New major features

Media-over-QUIC

• support forwarding streams (#6145)

API

• add /paths/static-sources/get endpoint (#6177) this allows to obtain details about static sources.
• add type-specific properties to forward destinations (#6178)
• add type-specific properties to static sources (#6184)

Fixes and improvements

General

• add --validate-conf flag (#5549) (#6140)
• use internal/core/VERSION as single source of truth to get version (#6119)
• httpp: propagate Flush() through the response writer wrappers (#6126) handlerLogger's responseRecorder and handlerWriteTimeout's writeTimeoutWriter both wrap http.ResponseWriter but implement neither http.Flusher nor Unwrap(). Any handler that flushes mid-response has that flush silently dropped, and its output only reaches the client when the handler returns. That defeats the stated purpose of writeTimeoutWriter, whose own comment says it exists so one can "write long responses, splitted in chunks, without causing timeouts": the deadline is reset per Write(), but nothing ever leaves the buffer until the end. Found while adding a server-sent-events endpoint: events written and flushed at t=0.4s onlyreached the client at t=2.2s, when the handler returned. Adding Flush() plus Unwrap() (so http.ResponseController can reach through) fixes both. The new test drives a real listener throughboth wrappers and reads while the handler is still blocked, so it fails on the current code by hitting the read deadline.
• support setting read buffer size on macOS (#6128) (#6131)
• drop support for Debian Bullseye (#6137) Bullseye reached EOL on 31st august 2026.
• emit "closed" log message when a server is closed (#6152)
• fix external command exit code reporting on non-Windows platforms (#6155)
• conf: support YAML version directives (#6157)
• metrics: add 'pos' property to forward_dests (#6183)
• metrics: deprecate the 'remoteAddr' property (#6174) Metrics are meant to provide aggregate statistics, not per-peer properties, that can be accessed through the API. The property is still served to keep backward compatibility.
• metrics: add 'type' to forward dests, deprecated 'protocol' (#6170) 'type' is aligned with the terminology used in the rest of the server.
• metrics, pprof: set default Allow-Origins to empty list (#6165) This prevents cross-site attacks to the API with the default configuration.
• always-available: support disabling recording when the source is offline (#6182) Add alwaysAvailableRecorded parameter that controls whether recording happens during offline periods for always-available paths. When set to false, recording only starts when a real source is connected. Co-authored-by: Abdulrahman Nashaat abdelrahmanndev@gmail.com
• allow sources and forward destinations with an empty password (#6193) Restore the behavior introduced in #395 and accidentally reverted by #5779, which factored the RTMP/HLS credential check into validateURL() and applied it to RTSP sources too. A username with an explicitly empty password is valid per RFC 3986 and is required by some legacy cameras whose password cannot be set. It is now accepted for every scheme handled by validateURL(), including forward destinations. A username without password or a password without username is still rejected,with a clearer error message pointing to the right syntax.
• fix wrong validation of HTTP allowed origins (#6198) An allowed origin with wildcards was making the server accept origins with a different scheme. This is fixed.
• fix HTTP allowed origins dots being interpreter as any character (#6199) A dot in an HTTP allowed origin now requires a corresponding dot in an incoming origin.
• serve Origin: Vary header with Access-Control-Allow-Origin (#6200) This prevents CDNs from caching the Access-Control-Allow-Origin header regardless of the origin.
• stop returning wildcard in Access-Control-Allow-Origin (#6201) if domain is allowed, return the domain, otherwise nothing.
• pmp4, fmp4: stop validating inbound H264/H265 SPS (bluenviron/mediacommon#366) Validating SPS adds latency and is generally redundant.
• pmp4, fmp4: do not accept empty H264/H265 parameters (bluenviron/mediacommon#367)
• h265: fix DTS extraction of streams with temporal sub-layers (bluenviron/mediacommon#368) The picture-type switches in the H265 DTS extractor accepted only TRAIL_N/TRAIL_R/RASL_N/RASL_R, so an access unit whose slices are TSA_N/TSA_R/STSA_N/STSA_R (Rec. ITU-T H.265, table 7-1, types 2-5) fell through to "access unit doesn't contain an IDR or non-IDR NALU" and the stream could never be recorded. TSA and STSA pictures use the same slice segment header syntax as TRAIL pictures, so handle them in the same way. Co-authored-by: aler9 46489434+aler9@users.noreply.github.com

API

• add 'type' to forward dests, deprecated 'protocol' (#6170) 'type' is aligned with the terminology used in the rest of the server.
• set default Allow-Origins to empty list (#6165) This prevents cross-site attacks to the API with the default configuration.
• deprecate 'conf' field of forward destinations (#6175) configuration is already available through the confName property of the path.
• refactor endpoint names (#6172) group endpoints by category (i.e. /hls/muxers, /hls/sessions), rename /forward/* into /forward-dests/*, use kebab-case. Backward compatibility is preserved by still serving old endpoints.

Media-Over-QUIC

• rename boolean header fields (#6148) rename Properties into HasProperties, FirstObject into IsFirstObject
• add shared Conn interface (#6149)
• close server streams when no longer in use (#6151) Explicitly close bidirectional and unidirectional streams that were previously keep open for the entire duration of the session. Note that closing a stream in QUIC/WebTransport means telling the peer that "we are not sending data anymore", while still allowing inbound data.
• add shared client (#6150)
• impose a 100MB limit on reordered bytes per session (#6194) previously, the limit was per-track. This decreases the probability of incurring in an out-of-memory situations.

RTSP

• redact credentials in logs (#6158)
• demux MPEG-TS from static source pull (#6181) When rtspDemuxMpegts is set, a pulled single MP2T track is demuxed into elementary streams, matching RTSP publishers, so HLS can attach. Co-authored-by: remreaygan remreaygan@gmail.com Co-authored-by: aler9 46489434+aler9@users.noreply.github.com
• support setting read buffer size on macOS (#6128) (bluenviron/gortsplib#1143)
• client: ignore invalid source IPs in SETUP responses (bluenviron/gortsplib#1070) (bluenviron/gortsplib#1145)
• fix decoding and encoding fragmented MPEG-4 audio packets (bluenviron/gortsplib#1150) The AU-size field was set incorrectly in subsequent fragments.
• stop validating inbound H264/H265 SPS (bluenviron/gortsplib#1151) Validating SPS adds latency and is generally redundant.
• Support SDES (RFC 4568) SRTP key exchange for RTSP/RTSPS sources (bluenviron/gortsplib#1148)
• rtpklv: do not reuse buffer of returned KLV units (bluenviron/gortsplib#1154) Decode() returns a slice that points to the decoder's internal buffer, and the next call to Decode() overwrites that same array in place. A caller that holds the previous unit - for instance while it is being recorded or forwarded on another goroutine - ends up reading the bytes of the next unit, or a torn mix of both when the sizes differ. Clear the buffer instead of truncating it, so each unit gets its own array. This is what the h264, h265, av1, vp8 andmpeg1video decoders already do, at the cost of one allocation per unit.
• auth: support qop=auth in digest client (bluenviron/gortsplib#1074) (bluenviron/gortsplib#1155) The client never looked at the qop directive of a digest challenge and always computed the legacy RFC 2069 response, so servers that require qop="auth" - as most RFC 7616 implementations do - rejected every request with a 401. Parse qop in WWW-Authenticate, and when the server offers "auth", send qop, cnonce and nc and compute the response as H(HA1:nonce:nc:cnonce:qop:HA2) (RFC 7616, section 3.4.1). The nonce count increases at every request, as required. Challenges without qop keep the previous behavior. auth-int is not implemented. Also copy the opaque value of the challenge into the Authorization header, which RFC 7616 section 3.3 says the client should return unchanged. Co-authored-by: aler9 46489434+aler9@users.noreply.github.com
• client: remove Content-Length from HTTP tunnel GET request (bluenviron/gortsplib#1158)
• rtpav1: do not set Y/Z bits when no OBU bytes were written (bluenviron/gortsplib#1153) When the remaining space in a packet is too small to hold any byte of thenext OBU, the encoder writes nothing but still marks the current packet with Y=1 and the following one with Z=1. The AV1 RTP payload format (v1.0, section 4.4) requires both bits to be 0 unless an OBU element is actually fragmented across the two packets. Receivers that honor the bits therefore join two complete OBUs into one: this happens with the decoder in this package, with pion/rtp and with ffmpeg. It is reachable whenever an earlier OBU leaves exactly 0 free bytes (or 0-2 when the next OBU is size-prefixed), so it affects streams that are repacketized, e.g. non-RTSP sources read over RTSP in mediamtx. Co-authored-by: aler9 46489434+aler9@users.noreply.github.com

RTMP

• reader: support empty H264 configs (#6132) (bluenviron/gortmplib#118)
• writer: fix crash in case of invalid H264/H265 parameters (bluenviron/gortmplib#122)
• reader: do not accept empty H264/H265 parameters (bluenviron/gortmplib#121)
• server: always strip auth parameters from URL (bluenviron/gortmplib#76) (bluenviron/gortmplib#123)

HLS

• validate hlsSegmentCount according to the HLS variant (#6154)

WebRTC

• Register RTX for incoming video tracks (#6125)
• fix deprecated webrtcICEServers parser for IPv6 hosts; (#5932)

RPI Camera

• drop support for Debian Bullseye (bluenviron/mediamtx-rpicamera#119) Bullseye reached EOL on 31st august 2026.

Dependencies

• code.cloudfoundry.org/bytefmt updated from v0.85.0 to v0.88.0
• github.com/bluenviron/gohlslib/v2 updated from v2.4.3 to v2.4.4
• github.com/bluenviron/gortmplib updated from v1.0.1 to v1.0.2
• github.com/bluenviron/gortsplib/v5 updated from v5.6.4 to v5.6.5
• github.com/bluenviron/mediacommon/v2 updated from v2.9.3 to v2.9.4
• github.com/matthewhartstonge/argon2 updated from v1.5.6 to v1.5.7
• github.com/pion/webrtc/v4 updated from v4.2.18 to v4.2.19
• github.com/quic-go/quic-go updated from v0.61.0 to v0.62.0
• github.com/quic-go/webtransport-go updated from v0.12.0 to v0.13.0
• github.com/stretchr/testify updated from v1.12.0 to v1.12.1
• github.com/dunglas/httpsfv updated from v1.1.0 to v1.1.1
• github.com/pion/stun/v3 updated from v3.1.6 to v3.1.7
• github.com/pion/turn/v5 updated from v5.0.12 to v5.0.13
• gopkg.in/yaml.v3 removed
• go.yaml.in/yaml/v3 v3.0.5 added
• github.com/bluenviron/mediamtx-rpicamera updated from v2.8.0 to v2.9.0
• hls.js updated from v1.7.0 to v1.7.2

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

Fixes and improvements

General

• prevent spamming of 'stream is closed' error during shutdown (#6062)
• impose a minimum value to clock rate of always-available tracks (#6086) Clock rates below 10 caused the emission of empty samples. Fix the issue by imposing a minimum value of 8khz, that rises to 22khz in case of AAC.
• fix race condition during sub-stream creation (#6075) (#6095) When a stream with always-available turned on switches from offline to online, or from a publisher to another, the reader mutex was not acquired during writing of codec parameters. This is now fixed.
• restore ability to run the server in a read-only file system (#6098) This was temporarily lost after the introduction of the native MoQ QUIC listener.
• fix deadlock when changing configuration through file and API (#6077) (#6101) When changing configuration in parallel by editing the configuration file and calling the API, the server could get into a deadlock that prevented any further action. This is fixed.
• change default value of authHTTPExclude (#6103) by default, do not exclude any action from HTTP authentication. Old value triggered several security warnings.
• add destFingerprint parameter (#6106) this allows to validate self-signed certificates of forward destinations.
• pmp4: fix panic in case of bad input (bluenviron/mediacommon#354) the stsc box was not checked properly. This is now fixed.
• pmp4: fix panic in case of bad input (bluenviron/mediacommon#355) The parser was not checking that the MP4 was properly sending addresses of samples, resulting in samples with invalid addresses. This is now fixed.
• pmp4, fmp4: do not emit empty payloads (bluenviron/mediacommon#353)

API

• redact password in responses (#6110) passwords are not exposed anymore through the API. They can only be set, not read.

Media-Over-QUIC

• support pulling streams from other servers (#6111)
• do not accept empty payloads (#6085)
• limit maximum amount of published tracks (#6087) this prevents clients from consuming an excessive amount of memory.
• make /moq URL suffix optional (#6107) In order to establish a MoQ session with WebTransport, a /moq suffix was required until now. This is now optional in order to allow connecting to the server with the standard MoQ URL format.
• impose maximum size on pending reordered bytes (#6112) Decrease the maximum memory that clients can take by imposing a maximum size of 100MB on the pending reordered bytes.

RTSP

• accept relative digest URI (bluenviron/gortsplib#1118) RFC 2617 section 3.2.2 allows the digest URI to be either an absolute URI or a relative path. Some clients use the latter, which was rejected with "wrong URL" since urlMatches only accepted an exact match against the absolute request URL.
• send initial RTCP sender report without waiting for a period (bluenviron/gortsplib#1052) (bluenviron/gortsplib#1111) (bluenviron/gortsplib#1120) Reports were emitted only on the ticker, so the first one arrived Period after Initialize (10s by default) and later still when no RTP packet had been sent by that first tick, since report() returns nil until then and the next opportunity is another Period away.
• ensure that decoders can produce only output that does not crash encoders (bluenviron/gortsplib#1123)
• discard empty Opus and G722 RTP packets (bluenviron/gortsplib#1131)
• improve error message when setting read buffer fails (bluenviron/gortsplib#1133)
• server: fix race condition when recording (bluenviron/gortsplib#1134) state was not protected.

RTMP

• inform about authentication failures (#5657) (#6072) Reply with NetStream.Play.Failed or NetStream.Publish.Unauthorized when a client is not authorized to play or publish. This makes clients like OBS to stop recreating the connection in case of authentication failures.

• reader: do not emit empty frames (bluenviron/gortmplib#106)

• parse video PTS delta as signed (bluenviron/gortmplib#88)
  HLS

• prefer hls.js on iOS too (#6090) In the embedded HLS reader, use hls.js on iOS, that was previously disabled due to compatibility issues that should have been solved.

• unlock the session-in-query+iOS combination (#6088) this was previously blocked because the session in query was meant to be dynamic, therefore incompatible with static playlists required by iOS. It is not anymore, so we can support that.

• stop using cookies with plain HTTP (#6089) in case of plain HTTP, fall back to query parameters, which are safer than HTTP cookies because they are not shared between different pages/domains, although they are visible in the URL.

WebRTC

• support forwarding streams (#6099)
• fix warning when IPv6 is disabled (#5733) (#6048)
• improve performance by ignoring mDNS candidates (#4963) (#6064) mDNS candidates sometimes require a large CPU portion, they are not involved in any connectivity method mentioned in the documentation, they work in local networks only.

SRT

• apply UDP read buffer size from configuration (#6069) Use upstream datarhei/gosrt's ListenerControl config field (datarhei/gosrt#144) to set SO_RCVBUF on the SRT listener's UDP socket.

RPI Camera

• fix crash when secondary stream is enabled (#6060) (#6061)
• prevent invalid MJPEG sizes (#6080) width and height of MJPEG frames must be multiple of 8 and less than 2048, otherwise they cannot be routed with RTP/RTSP.

Dependencies

• code.cloudfoundry.org/bytefmt updated from v0.83.0 to v0.85.0
• github.com/alecthomas/kong updated from v1.16.0 to v1.16.1
• github.com/asticode/go-astits updated from v1.15.0 to v1.16.0
• github.com/bluenviron/gohlslib/v2 updated from v2.4.2 to v2.4.3
• github.com/bluenviron/gortmplib updated from v1.0.0 to v1.0.1
• github.com/bluenviron/gortsplib/v5 updated from v5.6.3 to v5.6.4
• github.com/bluenviron/mediacommon/v2 updated from v2.9.2 to v2.9.3
• github.com/datarhei/gosrt updated from v0.11.0 to v0.11.1-0.20260812091715-a77b40bb4b76
• github.com/pion/ice/v4 updated from v4.4.0 to v4.4.1
• github.com/pion/transport/v4 updated from v4.0.2 to v4.1.0
• github.com/stretchr/testify updated from v1.11.1 to v1.12.0
• golang.org/x/crypto updated from v0.54.0 to v0.55.0
• golang.org/x/net updated from v0.57.0 to v0.58.0
• github.com/davecgh/go-spew removed
• github.com/pion/srtp/v3 updated from v3.0.12 to v3.0.13
• github.com/pmezard/go-difflib removed
• golang.org/x/text updated from v0.40.0 to v0.41.0
• hls.js updated from v1.6.16 to v1.7.0

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

New major features

General

• support forwarding streams natively (#5558) It is now possible to define forward destinations for each path configuration. For each destination, the server will create a client that will forward the stream to the intended destination. Supported protocols are RTSP, RTMP, SRT. API and metrics have also been improved to allow monitoring the new forwarding system. Documentation: https://mediamtx.org/docs/features/forward

Media-Over-QUIC

• support publishing and reading through native QUIC (#6039)
• support draft-17 (#6040)
• support draft-16 (#6045)

Fixes and improvements

General

• docs: add missing MoQ ports (#5983)
• Add OpenAPI definition of the Playback server (#5546)
• fix support for regexp groups greater than 10 (#6033)

Media-Over-QUIC

• increase max namespace field count to 32 (#6043)
• link primitives to draft-17 sections (#6044)

RTSP

• fix inability to read some AV1 streams with RTSP (#6001) (#6006) Since v1.16.0, temporal unit delimiters were not stripped from AV1 streams anymore. This has been restored, healing AV1 streams read with RTSP.
• log write errors (#6023)
• make multicast errors on single interfaces non-fatal (bluenviron/gortsplib#1115) (#5574) When writing multicast packets to several interfaces at one, a write error to a single interface was fatal and prevented writing to the other ones. Fix this.

RTMP

• server: fix parsing URL from multitrack OBS (#6007) (bluenviron/gortmplib#93)
• client: change mapping between URL and tcURL, app, streamKey (bluenviron/gortmplib#94) (#4676) URLs passed to clients are now mapped into RTMP-native fields (tcURL, app, streamKey) in this way: tcURL contains URL without credentials and without fragment, app contains path and query of tcURL, streamKey contains the fragment.
• client: fix compatibility with YouTube (#5558) (bluenviron/gortmplib#95)

HLS

• muxer: fix goroutine leak during part rotation (bluenviron/gohlslib#372) (bluenviron/gohlslib#373)
• muxer: remove lower limit on AAC access unit count in MPEG-TS segments (bluenviron/gohlslib#329) (bluenviron/gohlslib#377)
• muxer: recompute PTS of MPEG-TS AAC (bluenviron/gohlslib#379) iOS requires a precise timestamp that is often not available in AAC streams. Recompute timestamp from scratch.

WebRTC

• sort tracks in a deterministic way (#5988) (#5989) When ingesting tracks with WebRTC, track order was randomized, preventing multi-track always-available streams from working reliably, since they require tracks to be ordered in a precise way. WebRTC tracks are not ordered by MID, RID, trackID and streamID respectively.
• fix packet corruption when reading G722 (#6000)
• reset recomputed audio PTS if it drifts too much (#6021)
• fix "packet lost" error when routing streams from WebRTC (#6034) Chrome sometimes sends empty packets, that are discarded by the server, but the sequence number of following packets is not recomputed, leading downstream packet loss detectors to emit errors. This is fixed.

SRT

• improve log clarity (#5990) use message 'passphrase not provided by client' when clients do not provide passphrases.
• show stream ID in logs (#6018)
• close sources immediately when path is closed (#6038)

Dependencies

• code.cloudfoundry.org/bytefmt updated from v0.82.0 to v0.83.0
• github.com/MicahParks/jwkset updated from v0.11.0 to v0.11.3
• github.com/MicahParks/keyfunc/v3 updated from v3.8.0 to v3.8.1
• github.com/bluenviron/gohlslib/v2 updated from v2.4.1 to v2.4.2
• github.com/bluenviron/gortmplib updated from v0.4.1 to v1.0.0
• github.com/bluenviron/gortsplib/v5 updated from v5.6.2 to v5.6.3
• github.com/go-git/go-billy/v5 updated from v5.9.0 to v5.9.1
• github.com/go-git/go-git/v5 updated from v5.19.1 to v5.19.2
• github.com/pion/ice/v4 updated from v4.3.0 to v4.4.0
• github.com/pion/interceptor updated from v0.1.46 to v0.1.47
• github.com/pion/webrtc/v4 updated from v4.2.17 to v4.2.18
• github.com/quic-go/quic-go updated from v0.60.0 to v0.61.0
• github.com/quic-go/webtransport-go updated from v0.11.1 to v0.12.0
• github.com/pion/sctp updated from v1.11.0 to v1.11.1
• golang.org/x/time updated from v0.14.0 to v0.15.0

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

Fixes and improvements

General

• fix error message (#5922) 'all' is a synonym for 'all_others'
• fix clearing lists with environment variables (#5410) (#5924) MTX_AUTHINTERNALUSERS_0_IPS, MTX_LOGDESTINATIONS and MTX_RTSPTRANSPORTS can now be used to clear their corresponding list by setting them to an empty value.
• add runOnOnline / runOnOffline hooks (#5399) (#5956) These are triggered and a stream is online (i.e. not just provided by an offline segment).
• rename runOnReady into runOnAvailable, runOnNotReady into runOnUnavailable (#5957)
• fix wrong PTS and wrong playback of alwaysAvailableFile (#5436) (#5960) PTS offset of samples was not properly considered, and sleep between samples was PTS-based instead of being DTS-based.
• avoid potential timing attack when validating SHA256 credentials (#5961) The == operator is vulnerable to timing attacks as it short-circuits on a mismatch. Use ConstantTimeCompare to avoid this vector. Co-authored-by: Tristan Matthews tmatth@videolan.org
• normalize authentication error messages (#5421) (#5959) Log authentication errors as soon as possible, use the "warn" level, use the same message whatever the author or protocol.
• adjust code to prevent security scan false positives (#5963) about string escaping.
• ask for credentials only in case of protocols that support it (#5966) When clients connect with some protocols (SRT, RTMP), they are unable to provide credentials even if they are asked to. In this case, it's useless to wait for credentials, and it's better to immediately log authentication errors and apply the anti-brute force algorithm.
• docs: add fail2ban integration (#5016) (#5967)
• add comment to prevent security scan false positives (#5973)
• pmp4: fix support for ctts version 0 (#5436) (bluenviron/mediacommon#343)

API

• generate most of OpenAPI automatically (#5918) enums and structs are now generated automatically. This eliminates some inconsistencies and makes development easier.

Media-Over-QUIC

• fix race condition during startup (#5965) allocate the HTTP server only after the MoQ server has been initialized.
• fix several panics and OOM errors (#5964) Check for limits before allocating memory by using sizes passed from the remote peer. Also add fuzzing to all MoQ primitives.
• support draft-19 of the specification (#5968) * support draft-19 of the specification * support subscribing the same track multiple times.
• prevent excessive CPU consumption in reorderer (#5976) do not iterate by maxGroupID (passed by user) but iterate by internal pending packets (uncontrolled by user).

WebRTC

• prevent cross-origin unauthorized access (#5975) when a user had previously inserted credentials into a MediaMTX instance through a browser, and AllowOrigins was set to a wildcard, third-party websites visited by the user were allowed to read streams without restrictions. This is now prevented by returning "*" in Access-Control-Allow-Origins when AllowOrigins is a wildcard, a behavior that prevents browsers from sharing credentials with third-party websites.

RTSP

• restrict UDP port range to 32768-60999 (#5398) (#5958) this is the default Linux ephemeral port range.
• use session ID in requests to the external authentication server (#5977) Co-authored-by: Cycle1337 Cycle1337@outlook.com
• prevent truncation of 64-bit values on 32-bit platforms (bluenviron/gortsplib#1094)
• fix parsing RTCP of some Hanwha cameras (#5355) (bluenviron/gortsplib#1099)
• use original pion/sdp.SessionDescription instead of a custom one; move unmarshaler in sdpunmarshaler (bluenviron/gortsplib#1100)
• client: fix UDP ports not being released after close (bluenviron/gortsplib#1105)
• client: return an error when UDP port range is exhausted (bluenviron/gortsplib#1104)

HLS

• prevent cross-origin unauthorized access (#5975) when a user had previously inserted credentials into a MediaMTX instance through a browser, and AllowOrigins was set to a wildcard, third-party websites visited by the user were allowed to read streams without restrictions. This is now prevented by returning "*" in Access-Control-Allow-Origins when AllowOrigins is a wildcard, a behavior that prevents browsers from sharing credentials with third-party websites.

SRT

• fix compatibility with StreamToStudio app (#5414) (#5928)

Dependencies

• code.cloudfoundry.org/bytefmt updated from v0.78.0 to v0.82.0
• github.com/alecthomas/kong updated from v1.15.0 to v1.16.0
• github.com/bluenviron/gohlslib/v2 updated from v2.4.0 to v2.4.1
• github.com/bluenviron/gortmplib updated from v0.4.0 to v0.4.1
• github.com/bluenviron/gortsplib/v5 updated from v5.6.1 to v5.6.2
• github.com/bluenviron/mediacommon/v2 updated from v2.9.1 to v2.9.2
• github.com/matthewhartstonge/argon2 updated from v1.5.5 to v1.5.6
• github.com/pion/ice/v4 updated from v4.2.8-0.20260604162030-72f5001c4596 to v4.3.0
• github.com/pion/interceptor updated from v0.1.45 to v0.1.46
• github.com/pion/rtcp updated from v1.2.16 to v1.2.17
• github.com/pion/rtp updated from v1.10.2 to v1.10.5
• github.com/pion/webrtc/v4 updated from v4.2.15 to v4.2.17
• github.com/pires/go-proxyproto updated from v0.12.0 to v0.15.0
• github.com/quic-go/webtransport-go updated from v0.11.0 to v0.11.1
• golang.org/x/crypto updated from v0.53.0 to v0.54.0
• golang.org/x/net updated from v0.56.0 to v0.57.0
• golang.org/x/sync updated from v0.21.0 to v0.22.0
• golang.org/x/sys updated from v0.46.0 to v0.47.0
• golang.org/x/term updated from v0.44.0 to v0.45.0
• github.com/pion/datachannel updated from v1.6.0 to v1.6.2
• github.com/pion/dtls/v3 updated from v3.1.4 to v3.1.5
• github.com/pion/sctp updated from v1.10.0 to v1.11.0
• github.com/pion/stun/v3 updated from v3.1.5 to v3.1.6
• github.com/pion/turn/v5 updated from v5.0.9 to v5.0.12
• golang.org/x/text updated from v0.38.0 to v0.40.0

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

Fixes and improvements

General

• playback: fix panic when MP4 muxer flushes with no samples (#5867)
• redact sensitive headers in HTTP debug logs (#5873)
• fix(recordstore): decode timezone offset minutes correctly (#5884)
• improve HTTP server performance (#5886) log incoming requests without cloning.
• prevent truncation of 64-bit values on 32-bit platforms (#5902)

RTSP

• add rtspScale parameter to inject Scale header on PLAY (#5800)
• client: switch automatically to TCP in case of H264 packetization-mode=0 (bluenviron/gortsplib#1086)
• support VP8 streams with multiple partitions (https://github.com/bluenviron/mediamtx/issues/5426) (bluenviron/gortsplib#1090)
• allow FU-A and STAP-A packets with H264 packetization-mode 0 (#5887) (bluenviron/gortsplib#1092)

WebRTC

• skip unresolvable webrtcAdditionalHosts entries instead of aborting (#5845)

RPI Camera

• support encoding primary stream with MJPEG (2/2) (#5892)
• support encoding secondary stream with H264 (2/2) (#4485) (#5898)
• add unified rpiCameraH264Profile, rpiCameraH264Level params (#5894) These replace rpiCameraHardwareH264Profile, rpiCameraHardwareH264Level, rpiCameraSoftwareH264Profile, rpiCameraSoftwareH264Level.
• fix race condition that prevents decoding the stream (bluenviron/mediamtx-rpicamera#109) (#5861) When a player immediately connects to a newly-created stream, SPS/PPS might not be available, neither in the SDP and neither in-band. Prevent the issue by always sending SPS/PPS in-band.
• improve performance by computing frame size once (bluenviron/mediamtx-rpicamera#111)
• fix wrong timestamp being passed to openh264 (bluenviron/mediamtx-rpicamera#114)

Dependencies

• code.cloudfoundry.org/bytefmt updated from v0.76.0 to v0.78.0
• github.com/abema/go-mp4 updated from v1.6.0 to v1.7.1
• github.com/bluenviron/gortsplib/v5 updated from v5.6.0 to v5.6.1
• github.com/bluenviron/mediacommon/v2 updated from v2.9.0 to v2.9.1
• github.com/matthewhartstonge/argon2 updated from v1.5.4 to v1.5.5
• github.com/pion/sdp/v3 updated from v3.0.18 to v3.0.19
• github.com/quic-go/webtransport-go updated from v0.10.0 to v0.11.0
• github.com/pion/srtp/v3 updated from v3.0.11 to v3.0.12
• github.com/bluenviron/mediamtx-rpicamera updated from v2.6.0 to v2.8.0

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

Fixes and improvements

General

• support using regexp groups in every part of a source URL (#5766) (#5779)
• improve anti-brute force mechanism (#5835) delay authentication failure responses by a random amount of time, use the same anti-brute force mechanism with all users.
• limit size of HTTP requests shown in debug logs (#5858)
• print body of selected HTTP responses when log level is debug (#5859)

Media-over-QUIC

• fix race condition when closing server (#5836) some sessions were hanging if they were concurrently being closed by the remote peer.
• rename moqHTTPS2Address into moqHTTP2Address, moqHTTPS3Address into moqHTTP3Address (#5841)

RTSP

• support PROXY protocol (#5754) Support PROXY protocol v1/v2 on RTMP, RTMPS, RTSP, and RTSPS TCP listeners so real client IPs are visible when running behind L4 proxies (nginx stream, HAProxy, AWS NLB).
• restore support for H264 packetization-mode 0 (#5846) (#5857) H264 streams with packetization-mode=0 cannot be routed with UDP since packets are too big. Inbound streams with packetization-mode=0 are blocked by the server since v1.19.0 but this caused compatibility issues with some cameras. The server is now able to receive such streams with TCP, and automatically remuxes them in streams with packetization-mode=1, which can be routed freely.

RTMP

• support PROXY protocol (#5754) Support PROXY protocol v1/v2 on RTMP, RTMPS, RTSP, and RTSPS TCP listeners so real client IPs are visible when running behind L4 proxies (nginx stream, HAProxy, AWS NLB).

Dependencies

• code.cloudfoundry.org/bytefmt updated from v0.74.0 to v0.76.0
• github.com/bluenviron/gortsplib/v5 updated from v5.5.4 to v5.6.0
• github.com/pion/ice/v4 updated from v4.2.7 to v4.2.8-0.20260604162030-72f5001c4596
• github.com/pion/webrtc/v4 updated from v4.2.14 to v4.2.15
• github.com/quic-go/quic-go updated from v0.59.0 to v0.60.0
• golang.org/x/crypto updated from v0.52.0 to v0.53.0
• golang.org/x/net updated from v0.55.0 to v0.56.0
• golang.org/x/sync updated from v0.20.0 to v0.21.0
• golang.org/x/sys updated from v0.45.0 to v0.46.0
• golang.org/x/term updated from v0.43.0 to v0.44.0
• github.com/pion/dtls/v3 updated from v3.1.3 to v3.1.4
• github.com/pion/stun/v3 updated from v3.1.4 to v3.1.5
• github.com/pion/turn/v5 updated from v5.0.7 to v5.0.9
• golang.org/x/text updated from v0.37.0 to v0.38.0
• github.com/pires/go-proxyproto v0.12.0 added

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

New major features

Media-over-QUIC

• support reading and publishing with Media-over-QUIC (#5815) Media-over-QUIC is a streaming protocol built upon cutting edge protocols (QUIC, HTTP3) and browser APIs (WebTransport, WebCodecs). It's slightly faster than WebRTC, has an advanced data recovery mechanism, it supports additional codecs (FLAC) and is less complicated to route. Check the documentation for instructions and details.

RTMP

• support reading and writing FLAC (#5778) (#5789)

HLS

• support reading and publishing FLAC (#5778) (#5791)

Fixes and improvements

General

• Add user agent field to RTMP, RTSP, WebRTC, and HLS (#5753)
• add --check-version command line flag (#5786) this allows to check whether a new version is available without upgrading.
• use file name suffix for OS-specific code wherever possible (#5787)
• fix two hot reloading cases (#5817) * reload SRT server when metrics server is reloaded * reload API server when RTMPS server is reloaded

RTSP

• client: trigger TCP timeout only if nothing is received (bluenviron/gortsplib#1002) (bluenviron/gortsplib#968) (bluenviron/gortsplib#1067) Previously, a data packet was required, now a keepalive response from the server is enough.
• sdp: support non-standard 'meta' media type (bluenviron/gortsplib#1068)
• forbid H264 packetization mode zero (bluenviron/gortsplib#1072) Packetization mode zero requires allowing inefficient and brittle fragmented UDP packets, which we are not.

RTMP

• client: add FLAC fourCC (bluenviron/gortmplib#73)
• do not exit in case of undocumented Flash control messages (#5512) (bluenviron/gortmplib#75)

HLS

• remove redundant JavaScript argument (#5806)
• muxer: fix race condition when generating playlist (bluenviron/gohlslib#359) (bluenviron/gohlslib#360) Max age of playlist depends on segments, so it needs to be covered by the segment mutex.
• muxer: use coherent version in all playlists (#5781) (bluenviron/gohlslib#363)

WebRTC

• make JavaScript internal variables private (#5804)
• fix connectivity after network changes (#5097) (#5818)

RPI Camera

• use timestamp of frame in text overlay (#2733) (bluenviron/mediamtx-rpicamera#103)

Dependencies

• code.cloudfoundry.org/bytefmt updated from v0.72.0 to v0.74.0
• github.com/abema/go-mp4 updated from v1.5.0 to v1.6.0
• github.com/bluenviron/gohlslib/v2 updated from v2.3.2 to v2.4.0
• github.com/bluenviron/gortmplib updated from v0.3.2 to v0.4.0
• github.com/bluenviron/gortsplib/v5 updated from v5.5.3 to v5.5.4
• github.com/bluenviron/mediacommon/v2 updated from v2.8.3 to v2.9.0
• github.com/go-git/go-git/v5 updated from v5.19.0 to v5.19.1
• github.com/matthewhartstonge/argon2 updated from v1.5.3 to v1.5.4
• github.com/pion/ice/v4 updated from v4.2.5 to v4.2.7
• github.com/pion/transport/v4 updated from v4.0.1 to v4.0.2
• github.com/pion/webrtc/v4 updated from v4.2.12 to v4.2.14
• golang.org/x/crypto updated from v0.51.0 to v0.52.0
• golang.org/x/net updated from v0.54.0 to v0.55.0
• golang.org/x/sys updated from v0.44.0 to v0.45.0
• github.com/pion/dtls/v3 updated from v3.1.2 to v3.1.3
• github.com/pion/sctp updated from v1.9.5 to v1.10.0
• github.com/pion/srtp/v3 updated from v3.0.10 to v3.0.11
• github.com/pion/stun/v3 updated from v3.1.2 to v3.1.4
• github.com/pion/turn/v5 updated from v5.0.3 to v5.0.7
• github.com/quic-go/webtransport-go v0.10.0 added
• golang.org/x/sync v0.20.0 added
• github.com/dunglas/httpsfv v1.1.0 added
• github.com/bluenviron/mediamtx-rpicamera updated from v2.5.7 to v2.6.0

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

Fixes and improvements

RTSP

• fix compatibility with Verint.Vms.MediaGateway (#5292) (bluenviron/gortsplib#1061)
• fix crash when stream is closing (bluenviron/gortsplib#1062) when ServerStream.Close() is called, stream readers might have their setuppedTransport set to nil, causing the server to crash. Prevent this.
• fix race condition when tearing down connection (bluenviron/gortsplib#1063) ServerConn.session was not properly protected.
• fix leak in case of failure during multicast initialization (bluenviron/gortsplib#1064)

RTMP

• prevent nil / unconfigured tracks from appearing (bluenviron/gortmplib#66) (#5724) (#5729)

HLS

• fix error 500 caused by in-stream params (bluenviron/gohlslib#355) (#5728) (#5745) PR bluenviron/gohlslib#344 caused a regression. Many codecs (AV1, H264, H265, VP9) use in-stream parameters, that were not taken into consideration anymore when generating init.mp4 and playlists. This has been solved.

WebRTC

• fix checking POST responses (#5758)
• support interacting with servers with no trickle ICE (#5273) (#5757)
• support WHIP ICE restarts (https://github.com/bluenviron/mediamtx/issues/5183) (#5770)

RPI Camera

• support changing text overlay dynamically (#5270) (#5748)

Dependencies

• code.cloudfoundry.org/bytefmt updated from v0.70.0 to v0.72.0
• github.com/Masterminds/semver/v3 updated from v3.4.0 to v3.5.0
• github.com/bluenviron/gohlslib/v2 updated from v2.3.1 to v2.3.2
• github.com/bluenviron/gortmplib updated from v0.3.1 to v0.3.2
• github.com/bluenviron/gortsplib/v5 updated from v5.5.2 to v5.5.3
• github.com/datarhei/gosrt updated from v0.10.0 to v0.11.0
• github.com/fsnotify/fsnotify updated from v1.10.0 to v1.10.1
• github.com/go-git/go-billy/v5 updated from v5.8.0 to v5.9.0
• github.com/go-git/go-git/v5 updated from v5.18.0 to v5.19.0
• github.com/gookit/color updated from v1.6.0 to v1.6.1
• github.com/matthewhartstonge/argon2 updated from v1.5.2 to v1.5.3
• github.com/pion/rtp updated from v1.10.1 to v1.10.2
• golang.org/x/crypto updated from v0.50.0 to v0.51.0
• golang.org/x/net updated from v0.53.0 to v0.54.0
• golang.org/x/sys updated from v0.43.0 to v0.44.0
• golang.org/x/term updated from v0.42.0 to v0.43.0
• github.com/cyphar/filepath-securejoin updated from v0.4.1 to v0.6.1
• github.com/pjbgf/sha1cd updated from v0.3.2 to v0.6.0
• golang.org/x/text updated from v0.36.0 to v0.37.0
• github.com/bluenviron/mediamtx-rpicamera updated from v2.5.6 to v2.5.7

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

Fixes and improvements

General

• prevent code injection in case of MTX_QUERY in hooks (#5707) When MTX_QUERY is used explicitly in hooks, for instance "curl http://something/?$MTX_QUERY", it can be used to inject arbitrary commands. MTX_QUERY is now url-encoded to prevent any abuse regardless of the configuration.
• use temporary redirects instead of permanent redirects (#5710) this prevents unwanted caching.

HLS

• prevent open redirect attacks (#5708)
• support reading and writing KLV (#5604)
• add hlsCDNSecret (#5716) this allows to serve HLS streams behind a CDN in a simplified way, compatible with the new HLS session system.
• add public attribute to cache-control header (bluenviron/gohlslib#349)
• allow caching non-low-latency playlists (bluenviron/gohlslib#350)

WebRTC

• prevent open redirect attacks (#5708)

RPI Camera

• Merge request->controls instead of overwriting (bluenviron/mediamtx-rpicamera#97) libcamera 0.7.0 is more strict about changing controls; assignment is no longer allowed since raspberrypi/libcamera@310cd8b Instead, we use the merge call with overwrite.

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

New major features

HLS

• track sessions (#962) (#5683) sessions are now tracked through cookies or query parameters. This provides the ability to inspect sessions through logs, metrics and API, allows more precise tracking of outbound bytes, decreases load on external HTTP authentication URLs since they are now called once per session and not once per request.
• support serving streams with a CDN (#5696)

Fixes and improvements

General

• improve listener labels (#5635) add a label after every "listener opened on :XXX" message that mentions protocols of every listener.
• dump unencrypted TLS sessions (#5624) when dumpPackets is true, embed TLS master keys into the dump, in a format which is natively compatible with Wireshark.
• use "token" as query parameter key to pass tokens (#5647) the legacy "jwt" query parameter key is still supported.
• deprecate authJWTInHTTPQuery and disable JWTs in query parameters (#5648) This fixes a long standing security flaw. Even though it's a breaking change, few users should be impacted since this feature has been discouraged for some time.
• expose token passed as query parameter to HTTP authentication too (#5649) this allows to parse tokens coming from RTSP and RTMP without additional effort.
• playback: return errors as JSON (#5656) this is aligned with all other HTTP-based services.
• prevent out-of-memory errors (#5674) impose a maximum size on body of incoming HTTP requests and responses.
• metrics: improve performance (#5663) use string.Builder instead of string concatenation
• metrics: add labels to the output (#5687) group metrics under visible, distinct labels.
• metrics: fix filtering by type=rtmp_conns and type=rtmps_conns (#5689)
• metrics: add readerType attribute to the path_readers metric (#5690) this allows to filter path readers by type.
• metrics: use an enum for parsing metrics type (#5692)
• metrics: fix race condition when reloading configuration (#5693)
• docs: add scaling page (#5695)

API

• sort path readers (#5691)

RTSP

• client: fix RTSP-over-HTTP tunnel request target (bluenviron/gortsplib#1041)
• client: support Axis SRTP variant (bluenviron/gortsplib#1033)
• improve SDP parser compatibility with malformed connection information (bluenviron/gortsplib#1025)
• support parsing responses with no status message (bluenviron/gortsplib#1043) (bluenviron/gortsplib#1050)
• client: don't block RTSP-over-HTTP tunnel startup on POST response (bluenviron/gortsplib#1047)

HLS

• return JSON with error message in case path conf is not available (#5655) this behavior is aligned with WebRTC one.
• improve muxer performance (#5660) use a mutex instead of a channel to get current instance.
• fix running linter when there are unstaged git changes (bluenviron/gohlslib#336)
• client: use redirected URL when reloading playlist (bluenviron/gohlslib#340) this allows to store and use tokens and signed URLs.
• client: support reading KLV (bluenviron/gohlslib#337)
• prevent out-of-memory errors (bluenviron/gohlslib#343)
• muxer: generate init segment once (bluenviron/gohlslib#344) Previously, the init segment was regenerated in case of codec parameter changes, but changing the init segment has been proved to cause video and audio discontinuities on iOS. Now the init file contains starting parameters only and never changes during the stream lifetime.
• client: increase size limit of segments and parts (bluenviron/gohlslib#345)
• return a custom error when body size limit is exceeded (bluenviron/gohlslib#346)
• muxer: store non-low-latency playlists and init files on disk (bluenviron/gohlslib#348)

Dependencies

• code.cloudfoundry.org/bytefmt updated from v0.67.0 to v0.69.0
• github.com/alecthomas/kong updated from v1.14.0 to v1.15.0
• github.com/bluenviron/gohlslib/v2 updated from v2.2.9 to v2.3.0
• github.com/bluenviron/gortsplib/v5 updated from v5.5.1 to v5.5.2
• github.com/go-git/go-git/v5 updated from v5.17.2 to v5.18.0
• github.com/matthewhartstonge/argon2 updated from v1.4.6 to v1.5.2
• github.com/pion/ice/v4 updated from v4.2.2 to v4.2.5
• golang.org/x/crypto updated from v0.49.0 to v0.50.0
• golang.org/x/sys updated from v0.42.0 to v0.43.0
• golang.org/x/term updated from v0.41.0 to v0.42.0
• github.com/pion/stun/v3 updated from v3.1.1 to v3.1.2
• github.com/pion/turn/v4 removed
• golang.org/x/net updated from v0.52.0 to v0.53.0
• golang.org/x/text updated from v0.35.0 to v0.36.0
• golang.org/x/time updated from v0.12.0 to v0.14.0
• github.com/pion/turn/v5 v5.0.3 added
• hls.js updated from v1.6.15 to v1.6.16

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

Fixes and improvements

General

• prevent directory traversal attacks (#5602) Path names are used as part of paths in several components: in the recorder, in the playback server and in every HTTP-based component (WebRTC, HLS, API). Special characters that allow to escape from the intended directory are now forbidden in order to prevent directory traversal attacks.

RTSP

• client: fill server name indication (SNI) of TLS connections (bluenviron/gortsplib#1038)

RTMP

• implement AbortMessage (#4673) (bluenviron/gortmplib#59)
• client: fill server name indication (SNI) of TLS connections (bluenviron/gortmplib#63)

WebRTC

• fix random absolute timestamps with Opus, G711 and LPCM (#5597) When rewriting audio RTP timestamps in WebRTC egress, NTP was derived using regenerated packet timestamps minus the incoming RTP base timestamp. That mixed timestamp domains and could shift absolute time by an arbitrary offset while still exposing mapping as available. Fix by using a consistent outgoing RTP domain in rewritten audio paths
• strip TWCC extension of incoming RTP packets (#5146) (#5605) The TWCC extension is used as part of the WebRTC congestion control algorithm placed between the publisher and the server. If this extension is routed untouched from the server to readers, it messes with the congestion control algorithm present between the server and each reader. Remove it.

RPI Camera

• restore Docker compatibility with armv6 devices (#5590) (#5595)
• restore compatibility with armv6 devices (#5590) (bluenviron/mediamtx-rpicamera#95)

Dependencies

• github.com/bluenviron/gortmplib updated from v0.3.0 to v0.3.1
• github.com/bluenviron/gortsplib/v5 updated from v5.5.0 to v5.5.1
• github.com/gin-contrib/pprof updated from v1.5.3 to v1.5.4
• github.com/go-git/go-git/v5 updated from v5.17.0 to v5.17.2
• github.com/pion/ice/v4 updated from v4.2.1 to v4.2.2
• github.com/pion/webrtc/v4 updated from v4.2.9 to v4.2.11
• github.com/pion/sctp updated from v1.9.2 to v1.9.4
• github.com/bluenviron/mediamtx-rpicamera updated from v2.5.4 to v2.5.5

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

New major features

WebRTC

• support publishing multiple video/audio renditions (#5573) this allows to receive multiple video tracks from OBS Studio with the new WebRTC Simulcast feature introduced in v32.1.0.

API

• provide track details (#5307) (#5333) (#1726) (#5585)
• add user field to RTSP, RTMP, SRT, WebRTC conns and sessions (https://github.com/bluenviron/mediamtx/issues/5104) (#5565)
• add RTSP reported lost packets (#5198) (#5579) The new outboundRtpPacketsReportedLost property allows to track RTP packets that have been reported lost by readers. Furthermore, stats now have a "inbound" or "outbound" prefix to improve readability.
• rename WebRTC stats to match RTSP ones (#5581)
• add new stats (#5582) - RTSPSession.outboundRTPPacketsDiscarded - Path.inboundFramesInError - SRTConn.outboundFramesDiscarded - WebRTCSession.outboundFramesDiscarded - RTMPConn.outboundFramesDiscarded - HLSMuxer.outboundFramesDiscarded

Fixes and improvements

General

• avoid buffering HTTP response body in loggerWriter (#5552) loggerWriter was shadow-copying every response byte into a bytes.Buffer to report the body size, causing the entire response to be accumulated in memory for the lifetime of each request. Replace the buffer with a plain int counter since dump() only ever reported the byte count anyway.
• optionally validate JWT iss and aud claims (#5569)
• metrics: add two missing SRT stats (#5580)

API

• add deprecated fields to the OpenAPI definition (#5575)
• add missing enums and move all enums in dedicated components (#5576)

RTSP

• fix rtsps scheme not being used in requests (#5236) (#5544)
• support unwrapping MPEG-TS tracks (#5476) this allows to use MPEG-TS tracks with other protocols and with the recording system
• client: fix support for hostnames in source and dest headers (bluenviron/gortsplib#1009) (#5304) (bluenviron/gortsplib#1014)
• allocate a rtp sender for each server session (bluenviron/gortsplib#1021) this produces more realistic statistics and in the future will allow to implement per-session statistics and packet retransmission.
• store reported lost RTP packets in stats (#5198) (bluenviron/gortsplib#1023)

HLS

• muxer: support muxing KLS with MPEG-TS (bluenviron/gohlslib#327)
• client: fix deadlock when processing fMP4s (bluenviron/gohlslib#333) (bluenviron/gohlslib#334)

WebRTC

• fix panic with WHIP POST authentication failures (#5566)

Dependencies

• code.cloudfoundry.org/bytefmt updated from v0.64.0 to v0.67.0
• github.com/abema/go-mp4 updated from v1.4.1 to v1.5.0
• github.com/bluenviron/gohlslib/v2 updated from v2.2.8 to v2.2.9
• github.com/bluenviron/gortsplib/v5 updated from v5.4.0 to v5.5.0
• github.com/bluenviron/mediacommon/v2 updated from v2.8.2 to v2.8.3
• golang.org/x/crypto updated from v0.48.0 to v0.49.0
• golang.org/x/sys updated from v0.41.0 to v0.42.0
• golang.org/x/term updated from v0.40.0 to v0.41.0
• golang.org/x/net updated from v0.51.0 to v0.52.0
• golang.org/x/text updated from v0.34.0 to v0.35.0

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

Fixes and improvements

General

• fill product version of Windows executable (#5167) (#5511)
• improve JSON decoder performance (#5526) avoid decoding JSON twice.
• fix panic when setting writeQueueSize to zero (#5360) (#5527)
• prevent using alwaysAvailableFile and alwaysAvailableTracks together (#5529)
• improve playback precision of alwaysAvailable offline segment (#5530)
• fix MPEG-4 audio configuration not matching error (#5468) (#5533) This happened when using alwaysAvailableFile and a MPEG-4 audio track.
• fix corrupted video with alwaysAvailableFile (#5534) when alwaysAvailableFile points to a file with a H265 or H264 track, server is started, an online stream is published and then closed, video was getting corrupted since the online video was overriding the parameters of the offline video.
• fix audio from alwaysAvailableFile not being streamed (#5535)
• fix alwaysAvailableFile restarting when a publisher fails (#5536) when a publisher try to start an online stream and there's an error, alwaysAvailableFile restarted without any reason.
• revert to Go 1.25 (#5521) (#5538) It seems like Go 1.26 is causing segmentation faults, related to channels, on Windows.
• inherit MPEG-4 audio type from alwaysAvailableFile (#5539)
• mpegts: properly compute PTS of async KLV frames (bluenviron/mediacommon#291) (bluenviron/mediacommon#311) Store last valid PTS as soon as possible, by parsing PES headers in advance, then use this PTS as timestamp of KLV frames without PTS.

HLS

• client: fix initial packet loss after astits upgrade (bluenviron/gohlslib#331)

Dependencies

• Go updated from 1.26 to 1.25
• github.com/asticode/go-astits updated from v1.14.0 to v1.15.0
• github.com/bluenviron/gohlslib/v2 updated from v2.2.6 to v2.2.8
• github.com/bluenviron/gortsplib/v5 updated from v5.3.2 to v5.4.0
• github.com/bluenviron/mediacommon/v2 updated from v2.8.0 to v2.8.2
• github.com/gin-gonic/gin updated from v1.11.0 to v1.12.0
• github.com/go-git/go-billy/v5 updated from v5.7.0 to v5.8.0
• github.com/go-git/go-git/v5 updated from v5.16.5 to v5.17.0
• github.com/bytedance/sonic updated from v1.14.0 to v1.15.0
• github.com/bytedance/sonic/loader updated from v0.3.0 to v0.5.0
• github.com/cloudflare/circl updated from v1.6.1 to v1.6.3
• github.com/gabriel-vasile/mimetype updated from v1.4.8 to v1.4.12
• github.com/go-playground/validator/v10 updated from v10.27.0 to v10.30.1
• github.com/quic-go/quic-go updated from v0.57.0 to v0.59.0
• github.com/ugorji/go/codec updated from v1.3.0 to v1.3.1
• golang.org/x/arch updated from v0.20.0 to v0.22.0
• golang.org/x/net updated from v0.50.0 to v0.51.0
• google.golang.org/protobuf updated from v1.36.9 to v1.36.10
• github.com/bytedance/gopkg v0.1.3 added
• go.mongodb.org/mongo-driver/v2 v2.5.0 added

Security

Binaries are compiled from source code by the Release workflow without human intervention.

You can verify that binaries have been produced by the workflow by using GitHub Attestations:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

Fixes and improvements

General

• support X-Forwarded-Proto in playback server (#4970) (#5445) allow reverse proxies to change the schema of URLs returned by the server through the X-Forwarded-Proto header.
• make config file YAML 1.2 compliant (#5345) (#5456)
• replace YAML parser (#5461) switch from the unmaintained gopkg.in/yaml to goccy/go-yaml
• deprecate unix+rtp (#5318) (#4999) (#5351) (#5470) Unix socket are stream-based connections, while RTP requires packet-based connections. While packet-based Unix sockets exist (unixgram), no client supports them. Consequently we are forced to deprecate unix+rtp.
• fix codec parameters not being loaded from alwaysAvailableFile (#5484)
• warn when alwaysAvailableFile is not MP4 (#5483)
• suggest using JWTs in query parameters for RTSP and RTMP (#5267) (#5493) In case of RTSP and RTMP, JWTs cannot be used as passwords since there's a size limit. Therefore, documentation is updated to suggest passing JWT through query parameters, and authJWTInHTTPQuery is updated to act on HTTP requests only.
• fix error 400 with parallel describe and publish requests (#5095) (#5502) When a path is dynamic, and the path receives multiple describe and publish requests in parallel, describe requests might cause the path to be deleted, and this might cause pending publish requests to fail, since the path has been deleted. This patch improves the situation by checking for pending requests before deleting a path.
• add integrated packet dumper (#5488) this allows to dump any incoming and outgoing packet, to disk, in pcapng format.
• log packet sizes if UDPMaxPayloadSize is exceeded (#4668)
• improve video/audio sync of alwaysAvailable (#5443) (#5508) store elapsed time once for the entire stream and start PTS of sub streams from there.
• improve pmp4 and fmp4 parser robustness (bluenviron/mediacommon#299)
• mp4: fix H265 + iOS compatibility (bluenviron/mediacommon#290) On iOS, H265 requires the hvc1 box instead of the hev1 box.
• h264: prevent Annex-B from decoding more NALUs than MaxNALUsPerAccessUnit (bluenviron/mediacommon#303)
• improve H264 and MPEG-4 video performance (#4971) (bluenviron/mediacommon#304)
• mp4: fill reserved fields properly (bluenviron/mediacommon#307)
• mpegts: parse Opus channel configuration (#5002) (bluenviron/mediacommon#309)

API

• add conns to RTSP Sessions (#5454) this allows to find connections associated with a RTSP session.

RTMP

• prevent legacy clients from reading multiple video/audio tracks (#5478)
• fix marshaling H264 VideoExCodedFrames (#4996) (bluenviron/gortmplib#46) These messages were marshaled wrongly, causing errors when trying to read H264 tracks with an ID >= 1.
• support reading H265 with video codec id 12 (#5105) (bluenviron/gortmplib#48)

HLS

• client: support storing and sending cookies (#5444)

WebRTC

• allow tuning WHEP timeouts (#5027) (#5479) add whepHandshakeTimeout, whepTrackGatherTimeout, whepSTUNGatherTimeout
• add whepBearerTokenParameter (#3796) (#5486) this allows to pass Authorization: Bearer to servers that require it.

SRT

• set timeout of idle peers to readTimeout (#5489)

RPI Camera

• fix cross-compilation (bluenviron/mediamtx-rpicamera#89)
• fix kernel warning when closing camera (#4988) (bluenviron/mediamtx-rpicamera#88) close camera and encoder handlers properly.

Dependencies

• Go updated from 1.25 to 1.26
• code.cloudfoundry.org/bytefmt updated from v0.63.0 to v0.64.0
• github.com/MicahParks/keyfunc/v3 updated from v3.7.0 to v3.8.0
• github.com/bluenviron/gohlslib/v2 updated from v2.2.5 to v2.2.6
• github.com/bluenviron/gortmplib updated from v0.2.1 to v0.3.0
• github.com/bluenviron/gortsplib/v5 updated from v5.3.1 to v5.3.2
• github.com/bluenviron/mediacommon/v2 updated from v2.7.1 to v2.8.0
• github.com/datarhei/gosrt updated from v0.9.0 to v0.10.0
• github.com/go-git/go-git/v5 updated from v5.16.4 to v5.16.5
• github.com/matthewhartstonge/argon2 updated from v1.4.5 to v1.4.6
• github.com/pion/ice/v4 updated from v4.2.0 to v4.2.1
• github.com/pion/sdp/v3 updated from v3.0.17 to v3.0.18
• github.com/pion/webrtc/v4 updated from v4.2.3 to v4.2.9
• golang.org/x/crypto updated from v0.47.0 to v0.48.0
• golang.org/x/sys updated from v0.40.0 to v0.41.0
• golang.org/x/term updated from v0.39.0 to v0.40.0
• gopkg.in/yaml.v2 removed
• github.com/goccy/go-yaml updated from v1.18.0 to v1.19.2
• github.com/pion/dtls/v3 updated from v3.0.10 to v3.1.2
• golang.org/x/net updated from v0.49.0 to v0.50.0
• golang.org/x/text updated from v0.33.0 to v0.34.0
• github.com/google/gopacket v1.1.19 added
• github.com/bluenviron/mediamtx-rpicamera updated from v2.5.3 to v2.5.4

Security

Binaries are compiled from source code by the Release workflow without human intervention.

You can verify that binaries have been produced by the workflow by using GitHub Attestations:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

Fixes and improvements

General

• fix typo in error message ('alwaysAvailableVideo' -> 'alwaysAvailableFile') (#5417)
• emit structured logs with nanosecond precision (#4924) (#5404)
• set default udpMaxPayloadSize to an IPv6 compatible value (#4882) (#5402) When using IPv6, there are 20 bytes less available for UDP payload, which has been adjusted accordingly.
• add authHTTPFingerprint (#5413) (#5422)
• add additional checks on always-available streams (#5408) make sure that published streams match MPEG-4 audio, G711 and LPCM parameters declared in configuration or used by the offline file.
• improve JSON error message (#5412) (#5433)
• pmp4: improve compatibility (#5423) (bluenviron/mediacommon#298)

RTSP

• rtpreceiver: fix panic (bluenviron/gortsplib#994)
• support Amatek AR-N3222F NVR (bluenviron/gortsplib#989)
• rtpreceiver: fix TotalReceived computation (bluenviron/gortsplib#995) one packet was missing.

RPI Camera

• fix unsetting rpiCameraAWBGains (#4935) (bluenviron/mediamtx-rpicamera#85)

Dependencies

• code.cloudfoundry.org/bytefmt updated from v0.62.0 to v0.63.0
• github.com/alecthomas/kong updated from v1.13.0 to v1.14.0
• github.com/bluenviron/gortsplib/v5 updated from v5.3.0 to v5.3.1
• github.com/bluenviron/mediacommon/v2 updated from v2.7.0 to v2.7.1
• github.com/pion/interceptor updated from v0.1.43 to v0.1.44
• github.com/pion/rtp updated from v1.10.0 to v1.10.1
• github.com/bluenviron/mediamtx-rpicamera updated from v2.5.2 to v2.5.3

Security

Binaries are compiled from source code by the Release workflow without human intervention.

You can verify that binaries have been produced by the workflow by using GitHub Attestations:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

New major features

General

• add always available streams (#5335) When the publisher or source of a stream is offline, the server can be configured to fill gaps in the stream with a video that is played on repeat until a publisher comes back online. This allows readers to stay connected regardless of the state of the stream. The offline video and any future online stream are concatenated without decoding or re-encoding packets, using the original codec.

API

• add available, availableTime, online, onlineTime properties (#5391) these replace ready and readyTime and allow to monitor the new "always-available" feature.

WebRTC

• support reading KLV tracks (#4722)

Fixes and improvements

General

• move away from balenalib Docker images (#5313)
• print OS and Arch in first log line (#5315)
• print last decode error (#5319) decode errors are still grouped together, but the last one is now printed.
• print last processing error (#5323)
• use the same filtering process for every codec (#5324) this allows to apply features that were previously implemented for single codecs (like RTP packet resizing), to any codec, and simplifies future development.
• prevent several configuration errors (#5368)
• fix typos in documentation (#5370)
• fix overriding default user with environment variables (#5371) MTX_AUTHINTERNALUSERS_0_USER and MTX_AUTHINTERNALUSERS_0_PASS are now working even when the configuration file is present.
• prevent setting empty usernames with environment variables (#5373)
• fix panic with environment variables (#5374) this happened when loading deprecated slices of structs with environment variables.
• prevent setting slices to null (#5375) In Golang, slices can be set to nil, while in most other languages they cannot. This causes compatibility issues, especially because the OpenAPI definition of the API does not allow slices to be nil. This prevents slices from being set to nil through JSON/YAML, and also sets default slices to an empty list instead of nil.
• Update hlsEncryption documentation on Low-Latency HLS requirements (#5379)
• fix race condition when closing HTTP servers (#5390) when a HTTP server is closed, open connections are now immediately closed and open routines are waited before the server is considered closed.
• deprecate fallback (#5388) The fallback feature worked with RTSP only and did not allow readers to resume the original stream. It has been replaced by alwaysAvailable.
• mpegts: add E-AC-3 (Dolby Digital Plus) codec support (bluenviron/mediacommon#272)
• mpeg4audio: support channel_config=0 (bluenviron/mediacommon#273)
• mpeg4audio: in ASC, prefer marshaling legacy ChannelConfig when available (bluenviron/mediacommon#280)
• pmp4: increase compatibility (bluenviron/mediacommon#293)
• pmp4: support MP4s with data before track definitions (bluenviron/mediacommon#294)

API

• improve OpenAPI definition (#5380) add uint64, uint, uuid, move WebRTCICEServer into dedicated schema

RTSP

• fix log labels of RTSPS listeners (#5367) use "TCP/RTSPS", "UDP/SRTP", "UDP/SRTCP" to refer to secure listeners
• add rtspUDPSourcePortRange param (#5363) (#5397)

HLS

• fix playback starting point for VOD streams without EXT-X-PLAYLIST-TYPE (bluenviron/gohlslib#308)
• client: return every unit before an error (bluenviron/gohlslib#314) In case of an error, downloaded unit that were not processed yet were discarded. Now they are returned before the client exits.

WebRTC

• print incoming data channel messages (#5357)

RPI Camera

• move away from balenalib Docker images (bluenviron/mediamtx-rpicamera#82)

Dependencies

• code.cloudfoundry.org/bytefmt updated from v0.59.0 to v0.62.0
• github.com/bluenviron/gohlslib/v2 updated from v2.2.4 to v2.2.5
• github.com/bluenviron/gortmplib updated from v0.2.0 to v0.2.1
• github.com/bluenviron/gortsplib/v5 updated from v5.2.2 to v5.3.0
• github.com/bluenviron/mediacommon/v2 updated from v2.6.0 to v2.7.0
• github.com/golang-jwt/jwt/v5 updated from v5.3.0 to v5.3.1
• github.com/matthewhartstonge/argon2 updated from v1.4.4 to v1.4.5
• github.com/pion/ice/v4 updated from v4.1.0 to v4.2.0
• github.com/pion/interceptor updated from v0.1.42 to v0.1.43
• github.com/pion/rtp updated from v1.9.0 to v1.10.0
• github.com/pion/transport/v3 removed
• github.com/pion/webrtc/v4 updated from v4.2.1 to v4.2.3
• golang.org/x/crypto updated from v0.46.0 to v0.47.0
• golang.org/x/sys updated from v0.39.0 to v0.40.0
• golang.org/x/term updated from v0.38.0 to v0.39.0
• github.com/pion/datachannel updated from v1.5.10 to v1.6.0
• github.com/pion/dtls/v3 updated from v3.0.9 to v3.0.10
• github.com/pion/sctp updated from v1.9.0 to v1.9.2
• github.com/pion/srtp/v3 updated from v3.0.9 to v3.0.10
• github.com/pion/stun/v3 updated from v3.0.2 to v3.1.1
• github.com/pion/turn/v4 updated from v4.1.3 to v4.1.4
• golang.org/x/net updated from v0.48.0 to v0.49.0
• golang.org/x/text updated from v0.32.0 to v0.33.0
• github.com/pion/transport/v4 v4.0.1 added
• github.com/bluenviron/mediamtx-rpicamera updated from v2.5.1 to v2.5.2

Security

Binaries are compiled from source through the Release workflow without human intervention, preventing any external interference.

You can verify that binaries have been produced by the workflow by using GitHub Attestations:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

Fixes and improvements

General

• add structured logging (#5219)
• fix 1-minute offset when recording a H264 WebRTC track (#5275) (#5278)
• disable syslog logging on macOS (#5005) (#5295)
• set syslog priority and do not write level and date to syslog (#4923) (#5296) When writing log entries to syslog, pass the level (WARN, INFO, etc) directly to syslog. Avoid writing level and date. This provides a better integration and allows to use syslog search tools.

RTSP

• avoid setupping back channels (#5074) (#5289)
• Support URI format sent by HappyTime ONVIF and RTSP clients during (bluenviron/gortsplib#964)
• fix medias wrongly marked as back channels (#5074) (bluenviron/gortsplib#970) Some cameras mark medias as back channels even though they are not. Try to detect this by checking whether in full the SDP there are both back channels and standard channels, unmarking back channels otherwise.
• when there are back channels, add recvonly attribute to standard channels (bluenviron/gortsplib#971)

SRT

• fix broken connections in case of high latency (#3756) (#5282) When listening and accepting an incoming connection request, the response might be received by the peer with some delay due to latency. This causes the peer to send a second connection request, that is not detected as duplicate because the first connection request has already been removed from the map that is used to check for duplicates (connReqs), so it is treated as a brand new connection request, breaking the first connection. This patch fixes the issue by introducing another map (connByPeer) that is used to check whether a connection request is associated to an already-accepted connection.

Dependencies

• code.cloudfoundry.org/bytefmt updated from v0.58.0 to v0.59.0
• github.com/bluenviron/gortmplib updated from v0.1.2 to v0.2.0
• github.com/bluenviron/gortsplib/v5 updated from v5.2.1 to v5.2.2
• github.com/bluenviron/mediacommon/v2 updated from v2.5.3 to v2.6.0
• github.com/matthewhartstonge/argon2 updated from v1.4.3 to v1.4.4
• github.com/pion/ice/v4 updated from v4.0.13 to v4.1.0
• github.com/pion/rtp updated from v1.8.26 to v1.9.0
• github.com/pion/sdp/v3 updated from v3.0.16 to v3.0.17
• github.com/pion/webrtc/v4 updated from v4.1.7 to v4.2.1
• golang.org/x/crypto updated from v0.45.0 to v0.46.0
• golang.org/x/sys updated from v0.38.0 to v0.39.0
• golang.org/x/term updated from v0.37.0 to v0.38.0
• github.com/pion/dtls/v3 updated from v3.0.8 to v3.0.9
• github.com/pion/sctp updated from v1.8.41 to v1.9.0
• github.com/pion/stun/v3 updated from v3.0.1 to v3.0.2
• github.com/quic-go/qpack updated from v0.5.1 to v0.6.0
• github.com/quic-go/quic-go updated from v0.54.1 to v0.57.0
• go.uber.org/mock removed
• golang.org/x/mod removed
• golang.org/x/net updated from v0.47.0 to v0.48.0
• golang.org/x/sync removed
• golang.org/x/text updated from v0.31.0 to v0.32.0
• golang.org/x/time updated from v0.9.0 to v0.12.0
• golang.org/x/tools removed

Security

Binaries are compiled from source through the Release workflow without human intervention, preventing any external interference.

You can verify that binaries have been produced by the workflow by using GitHub Attestations:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

Fixes and improvements

General

• apidocs: fix compatibility with OpenAPI 3.0 (#5210) double-precision numbers are now represented as double.
• playback: support concatenating segments with long gaps (#5172) Thanks to the new mtxi MP4 box, it's possible to check whether two segments are consecutive without involving dates or timestamps. When the new mtxi box is present in both segments, do not check if the end of the first segment corresponds to the start of the second segment.
• recorder: reset when absolute time drifts from stream time (#4778) (#5239) the server now detects when system time changes too much and restarts recordings when that happens.
• playback: fix crash (#5240) (#5250) when requesting a recording with the mp4 format, if there are two tracks and the second track has no samples, the server crashed. This fixes the issue.
• fix panic when changing log file to a nonexisting directory (#5132) (#5249)
• h264: fix regression in DTS extractor (#5207) (bluenviron/mediacommon#263)
• h264: increase MaxNALUsPerAccessUnit (bluenviron/mediacommon#262) Some parrot drones use slice-encoding with 45 independent slices, resulting in frames consisting of 48 NALUs.
• pmp4: fix crash when unmarshaling and there are no samples (#5240) (bluenviron/mediacommon#267)
• fmp4: Correctly parse trun v0 sample composition time offset (bluenviron/mediacommon#268)
• h265: fix DTS extraction with multiple slices (#5071) (bluenviron/mediacommon#269)

API

• always reply with JSON in case of success or failure (#5252) Reply with "status": "ok" in case of success, and with "status": "error" in case of error. This makes the API more accessible and user friendly.

RTSP

• fix crash when setupping tracks between stream changes (#5253) (#5257)
• Allow 1 byte of extra padding at mikey message (bluenviron/gortsplib#953)

RTMP

• prevent dropping initial video and audio frames (bluenviron/gortmplib#26)

Dependencies

• github.com/bluenviron/gortmplib updated from v0.1.1 to v0.1.2
• github.com/bluenviron/gortsplib/v5 updated from v5.2.0 to v5.2.1
• github.com/bluenviron/mediacommon/v2 updated from v2.5.1 to v2.5.3
• github.com/go-git/go-billy/v5 updated from v5.6.2 to v5.7.0
• github.com/go-git/go-git/v5 updated from v5.16.3 to v5.16.4
• github.com/pion/ice/v4 updated from v4.0.10 to v4.0.13
• github.com/pion/rtp updated from v1.8.25 to v1.8.26
• github.com/pion/webrtc/v4 updated from v4.1.6 to v4.1.7
• github.com/pion/dtls/v3 updated from v3.0.7 to v3.0.8
• github.com/pion/mdns/v2 updated from v2.0.7 to v2.1.0
• github.com/pion/sctp updated from v1.8.40 to v1.8.41
• github.com/pion/srtp/v3 updated from v3.0.8 to v3.0.9
• github.com/pion/stun/v3 updated from v3.0.0 to v3.0.1
• github.com/pion/turn/v4 updated from v4.1.1 to v4.1.3

Security

Binaries are compiled from source through the Release workflow without human intervention, preventing any external interference.

You can verify that binaries have been produced by the workflow by using GitHub Attestations:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check