A private way to report a security problem, and a written statement of what Snatch defends against (SNAT-0054)
If you find a security problem you can now report it privately through
GitHub's Security tab, instead of having to open an issue everyone can
read. A new SECURITY.md also writes down, for the first time, who
Snatch is defending against and what counts as in scope -- so a report
gets a consistent answer rather than one that depends on who reads it.
Snatch can now record why something failed (SNAT-0045)
Snatch now has somewhere to write down what went wrong. It stays
silent unless you ask for it: start it with SNATCH_LOG=1 and it
writes snatch.log beside your settings, then behaves exactly as
before in every other respect. Failures that used to leave no trace
at all -- a download that died, a thumbnail that would not decode,
cleanup that quietly failed -- now say so in that file. The log is
readable only by you and is capped in size.
Automated tests now run on every change (SNAT-0020)
Nothing checked automatically that Snatch still worked after an edit,
so a mistake could reach you unnoticed. There is now a test suite
covering version comparison, link checking, how Snatch finds its helper
programs, and the update path — and it runs on every change.
The build now catches a whole class of crash before it ships (SNAT-0044)
A missing import used to reach users: the old check only proved each
file could be read, never that the app could actually load. The build
now refuses code that calls something which does not exist, which is
the exact bug that stopped Snatch launching in an earlier version.
Right-click to paste, copy or cut in any box (SNAT-0041)
Every text box in Snatch — the URL bar, the search boxes, the
cookies and save-location fields — now has a right-click menu with
Cut, Copy, Paste and Select All. Pasting a link no longer means
reaching for the Paste button or Ctrl+V.
The media information panel is read-only, so it offers Copy and
Select All only.
Snatch can now update its own downloader (SNAT-0016)
When YouTube changes something, yt-dlp — the tool Snatch uses to
fetch videos — has to be updated to keep up. Until now that meant
waiting for a whole new version of Snatch on all three platforms.
Snatch now checks on startup and offers to fetch a newer yt-dlp for
itself. It saves it inside Snatch's own folder, so it survives
restarts and works in the packaged Windows, Linux and macOS builds
alike. Nothing downloads without you saying yes.
The copy that shipped with Snatch is always kept. A download that
arrives broken is thrown away rather than installed, and if a newer
one ever misbehaves the button offers "Revert to bundled yt-dlp" to
put things back.
Install instructions now match the computer you are actually on (SNAT-0053)
When ffmpeg or a JavaScript runtime was missing, Snatch told everyone
who was not on Windows to run an Ubuntu command -- wrong on a Mac, and
wrong on Fedora, Arch and openSUSE. Each message now gives the right
command for your system. Snatch is also clearer about why a check
failed: a yt-dlp that is installed but will not run no longer reports
as missing, and a version check blocked by GitHub's hourly limit now
says so instead of just "failed".
The window no longer freezes while talking to the video player (SNAT-0048)
Dragging the volume slider, pressing play or pause, or simply having
a video open made Snatch wait on the player before it could redraw --
up to half a second each time, and the position readout asked twice
every half-second. If the player stopped responding, the whole window
locked up. Those conversations now happen in the background, and a
volume drag sends once when you let go instead of on every step.
Playlists containing deleted or private videos no longer break the results list (SNAT-0050)
A playlist with nothing listable in it, or one containing videos that
have since been deleted, made private or blocked in your region, could
end Snatch's search or format list in a raw error -- sometimes with the
results table left half filled in. Those entries are now skipped and
the rest are shown. Snatch also no longer loads an unlimited amount of
a thumbnail image or media report into memory.
A damaged settings file no longer stops Snatch opening (SNAT-0051)
If config.json was corrupted -- half-written by a crash, edited by
hand, or left unreadable -- Snatch could fail to start with a raw
error and no window, and nothing told you which file was at fault.
It now falls back to defaults, notes what it could not read in the
log, and opens. A theme name it does not recognise is corrected
instead of being saved back forever, and a window position saved on
a monitor you no longer have no longer reopens the window off the
edge of the screen.
Searching twice no longer leaves the box stuck on "Searching..." (SNAT-0049)
Clicking Search while a search was already running started a second
one on top of the first. The status line then said "Searching..."
for good, two searches ran at once, and -- the reason this mattered
most -- the results list could end up out of step with the rows on
screen, so Play or Download acted on a different video from the one
you had highlighted. Snatch now tells you a search is already
running instead, and the results and the rows are always filled in
together.
Windows builds failed intermittently on a GitHub API rate limit. (SNAT-0064)
Windows builds sometimes failed for no reason anyone could see; they no longer make the call that was failing.
A history entry with an odd filename no longer crashes the open action (SNAT-0020)
Opening a history entry whose stored path contained an invalid
character raised an error instead of simply reporting the file was not
found. Found by the new tests on their first run.
The player's controls say when they cannot work
On Windows the play/pause, volume and seek controls could never do
anything, because Snatch talks to the video player in a way Windows
does not provide. They looked normal and silently ignored every
click. They are now greyed out with a note saying so. Stop and
Fullscreen are unaffected and still work.
Reverting to the bundled yt-dlp works when running from source
Running Snatch from source rather than a packaged build, downloading a
newer yt-dlp overwrote the copy that shipped with it — so the promise
in the update dialog, that you could always go back, was not true
there. Downloaded copies are now kept separately, and the Revert
button is offered in that mode too.
Changing theme no longer hides a waiting update
If a yt-dlp update was available and you changed the colour theme, the
Update button reset itself to "Up to date" and greyed out, while the
version label still said an update was there. The only way back was
restarting.
Escape cancels downloads again after using fullscreen
Leaving fullscreen in the video player silently removed the Escape
shortcut for cancelling a download, for the rest of the session.
The format list no longer offers thumbnail sheets as video
YouTube returns a few entries that are neither video nor audio — they
are contact sheets of preview thumbnails. Snatch was listing them as
though they were normal video, including in the resolution filters,
and downloading one reported success. On a typical video that was 6
entries out of 53. They are no longer listed.
Queued downloads are recorded under their own name
Every download started from the queue was saved to your history with
the title and quality of a different video — whichever one you had
looked at last. The queue already knew the right name; it just was
not being used.
Two downloads at once no longer interfere with each other
The Download button greys out while a download runs, but the keyboard
shortcut and the Quick Select buttons did not, so a second download
could still be started. The two then tripped over each other and one
would fail with a confusing error. Starting a second download now
tells you one is already running.
Cancelling is cleaner too: pressing Escape no longer pops an error
message of its own, and the progress bar no longer flickers back to a
stale percentage afterwards.
A damaged history file no longer stops Snatch opening
If history.json was unreadable or its contents were not what Snatch
expected, the app failed to start at all, and there was no way to fix
it from inside the app. It now starts with an empty history instead.
Your settings, cookies and history are now really kept private
All three files were meant to be readable only by you. That was true
when they were first created and quietly stopped being true for any
file that already existed — from an older version, a backup or a
copy. It now holds in every case.
The same change makes saving safe to interrupt. Previously a save
that failed part-way (a full disk, for instance) could leave a
half-written file behind; for the history that then looked like an
empty history and got overwritten. Nothing is replaced now until the
new version is complete.
Snatch starts again (SNAT-0041)
The right-click menu added in this same unreleased batch was wired into
the Download tab but not the Search or Media Info tabs, and Snatch
builds all four tabs the moment it opens. The window never appeared at
all. Both tabs now have what they were missing, and all six text boxes
the right-click feature promised really do have it.
An empty playlist no longer breaks the fetch
Pasting a link to a playlist with nothing in it crashed the format
fetch partway through, so you got an unhelpful error instead of being
told the playlist was empty.
Error messages appear instead of vanishing
Five places that report a problem — fetching formats, downloading,
searching, and reading media info — were losing the message on the way
to the screen and failing silently instead. If a download failed, you
saw nothing. The message now reaches the dialog it was written for.
STANDARDS.md's own worked example was teaching this mistake, and
contradicted the rule three lines above it. The example is corrected,
so the next person copying it gets a working version.
Snatch was never using its bundled JavaScript helper, so YouTube hid most video qualities (SNAT-0043)
YouTube makes downloaders solve a small puzzle before it will hand
over the picture qualities, and Snatch ships a helper program to
solve it. Snatch had been naming that helper in a way yt-dlp could
not read, so it was never used — on every release, on every platform.
The result was videos that appeared to have sound-only versions, or
that failed outright with "Requested format is not available".
Snatch now names it correctly. On the reported video that is the
difference between 4 sound-only entries and 37 with 25 picture
qualities.
Queued downloads now use the quality you chose (SNAT-0039)
Anything added to the queue was downloaded at whatever quality
yt-dlp picked, ignoring the resolution and format Snatch had saved
from your last choice. Queued items now follow that preference, and
fall back to the best available if it cannot be matched.
A video that YouTube served as sound-only no longer empties the format list (SNAT-0042)
For some videos, the saved cookies made YouTube hand back only
sound-only versions. Snatch then showed either "Requested format is
not available" and nothing else, or a list with no picture qualities
in it at all.
Snatch now tries again without the cookies and keeps whichever answer
actually has picture in it, telling you in the status line when it
has skipped them. On the reported video that is the difference
between 4 sound-only entries and 53 with 37 picture qualities.
Updating no longer asks for your password or touches system files
The old path installed yt-dlp system-wide via a password prompt.
The new one writes only inside Snatch's own folder, so nothing
outside the app is changed and no admin rights are needed.
The update button no longer offers a version that cannot play YouTube
It checked yt-dlp's stable releases and offered to install one.
Stable is the channel that does not play YouTube — the exact problem
fixed in 1.0.1 — so taking that offer would have broken playback.
It now tracks the same nightly channel Snatch bundles.
Release downloads are no longer built from a shared package cache (SNAT-0047)
The files attached to a release are built on GitHub, and the build
reused a store of downloaded packages that a proposed change from
anyone could also write to. Release builds now start from a clean
download instead.
The built-in player can no longer be reached by other users on a shared computer (SNAT-0052)
Snatch talks to its video player through a small control channel. On
a computer shared with other people that channel could sit in a public
folder under a name anyone could work out, and the player accepts any
command sent to it. It now lives in a private folder only you can
open, and is removed when playback stops. Separately, a cookie file
whose name contains a comma is now passed to the player correctly
instead of being silently ignored.
Every bundled helper program is now checked against a known fingerprint (SNAT-0031)
Snatch ships five helper programs it downloads at build time. It
checked they came from the right website, but not that they were the
same files we had reviewed — so if one had been swapped out at the
source, the change would have reached you unnoticed. Each is now
recorded by fingerprint and the build stops if one does not match.
Write user data files with 0600 permissions. (SNAT-0006)
Settings, history and cookie files are now tightened to owner-only
at startup, not just when they are saved. A file left loose by an
older build, or copied in from one, is fixed on the next launch.
The Linux build no longer trusts whatever it downloads
The AppImage build pulled two pieces of tooling from a moving target,
with nothing checking what arrived — including the small program that
becomes the first thing your computer runs when you open Snatch. Both
are now locked to a specific version with a recorded fingerprint, and
the build stops if what arrives does not match.
Updates to yt-dlp are now checked before they are run
When Snatch downloads a newer yt-dlp for itself, it now compares the
file against the checksum yt-dlp publishes with that release, before
making it runnable and before running it. Previously the only check
was running the downloaded file to see whether it worked — which
means it had already run.
Snatch also refuses a download that gets redirected off a secure
connection, and refuses a release name that looks like it is trying
to point somewhere else.
The build pipeline now gets only the access it needs (SNAT-0035)
The automated build had permission to write to the whole project, for
every job, when only the release step ever publishes anything. That is
now read-only by default, with write access granted to the release step
alone. The five checkout steps no longer leave a login token behind in
the build workspace, and the third-party action that publishes releases
is locked to an exact version rather than a label its author can move.
Nothing here was being exploited. It shrinks what a problem elsewhere
could reach. The remaining thirteen version labels are still to do.
Updated the bundled image library to close 12 known advisories (SNAT-0030)
Snatch ships Pillow, which is what opens the picture previews it
fetches from whatever site you are downloading from. The version in
v1.0.0 and v1.0.1 had 12 published security advisories against it;
all 12 are fixed in the version now bundled. Confirmed with
pip-audit, which reports none remaining.
