youtube-dl->yt-dlp, edx-dl, python3-pafy: remove
In short: orphaned, not likely to get a new release, security vulnerablilty. Use yt-dlp or nightly youtube-dl releases from github.
Edit:
After reviewing qytdl, which depends on youtube-dl, but is patched to force the use of yt-dlp, it makes the most sense to turn youtube-dl into a dummy package. But edx-dl remains unusable and not likely to be updated, and python3-pafyno longer meets Void Package Requirements (not required to be system-wide, not compiled, and previously was required by mps-youtube which became yewtube which now uses yt-dlp - so not required by anything).
Testing the changes
- I tested the changes in this PR: Briefly
The RFC was closed as the discussion should take place here (totally fair). So here's the quick summary of the RFC:
- Upstream has moved to nightly releases (under
youtube-dl-nightly, and not to continue making releases underyoutube-dl, - The package has a security vulnerability in versions prior to
2024-07-03(which includes the current version): https://github.com/dirkf/youtube-dl/security/advisories/GHSA-22fp-mf44-f2mq - It does not currently work on youtube, but does work for other sites.
- There is a drop-in replacement
yt-dlp. It has a void package and is regularly updated and maintained. - Popcorn says usage is 18/115 (~15.6%). (54 are using
yt-dlp). - Other distros have dropped it (Alpine, Arch, Brew, FreeBSD, Gentoo), or make the release install
yt-dlpinstead (Ubuntu, Debian)
Additionally, on review, it doesn't meet the [Void Linux Package Requirements](Software need to be used in version announced by authors as ready to use by the general public - usually called releases.) as 1) There is no need for it to be installed system-wide 2) Not compiled 3) It is currently required by some packages (I will update the PR to remove them too if consensus is to remove):
qytdl(a front-end for this package)persepolis(which has changed toyt-dlp, just isn't updated in Void)python3-pafy(a python wrapper for this python script?)edx-dl(an edx.org downloader that seems unmaintained).
Alternative actions:
- Move the package to
youtube-dl-nightlyor similar (would need a willing maintainer). - Turn
youtube-dlinto a meta/dummy package foryt-dlpinstead.
Only downside is if someone is using aliases with youtube-dl they might stop working/work unexpectedly. There is a --compat-options flag in yt-dlp which Gentoo uses to mitigate this.
agree, it would be good to have the transitional package be a small wrapper script
split into commit per package, added a wrapper script
I don't think that's necessary
Then I think it looks good. There hasn't been anyone to veto removal or a transitional package, so I'll remove it from draft status. Thank you @classabbyamp
One could also upgrade yt-dlp to 2025.06.09 while at it..
?? https://github.com/void-linux/void-packages/commit/90a30170022a0aa7604a255f846a82c27d09fccf
Resolved merge conflicts, and xlint has been updated to now have metapackge= so the lint check should pass.