Alessandro Ros and GitHub
2183d37d32
add comment to prevent security scan false positives ( #5973 )
2026-07-23 22:59:23 +02:00
5994667eca
build(deps): bump code.cloudfoundry.org/bytefmt from 0.81.0 to 0.82.0 ( #5972 )
...
Bumps [code.cloudfoundry.org/bytefmt](https://github.com/cloudfoundry/bytefmt ) from 0.81.0 to 0.82.0.
- [Release notes](https://github.com/cloudfoundry/bytefmt/releases )
- [Commits](https://github.com/cloudfoundry/bytefmt/compare/v0.81.0...v0.82.0 )
---
updated-dependencies:
- dependency-name: code.cloudfoundry.org/bytefmt
dependency-version: 0.82.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-21 21:58:46 +02:00
0b33532432
build(deps): bump github.com/pion/interceptor from 0.1.45 to 0.1.46 ( #5971 )
...
Bumps [github.com/pion/interceptor](https://github.com/pion/interceptor ) from 0.1.45 to 0.1.46.
- [Release notes](https://github.com/pion/interceptor/releases )
- [Commits](https://github.com/pion/interceptor/compare/v0.1.45...v0.1.46 )
---
updated-dependencies:
- dependency-name: github.com/pion/interceptor
dependency-version: 0.1.46
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-21 21:58:27 +02:00
668b2ffcc9
build(deps): bump github.com/pion/webrtc/v4 from 4.2.16 to 4.2.17 ( #5970 )
...
Bumps [github.com/pion/webrtc/v4](https://github.com/pion/webrtc ) from 4.2.16 to 4.2.17.
- [Release notes](https://github.com/pion/webrtc/releases )
- [Commits](https://github.com/pion/webrtc/compare/v4.2.16...v4.2.17 )
---
updated-dependencies:
- dependency-name: github.com/pion/webrtc/v4
dependency-version: 4.2.17
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-21 00:49:05 +02:00
Alessandro Ros and GitHub
6da35dc389
moq: support draft-19 of the specification ( #5968 )
...
* support draft-19 of the specification
* support subscribing the same track multiple times
2026-07-21 00:24:03 +02:00
Alessandro Ros and GitHub
be610a6a04
docs: add fail2ban integration ( #5016 ) ( #5967 )
2026-07-19 17:03:57 +02:00
Alessandro Ros and GitHub
58c6099e50
ask for credentials only in case of protocols that support it ( #5966 )
...
When clients connect with some protocols (SRT, RTMP), they are unable
to provide credentials even if they are asked to. In this case, it's
useless to wait for credentials, and it's better to immediately log
authentication errors and apply the anti-brute force algorithm.
2026-07-19 16:52:14 +02:00
Alessandro Ros and GitHub
363ac206f7
moq: fix several panics and OOM errors ( #5964 )
...
Check for limits before allocating memory by using sizes passed from
the remote peer. Also add fuzzing to all MoQ primitives.
2026-07-19 12:13:45 +02:00
Alessandro Ros and GitHub
83cc54418c
moq: fix race condition during startup ( #5965 )
...
allocate the HTTP server only after the MoQ server has been initialized.
2026-07-19 11:29:04 +02:00
Alessandro Ros and GitHub
0e6426c648
adjust code to prevent security scan false positives ( #5963 )
...
... about string escaping.
2026-07-19 10:20:37 +02:00
Alessandro Ros and GitHub
e14ada6f4b
normalize authentication error messages ( #5421 ) ( #5959 )
...
Log authentication errors as soon as possible, use the "warn" level,
use the same message whatever the author or protocol.
2026-07-19 10:04:17 +02:00
d15c14ec6a
avoid potential timing attack when validating SHA256 credentials ( #5961 )
...
The == operator is vulnerable to timing attacks as it short-circuits on a mismatch. Use
ConstantTimeCompare to avoid this vector.
Co-authored-by: Tristan Matthews <tmatth@videolan.org >
2026-07-19 09:46:34 +02:00
Alessandro Ros and GitHub
0378876293
fix wrong PTS and wrong playback of alwaysAvailableFile ( #5436 ) ( #5960 )
...
PTS offset of samples was not properly considered, and sleep between
samples was PTS-based instead of being DTS-based.
2026-07-18 22:39:28 +02:00
Alessandro Ros and GitHub
fa7a89f840
rtsp: restrict UDP port range to 32768-60999 ( #5398 ) ( #5958 )
...
this is the default Linux ephemeral port range.
2026-07-18 20:59:33 +02:00
Alessandro Ros and GitHub
d6e765976c
srt: fix compatibility with StreamToStudio app ( #5414 ) ( #5928 )
2026-07-18 17:59:05 +02:00
Alessandro Ros and GitHub
96aeb1e603
rename runOnReady into runOnAvailable, runOnNotReady into runOnUnavailable ( #5957 )
2026-07-18 17:58:16 +02:00
Alessandro Ros and GitHub
8909e35a17
add runOnOnline / runOnOffline hooks ( #5399 ) ( #5956 )
...
These are triggered and a stream is online (i.e. not just provided by
an offline segment).
2026-07-18 17:41:38 +02:00
470136f1c7
build(deps): bump github.com/alecthomas/kong from 1.15.0 to 1.16.0 ( #5953 )
...
Bumps [github.com/alecthomas/kong](https://github.com/alecthomas/kong ) from 1.15.0 to 1.16.0.
- [Commits](https://github.com/alecthomas/kong/compare/v1.15.0...v1.16.0 )
---
updated-dependencies:
- dependency-name: github.com/alecthomas/kong
dependency-version: 1.16.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-18 17:22:39 +02:00
ecb5a670f5
build(deps): bump code.cloudfoundry.org/bytefmt from 0.80.0 to 0.81.0 ( #5955 )
...
Bumps [code.cloudfoundry.org/bytefmt](https://github.com/cloudfoundry/bytefmt ) from 0.80.0 to 0.81.0.
- [Release notes](https://github.com/cloudfoundry/bytefmt/releases )
- [Commits](https://github.com/cloudfoundry/bytefmt/compare/v0.80.0...v0.81.0 )
---
updated-dependencies:
- dependency-name: code.cloudfoundry.org/bytefmt
dependency-version: 0.81.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-18 17:22:29 +02:00
6e701b8f62
build(deps): bump github.com/matthewhartstonge/argon2 ( #5954 )
...
Bumps [github.com/matthewhartstonge/argon2](https://github.com/matthewhartstonge/argon2 ) from 1.5.5 to 1.5.6.
- [Release notes](https://github.com/matthewhartstonge/argon2/releases )
- [Changelog](https://github.com/matthewhartstonge/argon2/blob/main/CHANGELOG.md )
- [Commits](https://github.com/matthewhartstonge/argon2/compare/v1.5.5...v1.5.6 )
---
updated-dependencies:
- dependency-name: github.com/matthewhartstonge/argon2
dependency-version: 1.5.6
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-18 17:22:24 +02:00
Alessandro Ros and GitHub
75bf1af38c
fix clearing lists with environment variables ( #5410 ) ( #5924 )
...
MTX_AUTHINTERNALUSERS_0_IPS, MTX_LOGDESTINATIONS and MTX_RTSPTRANSPORTS
can now be used to clear their corresponding list by setting them to an
empty value.
2026-07-18 10:56:46 +02:00
e3b6fff942
build(deps): bump golang.org/x/net from 0.56.0 to 0.57.0 ( #5944 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.56.0 to 0.57.0.
- [Commits](https://github.com/golang/net/compare/v0.56.0...v0.57.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-version: 0.57.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-17 11:07:36 +02:00
4ee9fb0b56
build(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 ( #5939 )
...
Bumps [golang.org/x/sync](https://github.com/golang/sync ) from 0.21.0 to 0.22.0.
- [Commits](https://github.com/golang/sync/compare/v0.21.0...v0.22.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/sync
dependency-version: 0.22.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-17 10:22:50 +02:00
a6a80e6ddd
build(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 ( #5945 )
...
Bumps [golang.org/x/crypto](https://github.com/golang/crypto ) from 0.53.0 to 0.54.0.
- [Commits](https://github.com/golang/crypto/compare/v0.53.0...v0.54.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/crypto
dependency-version: 0.54.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-17 10:22:44 +02:00
1bcfd6fbfa
build(deps): bump github.com/pires/go-proxyproto from 0.14.0 to 0.15.0 ( #5946 )
...
Bumps [github.com/pires/go-proxyproto](https://github.com/pires/go-proxyproto ) from 0.14.0 to 0.15.0.
- [Release notes](https://github.com/pires/go-proxyproto/releases )
- [Commits](https://github.com/pires/go-proxyproto/compare/v0.14.0...v0.15.0 )
---
updated-dependencies:
- dependency-name: github.com/pires/go-proxyproto
dependency-version: 0.15.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-17 10:22:29 +02:00
4097235616
build(deps): bump actions/setup-go from 6 to 7 ( #5952 )
...
Bumps [actions/setup-go](https://github.com/actions/setup-go ) from 6 to 7.
- [Release notes](https://github.com/actions/setup-go/releases )
- [Commits](https://github.com/actions/setup-go/compare/v6...v7 )
---
updated-dependencies:
- dependency-name: actions/setup-go
dependency-version: '7'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-17 10:05:25 +02:00
638df74975
build(deps): bump github.com/pion/ice/v4 ( #5947 )
...
Bumps [github.com/pion/ice/v4](https://github.com/pion/ice ) from 4.2.8-0.20260604162030-72f5001c4596 to 4.3.0.
- [Release notes](https://github.com/pion/ice/releases )
- [Commits](https://github.com/pion/ice/commits/v4.3.0 )
---
updated-dependencies:
- dependency-name: github.com/pion/ice/v4
dependency-version: 4.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-17 10:05:10 +02:00
97ae0c6f69
build(deps): bump golang.org/x/term from 0.44.0 to 0.45.0 ( #5937 )
...
Bumps [golang.org/x/term](https://github.com/golang/term ) from 0.44.0 to 0.45.0.
- [Commits](https://github.com/golang/term/compare/v0.44.0...v0.45.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/term
dependency-version: 0.45.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-10 19:00:57 +02:00
c3c80d1714
build(deps): bump code.cloudfoundry.org/bytefmt from 0.79.0 to 0.80.0 ( #5930 )
...
Bumps [code.cloudfoundry.org/bytefmt](https://github.com/cloudfoundry/bytefmt ) from 0.79.0 to 0.80.0.
- [Release notes](https://github.com/cloudfoundry/bytefmt/releases )
- [Commits](https://github.com/cloudfoundry/bytefmt/compare/v0.79.0...v0.80.0 )
---
updated-dependencies:
- dependency-name: code.cloudfoundry.org/bytefmt
dependency-version: 0.80.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-10 19:00:32 +02:00
f785a5de93
build(deps): bump github.com/quic-go/webtransport-go ( #5929 )
...
Bumps [github.com/quic-go/webtransport-go](https://github.com/quic-go/webtransport-go ) from 0.11.0 to 0.11.1.
- [Release notes](https://github.com/quic-go/webtransport-go/releases )
- [Commits](https://github.com/quic-go/webtransport-go/compare/v0.11.0...v0.11.1 )
---
updated-dependencies:
- dependency-name: github.com/quic-go/webtransport-go
dependency-version: 0.11.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-10 19:00:26 +02:00
Alessandro Ros and GitHub
e98b727277
fix error message ( #5922 )
...
'all' is a synonym for 'all_others'
2026-07-05 11:00:09 +02:00
Alessandro Ros and GitHub
99f804d733
api: generate most of OpenAPI automatically ( #5918 )
...
enums and structs are now generated automatically. This eliminates some
inconsistencies and makes development easier.
2026-07-04 17:45:43 +02:00
7b60b51881
build(deps): bump github.com/pion/rtp from 1.10.2 to 1.10.3 ( #5917 )
...
Bumps [github.com/pion/rtp](https://github.com/pion/rtp ) from 1.10.2 to 1.10.3.
- [Release notes](https://github.com/pion/rtp/releases )
- [Commits](https://github.com/pion/rtp/compare/v1.10.2...v1.10.3 )
---
updated-dependencies:
- dependency-name: github.com/pion/rtp
dependency-version: 1.10.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-04 17:36:39 +02:00
cacc09ee93
build(deps): bump github.com/pion/webrtc/v4 from 4.2.15 to 4.2.16 ( #5907 )
...
Bumps [github.com/pion/webrtc/v4](https://github.com/pion/webrtc ) from 4.2.15 to 4.2.16.
- [Release notes](https://github.com/pion/webrtc/releases )
- [Commits](https://github.com/pion/webrtc/compare/v4.2.15...v4.2.16 )
---
updated-dependencies:
- dependency-name: github.com/pion/webrtc/v4
dependency-version: 4.2.16
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-02 21:25:29 +02:00
cdb57eaf71
build(deps): bump code.cloudfoundry.org/bytefmt from 0.78.0 to 0.79.0 ( #5911 )
...
Bumps [code.cloudfoundry.org/bytefmt](https://github.com/cloudfoundry/bytefmt ) from 0.78.0 to 0.79.0.
- [Release notes](https://github.com/cloudfoundry/bytefmt/releases )
- [Commits](https://github.com/cloudfoundry/bytefmt/compare/v0.78.0...v0.79.0 )
---
updated-dependencies:
- dependency-name: code.cloudfoundry.org/bytefmt
dependency-version: 0.79.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-02 21:11:57 +02:00
0a41fb2a47
build(deps): bump github.com/pion/rtcp from 1.2.16 to 1.2.17 ( #5910 )
...
Bumps [github.com/pion/rtcp](https://github.com/pion/rtcp ) from 1.2.16 to 1.2.17.
- [Release notes](https://github.com/pion/rtcp/releases )
- [Commits](https://github.com/pion/rtcp/compare/v1.2.16...v1.2.17 )
---
updated-dependencies:
- dependency-name: github.com/pion/rtcp
dependency-version: 1.2.17
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-02 21:11:48 +02:00
2cb5330398
build(deps): bump github.com/pires/go-proxyproto from 0.12.0 to 0.14.0 ( #5914 )
...
Bumps [github.com/pires/go-proxyproto](https://github.com/pires/go-proxyproto ) from 0.12.0 to 0.14.0.
- [Release notes](https://github.com/pires/go-proxyproto/releases )
- [Commits](https://github.com/pires/go-proxyproto/compare/v0.12.0...v0.14.0 )
---
updated-dependencies:
- dependency-name: github.com/pires/go-proxyproto
dependency-version: 0.14.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-02 21:11:26 +02:00
Alessandro Ros and GitHub
f4decfd41b
docs: fix MoQ read URL ( #5904 )
2026-06-28 16:29:24 +02:00
Alessandro Ros and GitHub
ce00edb92f
docs: change suggested hls.js CDN ( #5903 )
2026-06-28 16:29:12 +02:00
Alessandro Ros and GitHub
7eb5d30075
prevent truncation of 64-bit values on 32-bit platforms ( #5902 )
2026-06-28 11:37:14 +02:00
ed5496f607
build(deps): bump github.com/bluenviron/gortsplib/v5 from 5.6.0 to 5.6.1 ( #5900 )
...
Bumps [github.com/bluenviron/gortsplib/v5](https://github.com/bluenviron/gortsplib ) from 5.6.0 to 5.6.1.
- [Commits](https://github.com/bluenviron/gortsplib/compare/v5.6.0...v5.6.1 )
---
updated-dependencies:
- dependency-name: github.com/bluenviron/gortsplib/v5
dependency-version: 5.6.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-28 11:32:02 +02:00
Alessandro Ros and GitHub
bf098c7eb5
support encoding secondary stream with H264 (2/2) ( #4485 ) ( #5898 )
2026-06-28 11:19:23 +02:00
Alessandro Ros and GitHub
1a7c10af1e
rpicamera: support encoding primary stream with MJPEG (2/2) ( #5892 )
2026-06-27 19:19:36 +02:00
Alessandro Ros and GitHub
07d0e232b2
rpi: add unified rpiCameraH264Profile, rpiCameraH264Level params ( #5894 )
...
These replace rpiCameraHardwareH264Profile, rpiCameraHardwareH264Level, rpiCameraSoftwareH264Profile, rpiCameraSoftwareH264Level.
2026-06-25 22:07:36 +02:00
Alessandro Ros and GitHub
b91affa054
rpi: exclude additional code from non-arm builds ( #5893 )
2026-06-25 19:37:28 +02:00
0a26f8e8a2
build(deps): bump code.cloudfoundry.org/bytefmt from 0.77.0 to 0.78.0 ( #5891 )
...
Bumps [code.cloudfoundry.org/bytefmt](https://github.com/cloudfoundry/bytefmt ) from 0.77.0 to 0.78.0.
- [Release notes](https://github.com/cloudfoundry/bytefmt/releases )
- [Commits](https://github.com/cloudfoundry/bytefmt/compare/v0.77.0...v0.78.0 )
---
updated-dependencies:
- dependency-name: code.cloudfoundry.org/bytefmt
dependency-version: 0.78.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-25 12:14:39 +02:00
596931d04d
build(deps): bump github.com/pion/sdp/v3 from 3.0.18 to 3.0.19 ( #5889 )
...
Bumps [github.com/pion/sdp/v3](https://github.com/pion/sdp ) from 3.0.18 to 3.0.19.
- [Release notes](https://github.com/pion/sdp/releases )
- [Commits](https://github.com/pion/sdp/compare/v3.0.18...v3.0.19 )
---
updated-dependencies:
- dependency-name: github.com/pion/sdp/v3
dependency-version: 3.0.19
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-25 12:14:17 +02:00
suMin and GitHub
8fcbd0a796
webrtc: skip unresolvable webrtcAdditionalHosts entries instead of aborting ( #5845 )
...
Since #4866 , hostnames in webrtcAdditionalHosts are resolved server-side via
net.LookupIP, and a resolution failure aborts the entire WHEP/WHIP session.
A single entry that can't be resolved on the server (e.g. air-gapped networks
without DNS, or a name that only resolves on the client) therefore takes down
all WebRTC playback, even when the other entries are valid.
Log a warning and skip the unresolvable entry instead of returning an error,
so the remaining valid candidates are still offered.
Signed-off-by: suMin <sumin77123@gmail.com >
2026-06-22 21:14:04 +02:00
d31c0b3900
rtsp: add rtspScale parameter to inject Scale header on PLAY ( #5800 )
...
Co-authored-by: aler9 <46489434+aler9@users.noreply.github.com >
2026-06-20 12:08:15 +02:00
Alessandro Ros and GitHub
90b8d5c943
improve HTTP server performance ( #5886 )
...
log incoming requests without cloning.
2026-06-20 12:03:35 +02:00
