fix(lavalink): pin youtube-plugin to the snapshot carrying the TV User-Agent fix

[Magalvo]

Problem

After #39 the OAuth setup is correct and live — Lavalink logs YouTube access token refreshed successfully at startup and tries TVHTML5 first — and /play still joins the channel and plays nothing:

Client [TVHTML5] failed: The page needs to be reloaded.
Client [ANDROID_VR] failed: This video requires login.
Client [WEB] failed: No supported audio streams available, available types:
Client [WEB_EMBEDDED_PLAYER] failed: Video player configuration error

This is not a configuration problem. Around 2026-08-18 YouTube began rejecting Cobalt-family User-Agents on the TVHTML5 player endpoint, answering UNPLAYABLE with reason = "The page needs to be reloaded." Since TV is the only OAuth-capable client, that takes out authenticated playback outright — a valid refresh token buys nothing, because the one client that would send it is refused before it gets to the formats.

Upstream #226 carries a controlled reproduction isolating the User-Agent as the sole trigger: holding client name, version, params and signatureTimestamp constant, any Cobalt UA yields UNPLAYABLE with 0 formats, while a PlayStation 4 UA yields OK with 27.

Fix

#233 switches the TV client to a PlayStation 4 User-Agent. It was merged 2026-08-19 — but no release carries it: 1.18.2 is from 2026-07-27, three weeks earlier. Pinning a snapshot is the only way to get the fix today.

The pin is f45bbb7a, the current main tip, which carries #233 plus #235 (recover total length when contentLength is omitted). Snapshot builds are published per commit, so the pin is exact and reproducible rather than a floating -SNAPSHOT.

The comment in application.yml and the new docs section both say to return to a released version once one ships the fix (>= 1.18.3), so this does not quietly become permanent.

Verification

Driven against Lavalink 4.2.2 over REST/WebSocket:

• The snapshot downloads from the snapshots repository, loads, and initialises with TVHTML5 present in the client list.
• The TVHTML5 failure changes from "The page needs to be reloaded" to a later-stage error, confirming the request now clears the playability check that was blocking it.

The authenticated path cannot be verified here — that needs the deployment's own linked account, which is not mine to use. If playback still fails after this, the next error will be from a later stage and the documented remedy is a remote cipher server (yt-cipher, plugins.youtube.remoteCipher), which is what the person who diagnosed #226 runs.

Also

Documents that bot code changes need docker compose up -d --build bot. --force-recreate lavalink restarts Lavalink alone and a plain up -d bot reuses the existing image, so a pulled fix to src/ can sit undeployed with no visible sign beyond the CREATED column in docker compose ps — which is exactly what happened to #39's playback-failure notice on the live deployment.

🤖 Generated with Claude Code