Problem

Current vcpkg.json lists "ffmpeg" with the default feature set, which builds a general-purpose ffmpeg with a wide range of codecs, muxers/demuxers, protocols, and filters we never use. The shipped DLLs weigh in at:

The player only ever decodes HEVC video from mp4 containers, no audio — server-side encoded, no audio tracks in the stream. Confirmed by ContentDownloader/ (fetches .mp4 only) and ContentDecoder/ (no audio path).

Proposed fix

Restrict the vcpkg feature set to exactly what we use:

• Container: mp4 only. FFmpeg ships mp4 and mov together as the single mov demuxer (mov,mp4,m4a,3gp,3g2,mj2) — one binary symbol, no way to split. So the minimum is that one demuxer; drop everything else (matroska, avi, flv, asf, mpegts, rtsp/rtmp/hls/dash, and the long tail of legacy/network formats).
• Video decoder: HEVC only (drop h264, vp8, vp9, av1, mpeg2, mpeg4, prores, theora, …).
• Audio: none. Drop all audio decoders, drop swresample entirely, skip audio-track handling in the demuxer.
• Encoder: none (playback only).
• Filter: only what swscale implicitly needs.
• Protocol: file only; network fetches happen via libcurl, not ffmpeg's HTTP(S)/rtmp stacks.
• Hwaccel: consider enabling d3d11va / videotoolbox for HEVC GPU decode, or explicitly disabling to keep size tight — open question.

Concretely:

{
  "name": "ffmpeg",
  "default-features": false,
  "features": [ "avcodec", "avformat", "swscale" ]
}

plus a vcpkg patch / CMake cache options to pass the equivalent of:

--disable-everything
--enable-decoder=hevc
--enable-demuxer=mov
--enable-protocol=file
--enable-parser=hevc
--disable-swresample
--disable-network
--disable-encoders
--disable-muxers
--disable-filters

(see vcpkg/ports/ffmpeg/portfile.cmake for how feature flags translate to configure options).

Expected savings

Savings: ~14 MB of shipped DLLs (~80% of ffmpeg payload) and a correspondingly smaller CVE attack surface — ffmpeg's obscure demuxers/decoders are a historically busy CVE category.

Acceptance

• Windows and macOS playback still work end-to-end against alpha/stage playlists
• ContentDecoder/ doesn't probe for non-HEVC codecs or audio streams (verify with a grep pass)
• Shipped ffmpeg DLL total drops below 4 MB
• No swresample-*.dll in the output bundle

Related

• PR #541 vendored ~440 MB of Windows binary dependencies into the repo (should use vcpkg) #549 (vcpkg migration — unblocks this)
• Outdated OpenSSL 1.0.2k (EOL since Dec 2019) #551 (OpenSSL upgrade — same spirit of dropping unused attack surface)