Merge remote-tracking branch 'origin/dev' into fix/socketio-cors-wildcard

# Conflicts:
#	webui/static/helper.js

entrypoint.sh

@@ -69,10 +69,6 @@ chown -R soulsync:soulsync /app/config /app/data /app/logs /app/downloads /app/T
 
 echo "✅ Configuration initialized successfully"
 
-# Auto-update yt-dlp — YouTube changes their API frequently and stale versions break downloads
-echo "🔄 Updating yt-dlp..."
-pip install -U yt-dlp --quiet --no-cache-dir 2>/dev/null && echo "   ✅ yt-dlp updated" || echo "   ⚠️ yt-dlp update failed (will use existing version)"
-
 # Display final user info
 echo "👤 Running as:"
 echo "   User: $(id -u soulsync):$(id -g soulsync) ($(id -un soulsync):$(id -gn soulsync))"

requirements.txt

@@ -27,8 +27,8 @@ beautifulsoup4>=4.12.0
 # System monitoring
 psutil>=6.0.0
 
-# YouTube support
-yt-dlp>=2024.12.13
+# YouTube support — pinned for reproducible builds; bump per release. See #367.
+yt-dlp==2026.3.17
 
 # Lyrics support
 lrclibapi>=0.3.1

webui/static/helper.js

@@ -3445,6 +3445,7 @@ const WHATS_NEW = {
         // --- post-2.4.0 dev work — entries hidden by _getLatestWhatsNewVersion until the build version bumps ---
         { date: 'Unreleased — 2.4.1 dev cycle' },
         { title: 'Lock Down Socket.IO CORS', desc: 'socket.io was accepting websocket connections from any origin (cors=*). now defaults to same-origin only. if your websocket fails after updating, the server logs a clear warning with the rejected origin — add it to settings → security → allowed websocket origins.', page: 'settings' },
+        { title: 'Faster Docker Startup — yt-dlp Pinned', desc: 'docker startup used to run `pip install -U yt-dlp` on every container start. removed that — yt-dlp is now pinned in requirements.txt so startup is fast and reproducible. tradeoff: youtube fixes ship via soulsync releases now instead of next container restart.' },
     ],
     '2.4.0': [
         // --- April 26, 2026 — Search & Artists unification + reorganize queue ---