ytdl-material v1.0.10

🚀 ytdl-material 1.0.10

This patch release adds a yt-dlp update channel setting so you can move to nightly when an upstream change breaks the stable build, restores VAAPI/QSV hardware transcoding device access, and refreshes both lockfiles including a high-severity nanoid advisory.

✨ Features

• Added a yt-dlp update channel setting so you are no longer stuck on stable yt-dlp when an upstream change lands mid-cycle. yt-dlp is downloaded separately from this image and was always pulled from the latest stable release — so voc0der/ytdl-material:nightly still ran stable yt-dlp, because the image tag versions the app, not the downloader. Pick stable (default), nightly, or master with ytdl_ytdlp_update_channel in your environment block, or from the downloader dropdown under Settings → Advanced. Resolves the HTTP 403 download failures in #364. #365

🛠️ Fixes

• Fixed VAAPI/QSV hardware transcoding failing to reach the GPU. Drivers are now installed only when VAAPI/QSV is actually selected, and group_add device groups are preserved so the container can open /dev/dri. #360
• Bumped the bundled ffmpeg builds to n9.0, after the n7.1 builds this image pulled at build time were retired upstream. 25293292

🔒 Security / Dependencies

• Pinned nanoid to 3.3.18 to close GHSA-2v37-7h3g-55p8 (high). The backend pin is scoped to shortid on purpose, so Scalar keeps its own nanoid@5.x. Both packages now report 0 vulnerabilities. #365
• Updated Angular to 22.1.2 and its build tooling to 22.1.4, plus eslint, @types/node, @typescript-eslint, openid-client, pg, redis, core-js, @angular/material, @angular/cdk, @scalar/express-api-reference, express-rate-limit, and read-last-lines. Both lockfiles were refreshed so installed versions match their declared ranges. #350 #354 #358 #365
• Pinned the github/codeql-action (4.37.7) and docker/login-action (4.6.0) GitHub Actions to exact versions. #350 #365

Full Changelog: v1.0.9...v1.0.10

Contributors

• @voc0der