jozamudi
0cd79dd701
MegaPlay (behind both hianime and anikoto) stopped returning sources.file in plaintext and now ships the stream URL in an AES-256-CBC 'enc' field. Key/IV are static, hardcoded in their public player JS (newclient.min.js) — anti-scrape obscurity, not access control. Shared megaplay_sources() in upstream.py tolerates both shapes, so a revert upstream breaks nothing. Also: hianime master_m3u8 now raises when servers are listed but none resolve (403s, stale format) instead of returning None — a listed-but dead server is a provider fault, not 'no dub', and the old None silently short-circuited the ANI_SOURCE fallback chain.
13 lines
355 B
Plaintext
13 lines
355 B
Plaintext
# exact pins on purpose: curl_cffi behavior = impersonation behavior; an
|
|
# unpinned bump is a silent upstream-403 wave. Bump one at a time, re-run
|
|
# the upstream self-check (.venv/bin/python server/upstream.py) per bump.
|
|
fastapi==0.141.1
|
|
uvicorn==0.52.4
|
|
curl_cffi==0.16.0
|
|
itsdangerous==2.2.0
|
|
pycryptodome==3.23.0
|
|
|
|
# tests
|
|
pytest==9.1.1
|
|
playwright==1.62.0
|