Re: git: bd7b11985eec - main - multimedia/mpv: Disable YTDLP option by default

On Wed, Mar 11, 2026 at 07:05:52PM +0100, Daniel Engberg wrote:
> On 2026-03-11 18:57, Alexey Dokuchaev wrote:
> > On Wed, Mar 11, 2026 at 05:34:42PM +0000, Joel Bodenmann wrote:
> > > commit bd7b11985eecd759e36eb1f40b52eeb494b30493
> > > 
> > >    multimedia/mpv: Disable YTDLP option by default
> > > 
> > >    The www/yt-dlp dependency now requires npm and deno as
> > >    dependencies (via www/py-yt-dlp-ejs). This pulls in a
> > >    bunch of build and run dependencies [...]
> > 
> > Not sure why yt-dlp folks suggest oxidized deno by default; it works
> > just fine with `lang/quickjs' (written in C) which is also maintained
> > by yuri@ BTW.
> 
> The answer is [QuickJS does not fully allow executing files from stdin,
> so yt-dlp will create temporary files for each EJS script execution.
> This can theoretically lead to time-of-check to time-of-use (TOCTOU)
> vulnerabilities.]

This but in plain C is way more sane and preferrable than anything which
requires rust and/or npm.

./danfe