Alessandro Ros and GitHub
35990a38c3
webrtc: fix race condition in tests ( #6025 )
2026-08-03 18:11:24 +02:00
Alessandro Ros and GitHub
168c5900b1
docs: update ( #6022 )
2026-08-03 11:43:33 +00:00
Alessandro Ros and GitHub
3c77704ccf
rtsp: log write errors ( #6023 )
2026-08-02 16:48:13 +00:00
Alessandro Ros and GitHub
4bb896afe0
webrtc: reset recomputed audio PTS if it drifts too much ( #6021 )
2026-08-01 16:24:53 +00:00
Alessandro Ros and GitHub
24dd8f44a5
sync golangci-lint settings ( #6020 )
2026-08-01 08:30:58 +00:00
Alessandro Ros and GitHub
ef93aee083
use black-box testing where possible ( #6016 )
2026-08-01 08:06:27 +00:00
c41a88bb4a
build(deps): bump actions/attest from 4 to 4.2.0 ( #6017 )
...
Bumps [actions/attest](https://github.com/actions/attest ) from 4 to 4.2.0.
- [Release notes](https://github.com/actions/attest/releases )
- [Changelog](https://github.com/actions/attest/blob/main/RELEASE.md )
- [Commits](https://github.com/actions/attest/compare/v4...v4.2.0 )
---
updated-dependencies:
- dependency-name: actions/attest
dependency-version: 4.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-01 09:34:47 +02:00
2156e75dd6
Add OpenAPI definition of the Playback server ( #5546 )
...
Co-authored-by: aler9 <46489434+aler9@users.noreply.github.com >
2026-07-31 20:34:41 +00:00
fa9cd4fbed
build(deps): bump github.com/quic-go/webtransport-go from 0.11.1 to 0.12.0 ( #6011 )
...
* build(deps): bump github.com/quic-go/webtransport-go
Bumps [github.com/quic-go/webtransport-go](https://github.com/quic-go/webtransport-go ) from 0.11.1 to 0.12.0.
- [Release notes](https://github.com/quic-go/webtransport-go/releases )
- [Commits](https://github.com/quic-go/webtransport-go/compare/v0.11.1...v0.12.0 )
---
updated-dependencies:
- dependency-name: github.com/quic-go/webtransport-go
dependency-version: 0.12.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
* additional changes
---------
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: aler9 <46489434+aler9@users.noreply.github.com >
2026-07-29 18:40:36 +02:00
74ded29fc3
build(deps): bump code.cloudfoundry.org/bytefmt from 0.82.0 to 0.83.0 ( #6008 )
...
---
updated-dependencies:
- dependency-name: code.cloudfoundry.org/bytefmt
dependency-version: 0.83.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-29 18:15:24 +02:00
97e439dcb2
build(deps): bump github.com/pion/webrtc/v4 from 4.2.17 to 4.2.18 ( #6009 )
...
Bumps [github.com/pion/webrtc/v4](https://github.com/pion/webrtc ) from 4.2.17 to 4.2.18.
- [Release notes](https://github.com/pion/webrtc/releases )
- [Commits](https://github.com/pion/webrtc/compare/v4.2.17...v4.2.18 )
---
updated-dependencies:
- dependency-name: github.com/pion/webrtc/v4
dependency-version: 4.2.18
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-29 18:15:16 +02:00
f8ce85cc86
build(deps): bump github.com/go-git/go-git/v5 from 5.19.1 to 5.19.2 ( #6010 )
...
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git ) from 5.19.1 to 5.19.2.
- [Release notes](https://github.com/go-git/go-git/releases )
- [Changelog](https://github.com/go-git/go-git/blob/main/HISTORY.md )
- [Commits](https://github.com/go-git/go-git/compare/v5.19.1...v5.19.2 )
---
updated-dependencies:
- dependency-name: github.com/go-git/go-git/v5
dependency-version: 5.19.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-29 18:15:06 +02:00
da52852e12
build(deps): bump github.com/pion/interceptor from 0.1.46 to 0.1.47 ( #5994 )
...
Bumps [github.com/pion/interceptor](https://github.com/pion/interceptor ) from 0.1.46 to 0.1.47.
- [Release notes](https://github.com/pion/interceptor/releases )
- [Commits](https://github.com/pion/interceptor/compare/v0.1.46...v0.1.47 )
---
updated-dependencies:
- dependency-name: github.com/pion/interceptor
dependency-version: 0.1.47
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-29 16:57:09 +02:00
0776496f3c
build(deps): bump github.com/MicahParks/jwkset from 0.11.1 to 0.11.2 ( #5996 )
...
Bumps [github.com/MicahParks/jwkset](https://github.com/MicahParks/jwkset ) from 0.11.1 to 0.11.2.
- [Release notes](https://github.com/MicahParks/jwkset/releases )
- [Commits](https://github.com/MicahParks/jwkset/compare/v0.11.1...v0.11.2 )
---
updated-dependencies:
- dependency-name: github.com/MicahParks/jwkset
dependency-version: 0.11.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-29 16:57:02 +02:00
Alessandro Ros and GitHub
817c22cc6c
fix inability to read some AV1 streams with RTSP ( #6001 ) ( #6006 )
...
Since v1.16.0, temporal unit delimiters were not stripped from AV1 streams
anymore. This has been restored, healing AV1 streams read with
RTSP.
2026-07-29 14:36:23 +02:00
4236e40881
build(deps): bump github.com/MicahParks/keyfunc/v3 from 3.8.0 to 3.8.1 ( #5997 )
...
Bumps [github.com/MicahParks/keyfunc/v3](https://github.com/MicahParks/keyfunc ) from 3.8.0 to 3.8.1.
- [Release notes](https://github.com/MicahParks/keyfunc/releases )
- [Commits](https://github.com/MicahParks/keyfunc/compare/v3.8.0...v3.8.1 )
---
updated-dependencies:
- dependency-name: github.com/MicahParks/keyfunc/v3
dependency-version: 3.8.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-29 13:39:32 +02:00
ee59b83574
build(deps): bump github.com/pion/ice/v4 from 4.3.0 to 4.4.0 ( #5995 )
...
Bumps [github.com/pion/ice/v4](https://github.com/pion/ice ) from 4.3.0 to 4.4.0.
- [Release notes](https://github.com/pion/ice/releases )
- [Commits](https://github.com/pion/ice/compare/v4.3.0...v4.4.0 )
---
updated-dependencies:
- dependency-name: github.com/pion/ice/v4
dependency-version: 4.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-29 13:32:25 +02:00
d843a0bf21
webrtc: fix packet corruption when reading G722 ( #6000 )
...
Co-authored-by: aler9 <46489434+aler9@users.noreply.github.com >
2026-07-29 13:31:02 +02:00
Alessandro Ros and GitHub
a0482f937f
webrtc: sort tracks in a deterministic way ( #5988 ) ( #5989 )
...
When ingesting tracks with WebRTC, track order was randomized,
preventing multi-track always-available streams from working reliably,
since they require tracks to be ordered in a precise way.
WebRTC tracks are not ordered by MID, RID, trackID and streamID
respectively.
2026-07-25 19:44:45 +02:00
Alessandro Ros and GitHub
fc47d9e6ed
srt: improve log clarity ( #5990 )
...
use message 'passphrase not provided by client' when clients do not
provide passphrases.
2026-07-25 19:44:31 +02:00
7b5251afb3
build(deps): bump github.com/go-git/go-billy/v5 from 5.9.0 to 5.9.1 ( #5987 )
...
Bumps [github.com/go-git/go-billy/v5](https://github.com/go-git/go-billy ) from 5.9.0 to 5.9.1.
- [Release notes](https://github.com/go-git/go-billy/releases )
- [Commits](https://github.com/go-git/go-billy/compare/v5.9.0...v5.9.1 )
---
updated-dependencies:
- dependency-name: github.com/go-git/go-billy/v5
dependency-version: 5.9.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-25 18:40:08 +02:00
Alessandro Ros and GitHub
83e04d8255
improve documentation ( #5985 )
2026-07-24 15:43:06 +02:00
Alessandro Ros and GitHub
519a04e490
docs: add missing MoQ ports ( #5983 )
2026-07-24 09:12:48 +02:00
5ccc80ad7b
build(deps): bump github.com/bluenviron/gortsplib/v5 from 5.6.1 to 5.6.2 ( #5981 )
...
* build(deps): bump github.com/bluenviron/gortsplib/v5 from 5.6.1 to 5.6.2
Bumps [github.com/bluenviron/gortsplib/v5](https://github.com/bluenviron/gortsplib ) from 5.6.1 to 5.6.2.
- [Commits](https://github.com/bluenviron/gortsplib/compare/v5.6.1...v5.6.2 )
---
updated-dependencies:
- dependency-name: github.com/bluenviron/gortsplib/v5
dependency-version: 5.6.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
* additional changes
---------
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: aler9 <46489434+aler9@users.noreply.github.com >
2026-07-23 23:49:31 +02:00
6d253930be
build(deps): bump github.com/bluenviron/gortmplib from 0.4.0 to 0.4.1 ( #5979 )
...
Bumps [github.com/bluenviron/gortmplib](https://github.com/bluenviron/gortmplib ) from 0.4.0 to 0.4.1.
- [Commits](https://github.com/bluenviron/gortmplib/compare/v0.4.0...v0.4.1 )
---
updated-dependencies:
- dependency-name: github.com/bluenviron/gortmplib
dependency-version: 0.4.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-23 23:41:53 +02:00
28588d5a95
build(deps): bump github.com/bluenviron/gohlslib/v2 from 2.4.0 to 2.4.1 ( #5978 )
...
Bumps [github.com/bluenviron/gohlslib/v2](https://github.com/bluenviron/gohlslib ) from 2.4.0 to 2.4.1.
- [Commits](https://github.com/bluenviron/gohlslib/compare/v2.4.0...v2.4.1 )
---
updated-dependencies:
- dependency-name: github.com/bluenviron/gohlslib/v2
dependency-version: 2.4.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-23 23:27:27 +02:00
Alessandro Ros and GitHub
4c5f558006
hls, webrtc: prevent cross-origin unauthorized access ( #5975 )
...
when a user had previously inserted credentials into a MediaMTX
instance through a browser, and AllowOrigins was set to a wildcard,
third-party websites visited by the user were allowed to read streams
without restrictions. This is now prevented by returning "*" in
Access-Control-Allow-Origins when AllowOrigins is a wildcard, a
behavior that prevents browsers from sharing credentials with
third-party websites.
2026-07-23 23:06:15 +02:00
da0691edcc
build(deps): bump github.com/pion/rtp from 1.10.4 to 1.10.5 ( #5974 )
...
Bumps [github.com/pion/rtp](https://github.com/pion/rtp ) from 1.10.4 to 1.10.5.
- [Release notes](https://github.com/pion/rtp/releases )
- [Commits](https://github.com/pion/rtp/compare/v1.10.4...v1.10.5 )
---
updated-dependencies:
- dependency-name: github.com/pion/rtp
dependency-version: 1.10.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-23 23:05:16 +02:00
c23bdf2924
rtsp: use session ID in requests to the external authentication server ( #5977 )
...
Co-authored-by: Cycle1337 <Cycle1337@outlook.com >
2026-07-23 23:04:29 +02:00
Alessandro Ros and GitHub
5d0ba43667
moq: prevent excessive CPU consumption in reorderer ( #5976 )
...
do not iterate by maxGroupID (passed by user) but iterate by internal
pending packets (uncontrolled by user).
2026-07-23 23:01:05 +02:00
Alessandro Ros and GitHub
2183d37d32
add comment to prevent security scan false positives ( #5973 )
2026-07-23 22:59:23 +02:00
5994667eca
build(deps): bump code.cloudfoundry.org/bytefmt from 0.81.0 to 0.82.0 ( #5972 )
...
Bumps [code.cloudfoundry.org/bytefmt](https://github.com/cloudfoundry/bytefmt ) from 0.81.0 to 0.82.0.
- [Release notes](https://github.com/cloudfoundry/bytefmt/releases )
- [Commits](https://github.com/cloudfoundry/bytefmt/compare/v0.81.0...v0.82.0 )
---
updated-dependencies:
- dependency-name: code.cloudfoundry.org/bytefmt
dependency-version: 0.82.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-21 21:58:46 +02:00
0b33532432
build(deps): bump github.com/pion/interceptor from 0.1.45 to 0.1.46 ( #5971 )
...
Bumps [github.com/pion/interceptor](https://github.com/pion/interceptor ) from 0.1.45 to 0.1.46.
- [Release notes](https://github.com/pion/interceptor/releases )
- [Commits](https://github.com/pion/interceptor/compare/v0.1.45...v0.1.46 )
---
updated-dependencies:
- dependency-name: github.com/pion/interceptor
dependency-version: 0.1.46
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-21 21:58:27 +02:00
668b2ffcc9
build(deps): bump github.com/pion/webrtc/v4 from 4.2.16 to 4.2.17 ( #5970 )
...
Bumps [github.com/pion/webrtc/v4](https://github.com/pion/webrtc ) from 4.2.16 to 4.2.17.
- [Release notes](https://github.com/pion/webrtc/releases )
- [Commits](https://github.com/pion/webrtc/compare/v4.2.16...v4.2.17 )
---
updated-dependencies:
- dependency-name: github.com/pion/webrtc/v4
dependency-version: 4.2.17
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-21 00:49:05 +02:00
Alessandro Ros and GitHub
6da35dc389
moq: support draft-19 of the specification ( #5968 )
...
* support draft-19 of the specification
* support subscribing the same track multiple times
2026-07-21 00:24:03 +02:00
Alessandro Ros and GitHub
be610a6a04
docs: add fail2ban integration ( #5016 ) ( #5967 )
2026-07-19 17:03:57 +02:00
Alessandro Ros and GitHub
58c6099e50
ask for credentials only in case of protocols that support it ( #5966 )
...
When clients connect with some protocols (SRT, RTMP), they are unable
to provide credentials even if they are asked to. In this case, it's
useless to wait for credentials, and it's better to immediately log
authentication errors and apply the anti-brute force algorithm.
2026-07-19 16:52:14 +02:00
Alessandro Ros and GitHub
363ac206f7
moq: fix several panics and OOM errors ( #5964 )
...
Check for limits before allocating memory by using sizes passed from
the remote peer. Also add fuzzing to all MoQ primitives.
2026-07-19 12:13:45 +02:00
Alessandro Ros and GitHub
83cc54418c
moq: fix race condition during startup ( #5965 )
...
allocate the HTTP server only after the MoQ server has been initialized.
2026-07-19 11:29:04 +02:00
Alessandro Ros and GitHub
0e6426c648
adjust code to prevent security scan false positives ( #5963 )
...
... about string escaping.
2026-07-19 10:20:37 +02:00
Alessandro Ros and GitHub
e14ada6f4b
normalize authentication error messages ( #5421 ) ( #5959 )
...
Log authentication errors as soon as possible, use the "warn" level,
use the same message whatever the author or protocol.
2026-07-19 10:04:17 +02:00
d15c14ec6a
avoid potential timing attack when validating SHA256 credentials ( #5961 )
...
The == operator is vulnerable to timing attacks as it short-circuits on a mismatch. Use
ConstantTimeCompare to avoid this vector.
Co-authored-by: Tristan Matthews <tmatth@videolan.org >
2026-07-19 09:46:34 +02:00
Alessandro Ros and GitHub
0378876293
fix wrong PTS and wrong playback of alwaysAvailableFile ( #5436 ) ( #5960 )
...
PTS offset of samples was not properly considered, and sleep between
samples was PTS-based instead of being DTS-based.
2026-07-18 22:39:28 +02:00
Alessandro Ros and GitHub
fa7a89f840
rtsp: restrict UDP port range to 32768-60999 ( #5398 ) ( #5958 )
...
this is the default Linux ephemeral port range.
2026-07-18 20:59:33 +02:00
Alessandro Ros and GitHub
d6e765976c
srt: fix compatibility with StreamToStudio app ( #5414 ) ( #5928 )
2026-07-18 17:59:05 +02:00
Alessandro Ros and GitHub
96aeb1e603
rename runOnReady into runOnAvailable, runOnNotReady into runOnUnavailable ( #5957 )
2026-07-18 17:58:16 +02:00
Alessandro Ros and GitHub
8909e35a17
add runOnOnline / runOnOffline hooks ( #5399 ) ( #5956 )
...
These are triggered and a stream is online (i.e. not just provided by
an offline segment).
2026-07-18 17:41:38 +02:00
470136f1c7
build(deps): bump github.com/alecthomas/kong from 1.15.0 to 1.16.0 ( #5953 )
...
Bumps [github.com/alecthomas/kong](https://github.com/alecthomas/kong ) from 1.15.0 to 1.16.0.
- [Commits](https://github.com/alecthomas/kong/compare/v1.15.0...v1.16.0 )
---
updated-dependencies:
- dependency-name: github.com/alecthomas/kong
dependency-version: 1.16.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-18 17:22:39 +02:00
ecb5a670f5
build(deps): bump code.cloudfoundry.org/bytefmt from 0.80.0 to 0.81.0 ( #5955 )
...
Bumps [code.cloudfoundry.org/bytefmt](https://github.com/cloudfoundry/bytefmt ) from 0.80.0 to 0.81.0.
- [Release notes](https://github.com/cloudfoundry/bytefmt/releases )
- [Commits](https://github.com/cloudfoundry/bytefmt/compare/v0.80.0...v0.81.0 )
---
updated-dependencies:
- dependency-name: code.cloudfoundry.org/bytefmt
dependency-version: 0.81.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-18 17:22:29 +02:00
6e701b8f62
build(deps): bump github.com/matthewhartstonge/argon2 ( #5954 )
...
Bumps [github.com/matthewhartstonge/argon2](https://github.com/matthewhartstonge/argon2 ) from 1.5.5 to 1.5.6.
- [Release notes](https://github.com/matthewhartstonge/argon2/releases )
- [Changelog](https://github.com/matthewhartstonge/argon2/blob/main/CHANGELOG.md )
- [Commits](https://github.com/matthewhartstonge/argon2/compare/v1.5.5...v1.5.6 )
---
updated-dependencies:
- dependency-name: github.com/matthewhartstonge/argon2
dependency-version: 1.5.6
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-18 17:22:24 +02:00
