yt-dlp: 2025.10.22 -> 2025.11.12, add JS runtime

[Mynacol]

This supersedes #460852. Context: #460852 (comment).

New docs: https://github.com/yt-dlp/yt-dlp/wiki/EJS and more details on the migration for packagers: yt-dlp/yt-dlp#15012.
For full YouTube support, we have to add a JavaScript engine. The upstream project prefers deno for security reasons. Bun, node and QuickJS are also supported, but have to be enabled with a flag, hence we should also use deno by default.
Furthermore, the yt-dlp-ejs project is required for extraction. We may package this repo as well.

I just tested getting this dynamic remote code with --remote-components ejs:npm so far.
Initial attempts to also package yt-dlp-ejs were not fruitful (we have to mix Python and JavaScript builders).

Closes #455290

Things done

• Built on platform:
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• Tested, as applicable:
  • NixOS tests in nixos/tests.
  • Package tests at passthru.tests.
  • Tests in lib/tests or pkgs/test for functions and "core" functionality.
• Ran nixpkgs-review on this PR. See nixpkgs-review usage.
• Tested basic functionality of all binary files, usually in ./result/bin/.
• Nixpkgs Release Notes
  • Package update: when the change is major or breaking.
• NixOS Release Notes
  • Module addition: when adding a new NixOS module.
  • Module update: when the change is significant.
• Fits CONTRIBUTING.md, pkgs/README.md, maintainers/README.md and other READMEs.

---

Add a 👍 reaction to pull requests you find important.

[SuperSandro2000]

I will take a look how to package yt-dlp-ejs probably later today or tomorrow.

Please don't get into a panic, everything will be fine.

[Mynacol]

I will take a look how to package yt-dlp-ejs probably later today or tomorrow.

Please don't get into a panic, everything will be fine.

Everything's good, I just wanted to help out as far as I get. The previous version of yt-dlp works fine so far.

The current PR works, it just doesn't package the ejs part. Thanks for having a look, I don't think I can do that.

[SuperSandro2000]

Without yt-dlp-ejs:

 ➜ ./result/bin/yt-dlp https://www.youtube.com/watch?v=OGc9W-_C9u0
[youtube] Extracting URL: https://www.youtube.com/watch?v=OGc9W-_C9u0
[youtube] OGc9W-_C9u0: Downloading webpage
[youtube] OGc9W-_C9u0: Downloading tv client config
[youtube] OGc9W-_C9u0: Downloading player 7f3b257d-main
[youtube] OGc9W-_C9u0: Downloading tv player API JSON
[youtube] OGc9W-_C9u0: Downloading android sdkless player API JSON
[youtube] [jsc:deno] Solving JS challenges using deno
WARNING: [youtube] [jsc] Remote components challenge solver script (deno) and NPM package (deno) were skipped. These may be required to solve JS challenges. You can enable these downloads with  --remote-components ejs:github  (recommended) or  --remote-components ejs:npm , respectively. For more information and alternatives, refer to  https://github.com/yt-dlp/yt-dlp/wiki/EJS
WARNING: [youtube] OGc9W-_C9u0: Signature solving failed: Some formats may be missing. Ensure you have a supported JavaScript runtime and challenge solver script distribution installed. Review any warnings presented before this message. For more details, refer to  https://github.com/yt-dlp/yt-dlp/wiki/EJS
WARNING: [youtube] OGc9W-_C9u0: n challenge solving failed: Some formats may be missing. Ensure you have a supported JavaScript runtime and challenge solver script distribution installed. Review any warnings presented before this message. For more details, refer to  https://github.com/yt-dlp/yt-dlp/wiki/EJS
[info] OGc9W-_C9u0: Downloading 1 format(s): 139
[download] Sleeping 5.00 seconds as required by the site...
[download] Destination: Bring Me The Horizon - Doomed (Live at the Royal Albert Hall) [OGc9W-_C9u0].m4a
[download] 100% of    2.52MiB in 00:00:00 at 6.88MiB/s
[FixupM4a] Correcting container of "Bring Me The Horizon - Doomed (Live at the Royal Albert Hall) [OGc9W-_C9u0].m4a"

With yt-dlp-ejs:

 ➜ ./result/bin/yt-dlp https://www.youtube.com/watch?v=OGc9W-_C9u0
[youtube] Extracting URL: https://www.youtube.com/watch?v=OGc9W-_C9u0
[youtube] OGc9W-_C9u0: Downloading webpage
[youtube] OGc9W-_C9u0: Downloading tv client config
[youtube] OGc9W-_C9u0: Downloading player 1898687b-main
[youtube] OGc9W-_C9u0: Downloading tv player API JSON
[youtube] OGc9W-_C9u0: Downloading android sdkless player API JSON
[youtube] [jsc:deno] Solving JS challenges using deno
[info] OGc9W-_C9u0: Downloading 1 format(s): 399+251
[download] Sleeping 4.00 seconds as required by the site...
[download] Destination: Bring Me The Horizon - Doomed (Live at the Royal Albert Hall) [OGc9W-_C9u0].f399.mp4
[download] 100% of   23.34MiB in 00:00:00 at 23.52MiB/s
[download] Destination: Bring Me The Horizon - Doomed (Live at the Royal Albert Hall) [OGc9W-_C9u0].f251.webm
[download] 100% of    6.63MiB in 00:00:00 at 86.88MiB/s
[Merger] Merging formats into "Bring Me The Horizon - Doomed (Live at the Royal Albert Hall) [OGc9W-_C9u0].webm"
Deleting original file Bring Me The Horizon - Doomed (Live at the Royal Albert Hall) [OGc9W-_C9u0].f399.mp4 (pass -k to keep)
Deleting original file Bring Me The Horizon - Doomed (Live at the Royal Albert Hall) [OGc9W-_C9u0].f251.webm (pass -k to keep)

I would call that success. 🎉

[Mynacol]

Yeah, using npmfetchdeps and npmconfighook manually lets us build the ejs package.

Maybe we can push upstream to provide a nodejs lockfile as well, as they ask for such feedback. @SuperSandro2000 do you want to weigh in there? Or we can somehow use the deno lockfile ourselves.

Also, we might have to adapt the license:

when the yt-dlp-ejs package is built, it bundles code licensed under ISC and MIT.

[Mynacol]

I went ahead and changed the license. Maybe you want to squash the last two commits.

I'm also not able to build yt-dlp-ejs (while building yt-dlp), apparently due to a missing package-lock.json. I repeated it on a second system with the same problem, just like ofborg here.
ERROR: The package-lock.json file does not exist!

[SuperSandro2000]

I went ahead and changed the license. Maybe you want to squash the last two commits.

I'm also not able to build yt-dlp-ejs (while building yt-dlp), apparently due to a missing package-lock.json. I repeated it on a second system with the same problem, just like ofborg here. ERROR: The package-lock.json file does not exist!

I first pushed it without that file 😅

[pyrox0]

I'd not be comfortable packaging this with a lockfile in-tree, can this wait for the new deno tooling so that it can use deno.lock?

[VlaDexa]

can this wait for the new deno tooling

It can get packaged without yt-dlp-ejs (yt-dlp can download that itself), but this update is much desired by me, because youtube blocked every video format for me on old yt-dlp, so I really would love to see the new version in nixpkgs

[eclairevoyant]

@VlaDexa You can use the PR code in your own config (if you have questions, ask on discourse.nixos.org, I won't discuss that here). But the main objection to adding a huge lockfile is that such lockfiles tend to bloat the nixpkgs tarballs and affect everyone, and puts an extra maintenance burden for every single update.

@SuperSandro2000 I am also still getting the same error.

nix build github:mynacol/nixpkgs/1894706397946f80a48ae976b2bb85f54546d618#yt-dlp                                                  
error: builder for '/nix/store/qb5kpj1pvasqgvy6wr3n7di7ghx991bl-npm-deps.drv' failed with exit code 1;
       last 16 log lines:
       > Running phase: unpackPhase
       > unpacking source archive /nix/store/qakqvxzry0194vmyqzidibvjnfzrcmya-source
       > source root is source
       > Running phase: patchPhase
       > Running phase: updateAutotoolsGnuConfigScriptsPhase
       > Running phase: configurePhase
       > no configure script, doing nothing
       > Running phase: buildPhase
       >
       > ERROR: The package-lock.json file does not exist!
       >
       > package-lock.json is required to make sure that npmDepsHash doesn't change
       > when packages are updated on npm.
       >
       > Hint: You can copy a vendored package-lock.json file via postPatch.
       >
       For full logs, run 'nix log /nix/store/qb5kpj1pvasqgvy6wr3n7di7ghx991bl-npm-deps.drv'.
error: 1 dependencies of derivation '/nix/store/2y5yx8spaqkrppplhgislqgg9ywb861b-yt-dlp-ejs-0.3.1.drv' failed to build
error: 1 dependencies of derivation '/nix/store/riram0xcxr1vsa9h90b9prhqklswwjdi-yt-dlp-2025.11.12.drv' failed to build

[Grub4K]

I'd not be comfortable packaging this with a lockfile in-tree, can this wait for the new deno tooling so that it can use deno.lock?

See yt-dlp/ejs#29 for upstream solution tracking of this problem

[SuperSandro2000]

I'd not be comfortable packaging this with a lockfile in-tree, can this wait for the new deno tooling so that it can use deno.lock?

yt-dlp is a package which requires frequent and in time updates to be useful and also needs to be backported to stable. I already tested the current commits on stable and they work there. If adding deno tooling would only require 5 days to be merged, then I still calculate with multiple issues getting opened in that timeframe requesting an update for the package. I would like to resolve this before that is happening. #326003 seems to require lots of work and it does not look to me that it will be ready immediately and I do not want to pressure work when we may not truly need it.

Lets look on how ejs uses the js eco system. They have pinned exact versions in their package.json file (https://github.com/yt-dlp/ejs/blob/main/package.json#L10-L13) which is great for us as the lock file can't change much about the relevant packages, no updates are possible there. Also they advertise npm in the build script (https://github.com/yt-dlp/ejs/blob/main/hatch_build.py#L21-L26) so it is at least partly supported. We don't have great deno or bun support (yet) in nixpkgs, so we are using the 3rd best choice we have but it is something upstream allows us. The patch we are applying us purely on us, as we replace npm install with the npm config hook.

Also I am the maintainer of yt-dlp already and I am willing to also take the maintainership of that new python dependency as well as I see it to be very little work to maintain other than making sure to also update it when yt-dlp bumps its requirements.

But the main objection to adding a huge lockfile is that such lockfiles tend to bloat the nixpkgs tarballs and affect everyone

We can fix that by dropping all the dev dependencies. Then the lock file is smaller than 1KB.

We at least need rollup to build the bundle...

and puts an extra maintenance burden for every single update.

Leave that a problem for me to solve. I will likely add an update script with the next update.

I am also still getting the same error.

Ahh, I think I forgot to re-add the postPatch to the fetcher and since I have the FOD already generated it stayed the same.

[pyrox0]

My concern is primarily about bloat as mentioned above, as I've been working to remove lockfiles and large files in general from nixpkgs recently(see my recent PRs), so as long as this is strictly temporary, its fine. But I do not want a lockfile sticking around permanently, as that causes lockfile bloat that makes nixpkgs less accessible for everyone.

[paulperegud]

nixpkgs-review result

Generated using nixpkgs-review.

Command: nixpkgs-review pr 460892 --checkout commit --package yt-dlp --package yt-dlp-light
Commit: 7910f1aa064d98d2b0975a36908c865f17d18205

---

aarch64-linux

✅ 4 packages built:

• yt-dlp
• yt-dlp-light
• yt-dlp-light.dist (yt-dlp-light.dist.dist)
• yt-dlp.dist (yt-dlp.dist.dist)

manual testing:

[nix-shell:~/.cache/nixpkgs-review/pr-460892-8]$ yt-dlp -t mkv https://www.youtube.com/watch?v=WGw6UQM31zA
[youtube] Extracting URL: https://www.youtube.com/watch?v=WGw6UQM31zA
[youtube] WGw6UQM31zA: Downloading webpage
[youtube] WGw6UQM31zA: Downloading tv client config
[youtube] WGw6UQM31zA: Downloading player 1898687b-main
[youtube] WGw6UQM31zA: Downloading tv player API JSON
[youtube] WGw6UQM31zA: Downloading android sdkless player API JSON
[youtube] [jsc:deno] Solving JS challenges using deno
[info] WGw6UQM31zA: Downloading 1 format(s): 248+251
[download] Sleeping 4.00 seconds as required by the site...
[download] Destination: GraphDynamics.jl： Efficient, scalable neuronal dynamics ｜ Protter ｜ JuliaCon Global 2025 [WGw6UQM31zA].f248.webm
[download] 100% of   45.86MiB in 00:00:08 at 5.23MiB/s
[download] Destination: GraphDynamics.jl： Efficient, scalable neuronal dynamics ｜ Protter ｜ JuliaCon Global 2025 [WGw6UQM31zA].f251.webm
[download] 100% of   17.94MiB in 00:00:02 at 6.66MiB/s
[Merger] Merging formats into "GraphDynamics.jl： Efficient, scalable neuronal dynamics ｜ Protter ｜ JuliaCon Global 2025 [WGw6UQM31zA].mkv"
Deleting original file GraphDynamics.jl： Efficient, scalable neuronal dynamics ｜ Protter ｜ JuliaCon Global 2025 [WGw6UQM31zA].f248.webm (pass -k to keep)
Deleting original file GraphDynamics.jl： Efficient, scalable neuronal dynamics ｜ Protter ｜ JuliaCon Global 2025 [WGw6UQM31zA].f251.webm (pass -k to keep)
[VideoRemuxer] Not remuxing media file "GraphDynamics.jl： Efficient, scalable neuronal dynamics ｜ Protter ｜ JuliaCon Global 2025 [WGw6UQM31zA].mkv"; already is in target format mkv

[nix-shell:~/.cache/nixpkgs-review/pr-460892-8]$
  

[winterqt]

(Still want to eyeball this at some point in the next ~15h, just posting here so it doesn’t look like I dropped it.)

[SuperSandro2000]

I would appreciate it if you could allocate some time for that so that we can merge this before people start to notice that we hadn't updated yet 😅

[SuperSandro2000]

@winterqt I am going ahead and merging this one as many people are waiting for it and you didn't react in the last 3 days. The solution I proposed is not horrible but also not perfect and as soon as upstream switches lock files or we support demo, the vendored lock file is going to be dropped but making yt-dlp less useful in that timeframe is not reasonable due everyone eagerly awaiting this update.
If you have any further comments to improve this, please let me know and I am going to work them in.

[nixpkgs-ci]

Successfully created backport PR for release-25.05:

• [Backport release-25.05] yt-dlp: 2025.10.22 -> 2025.11.12, add JS runtime #462410

[Eveeifyeve]

@winterqt I am going ahead and merging this one as many people are waiting for it and you didn't react in the last 3 days. The solution I proposed is not horrible but also not perfect and as soon as upstream switches lock files or we support demo, the vendored lock file is going to be dropped but making yt-dlp less useful in that timeframe is not reasonable due everyone eagerly awaiting this update. If you have any further comments to improve this, please let me know and I am going to work them in.

Why did you not move the ytdl-ejs to by-name?

[SuperSandro2000]

Why did you not move the ytdl-ejs to by-name?

I am reading this like I forgot a review comment in the thread, but I could not find any previous comment regarding this.

We also have CI for this, so no new packages under pkgs are added that are not under by-name.
I also just double-checked that python packages do not have by-name packages, yet (?). So unless we promote yt-dlp-ejs to a toplevel package (it is a python packages, so it doesn't belong there) then it cannot be under by-name.