[cleanup] Misc (#17892)

Authored by: doe1080, bashonly

Co-authored-by: bashonly <88596187+bashonly@users.noreply.github.com>

Changelog.md

@@ -10,7 +10,7 @@
 - Security: Old yt-dlp executables are vulnerable to man-in-the-middle attacks
     - A man-in-the-middle/MITM attack is when your internet traffic is intercepted by an attacker that impersonates the website(s) you browse and sends you malicious data instead.
     - If you think you may be targeted by such an attack, it is strongly recommended to avoid using the self-updater (e.g. the `-U`, `--update`, `--update-to` command-line options), and instead manually download and install this release's executable.
-    - For more details, see the [`certifi` security advisory](https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2)
+    - For more details, see the [`certifi` security advisory](https://github.com/advisories/GHSA-6q48-6c7w-9gw2)
 
 #### Core changes
 - **update**

Maintainers.md

@@ -95,3 +95,4 @@ Triage Maintainers are frequent contributors who can manage issues and pull requ
 - [DTrombett](https://github.com/dtrombett)
 - [grqz](https://github.com/grqz)
 - [InvalidUsernameException](https://github.com/InvalidUsernameException)
+- [ruben1PvP](https://github.com/ruben1PvP)

Makefile

@@ -197,7 +197,7 @@ CONTRIBUTORS: Changelog.md
 	  $(PYTHON) devscripts/make_changelog.py -v -c > /dev/null ; \
 	fi
 
-# The following EJS_-prefixed variables are auto-generated by devscripts/update_ejs.py
+# The following EJS_-prefixed variables are auto-generated by dlp-bot
 # DO NOT EDIT!
 EJS_VERSION = 0.8.0
 EJS_WHEEL_NAME = yt_dlp_ejs-0.8.0-py3-none-any.whl

devscripts/changelog_override.json

@@ -408,7 +408,7 @@
     {
         "action": "add",
         "when": "70279f2f0c576e23e1ec1406317d2cb85586af3f",
-        "short": "[priority] Security: Old yt-dlp executables are vulnerable to man-in-the-middle attacks\n    - A man-in-the-middle/MITM attack is when your internet traffic is intercepted by an attacker that impersonates the website(s) you browse and sends you malicious data instead.\n    - If you think you may be targeted by such an attack, it is strongly recommended to avoid using the self-updater (e.g. the `-U`, `--update`, `--update-to` command-line options), and instead manually download and install this release's executable.\n    - For more details, see the [`certifi` security advisory](https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2)"
+        "short": "[priority] Security: Old yt-dlp executables are vulnerable to man-in-the-middle attacks\n    - A man-in-the-middle/MITM attack is when your internet traffic is intercepted by an attacker that impersonates the website(s) you browse and sends you malicious data instead.\n    - If you think you may be targeted by such an attack, it is strongly recommended to avoid using the self-updater (e.g. the `-U`, `--update`, `--update-to` command-line options), and instead manually download and install this release's executable.\n    - For more details, see the [`certifi` security advisory](https://github.com/advisories/GHSA-6q48-6c7w-9gw2)"
     },
     {
         "action": "add",
@@ -419,5 +419,10 @@
         "action": "add",
         "when": "3d28cf4780fa88689fc50010d72cf2f40ce3a3b8",
         "short": "[priority] **The official Windows release binaries now require Windows 10 or later.** [Read more](https://github.com/yt-dlp/yt-dlp/issues/16917)"
+    },
+    {
+        "action": "add",
+        "when": "7747073a2b00ca4688637eef4e168af9d2a806cb",
+        "short": "[priority] Security: The recent `brotli` and `certifi` vulnerabilities have now been fully addressed in the executables\n    - The `brotli` package bundled with the executables has been upgraded to version 1.2.1, and the `curl-cffi` package has been upgraded to version 0.17.0. These upgrades address the recent [`brotli` security vulnerability](https://github.com/advisories/GHSA-9v8h-qqgm-4m35)\n    - `curl-cffi` 0.17.0 also fully addresses the recent [`certifi` security vulnerability](https://github.com/advisories/GHSA-6q48-6c7w-9gw2) that was already partially addressed by upgrading the `certifi` package bundled with the executables"
     }
 ]

pyproject.toml

@@ -249,13 +249,16 @@ exclude-newer = "7 days"
 
 [tool.uv.exclude-newer-package]
 brotli = false       # temporary
+brotlicffi = false   # temporary
 certifi = false      # temporary
 curl-cffi = false    # temporary
 deno = false         # temporary
 pip = false
 protobug = false
 pyinstaller = false
+setuptools = false   # temporary
 uv = false
+virtualenv = false   # temporary
 yt-dlp-ejs = false
 
 [tool.ruff]

yt_dlp/extractor/youtube/jsc/_builtin/vendor/_info.py

@@ -1,4 +1,4 @@
-# This file is generated by devscripts/update_requirements.py. DO NOT MODIFY!
+# This file is generated by dlp-bot. DO NOT MODIFY!
 
 VERSION = '0.8.0'
 HASHES = {