{
  "auditedAt": "2026-09-21",
  "scope": "Supplemental inventory and existing source materials, not a legal clearance.",
  "releases": [
    {
      "platform": "Windows",
      "version": "1.1.19",
      "binaries": [
        {
          "path": "bin/win32-x64/deno.exe",
          "component": "deno",
          "version": "2.9.5",
          "bytes": 97408288,
          "sha256": "98f8c2a2d470e4ccb04c935c86ff8050817d877762aec5eaeeb9e409ccb3b9fd"
        },
        {
          "path": "bin/win32-x64/ffmpeg.exe",
          "component": "ffmpeg",
          "version": "N-126122-gca821e458a-20260813",
          "bytes": 145814528,
          "sha256": "a7168cacb8069bb9a55fb530d25df082b8de35418f9acc8b45f325c95faf0ed5"
        },
        {
          "path": "bin/win32-x64/ffprobe.exe",
          "component": "ffprobe",
          "version": "N-126122-gca821e458a-20260813",
          "bytes": 145599488,
          "sha256": "ed745464828a4aea205cb5e6e88aa3d5fa64af04ee2510f55356d4768e22b74e"
        },
        {
          "path": "bin/win32-x64/node.exe",
          "component": "node",
          "version": "24.19.0",
          "bytes": 92825416,
          "sha256": "3602f2bb1a10f2cbab4c36886218a33c1ab3db87290e73b033c46c77147d0237"
        },
        {
          "path": "bin/win32-x64/yt-dlp.exe",
          "component": "yt-dlp",
          "version": "2026.08.27.231323",
          "bytes": 17841967,
          "sha256": "f6ce5a8c8d72e663b5a450c733e9d184f779a3d2cdbb30459b6059a4de4afef1"
        },
        {
          "path": "js/vendor/hls.min.js",
          "component": "hls",
          "version": "1.6.17",
          "bytes": 543036,
          "sha256": "bf908f85f3941c514bd3df640695d1bf1190798720a74569700f64cc19845d6b"
        }
      ],
      "versionEvidence": "Bundled metadata; yt-dlp and FFmpeg also executed with version flags on 2026-09-21.",
      "ffmpegConfigure": "configuration: --prefix=/ffbuild/prefix --pkg-config-flags=--static --pkg-config=pkg-config --cross-prefix=x86_64-w64-mingw32- --arch=x86_64 --target-os=mingw32 --enable-gpl --enable-version3 --disable-debug --disable-w32threads --enable-pthreads --enable-iconv --enable-zlib --enable-libxml2 --enable-libvmaf --enable-fontconfig --enable-libharfbuzz --enable-libfreetype --enable-libfribidi --enable-vulkan --enable-libvorbis --disable-libxcb --disable-xlib --disable-libpulse --enable-gmp --enable-lzma --enable-liblcevc-dec --enable-opencl --enable-amf --enable-libaom --enable-libaribb24 --enable-avisynth --enable-chromaprint --enable-libdav1d --enable-libdavs2 --enable-libdvdread --enable-libdvdnav --disable-libfdk-aac --enable-ffnvcodec --enable-cuda-llvm --enable-frei0r --enable-libgme --enable-libkvazaar --enable-libaribcaption --enable-libass --enable-libbluray --enable-libjxl --enable-libmp3lame --enable-libopus --enable-libplacebo --enable-librist --enable-libssh --enable-libtheora --enable-libvpx --enable-libwebp --enable-libzmq --enable-lv2 --enable-libvpl --enable-openal --enable-liboapv --enable-libopencore-amrnb --enable-libopencore-amrwb --enable-libopenh264 --enable-libopenjpeg --enable-libopenmpt --enable-librav1e --enable-librubberband --enable-schannel --enable-sdl2 --enable-libsnappy --enable-libsoxr --enable-libsrt --enable-libsvtav1 --enable-libtwolame --enable-libuavs3d --disable-libdrm --enable-vaapi --enable-libvidstab --enable-libvvenc --disable-whisper --enable-libx264 --enable-libx265 --enable-libxavs2 --enable-libxvid --enable-libzimg --enable-libzvbi --extra-cflags=-DLIBTWOLAME_STATIC --extra-cxxflags= --extra-libs=-lgomp --extra-ldflags=-pthread --extra-ldexeflags= --cc=x86_64-w64-mingw32-gcc --cxx=x86_64-w64-mingw32-g++ --ar=x86_64-w64-mingw32-gcc-ar --ranlib=x86_64-w64-mingw32-gcc-ranlib --nm=x86_64-w64-mingw32-gcc-nm --extra-version=20260813",
      "correspondingSourceComplete": false,
      "remainingSourceWork": [
        "Identify exact versions and obtain source/build inputs for statically linked FFmpeg dependencies.",
        "Resolve FFmpeg build provenance, patches and scripts for these exact binaries.",
        "Verify all bundled downloader dependencies and runtime notices, not only the top-level source."
      ]
    },
    {
      "platform": "macOS",
      "version": "1.1.22",
      "binaries": [
        {
          "path": "bin/darwin-arm64/deno",
          "component": "deno",
          "version": "2.9.5",
          "bytes": 80902432,
          "sha256": "7942faaed572a2b555db7183c90b09a13fe530f2bf2bbebe6fa0a4de39bdf7fe"
        },
        {
          "path": "bin/darwin-arm64/node",
          "component": "node",
          "version": "24.19.0",
          "bytes": 121306272,
          "sha256": "3aad66cde8922e01b75b146a2aea0bf29d8dfc64a20e7f1bc5d5a3464e28b0b9"
        },
        {
          "path": "bin/darwin-x64/deno",
          "component": "deno",
          "version": "2.9.5",
          "bytes": 97741632,
          "sha256": "e0a9cb1cc69a487b649496813bb3329190dccee401566aad5f35fcbc047f4652"
        },
        {
          "path": "bin/darwin-x64/ffmpeg",
          "component": "ffmpeg",
          "version": "9.0.1-tessus",
          "bytes": 81425792,
          "sha256": "1fbfac4a0e824ca3bcaa68ec5bc481428bcb39c3b4c6e2fd7e8abe8d85d1b7a7"
        },
        {
          "path": "bin/darwin-x64/ffprobe",
          "component": "ffprobe",
          "version": "9.0.1-tessus",
          "bytes": 81238032,
          "sha256": "4b7df76c93f8f1981954ae0044227c73159cca727ce6a09b50a7e0802daae17c"
        },
        {
          "path": "bin/darwin-x64/node",
          "component": "node",
          "version": "24.19.0",
          "bytes": 123666112,
          "sha256": "96d113d57f8a54fe2e23132ea525cb2ceae410fa243b76903f85f439f5aa9a1f"
        },
        {
          "path": "bin/darwin-x64/yt-dlp_macos",
          "component": "yt-dlp",
          "version": "2026.08.27.231323",
          "bytes": 34256448,
          "sha256": "13242ee30b7203a3ec015f15ae830f4d4d207e8b1ba29ed0d6343bc029b23fe3"
        },
        {
          "path": "js/vendor/hls.min.js",
          "component": "hls",
          "version": "1.6.17",
          "bytes": 543036,
          "sha256": "bf908f85f3941c514bd3df640695d1bf1190798720a74569700f64cc19845d6b"
        }
      ],
      "versionEvidence": "Bundled metadata and signed release/native CI evidence; not executed on this Windows machine.",
      "ffmpegConfigure": "configuration: --cc=/usr/bin/clang --prefix=/opt/ffmpeg --extra-version=tessus --enable-avisynth --enable-fontconfig --enable-gpl --enable-libaom --enable-libass --enable-libbluray --enable-libdav1d --enable-libfreetype --enable-libgsm --enable-libharfbuzz --enable-libmodplug --enable-libmp3lame --enable-libmysofa --enable-libopencore-amrnb --enable-libopencore-amrwb --enable-libopenh264 --enable-libopenjpeg --enable-libopus --enable-librubberband --enable-libshine --enable-libsnappy --enable-libsoxr --enable-libspeex --enable-libtheora --enable-libtwolame --enable-libvidstab --enable-libvmaf --enable-libvo-amrwbenc --enable-libvorbis --enable-libvpx --enable-libwebp --enable-libx264 --enable-libx265 --enable-libxavs --enable-libxml2 --enable-libxvid --enable-libzimg --enable-libzmq --enable-libzvbi --enable-version3 --pkg-config-flags=--static --disable-ffplay",
      "correspondingSourceComplete": false,
      "remainingSourceWork": [
        "Identify exact versions and obtain source/build inputs for statically linked FFmpeg dependencies.",
        "Resolve FFmpeg build provenance, patches and scripts for these exact binaries.",
        "Verify all bundled downloader dependencies and runtime notices, not only the top-level source."
      ]
    }
  ],
  "materials": [
    {
      "path": "licenses/BTBN-FFMPEG-BUILDS-MIT.txt",
      "bytes": 1064,
      "sha256": "c1b3cc7eec42bd9c4f6247169bb887b4a9bc904abfd2a7f7f9231ed357844993"
    },
    {
      "path": "licenses/DENO-MIT.txt",
      "bytes": 1074,
      "sha256": "a180b60d24dd154932ec09f77ebb1cd1d4e80bd918158ebf8f947bba13a029fb"
    },
    {
      "path": "licenses/FFMPEG-GPLv3.txt",
      "bytes": 35147,
      "sha256": "8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903"
    },
    {
      "path": "licenses/GPLv3.txt",
      "bytes": 35147,
      "sha256": "8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903"
    },
    {
      "path": "licenses/HLS-JS-LICENSE.txt",
      "bytes": 1338,
      "sha256": "ca8773cf798c7ed997d4dd7c8e23c348699f8d5b7462636694cc14de6cda12db"
    },
    {
      "path": "licenses/NODE-LICENSE.txt",
      "bytes": 157606,
      "sha256": "148eacf7863ef4329224a29398623077200a27194aa075569faf4a0a85566ca5"
    },
    {
      "path": "licenses/YT-DLP-THIRD-PARTY-LICENSES.txt",
      "bytes": 243550,
      "sha256": "472aefe951c7db35e1657c1d13fd337140511ed6f2b329205105ad441c5a02b7"
    },
    {
      "path": "licenses/YT-DLP-UNLICENSE.txt",
      "bytes": 1209,
      "sha256": "916b2e8212c910dbfdbdf4245cb594529a51c4f759f519599be66d8bb566c592"
    },
    {
      "path": "Source-Code/BtbN-FFmpeg-Builds-590a6612.tar.gz",
      "bytes": 101922,
      "sha256": "3d59554604274dd229806133b0b67e9936687ac420975742f8a0da4e46140223"
    },
    {
      "path": "Source-Code/ffmpeg-9.0.1.tar.xz",
      "bytes": 12036420,
      "sha256": "cf38e0e28c7e5605942c4a77755349b0145804a397af37eb1fb4c77cb237f635"
    },
    {
      "path": "Source-Code/FFmpeg-ca821e458a.tar.gz",
      "bytes": 17535745,
      "sha256": "c4104325894721cfd17c29c9d6fb8ceccee36e4df81e18b813e14db58baca53f"
    },
    {
      "path": "Source-Code/yt-dlp-2026.08.27.231323-SHA2-256SUMS.sig",
      "bytes": 566,
      "sha256": "a0e2f458ccceb7e1573efa4a7a3816380802a59621bc4dae726d1a05a311b064"
    },
    {
      "path": "Source-Code/yt-dlp-2026.08.27.231323-SHA2-256SUMS.txt",
      "bytes": 1505,
      "sha256": "760d9a874406455118e95eadf310e20a45c6c7827603e325a1bbc2f47ccd1efb"
    },
    {
      "path": "Source-Code/yt-dlp-2026.08.27.231323.tar.gz",
      "bytes": 6022073,
      "sha256": "512eca4e7ffd2080c6ca477bf2d512e29df5f0e35c691e72be0fc01504a5d275"
    },
    {
      "path": "Source-Code/yt-dlp-public.key",
      "bytes": 1676,
      "sha256": "45d6b415928b5f3e228b461fa9e6d7eb56a824931c785ece00279a06c7a6d6e5"
    },
    {
      "path": "Mac-ffmpeg-version.txt",
      "bytes": 1297,
      "sha256": "59dd8b88e0e34487b3fcc863c11f1ac31bef8015365ffc5f29eed7f71cfed4ec"
    },
    {
      "path": "Windows-ffmpeg-version.txt",
      "bytes": 2360,
      "sha256": "aaa53b3ded65681a8b46fc69f57f1d3772630927c60559baae2d745aafbf1052"
    },
    {
      "path": "FFMPEG-BUILD-INFORMATION.txt",
      "bytes": 673,
      "sha256": "af4cd542c6cca9dca5d95cd2f0e73eb9f04db8b91eee206245fbdd03cab6bf4f"
    },
    {
      "path": "licenses/APACHE-2.0.txt",
      "upstream": "https://www.apache.org/licenses/LICENSE-2.0.txt",
      "bytes": 11358,
      "sha256": "cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30"
    }
  ],
  "issues": [
    "windows: bundled SBOM identifies an older release",
    "mac: bundled SBOM identifies an older release"
  ],
  "launchReady": false
}