FramePier 0.2.3 — final bundled release candidate

CHANGELOG.md

@@ -18,6 +18,12 @@ All notable changes to FramePier are documented here. Versions follow Semantic V
 
 ### Changed
 
+- Replaced upstream's published `yt-dlp.exe` (Python 3.10, OpenSSL 1.1.1t, end-of-life) with a build of the same tagged source (2026.08.19) made with yt-dlp's own recipe on Python 3.13.16 (OpenSSL 3.5.9, SQLite 3.50.4). curl_cffi impersonation and the Deno integration are unchanged. SHA-256 `8b976e7ff71a6f8e8dd48feb2920b3c41a44641ffe192dba08cde0175890ee44`; recipe, evidence and corresponding source are in `FramePier-0.2.3-YtDlp-Source.zip`.
+- Removed the in-app yt-dlp self-updater: the Settings button and the helper's `update_ytdlp` command are gone (the helper now rejects it), so the pinned, verified yt-dlp cannot be replaced by an unverified upstream executable. yt-dlp changes only with a new FramePier release.
+- Added the compiled license texts for Deno's Rust crates and V8 build libraries, and the CPython runtime component notices, to `licenses/`.
+- Replaced the static BtbN FFmpeg with a minimal shared LGPL build (FFmpeg `1a748fe`, LAME 3.100; `ffmpeg.exe`, `ffprobe.exe` and 9 DLLs). All eleven files are SHA-256 pinned in `scripts/build.ps1` and installed together. FFmpeg is no longer downloaded during the build.
+- Settings now shows the abbreviated commit hash when FFmpeg reports `ffmpeg version <hash>` (previously "version unknown").
+- Replaced the FFmpeg LGPL-3.0 license text with LGPL-2.1, added LAME and winpthreads license texts, the MinGW-w64 runtime text, the FFmpeg build provenance and a source-availability index to `licenses/`.
 - Every yt-dlp process is now created by one helper that always passes `--ignore-config`, `--no-plugin-dirs`, `--no-remote-components` and `--no-js-runtimes`, then enables only the bundled Deno by absolute path for YouTube. User-level yt-dlp configuration, plugins, remotely fetched components and runtimes found on PATH are no longer used.
 
 ## [0.2.3] - 2026-09-20

README.md

@@ -15,7 +15,7 @@ Version: **0.2.3**
 
 ## Requirements
 
-The Windows installer includes the FramePier helper, a checksum-verified official `yt-dlp` Windows release, and FFmpeg from the Windows build provider linked by the FFmpeg project. It also includes a pinned, checksum-verified Deno JavaScript runtime, which yt-dlp needs to extract YouTube videos. No Python or other runtime is required after installation.
+The Windows installer includes the FramePier helper, a checksum-verified official `yt-dlp` Windows release, and a shared FFmpeg build (see below). It also includes a pinned, checksum-verified Deno JavaScript runtime, which yt-dlp needs to extract YouTube videos. No Python or other runtime is required after installation.
 
 ## Install the helper
 
@@ -104,11 +104,11 @@ For an explicitly selected quality, FramePier resolves an exact current video fo
 
 ## yt-dlp and FFmpeg
 
-The build downloads `yt-dlp.exe` from the pinned official GitHub release tag (2026.08.19) and verifies it against that release's official SHA-256 list. Public binary releases remain subject to the dependency, security and redistribution release gate. The Settings page can run the executable's controlled `-U` updater; it cannot select another repository or update channel.
+The build packages FramePier's own `yt-dlp.exe` build of yt-dlp 2026.08.19 (Python 3.13 / OpenSSL 3.5.9, built from the tagged source with yt-dlp's recipe; see `third-party/ytdlp-openssl3/`), supplied as a local file (`-YtDlpPath`, default `.tools\ytdlp-openssl3\yt-dlp.exe`) and checked against a pinned SHA-256. Public binary releases remain subject to the dependency, security and redistribution release gate. The in-app yt-dlp updater was removed in 0.2.3 so the pinned, verified executable cannot be replaced by an unverified one.
 
-FFmpeg is downloaded from the BtbN/FFmpeg-Builds GitHub repository (pinned release tag), and verified with SHA-256 checksums on both the archive and extracted binaries. FramePier never downloads tools from page-provided URLs.
+FFmpeg is a shared (DLL) LGPL build made from FFmpeg commit `1a748fe2cd43e3ead22fafb1b5b7d77f153898a8` and LAME 3.100 with MSYS2 UCRT64 (configuration and provenance in `third-party/ffmpeg-shared/` and `licenses/FFMPEG-BUILD-PROVENANCE.txt`). `ffmpeg.exe`, `ffprobe.exe` and nine DLLs are installed together in the tools folder. The build script copies them from a local directory and checks the SHA-256 of all eleven files; it never downloads FFmpeg. FramePier never downloads tools from page-provided URLs.
 
-Deno 2.9.7 is bundled as the JavaScript runtime yt-dlp requires for YouTube. The build downloads it from the official release, checks the archive against the checksum published with that release and against a hash recorded in `scripts/build.ps1`, and checks the extracted `deno.exe`. FramePier runs every yt-dlp process with `--ignore-config`, `--no-plugin-dirs`, `--no-remote-components` and `--no-js-runtimes`, then enables only the bundled Deno by absolute path. It never uses a runtime found on PATH, and Twitch downloads do not need it. The redistribution and source-availability gate for the bundled FFmpeg is PENDING / NOT CLEARED (see `THIRD_PARTY_NOTICES.md`); no public binary release should be published until it is completed.
+Deno 2.9.7 is bundled as the JavaScript runtime yt-dlp requires for YouTube. The build downloads it from the official release, checks the archive against the checksum published with that release and against a hash recorded in `scripts/build.ps1`, and checks the extracted `deno.exe`. FramePier runs every yt-dlp process with `--ignore-config`, `--no-plugin-dirs`, `--no-remote-components` and `--no-js-runtimes`, then enables only the bundled Deno by absolute path. It never uses a runtime found on PATH, and Twitch downloads do not need it. Third-party licenses and where the source is published are listed in `THIRD_PARTY_NOTICES.md` and `licenses\SOURCE-AVAILABILITY.txt`.
 
 ## Settings and logs
 
@@ -121,7 +121,7 @@ Logs are stored at `%LOCALAPPDATA%\VidDock\logs`. Open them from Settings. Logs
 ## Updating
 
 - Extension/helper: build and install a newer FramePier release. FramePier compares the active extension with the installer's trusted `%LOCALAPPDATA%\Programs\FramePier\package-version.json` marker through the helper and requests Chromium's supported `chrome.runtime.reload()` once when a newer package is detected. Reload attempts and successful activation are recorded in the local helper log. If Chromium does not activate changed unpacked files, completely exit and reopen the browser; manual **Reload** remains the final fallback and Remove/Load unpacked is not required.
-- yt-dlp: use **Check/update yt-dlp** in Settings.
+- yt-dlp: bundled and pinned (2026.08.19, FramePier's verified build); it is updated only by installing a newer FramePier release. There is no in-app yt-dlp updater.
 - Browser installed later: run **Repair Browser Integration** from the Start Menu.
 
 ## Troubleshooting
@@ -190,4 +190,4 @@ Small, reviewable changes with tests are welcome. Do not add telemetry, broad ho
 
 ## License
 
-FramePier's original source is licensed under the MIT License; see [LICENSE](LICENSE). Bundled release tools have their own licenses, including LGPL-3.0 terms for FFmpeg and GPLv3+ and other terms for components inside the yt-dlp executable. See [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md). A distributor must preserve those notices and comply with the applicable third-party licenses.
+FramePier's original source is licensed under the MIT License; see [LICENSE](LICENSE). Bundled release tools have their own licenses, including LGPL-2.1-or-later terms for FFmpeg, LGPL terms for LAME, and GPLv3+ and other terms for components inside the yt-dlp executable. See [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md). A distributor must preserve those notices and comply with the applicable third-party licenses.

SECURITY.md

@@ -45,11 +45,11 @@ Some internal identifiers intentionally retain the former VidDock name so existi
 
 ## Dependency and update trust
 
-Builds retrieve Go from `go.dev`, `yt-dlp.exe` from the official `yt-dlp/yt-dlp` GitHub release (pinned tag), FFmpeg from the BtbN/FFmpeg-Builds repository (pinned release tag), and Deno from the official release (pinned version). Every downloaded release artifact is checksum-verified before packaging.
+Builds retrieve Go from `go.dev`, FramePier's own build of `yt-dlp.exe` from the pinned `yt-dlp/yt-dlp` tag from a verified local file (SHA-256 pinned in `scripts/build.ps1`; recipe and evidence in `third-party/ytdlp-openssl3/`), FFmpeg from a verified local directory (11 files, each pinned by SHA-256 in `scripts/build.ps1`; the shared build's provenance is in `third-party/ffmpeg-shared/`), and Deno from the official release (pinned version). Every downloaded release artifact is checksum-verified before packaging.
 
 Before every public binary release, the release gate must verify the exact dependency versions, current security advisories, the exact artifacts and hashes being bundled, license and redistribution obligations, and required source/source-availability status. A failed or incomplete gate blocks the public release.
 
-The in-app yt-dlp updater invokes only `yt-dlp.exe -U`; callers cannot choose a repository or arbitrary update arguments.
+There is no in-app yt-dlp updater: the `update_ytdlp` command was removed in 0.2.3 and the helper rejects it as an unknown command, so the pinned, verified `yt-dlp.exe` cannot be replaced at run time. yt-dlp changes only by installing a newer FramePier release.
 
 Release maintainers should retain checksums and third-party notices with build records, scan the complete source tree and relevant Git history for secrets, run the automated test/security checks, and manually inspect the final installer before distribution.