Bug 2510113

Created attachment 2153296 [details]
Update to 8.5.0 (#2510113)

the-new-hotness/release-monitoring.org's scratch build of python-streamlink-8.5.0-1.fc44.src.rpm for rawhide failed http://koji.fedoraproject.org/koji/taskinfo?taskID=148597751

Releases retrieved: 8.6.0
Upstream release that is considered latest: 8.6.0
Current version/release in rawhide: 8.4.0-4.fc45
URL: https://streamlink.github.io/

Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/


More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_Monitoring


Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream.


Based on the information from Anitya: https://release-monitoring.org/project/12791/


To change the monitoring settings for the project, please visit:
https://src.fedoraproject.org/rpms/python-streamlink

Created attachment 2157665 [details]
Update to 8.6.0 (#2510113)

the-new-hotness/release-monitoring.org's scratch build of python-streamlink-8.6.0-1.fc44.src.rpm for rawhide failed http://koji.fedoraproject.org/koji/taskinfo?taskID=150212440

Releases retrieved: 8.6.1
Upstream release that is considered latest: 8.6.1
Current version/release in rawhide: 8.4.0-4.fc45
URL: https://streamlink.github.io/

Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/


More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_Monitoring


Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream.


Based on the information from Anitya: https://release-monitoring.org/project/12791/


To change the monitoring settings for the project, please visit:
https://src.fedoraproject.org/rpms/python-streamlink

Created attachment 2157899 [details]
Update to 8.6.1 (#2510113)

the-new-hotness/release-monitoring.org's scratch build of python-streamlink-8.6.1-1.fc44.src.rpm for rawhide failed http://koji.fedoraproject.org/koji/taskinfo?taskID=150303689

Please have a look at the recent releases. Thank you.

8.6.0 includes important security fixes for CVE-2026-92164 / GHSA-vf2x-4v53-pm7v:
https://github.com/streamlink/streamlink/blob/bda206b088bceadd40bd1c327f2f7b26d21f67ea/CHANGELOG.md#streamlink-860-2026-09-13

8.6.1 fixes incompabilities with urllib3 2.8.0 which otherwise render the application broken (urllib3 2.8.0 itself includes fixes for lots of CVEs, so I expect this to be packaged soon):
https://github.com/streamlink/streamlink/blob/bda206b088bceadd40bd1c327f2f7b26d21f67ea/CHANGELOG.md#streamlink-861-2026-09-16

----

> python-streamlink-8.1.0-documentation.patch

This can be removed, as the "intersphinx" extension can be disabled by setting the `-t no_intersphinx` Sphinx option (or `NO_INTERSPHINX=1` when using the Makefile).
The shell completions script was also rewritten, so the patch doesn't even apply.

8.5.0 also added FISH completions in addition to BASH and ZSH.

> python-streamlink-8.4.0-python3.15_tests.patch
> python-streamlink-8.4.0-requests_2.34.patch

Unneeded since 8.5.0

> python-streamlink-8.1.0-pytest_8.3.patch

Can be removed with F43 EOL, as F44+ has bumped pytest to >=8.4.0

(In reply to Sebastian Meyer from comment #9)
> 8.6.1 fixes incompabilities with urllib3 2.8.0 which otherwise render the
> application broken (urllib3 2.8.0 itself includes fixes for lots of CVEs, so
> I expect this to be packaged soon)

This is now blocking the update to urllib3 2.8.0, https://src.fedoraproject.org/rpms/python-urllib3/pull-request/58.

I opened a PR that would update this package to 8.6.1, https://src.fedoraproject.org/rpms/python-streamlink/pull-request/9. Mohamed, could you please take a look? Ideally, this could be shipped in the same side tags as urllib3 2.8.0. With your consent, I would be happy to take care of that using provenpackager privilege.

I’d like to move forward on this relatively quickly, since urllib3 is a very widely used dependency, and I don’t want to delay too much in shipping security fixes for it. Thanks!