11a3d3eaee
build(deps): bump actions/github-script from 8 to 9 ( #5662 )
...
Bumps [actions/github-script](https://github.com/actions/github-script ) from 8 to 9.
- [Release notes](https://github.com/actions/github-script/releases )
- [Commits](https://github.com/actions/github-script/compare/v8...v9 )
---
updated-dependencies:
- dependency-name: actions/github-script
dependency-version: '9'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-19 21:40:50 +02:00
2f2bc303a8
build(deps): bump golang.org/x/net from 0.52.0 to 0.53.0 ( #5661 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.52.0 to 0.53.0.
- [Commits](https://github.com/golang/net/compare/v0.52.0...v0.53.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-version: 0.53.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-19 21:40:38 +02:00
Alessandro Ros and GitHub
caeccdceff
prevent out-of-memory errors ( #5674 )
...
impose a maximum size on body of incoming HTTP requests and responses.
2026-04-19 21:39:08 +02:00
3c7c45efa4
build(deps): bump golang.org/x/crypto from 0.49.0 to 0.50.0 ( #5658 )
...
Bumps [golang.org/x/crypto](https://github.com/golang/crypto ) from 0.49.0 to 0.50.0.
- [Commits](https://github.com/golang/crypto/compare/v0.49.0...v0.50.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/crypto
dependency-version: 0.50.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-09 19:28:06 +02:00
2be051afea
build(deps): bump golang.org/x/term from 0.41.0 to 0.42.0 ( #5659 )
...
Bumps [golang.org/x/term](https://github.com/golang/term ) from 0.41.0 to 0.42.0.
- [Commits](https://github.com/golang/term/compare/v0.41.0...v0.42.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/term
dependency-version: 0.42.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-09 19:28:04 +02:00
Alessandro Ros and GitHub
67caaea4fe
playback: return errors as JSON ( #5656 )
...
this is aligned with all other HTTP-based services.
2026-04-09 17:11:03 +02:00
Alessandro Ros and GitHub
c7826d406b
hls: return JSON with error message in case path conf is not available ( #5655 )
...
this behavior is aligned with WebRTC one.
2026-04-08 23:26:04 +02:00
c9ec74c19b
build(deps): bump code.cloudfoundry.org/bytefmt from 0.67.0 to 0.68.0 ( #5651 )
...
Bumps [code.cloudfoundry.org/bytefmt](https://github.com/cloudfoundry/bytefmt ) from 0.67.0 to 0.68.0.
- [Release notes](https://github.com/cloudfoundry/bytefmt/releases )
- [Commits](https://github.com/cloudfoundry/bytefmt/compare/v0.67.0...v0.68.0 )
---
updated-dependencies:
- dependency-name: code.cloudfoundry.org/bytefmt
dependency-version: 0.68.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-08 19:41:28 +02:00
9d1c6f8e02
build(deps): bump golang.org/x/sys from 0.42.0 to 0.43.0 ( #5654 )
...
Bumps [golang.org/x/sys](https://github.com/golang/sys ) from 0.42.0 to 0.43.0.
- [Commits](https://github.com/golang/sys/compare/v0.42.0...v0.43.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/sys
dependency-version: 0.43.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-08 19:41:09 +02:00
0a69020401
build(deps): bump github.com/matthewhartstonge/argon2 ( #5650 )
...
Bumps [github.com/matthewhartstonge/argon2](https://github.com/matthewhartstonge/argon2 ) from 1.4.6 to 1.5.1.
- [Release notes](https://github.com/matthewhartstonge/argon2/releases )
- [Changelog](https://github.com/matthewhartstonge/argon2/blob/main/CHANGELOG.md )
- [Commits](https://github.com/matthewhartstonge/argon2/compare/v1.4.6...v1.5.1 )
---
updated-dependencies:
- dependency-name: github.com/matthewhartstonge/argon2
dependency-version: 1.5.1
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-07 20:43:51 +02:00
Alessandro Ros and GitHub
14e0a8f55b
expose token passed as query parameter to HTTP authentication too ( #5649 )
...
this allows to parse tokens coming from RTSP and RTMP without additional effort.
2026-04-06 18:10:29 +02:00
Alessandro Ros and GitHub
6d6ebee80d
deprecate authJWTInHTTPQuery and disable JWTs in query parameters ( #5648 )
...
This fixes a long standing security flaw. Even though it's a breaking
change, few users should be impacted since this feature has been discouraged
for some time.
2026-04-06 18:03:22 +02:00
Alessandro Ros and GitHub
4472bcfc4b
use "token" as query parameter key to pass tokens ( #5647 )
...
the legacy "jwt" query parameter key is still supported.
2026-04-06 17:51:59 +02:00
Alessandro Ros and GitHub
141b789fa9
docs: further decrease Keycloak JWT length ( #5646 )
...
this helps a lot in using JWTs with players with URL limitations.
2026-04-06 17:23:10 +02:00
Alessandro Ros and GitHub
dc7bd9a096
docs: update ( #5645 )
2026-04-05 11:36:51 +02:00
Alessandro Ros and GitHub
b133a18c42
docs: update ( #5644 )
2026-04-05 11:33:17 +02:00
Alessandro Ros and GitHub
08466b0d95
docs: update links ( #5641 )
2026-04-05 09:55:26 +02:00
Alessandro Ros and GitHub
79cf43644d
docs: update ( #5640 )
2026-04-05 09:51:17 +02:00
Alessandro Ros and GitHub
d44413a5ba
docs: reorganize documentation ( #5639 )
2026-04-04 22:37:19 +02:00
Alessandro Ros and GitHub
d7a0111aa6
docs: add architecture page ( #5638 )
2026-04-04 22:13:54 +02:00
Alessandro Ros and GitHub
6a2bccd25b
add docsorder linter ( #5637 )
2026-04-04 17:01:15 +02:00
Alessandro Ros and GitHub
d4c6f95291
dump unencrypted TLS sessions ( #5624 )
...
when dumpPackets is true, embed TLS master keys into the dump, in a
format which is natively compatible with Wireshark.
2026-04-04 14:46:43 +02:00
Alessandro Ros and GitHub
f52a63858c
docs: add instructions on how to use encryption with OBS Studio ( #5636 )
2026-04-03 22:04:20 +02:00
Alessandro Ros and GitHub
f453b59cd6
improve listener labels ( #5635 )
...
add a label after every "listener opened on :XXX" message that mentions
protocols of every listener.
2026-04-03 16:35:31 +02:00
4ed821add0
build(deps): bump github.com/alecthomas/kong from 1.14.0 to 1.15.0 ( #5631 )
...
Bumps [github.com/alecthomas/kong](https://github.com/alecthomas/kong ) from 1.14.0 to 1.15.0.
- [Commits](https://github.com/alecthomas/kong/compare/v1.14.0...v1.15.0 )
---
updated-dependencies:
- dependency-name: github.com/alecthomas/kong
dependency-version: 1.15.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-02 10:58:33 +02:00
Alessandro Ros and GitHub
5addbed337
Revert "modernize make dockerhub ( #5628 )" ( #5630 )
...
This reverts commit d76c6b561a
2026-03-31 23:04:24 +02:00
bluenviron-bot and GitHub
489a69af38
bump mediamtx-rpicamera to v2.5.5 ( #5629 )
2026-03-31 22:34:55 +02:00
Alessandro Ros and GitHub
d76c6b561a
modernize make dockerhub ( #5628 )
2026-03-31 22:34:46 +02:00
e144f8b97e
build(deps): bump github.com/bluenviron/gortmplib from 0.3.0 to 0.3.1 ( #5625 )
...
Bumps [github.com/bluenviron/gortmplib](https://github.com/bluenviron/gortmplib ) from 0.3.0 to 0.3.1.
- [Commits](https://github.com/bluenviron/gortmplib/compare/v0.3.0...v0.3.1 )
---
updated-dependencies:
- dependency-name: github.com/bluenviron/gortmplib
dependency-version: 0.3.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-31 21:31:19 +02:00
89b1d526f9
build(deps): bump github.com/bluenviron/gortsplib/v5 from 5.5.0 to 5.5.1 ( #5626 )
...
Bumps [github.com/bluenviron/gortsplib/v5](https://github.com/bluenviron/gortsplib ) from 5.5.0 to 5.5.1.
- [Commits](https://github.com/bluenviron/gortsplib/compare/v5.5.0...v5.5.1 )
---
updated-dependencies:
- dependency-name: github.com/bluenviron/gortsplib/v5
dependency-version: 5.5.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-31 21:24:03 +02:00
20111af27e
build(deps): bump github.com/go-git/go-git/v5 from 5.17.1 to 5.17.2 ( #5623 )
...
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git ) from 5.17.1 to 5.17.2.
- [Release notes](https://github.com/go-git/go-git/releases )
- [Commits](https://github.com/go-git/go-git/compare/v5.17.1...v5.17.2 )
---
updated-dependencies:
- dependency-name: github.com/go-git/go-git/v5
dependency-version: 5.17.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-31 21:10:01 +02:00
Alessandro Ros and GitHub
0eb7089ed6
use safer atomic structs instead of atomic functions ( #5622 )
2026-03-31 11:30:50 +02:00
19f66ed06a
build(deps): bump github.com/gin-contrib/pprof from 1.5.3 to 1.5.4 ( #5620 )
...
Bumps [github.com/gin-contrib/pprof](https://github.com/gin-contrib/pprof ) from 1.5.3 to 1.5.4.
- [Release notes](https://github.com/gin-contrib/pprof/releases )
- [Commits](https://github.com/gin-contrib/pprof/compare/v1.5.3...v1.5.4 )
---
updated-dependencies:
- dependency-name: github.com/gin-contrib/pprof
dependency-version: 1.5.4
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-31 11:13:14 +02:00
Alessandro Ros and GitHub
525c020736
docs: fix typo ( #5621 )
2026-03-31 11:08:23 +02:00
1aa7e09d96
build(deps): bump github.com/pion/webrtc/v4 from 4.2.9 to 4.2.11 ( #5615 )
...
Bumps [github.com/pion/webrtc/v4](https://github.com/pion/webrtc ) from 4.2.9 to 4.2.11.
- [Release notes](https://github.com/pion/webrtc/releases )
- [Commits](https://github.com/pion/webrtc/compare/v4.2.9...v4.2.11 )
---
updated-dependencies:
- dependency-name: github.com/pion/webrtc/v4
dependency-version: 4.2.11
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-31 11:07:50 +02:00
c3184d4cb7
build(deps): bump codecov/codecov-action from 5 to 6 ( #5616 )
...
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action ) from 5 to 6.
- [Release notes](https://github.com/codecov/codecov-action/releases )
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/codecov/codecov-action/compare/v5...v6 )
---
updated-dependencies:
- dependency-name: codecov/codecov-action
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-31 11:07:20 +02:00
3e8c7de439
build(deps): bump github.com/go-git/go-git/v5 from 5.17.0 to 5.17.1 ( #5619 )
...
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git ) from 5.17.0 to 5.17.1.
- [Release notes](https://github.com/go-git/go-git/releases )
- [Commits](https://github.com/go-git/go-git/compare/v5.17.0...v5.17.1 )
---
updated-dependencies:
- dependency-name: github.com/go-git/go-git/v5
dependency-version: 5.17.1
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-31 11:07:01 +02:00
b4d198647d
build(deps): bump github.com/pion/ice/v4 from 4.2.1 to 4.2.2 ( #5609 )
...
Bumps [github.com/pion/ice/v4](https://github.com/pion/ice ) from 4.2.1 to 4.2.2.
- [Release notes](https://github.com/pion/ice/releases )
- [Commits](https://github.com/pion/ice/compare/v4.2.1...v4.2.2 )
---
updated-dependencies:
- dependency-name: github.com/pion/ice/v4
dependency-version: 4.2.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-26 08:37:14 +01:00
Alessandro Ros and GitHub
7418e51031
prevent directory traversal attacks ( #5602 )
...
Path names are used as part of paths in several components: in the
recorder, in the playback server and in every HTTP-based component
(WebRTC, HLS, API). Special characters that allow to escape from the
intended directory are now forbidden in order to prevent directory
traversal attacks.
2026-03-23 20:16:12 +01:00
Alessandro Ros and GitHub
d5d1de0bd2
webrtc: strip TWCC extension of incoming RTP packets ( #5146 ) ( #5605 )
...
The TWCC extension is used as part of the WebRTC congestion control
algorithm placed between the publisher and the server. If this
extension is routed untouched from the server to readers, it messes
with the congestion control algorithm present between the server and
each reader. Remove it.
2026-03-23 14:14:46 +01:00
bluenviron-bot and GitHub
ff4ca04fb4
bump golangci-lint to 2.11.4 ( #5607 )
2026-03-23 13:50:19 +01:00
Alessandro Ros and GitHub
33f12816cd
docs: update ( #5598 )
2026-03-22 10:38:53 +01:00
8568d8c57c
webrtc: fix random absolute timestamps with Opus, G711 and LPCM ( #5597 )
...
When rewriting audio RTP timestamps in WebRTC egress, NTP was
derived using regenerated packet timestamps minus the incoming
RTP base timestamp.
That mixed timestamp domains and could shift absolute time by an
arbitrary offset while still exposing mapping as available.
Fix by using a consistent outgoing RTP domain in rewritten audio
paths:
- snapshot outgoing base timestamp before rewriting each unit
- compute NTP from (outgoing packet timestamp - outgoing base
timestamp)
This keeps RTP<->NTP mapping coherent for sender reports and prevents
random absolute-time offsets in WebRTC loopback with
useAbsoluteTimestamp.
---------
Co-authored-by: aler9 <46489434+aler9@users.noreply.github.com >
2026-03-21 19:46:39 +01:00
Alessandro Ros and GitHub
3381b196fb
solve codec labels internally ( #5603 )
...
stop using gortsplib format.Format.Codec() for getting codec names.
2026-03-21 18:22:49 +01:00
Alessandro Ros and GitHub
0f42f087ab
test: add docslinks linter ( #5601 )
...
this checks links in the documentation.
2026-03-21 13:04:14 +01:00
Alessandro Ros and GitHub
a82e0c7a9d
rpi: restore Docker compatibility with armv6 devices ( #5590 ) ( #5595 )
2026-03-19 21:21:27 +01:00
Alessandro Ros and GitHub
12687e5abb
improve documentation ( #5586 )
2026-03-18 09:47:46 +01:00
Alessandro Ros and GitHub
2b302e7940
api: provide track details ( #5307 ) ( #5333 ) ( #1726 ) ( #5585 )
2026-03-18 00:01:43 +01:00
95e5b55dae
build(deps): bump code.cloudfoundry.org/bytefmt from 0.66.0 to 0.67.0 ( #5583 )
...
Bumps [code.cloudfoundry.org/bytefmt](https://github.com/cloudfoundry/bytefmt ) from 0.66.0 to 0.67.0.
- [Release notes](https://github.com/cloudfoundry/bytefmt/releases )
- [Commits](https://github.com/cloudfoundry/bytefmt/compare/v0.66.0...v0.67.0 )
---
updated-dependencies:
- dependency-name: code.cloudfoundry.org/bytefmt
dependency-version: 0.67.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-17 19:14:19 +01:00
f98c9c59ca
rtsp: support unwrapping MPEG-TS tracks ( #5476 )
...
this allows to use MPEG-TS tracks with other protocols and with the recording system.
---------
Co-authored-by: aler9 <46489434+aler9@users.noreply.github.com >
2026-03-17 19:14:04 +01:00
