Streamlink Files

• SECURITY: fixed arbitrary local file read via file:// URLs in DASH Location tags (CVE-2026-TO-BE-ASSIGNED / GHSA-j7pf-m7gx-jr33) (98781761)
• Changed: validate.xml_xpath() and validate.xml_xpath_string() to include access to re:test(), re:match() and re:replace() regex functions (#7151)
• Changed: log format of deprecation warnings (#7141)
• Fixed: missing deprecation warnings for already deprecated CLI arguments (req. Python 3.13+) (#7141)
• Fixed: being able to close SegmentedStreamReader streams without opening them first, emitting log records on garbage collection (#7146)
• Updated plugins:
• blazetv: fixed live streams (#7147)
• cinergroup: fixed Bloomberg HT (#7132)
• dogan: fixed plugin (#7138)
• facebook: re-introduced plugin with new implementation (#7115)
• vimeo: rewritten and fixed plugin (#7069)
• youtvua: added new plugin (#7140)
• Docs: tightened rules about AI-assisted contributions and security vulnerability reports (#7136, #7152)

📦 Download and Installation

Please see the installation instructions for a list of available install methods and packages on the supported operating systems.

⚙️ Configuration and Usage

Please see the CLI documentation for how to configure and use Streamlink.

❤️ Support

If you think that Streamlink is useful and if you want to keep the project alive, then please consider supporting its maintainers by sending a small and optionally recurring tip via the available options.
Your support is very much appreciated, thank you!

🙏 Contributors

• 33: @bastimeyer
• 2: @fl-Henry
• 2: @mrhard9090
• 1: @YupCore
• 1: @oliviernes
• 1: @streamlinkbot

🗒️ Full changelog

:::text
YupCore <62990068+YupCore@users.noreply.github.com> (1):
      plugins.youtvua: add a new plugin

bastimeyer <mail@bastimeyer.de> (30):
      docs: fix typo in 8.6.1 changelog
      tools: bump ruff to 0.16.7
      tools: bump ty to 0.0.81 and fix issues
      build: bump types-docutils to 0.23.0.20260911
      docs: add CVE-2026-92164 to 8.6.0 changelog
      cli.argparser: refactor, set exit_on_error=False
      tests.cli: add more setup_args() tests
      tests.cli: move test_setup_session_options()
      build: bump docs dependency group
      ci.github: update Unicode checks in lint workflow
      ci.github: prevent @-mentions in commit messages
      docs: update developing page
      tools: bump ty to 0.0.84
      docs: update AI-assisted contributions section
      logger: change WarningLogRecord attrs and msg
      cli.main: ignore warnings on initial args parsing
      cli.argparser: emit warnings, no stderr output
      cli: explicitly flag already deprecated args
      tests.stream: add caplog fixture to TestCase tests
      tests.stream.ffmpegmux: move caplog fixture
      stream.segmented: check opened state in reader
      tests.stream.hls: minor test setup cleanup
      validate: add the "re" namespace to XPath queries
      docs: add SECURITY.md
      tools: bump ruff to 0.16.10
      tools: bump ty to 0.0.85 and fix issues
      tools: bump mypy to 2.4.0
      build: bump pycryptodome to 3.24.0
      build: bump charset-normalizer to 3.5.2
      stream.dash: add Location URL scheme check

dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (4):
      ci.github: bump codecov/codecov-action to 7.1.1
      ci.github: bump astral-sh/setup-uv to 10.2.0
      build: bump types-docutils to 0.23.0.20260923
      build: bump shtab to 1.12.1

fl-henry <fl.henry.jefferson@gmail.com> (2):
      plugins.facebook: add facebook plugin
      plugins.vimeo: HLS URLs re-fetch

mrhard9090 <74858909+mrhard9090@users.noreply.github.com> (2):
      plugins.dogan: fix plugin
      plugins.cinergroup: fix Bloomberg HT

oliviernes <olivier.nesme@gmail.com> (1):
      plugins.blazetv: fix streams with new SimpleStream API

streamlinkbot <streamlinkbot@users.noreply.github.com> (1):
      session.http_useragents: update useragents