d15c14ec6a
avoid potential timing attack when validating SHA256 credentials ( #5961 )
...
The == operator is vulnerable to timing attacks as it short-circuits on a mismatch. Use
ConstantTimeCompare to avoid this vector.
Co-authored-by: Tristan Matthews <tmatth@videolan.org >
2026-07-19 09:46:34 +02:00
Alessandro Ros and GitHub
0378876293
fix wrong PTS and wrong playback of alwaysAvailableFile ( #5436 ) ( #5960 )
...
PTS offset of samples was not properly considered, and sleep between
samples was PTS-based instead of being DTS-based.
2026-07-18 22:39:28 +02:00
Alessandro Ros and GitHub
fa7a89f840
rtsp: restrict UDP port range to 32768-60999 ( #5398 ) ( #5958 )
...
this is the default Linux ephemeral port range.
2026-07-18 20:59:33 +02:00
Alessandro Ros and GitHub
d6e765976c
srt: fix compatibility with StreamToStudio app ( #5414 ) ( #5928 )
2026-07-18 17:59:05 +02:00
Alessandro Ros and GitHub
96aeb1e603
rename runOnReady into runOnAvailable, runOnNotReady into runOnUnavailable ( #5957 )
2026-07-18 17:58:16 +02:00
Alessandro Ros and GitHub
8909e35a17
add runOnOnline / runOnOffline hooks ( #5399 ) ( #5956 )
...
These are triggered and a stream is online (i.e. not just provided by
an offline segment).
2026-07-18 17:41:38 +02:00
470136f1c7
build(deps): bump github.com/alecthomas/kong from 1.15.0 to 1.16.0 ( #5953 )
...
Bumps [github.com/alecthomas/kong](https://github.com/alecthomas/kong ) from 1.15.0 to 1.16.0.
- [Commits](https://github.com/alecthomas/kong/compare/v1.15.0...v1.16.0 )
---
updated-dependencies:
- dependency-name: github.com/alecthomas/kong
dependency-version: 1.16.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-18 17:22:39 +02:00
ecb5a670f5
build(deps): bump code.cloudfoundry.org/bytefmt from 0.80.0 to 0.81.0 ( #5955 )
...
Bumps [code.cloudfoundry.org/bytefmt](https://github.com/cloudfoundry/bytefmt ) from 0.80.0 to 0.81.0.
- [Release notes](https://github.com/cloudfoundry/bytefmt/releases )
- [Commits](https://github.com/cloudfoundry/bytefmt/compare/v0.80.0...v0.81.0 )
---
updated-dependencies:
- dependency-name: code.cloudfoundry.org/bytefmt
dependency-version: 0.81.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-18 17:22:29 +02:00
6e701b8f62
build(deps): bump github.com/matthewhartstonge/argon2 ( #5954 )
...
Bumps [github.com/matthewhartstonge/argon2](https://github.com/matthewhartstonge/argon2 ) from 1.5.5 to 1.5.6.
- [Release notes](https://github.com/matthewhartstonge/argon2/releases )
- [Changelog](https://github.com/matthewhartstonge/argon2/blob/main/CHANGELOG.md )
- [Commits](https://github.com/matthewhartstonge/argon2/compare/v1.5.5...v1.5.6 )
---
updated-dependencies:
- dependency-name: github.com/matthewhartstonge/argon2
dependency-version: 1.5.6
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-18 17:22:24 +02:00
Alessandro Ros and GitHub
75bf1af38c
fix clearing lists with environment variables ( #5410 ) ( #5924 )
...
MTX_AUTHINTERNALUSERS_0_IPS, MTX_LOGDESTINATIONS and MTX_RTSPTRANSPORTS
can now be used to clear their corresponding list by setting them to an
empty value.
2026-07-18 10:56:46 +02:00
e3b6fff942
build(deps): bump golang.org/x/net from 0.56.0 to 0.57.0 ( #5944 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.56.0 to 0.57.0.
- [Commits](https://github.com/golang/net/compare/v0.56.0...v0.57.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-version: 0.57.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-17 11:07:36 +02:00
4ee9fb0b56
build(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 ( #5939 )
...
Bumps [golang.org/x/sync](https://github.com/golang/sync ) from 0.21.0 to 0.22.0.
- [Commits](https://github.com/golang/sync/compare/v0.21.0...v0.22.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/sync
dependency-version: 0.22.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-17 10:22:50 +02:00
a6a80e6ddd
build(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 ( #5945 )
...
Bumps [golang.org/x/crypto](https://github.com/golang/crypto ) from 0.53.0 to 0.54.0.
- [Commits](https://github.com/golang/crypto/compare/v0.53.0...v0.54.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/crypto
dependency-version: 0.54.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-17 10:22:44 +02:00
1bcfd6fbfa
build(deps): bump github.com/pires/go-proxyproto from 0.14.0 to 0.15.0 ( #5946 )
...
Bumps [github.com/pires/go-proxyproto](https://github.com/pires/go-proxyproto ) from 0.14.0 to 0.15.0.
- [Release notes](https://github.com/pires/go-proxyproto/releases )
- [Commits](https://github.com/pires/go-proxyproto/compare/v0.14.0...v0.15.0 )
---
updated-dependencies:
- dependency-name: github.com/pires/go-proxyproto
dependency-version: 0.15.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-17 10:22:29 +02:00
4097235616
build(deps): bump actions/setup-go from 6 to 7 ( #5952 )
...
Bumps [actions/setup-go](https://github.com/actions/setup-go ) from 6 to 7.
- [Release notes](https://github.com/actions/setup-go/releases )
- [Commits](https://github.com/actions/setup-go/compare/v6...v7 )
---
updated-dependencies:
- dependency-name: actions/setup-go
dependency-version: '7'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-17 10:05:25 +02:00
638df74975
build(deps): bump github.com/pion/ice/v4 ( #5947 )
...
Bumps [github.com/pion/ice/v4](https://github.com/pion/ice ) from 4.2.8-0.20260604162030-72f5001c4596 to 4.3.0.
- [Release notes](https://github.com/pion/ice/releases )
- [Commits](https://github.com/pion/ice/commits/v4.3.0 )
---
updated-dependencies:
- dependency-name: github.com/pion/ice/v4
dependency-version: 4.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-17 10:05:10 +02:00
97ae0c6f69
build(deps): bump golang.org/x/term from 0.44.0 to 0.45.0 ( #5937 )
...
Bumps [golang.org/x/term](https://github.com/golang/term ) from 0.44.0 to 0.45.0.
- [Commits](https://github.com/golang/term/compare/v0.44.0...v0.45.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/term
dependency-version: 0.45.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-10 19:00:57 +02:00
c3c80d1714
build(deps): bump code.cloudfoundry.org/bytefmt from 0.79.0 to 0.80.0 ( #5930 )
...
Bumps [code.cloudfoundry.org/bytefmt](https://github.com/cloudfoundry/bytefmt ) from 0.79.0 to 0.80.0.
- [Release notes](https://github.com/cloudfoundry/bytefmt/releases )
- [Commits](https://github.com/cloudfoundry/bytefmt/compare/v0.79.0...v0.80.0 )
---
updated-dependencies:
- dependency-name: code.cloudfoundry.org/bytefmt
dependency-version: 0.80.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-10 19:00:32 +02:00
f785a5de93
build(deps): bump github.com/quic-go/webtransport-go ( #5929 )
...
Bumps [github.com/quic-go/webtransport-go](https://github.com/quic-go/webtransport-go ) from 0.11.0 to 0.11.1.
- [Release notes](https://github.com/quic-go/webtransport-go/releases )
- [Commits](https://github.com/quic-go/webtransport-go/compare/v0.11.0...v0.11.1 )
---
updated-dependencies:
- dependency-name: github.com/quic-go/webtransport-go
dependency-version: 0.11.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-10 19:00:26 +02:00
Alessandro Ros and GitHub
e98b727277
fix error message ( #5922 )
...
'all' is a synonym for 'all_others'
2026-07-05 11:00:09 +02:00
Alessandro Ros and GitHub
99f804d733
api: generate most of OpenAPI automatically ( #5918 )
...
enums and structs are now generated automatically. This eliminates some
inconsistencies and makes development easier.
2026-07-04 17:45:43 +02:00
7b60b51881
build(deps): bump github.com/pion/rtp from 1.10.2 to 1.10.3 ( #5917 )
...
Bumps [github.com/pion/rtp](https://github.com/pion/rtp ) from 1.10.2 to 1.10.3.
- [Release notes](https://github.com/pion/rtp/releases )
- [Commits](https://github.com/pion/rtp/compare/v1.10.2...v1.10.3 )
---
updated-dependencies:
- dependency-name: github.com/pion/rtp
dependency-version: 1.10.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-04 17:36:39 +02:00
cacc09ee93
build(deps): bump github.com/pion/webrtc/v4 from 4.2.15 to 4.2.16 ( #5907 )
...
Bumps [github.com/pion/webrtc/v4](https://github.com/pion/webrtc ) from 4.2.15 to 4.2.16.
- [Release notes](https://github.com/pion/webrtc/releases )
- [Commits](https://github.com/pion/webrtc/compare/v4.2.15...v4.2.16 )
---
updated-dependencies:
- dependency-name: github.com/pion/webrtc/v4
dependency-version: 4.2.16
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-02 21:25:29 +02:00
cdb57eaf71
build(deps): bump code.cloudfoundry.org/bytefmt from 0.78.0 to 0.79.0 ( #5911 )
...
Bumps [code.cloudfoundry.org/bytefmt](https://github.com/cloudfoundry/bytefmt ) from 0.78.0 to 0.79.0.
- [Release notes](https://github.com/cloudfoundry/bytefmt/releases )
- [Commits](https://github.com/cloudfoundry/bytefmt/compare/v0.78.0...v0.79.0 )
---
updated-dependencies:
- dependency-name: code.cloudfoundry.org/bytefmt
dependency-version: 0.79.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-02 21:11:57 +02:00
0a41fb2a47
build(deps): bump github.com/pion/rtcp from 1.2.16 to 1.2.17 ( #5910 )
...
Bumps [github.com/pion/rtcp](https://github.com/pion/rtcp ) from 1.2.16 to 1.2.17.
- [Release notes](https://github.com/pion/rtcp/releases )
- [Commits](https://github.com/pion/rtcp/compare/v1.2.16...v1.2.17 )
---
updated-dependencies:
- dependency-name: github.com/pion/rtcp
dependency-version: 1.2.17
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-02 21:11:48 +02:00
2cb5330398
build(deps): bump github.com/pires/go-proxyproto from 0.12.0 to 0.14.0 ( #5914 )
...
Bumps [github.com/pires/go-proxyproto](https://github.com/pires/go-proxyproto ) from 0.12.0 to 0.14.0.
- [Release notes](https://github.com/pires/go-proxyproto/releases )
- [Commits](https://github.com/pires/go-proxyproto/compare/v0.12.0...v0.14.0 )
---
updated-dependencies:
- dependency-name: github.com/pires/go-proxyproto
dependency-version: 0.14.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-02 21:11:26 +02:00
Alessandro Ros and GitHub
f4decfd41b
docs: fix MoQ read URL ( #5904 )
2026-06-28 16:29:24 +02:00
Alessandro Ros and GitHub
ce00edb92f
docs: change suggested hls.js CDN ( #5903 )
2026-06-28 16:29:12 +02:00
Alessandro Ros and GitHub
7eb5d30075
prevent truncation of 64-bit values on 32-bit platforms ( #5902 )
2026-06-28 11:37:14 +02:00
ed5496f607
build(deps): bump github.com/bluenviron/gortsplib/v5 from 5.6.0 to 5.6.1 ( #5900 )
...
Bumps [github.com/bluenviron/gortsplib/v5](https://github.com/bluenviron/gortsplib ) from 5.6.0 to 5.6.1.
- [Commits](https://github.com/bluenviron/gortsplib/compare/v5.6.0...v5.6.1 )
---
updated-dependencies:
- dependency-name: github.com/bluenviron/gortsplib/v5
dependency-version: 5.6.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-28 11:32:02 +02:00
Alessandro Ros and GitHub
bf098c7eb5
support encoding secondary stream with H264 (2/2) ( #4485 ) ( #5898 )
2026-06-28 11:19:23 +02:00
Alessandro Ros and GitHub
1a7c10af1e
rpicamera: support encoding primary stream with MJPEG (2/2) ( #5892 )
2026-06-27 19:19:36 +02:00
Alessandro Ros and GitHub
07d0e232b2
rpi: add unified rpiCameraH264Profile, rpiCameraH264Level params ( #5894 )
...
These replace rpiCameraHardwareH264Profile, rpiCameraHardwareH264Level, rpiCameraSoftwareH264Profile, rpiCameraSoftwareH264Level.
2026-06-25 22:07:36 +02:00
Alessandro Ros and GitHub
b91affa054
rpi: exclude additional code from non-arm builds ( #5893 )
2026-06-25 19:37:28 +02:00
0a26f8e8a2
build(deps): bump code.cloudfoundry.org/bytefmt from 0.77.0 to 0.78.0 ( #5891 )
...
Bumps [code.cloudfoundry.org/bytefmt](https://github.com/cloudfoundry/bytefmt ) from 0.77.0 to 0.78.0.
- [Release notes](https://github.com/cloudfoundry/bytefmt/releases )
- [Commits](https://github.com/cloudfoundry/bytefmt/compare/v0.77.0...v0.78.0 )
---
updated-dependencies:
- dependency-name: code.cloudfoundry.org/bytefmt
dependency-version: 0.78.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-25 12:14:39 +02:00
596931d04d
build(deps): bump github.com/pion/sdp/v3 from 3.0.18 to 3.0.19 ( #5889 )
...
Bumps [github.com/pion/sdp/v3](https://github.com/pion/sdp ) from 3.0.18 to 3.0.19.
- [Release notes](https://github.com/pion/sdp/releases )
- [Commits](https://github.com/pion/sdp/compare/v3.0.18...v3.0.19 )
---
updated-dependencies:
- dependency-name: github.com/pion/sdp/v3
dependency-version: 3.0.19
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-25 12:14:17 +02:00
suMin and GitHub
8fcbd0a796
webrtc: skip unresolvable webrtcAdditionalHosts entries instead of aborting ( #5845 )
...
Since #4866 , hostnames in webrtcAdditionalHosts are resolved server-side via
net.LookupIP, and a resolution failure aborts the entire WHEP/WHIP session.
A single entry that can't be resolved on the server (e.g. air-gapped networks
without DNS, or a name that only resolves on the client) therefore takes down
all WebRTC playback, even when the other entries are valid.
Log a warning and skip the unresolvable entry instead of returning an error,
so the remaining valid candidates are still offered.
Signed-off-by: suMin <sumin77123@gmail.com >
2026-06-22 21:14:04 +02:00
d31c0b3900
rtsp: add rtspScale parameter to inject Scale header on PLAY ( #5800 )
...
Co-authored-by: aler9 <46489434+aler9@users.noreply.github.com >
2026-06-20 12:08:15 +02:00
Alessandro Ros and GitHub
90b8d5c943
improve HTTP server performance ( #5886 )
...
log incoming requests without cloning.
2026-06-20 12:03:35 +02:00
VJSai and GitHub
384cc66114
fix(recordstore): decode timezone offset minutes correctly ( #5884 )
...
timeLocationDecode multiplied the minutes field of a %z token by 3600
instead of 60, and did not apply the sign to the minutes term. As a
result, any non-whole-hour timezone offset (e.g. +0530, +0545, +0330,
-0330) was decoded incorrectly: +0530 produced 126000s instead of
19800s.
This broke the round-trip between Path.Encode and Path.Decode for
fractional-hour timezones. The encode side already used off/60/60 and
(off/60)%60 correctly, so this change makes the two consistent.
Add round-trip test cases with fractional-hour offsets (+0530, +0545,
-0330) to cover the previously untested code path.
2026-06-20 11:21:54 +02:00
Alessandro Ros and GitHub
28d648da37
move Content-Types to log in a map ( #5875 )
2026-06-20 09:35:55 +02:00
varun-nominal and GitHub
472e86d48c
redact sensitive headers in HTTP debug logs ( #5873 )
2026-06-20 09:19:01 +02:00
3d48165caf
build(deps): bump github.com/abema/go-mp4 from 1.6.0 to 1.7.1 ( #5880 )
...
Bumps [github.com/abema/go-mp4](https://github.com/abema/go-mp4 ) from 1.6.0 to 1.7.1.
- [Release notes](https://github.com/abema/go-mp4/releases )
- [Commits](https://github.com/abema/go-mp4/compare/v1.6.0...v1.7.1 )
---
updated-dependencies:
- dependency-name: github.com/abema/go-mp4
dependency-version: 1.7.1
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-20 09:17:31 +02:00
d4055760a5
build(deps): bump actions/checkout from 6 to 7 ( #5883 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 6 to 7.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/v6...v7 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '7'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-19 09:01:53 +02:00
c70bb83d08
build(deps): bump code.cloudfoundry.org/bytefmt from 0.76.0 to 0.77.0 ( #5879 )
...
Bumps [code.cloudfoundry.org/bytefmt](https://github.com/cloudfoundry/bytefmt ) from 0.76.0 to 0.77.0.
- [Release notes](https://github.com/cloudfoundry/bytefmt/releases )
- [Commits](https://github.com/cloudfoundry/bytefmt/compare/v0.76.0...v0.77.0 )
---
updated-dependencies:
- dependency-name: code.cloudfoundry.org/bytefmt
dependency-version: 0.77.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-19 09:01:45 +02:00
Alessandro Ros and GitHub
0996186cdf
restore quic-go/webtransport-go ( #5876 )
2026-06-16 15:09:00 +02:00
bluenviron-bot and GitHub
49aa78bc1d
bump Alpine to 3.24 ( #5853 )
2026-06-15 19:02:39 +02:00
bluenviron-bot and GitHub
a8f1f964a6
bump NodeJS to 24 ( #5872 )
2026-06-15 18:53:35 +02:00
Alessandro Ros and GitHub
874b47d0b0
remove redundant copy operation ( #5862 )
...
Since #5856 , OrigDesc of Streams is never changed, so there's no reason
to clone offlineDesc before putting it into OrigDesc.
2026-06-13 11:45:44 +02:00
2d08cfec7b
playback: fix panic when MP4 muxer flushes with no samples ( #5867 )
...
Co-authored-by: Arturo2511 <arturomozzon@gmail.com >
2026-06-13 11:22:53 +02:00
