==0.28.1
|
|
idna==3.18
|
|
itsdangerous==2.2.0
|
|
joserfc==1.7.4
|
|
markdown-it-py==4.2.0
|
|
mdurl==0.1.2
|
|
mutagen==1.48.1
|
|
numpy==2.5.2
|
|
psycopg-binary==3.3.4
|
|
psycopg==3.3.4
|
|
py3langid==0.3.0
|
|
pycparser==3.0
|
|
pycryptodomex==3.23.0
|
|
pydantic-settings==2.15.0
|
|
pydantic==2.13.4
|
|
pydantic_core==2.46.4
|
|
python-dotenv==1.2.3
|
|
requests==2.34.2
|
|
rich==15.0.0
|
|
starlette==1.6.0
|
|
typing-inspection==0.4.4
|
|
typing_extensions==4.16.0
|
|
tzlocal==5.4.4
|
|
urllib3==2.8.0
|
|
uvicorn==0.52.3
|
|
uvloop==0.22.1
|
|
watchfiles==1.2.0
|
|
websockets==17.0.1
|
|
yt-dlp-ejs==0.8.0
|
|
yt-dlp==2026.8.19
|