From 8f45e3cb7ed6098561f396d00f87a845659d800a Mon Sep 17 00:00:00 2001
From: Simon <simobilleter@gmail.com>
Date: Sat, 14 Mar 2026 17:19:46 +0700
Subject: [PATCH] split plugin install, runtime whitelisting

---
 Dockerfile                          |  5 ++++-
 backend/download/src/yt_dlp_base.py | 13 ++-----------
 backend/requirements.plugins.txt    |  2 ++
 backend/requirements.txt            |  7 +++----
 requirements-dev.txt                |  3 ++-
 5 files changed, 13 insertions(+), 17 deletions(-)
 create mode 100644 backend/requirements.plugins.txt

diff --git a/Dockerfile b/Dockerfile
index adc1326d..293f2446 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -25,7 +25,9 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 
 # install requirements
 COPY ./backend/requirements.txt /requirements.txt
-RUN pip install --user -r requirements.txt
+COPY ./backend/requirements.plugins.txt /requirements.plugins.txt
+RUN pip install --user -r /requirements.txt \
+    && python -m pip install --target /opt/yt_plugins/bgutil -r /requirements.plugins.txt
 
 # build ffmpeg
 FROM python:3.13.11-slim-trixie AS ffmpeg-builder
@@ -46,6 +48,7 @@ COPY --from=denoland/deno:bin /deno /usr/local/bin/deno
 
 # copy build requirements
 COPY --from=builder /root/.local /root/.local
+COPY --from=builder /opt/yt_plugins /opt/yt_plugins
 ENV PATH=/root/.local/bin:$PATH
 
 # copy ffmpeg
diff --git a/backend/download/src/yt_dlp_base.py b/backend/download/src/yt_dlp_base.py
index 8c416fbd..5cb2d81b 100644
--- a/backend/download/src/yt_dlp_base.py
+++ b/backend/download/src/yt_dlp_base.py
@@ -29,6 +29,7 @@ class YtWrap:
         "cachedir": path.abspath(
             path.join(EnvironmentSettings.CACHE_DIR, "ytdlp")
         ),
+        "plugin_dirs": [],
     }
 
     def __init__(self, obs_request, config=False):
@@ -72,17 +73,7 @@ class YtWrap:
                     }
                 },
             )
-            return
-
-        # https://github.com/Brainicism/bgutil-ytdlp-pot-provider/pull/185
-        deep_merge(
-            self.obs,
-            {
-                "extractor_args": {
-                    "youtubepot-bgutilhttp": {"disable": ["True"]}
-                }
-            },
-        )
+            self.obs["plugin_dirs"].append("/opt/yt_plugins/bgutil")
 
     def download(self, url):
         """make download request"""
diff --git a/backend/requirements.plugins.txt b/backend/requirements.plugins.txt
new file mode 100644
index 00000000..eaaf09fd
--- /dev/null
+++ b/backend/requirements.plugins.txt
@@ -0,0 +1,2 @@
+# install plugins in separate folder for runtime whitelisting
+bgutil-ytdlp-pot-provider==1.3.1
diff --git a/backend/requirements.txt b/backend/requirements.txt
index 5dff2b5e..6808f5da 100644
--- a/backend/requirements.txt
+++ b/backend/requirements.txt
@@ -1,5 +1,4 @@
-apprise==1.9.7
-bgutil-ytdlp-pot-provider @ git+https://github.com/bbilly1/bgutil-ytdlp-pot-provider@f9e694f0b040ec3074301e8ffccad0f9cdb68ed1#subdirectory=plugin
+apprise==1.9.8
 celery==5.6.2
 deepdiff==8.6.1
 django-auth-ldap==5.3.0
@@ -9,8 +8,8 @@ Django==6.0.3
 djangorestframework==3.16.1
 drf-spectacular==0.28.0  # rc:ignore
 Pillow==12.1.1
-redis==7.2.1
+redis==7.3.0
 requests==2.32.5
 ryd-client==0.0.6
 uvicorn==0.41.0
-yt-dlp[default]==2026.3.3
+yt-dlp[default]==2026.3.13
diff --git a/requirements-dev.txt b/requirements-dev.txt
index 82d11ea9..0c1d2db9 100644
--- a/requirements-dev.txt
+++ b/requirements-dev.txt
@@ -1,5 +1,6 @@
 -r backend/requirements.txt
-ipython==9.10.0
+-r backend/requirements.plugins.txt
+ipython==9.11.0
 pre-commit==4.5.1
 pylint-django==2.7.0
 pylint==4.0.5