CSMWrap Version 3.1.1

Changelog since CSMWrap 3.1.0

Miscellaneous bug fixes, mostly surrounding the SeaBIOS storage driver code.

Full Changelog: 3.1.0...3.1.1

[0.16.4] - 2026-05-05

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

Changed

Fixed

• Live tracing in community and OSS versions.
• Timezone changes from the AccountSettings object return invalidProperties.
• mail-parser panic with certain messages containing corrupted attachments.
• Pagination by anchor for queued messages, tasks and metrics.
• Spam filter: Use original instead of rewritten RCPT on checks.
• JMAP:
  • References in nested objects not resolved.
  • AddressBook/query fetches wrong resources.
• Import tool fails to restore registry entries.
• FDB: Allow multiple FoundationDB instances in the same process.
• Autoconfig: Return %EMAILADDRESS% when no email address is provided.
• Quota: Include Sieve scripts in quota recalculations.

Check binary attestation here

Hi,

The OpenWrt community is proud to announce the third service release of the OpenWrt 25.12 stable series.

Download firmware images using the OpenWrt Firmware Selector:

• https://firmware-selector.openwrt.org/?version=25.12.3

Download firmware images directly from our download servers:

• https://downloads.openwrt.org/releases/25.12.3/targets/

Main changes between OpenWrt 25.12.2 and OpenWrt 25.12.3

Only the main changes are listed below. See the full changelog for details.

Security fixes

• Linux kernel: fixes CVE-2026-31431 ("Copy Fail"). In earlier releases this only affected users on the starfive target and users who had installed kmod-crypto-user.
• mbedtls: update to 3.6.6 (multiple CVE fixes)
• OpenSSL: update to 3.5.6 (multiple CVE fixes)
• wolfSSL: update to 5.9.1 (multiple CVE fixes)

Device support

New devices supported in 25.12.3:

• mediatek: filogic: ASUS RT-AX52 PRO
• mediatek: filogic: D-Link AQUILA PRO AI E30
• mediatek: filogic: Huasifei WH3000 Pro (NAND variant)
• mediatek: filogic: Keenetic KAP-630 / Netcraze NAP-630
• mediatek: filogic: Zbtlink ZBT-Z8106AX-T
• mediatek: filogic: Zyxel WX5600-T0
• ramips: mt7621: EDUP EP-RT2983
• ramips: mt76x8: Cudy LT300 v3
• x86: DFI ADN553
• x86: DFI ASL553

Device fixes:

• ath79: Netgear WNDAP360: multiple fixes restoring proper operation (sysupgrade, kernel loader, ethernet, LED, serial baud rate and U-Boot environment)
• ath79: Extreme Networks WS-AP3805i: fix U-Boot environment configuration
• ath79: Mikrotik: fix included device packages
• ipq50xx: Linksys MX5500: add label MAC device assignment
• lantiq: Netgear DGN3500: fix U-Boot environment size — device was broken on 25.12 (#22692)
• mediatek: filogic: Bananapi BPI-R4: add device tree overlay for the BE14 WiFi 7 module — fixes very low WiFi TX power on this module (#17489)
• mediatek: filogic: Keenetic KN-1812: various Ethernet PHY device tree fixes (PHY reset, interrupt support, MDIO drive strength, partition naming, xsphy node)
• mediatek: filogic: Netgear EAX17: fix rootfs hash in FIT node for per-device rootfs builds
• mediatek: filogic: CMCC RAX3000M: add Airoha AN8855 switch support (#21230)
• mediatek: filogic: Zbtlink ZBT-Z8103AX-D: enable NMBM on the SPI-NAND flash
• mvebu: ClearFog Base/Pro: fix switch kernel module
• qualcommax: ipq50xx: Xiaomi AX6000: enable PCIe1 for QCA9887
• qualcommax: ipq807x: Linksys MX5300: add label MAC assignment
• ramips: Yuncore CPE200: fix EEPROM size
• ramips: mt7621: fix reset hang
• ramips: Wavlink WL-WN575A3: fix EEPROM size for 5 GHz WiFi
• ramips: Xiaomi Mi Router 4C: fix WAN LED GPIO (#18578)

WiFi fixes and improvements

• wifi-scripts: fix incorrect erp_domain and fils_cache_id values generated by the ucode-based config script (#21768)
• wifi-scripts: add missing bridge_isolate and network_vlan fields to the ucode schema (#22620)
• wifi-scripts: add missing iface and other fields to the ucode station/vlan schema (#22165)
• wifi-scripts: add EHT (WiFi 7) rates to set_fixed_freq

Networking and system fixes

• mbedtls: backport upstream patches to fix TLS 1.2 client issues — fixes a regression that broke DDNS updates and other TLS 1.2 client connections; the regression was introduced in mbedtls package updates shipped after the 25.12.2 release (#22874)
• base-files: sysupgrade: fix -u option (skip default configuration) which was broken with apk
• base-files: sysupgrade: fix -f (custom backup) when the path contains spaces
• base-files: sysupgrade: update backup exclusion list
• base-files: use DISKSEQ instead of MAJOR/MINOR for stable disk identification (MAJOR/MINOR are not sequential)
• lantiq: fix mtdparsers refcount and memory leak
• uqmi / umbim: introduce devpath option for selecting cellular modems by USB device path
• kernel: add kmod-vsock and kmod-vsock-virtio for VM guests (vsock communication)

Core component updates

• Linux kernel: update from 6.12.74 to 6.12.85
• ca-certificates: update from 20250419 to 20260223
• linux-firmware: update from 20251125 to 20260221
• mbedtls: update from 3.6.5 to 3.6.6 (security fixes)
• OpenSSL: update from 3.5.5 to 3.5.6 (security fixes)
• wireless-regdb: update from 2026.02.04 to 2026.03.18
• wolfSSL: update from 5.8.4 to 5.9.1 (security fixes)
• xdp-tools: update from 1.4.3 to 1.6.3

Upgrading to 25.12.3

Upgrading from 24.10 to 25.12 should be transparent on most devices, as most configuration data has either remained the same or will be translated correctly on first boot by the package init scripts.
For upgrades within the OpenWrt 25.12 stable series, Attended Sysupgrade is also supported, which allows preserving the installed packages.

• Sysupgrade from 23.05 or earlier to 25.12 is not officially supported.

• Cron log level was fixed in busybox. system.@system[0].cronloglevel should be set to 7 for normal logging. 7 is the default now. If this option is not set, the default is used and no manual action is needed. fc0c518

• Bananapi BPI-R4: Interface eth1 was renamed to sfp-lan or lan4, and interface eth2 was renamed to sfp-wan to match the labels. You have to upgrade without saving the configuration. cd8dcfe

• TP-Link RE355 v1, RE450 v1 and RE450 v2: The partition layout and block size changed in this release to fix configuration loss on sysupgrade. Users upgrading from OpenWrt 25.12.0 or earlier must use sysupgrade -F to force the upgrade. The image must not exceed 5.875 MB (6016 KiB).

• Meraki MX60: Direct sysupgrade to 25.12.3 is not possible without manual preparation — meraki_loadaddr must be changed before upgrading, as the default value is insufficient to boot OpenWrt 25.12+. See the device wiki page for instructions.

Known issues

• Zyxel EX5601-T0: the WAN interface was renamed from eth1 to wan — check and update your network configuration after upgrading.
• Pixel 10 phones have problems connecting to WPA3-protected WiFi 6 APs. #21486
• 802.11r Fast Transition (FT) causes connection problems with some WiFi clients when WPA3 is used. #22200
• SQM CAKE MQ (cake_mq): throughput may be unexpectedly low on some configurations after the scheduler fixes in this release. #22344

Full release notes and upgrade instructions are available at
https://openwrt.org/releases/25.12/notes-25.12.3

In particular, make sure to read the known issues before upgrading:
https://openwrt.org/releases/25.12/notes-25.12.3#known_issues

For a detailed list of all changes, refer to
https://openwrt.org/releases/25.12/changelog-25.12.3

To download the 25.12.3 images, navigate to:
https://downloads.openwrt.org/releases/25.12.3/targets/
Use OpenWrt Firmware Selector to download:
https://firmware-selector.openwrt.org?version=25.12.3

As always, a big thank you goes to all our active package maintainers, testers, documenters and supporters.

Have fun!

The OpenWrt Community

To stay informed of new OpenWrt releases and security advisories, there
are new channels available:

• a low-volume mailing list for important announcements:
  https://lists.openwrt.org/mailman/listinfo/openwrt-announce

• a dedicated "announcements" section in the forum:
  https://forum.openwrt.org/c/announcements/14

• other announcement channels (such as RSS feeds) might be added in
  the future, they will be listed at https://openwrt.org/contact

CSMWrap Version 3.1.0

Changelog since CSMWrap 3.0.1

New Features

• Non-VGA option ROM dispatch - CSMWrap now enumerates legacy x86 option ROMs from non-VGA PCI devices (NIC PXE ROMs, RAID/storage ROMs, etc.) and dispatches them through the CSM, mirroring what a real CSM would do.
• $PIR table synthesis - A PCI BIOS Specification 2.1 $PIR table is now synthesized from ACPI _PRT/_PRS and handed to SeaBIOS so legacy OSes can get non-ACPI PCI IRQ routing.
• Working APM shutdown and reboot - APM Set Power State (off/reboot) now trampolines through the helper core into UEFI's ResetSystem runtime service. Previously these calls were no-ops.
• CPU visibility configuration - Three new csmwrap.ini options (system_thread, cpu_allowlist, cpu_blocklist) let you pin the BIOS proxy helper core to a specific APIC ID and hide arbitrary APs.
• Auto-select GPU with working OpROM - When the primary GPU's option ROM can't be claimed (VGA arbitration fails, no legacy image, oversized ROM), CSMWrap now falls through to the next VGA-class device instead of giving up.
• And more!

Bug Fixes

• Many bug fixes and improvements across PCI, APIC/x2APIC/MP tables, AMD MTRR and PAM unlocking, AMD IOMMU teardown order, GOP/VGA arbitration, e820 generation, and more.

SeaBIOS

• Many bug fixes and improvements across xHCI/EHCI/OHCI/UHCI, AHCI/NVMe/eMMC, and more.

Full Changelog: 3.0.1...3.1.0

[0.16.3] - 2026-04-30

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

Changed

• Replaced STALWART_HTTPS_PORT with STALWART_PUBLIC_URL.
• App Passwords now begin with app_ instead of app to avoid issues with some clients that do not support spaces in passwords.

Fixed

• Directory:
  • Invalidate caches when group memberships change on an external directory.
  • OIDC: errors instead of "failed to decode token".
  • OIDC: Recovery admin access.
  • User impersonation.
• Tasks:
  • Delete locked tasks.
  • Queue pagination by anchor.
• Log viewer: All events show as INFO.
• Registry: Allow changing object variants.
• Node id renewal.
• DNS Updater: Fix Route53 serialization format.

Check binary attestation here

✨ New Features & Improvements

• @directus/app
  • Updated the token field on the user detail page to require confirmation before regenerating or removing a token, and saved those changes immediately without requiring a page-level save. (#27108 by @LZylstra)
• @directus/api
  • Added opt-in must-revalidate and ETag headers for assets via ASSETS_CACHE_REVALIDATE env var (#27027 by @gaetansenn)
  • Added a force option to schema apply to bypass hash check (#27136 by @Nitwel)
• @directus/env
  • Added opt-in must-revalidate and ETag headers for assets via ASSETS_CACHE_REVALIDATE env var (#27027 by @gaetansenn)
• @directus/sdk
  • Added a force option to schema apply to bypass hash check (#27136 by @Nitwel)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Fixed UI freeze when navigating items with WYSIWYG translations for non-admin users (#27154 by @gaetansenn)
  • Fixed selection not being cleared after running a manual flow from the collection list view sidebar (#27330 by @kropsi)
  • Fixed "Save as copy" in the file library throwing a 403 Forbidden error (#27181 by @sanskar-soni-9)
  • Fixed user token not being displayed after generation when collaboration is enabled (#27319 by @LZylstra)
  • Prevented filter popup being closed when reordering filters (#27324 by @HZooly)
  • Fixed icon flash in navigation sidebar for bookmarks without an icon (#27329 by @HZooly)
  • Migrated @directus/visual-editing into the monorepo (#27157 by @formfcw)
• @directus/api
  • Removed duplicate @directus/schema-builder dependency (#27166 by @ComfortablyCoding)
  • Bumped basic-ftp, liquidjs, xmldom, protobufjs, vite dependencies (#27335 by @br41nslug)
  • Fixed flows not awaiting reload (#27137 by @Nitwel)
  • Fixed VERSION_SAVE activity/revisions not respecting collection tracking settings (#27096 by @yogeshwaran-c)
  • Denied creating collections with / in name (#27114 by @costajohnt)
• @directus/types
  • Added a force option to schema apply to bypass hash check (#27136 by @Nitwel)
• @directus/visual-editing
  • Migrated @directus/visual-editing into the monorepo (#27157 by @formfcw)
  • Fixed the edit handler firing twice when clicking an overlay button directly (#27157 by @formfcw)
• @directus/utils
  • Migrated @directus/visual-editing into the monorepo (#27157 by @formfcw)
• @directus/sdk
  • Fixed SDK types linking to directus_access junction collection (#27152 by @yogeshwaran-c)
• @directus/composables
  • Fixed useShortcut attempting to access document before available (#27155 by @ComfortablyCoding)

📦 Published Versions

• @directus/app@15.10.0
• @directus/api@35.2.0
• @directus/composables@11.4.1
• create-directus-extension@11.0.36
• @directus/env@5.8.0
• @directus/extensions@3.0.25
• @directus/extensions-registry@3.0.26
• @directus/extensions-sdk@17.1.4
• @directus/memory@3.1.8
• @directus/pressure@3.0.22
• @directus/schema-builder@0.0.20
• @directus/storage-driver-azure@12.0.22
• @directus/storage-driver-cloudinary@12.0.22
• @directus/storage-driver-gcs@12.0.22
• @directus/storage-driver-s3@12.1.8
• @directus/storage-driver-supabase@3.0.22
• @directus/themes@1.3.3
• @directus/types@15.0.3
• @directus/utils@13.4.1
• @directus/validation@2.0.23
• @directus/visual-editing@2.0.1
• @directus/sdk@21.3.0
• @directus/sandbox@0.0.0

Fixes and improvements

General

• prevent code injection in case of MTX_QUERY in hooks (#5707) When MTX_QUERY is used explicitly in hooks, for instance "curl http://something/?$MTX_QUERY", it can be used to inject arbitrary commands. MTX_QUERY is now url-encoded to prevent any abuse regardless of the configuration.
• use temporary redirects instead of permanent redirects (#5710) this prevents unwanted caching.

HLS

• prevent open redirect attacks (#5708)
• support reading and writing KLV (#5604)
• add hlsCDNSecret (#5716) this allows to serve HLS streams behind a CDN in a simplified way, compatible with the new HLS session system.
• add public attribute to cache-control header (bluenviron/gohlslib#349)
• allow caching non-low-latency playlists (bluenviron/gohlslib#350)

WebRTC

• prevent open redirect attacks (#5708)

RPI Camera

• Merge request->controls instead of overwriting (bluenviron/mediamtx-rpicamera#97) libcamera 0.7.0 is more strict about changing controls; assignment is no longer allowed since raspberrypi/libcamera@310cd8b Instead, we use the merge call with overwrite.

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

New major features

HLS

• track sessions (#962) (#5683) sessions are now tracked through cookies or query parameters. This provides the ability to inspect sessions through logs, metrics and API, allows more precise tracking of outbound bytes, decreases load on external HTTP authentication URLs since they are now called once per session and not once per request.
• support serving streams with a CDN (#5696)

Fixes and improvements

General

• improve listener labels (#5635) add a label after every "listener opened on :XXX" message that mentions protocols of every listener.
• dump unencrypted TLS sessions (#5624) when dumpPackets is true, embed TLS master keys into the dump, in a format which is natively compatible with Wireshark.
• use "token" as query parameter key to pass tokens (#5647) the legacy "jwt" query parameter key is still supported.
• deprecate authJWTInHTTPQuery and disable JWTs in query parameters (#5648) This fixes a long standing security flaw. Even though it's a breaking change, few users should be impacted since this feature has been discouraged for some time.
• expose token passed as query parameter to HTTP authentication too (#5649) this allows to parse tokens coming from RTSP and RTMP without additional effort.
• playback: return errors as JSON (#5656) this is aligned with all other HTTP-based services.
• prevent out-of-memory errors (#5674) impose a maximum size on body of incoming HTTP requests and responses.
• metrics: improve performance (#5663) use string.Builder instead of string concatenation
• metrics: add labels to the output (#5687) group metrics under visible, distinct labels.
• metrics: fix filtering by type=rtmp_conns and type=rtmps_conns (#5689)
• metrics: add readerType attribute to the path_readers metric (#5690) this allows to filter path readers by type.
• metrics: use an enum for parsing metrics type (#5692)
• metrics: fix race condition when reloading configuration (#5693)
• docs: add scaling page (#5695)

API

• sort path readers (#5691)

RTSP

• client: fix RTSP-over-HTTP tunnel request target (bluenviron/gortsplib#1041)
• client: support Axis SRTP variant (bluenviron/gortsplib#1033)
• improve SDP parser compatibility with malformed connection information (bluenviron/gortsplib#1025)
• support parsing responses with no status message (bluenviron/gortsplib#1043) (bluenviron/gortsplib#1050)
• client: don't block RTSP-over-HTTP tunnel startup on POST response (bluenviron/gortsplib#1047)

HLS

• return JSON with error message in case path conf is not available (#5655) this behavior is aligned with WebRTC one.
• improve muxer performance (#5660) use a mutex instead of a channel to get current instance.
• fix running linter when there are unstaged git changes (bluenviron/gohlslib#336)
• client: use redirected URL when reloading playlist (bluenviron/gohlslib#340) this allows to store and use tokens and signed URLs.
• client: support reading KLV (bluenviron/gohlslib#337)
• prevent out-of-memory errors (bluenviron/gohlslib#343)
• muxer: generate init segment once (bluenviron/gohlslib#344) Previously, the init segment was regenerated in case of codec parameter changes, but changing the init segment has been proved to cause video and audio discontinuities on iOS. Now the init file contains starting parameters only and never changes during the stream lifetime.
• client: increase size limit of segments and parts (bluenviron/gohlslib#345)
• return a custom error when body size limit is exceeded (bluenviron/gohlslib#346)
• muxer: store non-low-latency playlists and init files on disk (bluenviron/gohlslib#348)

Dependencies

• code.cloudfoundry.org/bytefmt updated from v0.67.0 to v0.69.0
• github.com/alecthomas/kong updated from v1.14.0 to v1.15.0
• github.com/bluenviron/gohlslib/v2 updated from v2.2.9 to v2.3.0
• github.com/bluenviron/gortsplib/v5 updated from v5.5.1 to v5.5.2
• github.com/go-git/go-git/v5 updated from v5.17.2 to v5.18.0
• github.com/matthewhartstonge/argon2 updated from v1.4.6 to v1.5.2
• github.com/pion/ice/v4 updated from v4.2.2 to v4.2.5
• golang.org/x/crypto updated from v0.49.0 to v0.50.0
• golang.org/x/sys updated from v0.42.0 to v0.43.0
• golang.org/x/term updated from v0.41.0 to v0.42.0
• github.com/pion/stun/v3 updated from v3.1.1 to v3.1.2
• github.com/pion/turn/v4 removed
• golang.org/x/net updated from v0.52.0 to v0.53.0
• golang.org/x/text updated from v0.35.0 to v0.36.0
• golang.org/x/time updated from v0.12.0 to v0.14.0
• github.com/pion/turn/v5 v5.0.3 added
• hls.js updated from v1.6.15 to v1.6.16

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

Fixes and improvements

General

• prevent directory traversal attacks (#5602) Path names are used as part of paths in several components: in the recorder, in the playback server and in every HTTP-based component (WebRTC, HLS, API). Special characters that allow to escape from the intended directory are now forbidden in order to prevent directory traversal attacks.

RTSP

• client: fill server name indication (SNI) of TLS connections (bluenviron/gortsplib#1038)

RTMP

• implement AbortMessage (#4673) (bluenviron/gortmplib#59)
• client: fill server name indication (SNI) of TLS connections (bluenviron/gortmplib#63)

WebRTC

• fix random absolute timestamps with Opus, G711 and LPCM (#5597) When rewriting audio RTP timestamps in WebRTC egress, NTP was derived using regenerated packet timestamps minus the incoming RTP base timestamp. That mixed timestamp domains and could shift absolute time by an arbitrary offset while still exposing mapping as available. Fix by using a consistent outgoing RTP domain in rewritten audio paths
• strip TWCC extension of incoming RTP packets (#5146) (#5605) The TWCC extension is used as part of the WebRTC congestion control algorithm placed between the publisher and the server. If this extension is routed untouched from the server to readers, it messes with the congestion control algorithm present between the server and each reader. Remove it.

RPI Camera

• restore Docker compatibility with armv6 devices (#5590) (#5595)
• restore compatibility with armv6 devices (#5590) (bluenviron/mediamtx-rpicamera#95)

Dependencies

• github.com/bluenviron/gortmplib updated from v0.3.0 to v0.3.1
• github.com/bluenviron/gortsplib/v5 updated from v5.5.0 to v5.5.1
• github.com/gin-contrib/pprof updated from v1.5.3 to v1.5.4
• github.com/go-git/go-git/v5 updated from v5.17.0 to v5.17.2
• github.com/pion/ice/v4 updated from v4.2.1 to v4.2.2
• github.com/pion/webrtc/v4 updated from v4.2.9 to v4.2.11
• github.com/pion/sctp updated from v1.9.2 to v1.9.4
• github.com/bluenviron/mediamtx-rpicamera updated from v2.5.4 to v2.5.5

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

New major features

WebRTC

• support publishing multiple video/audio renditions (#5573) this allows to receive multiple video tracks from OBS Studio with the new WebRTC Simulcast feature introduced in v32.1.0.

API

• provide track details (#5307) (#5333) (#1726) (#5585)
• add user field to RTSP, RTMP, SRT, WebRTC conns and sessions (https://github.com/bluenviron/mediamtx/issues/5104) (#5565)
• add RTSP reported lost packets (#5198) (#5579) The new outboundRtpPacketsReportedLost property allows to track RTP packets that have been reported lost by readers. Furthermore, stats now have a "inbound" or "outbound" prefix to improve readability.
• rename WebRTC stats to match RTSP ones (#5581)
• add new stats (#5582) - RTSPSession.outboundRTPPacketsDiscarded - Path.inboundFramesInError - SRTConn.outboundFramesDiscarded - WebRTCSession.outboundFramesDiscarded - RTMPConn.outboundFramesDiscarded - HLSMuxer.outboundFramesDiscarded

Fixes and improvements

General

• avoid buffering HTTP response body in loggerWriter (#5552) loggerWriter was shadow-copying every response byte into a bytes.Buffer to report the body size, causing the entire response to be accumulated in memory for the lifetime of each request. Replace the buffer with a plain int counter since dump() only ever reported the byte count anyway.
• optionally validate JWT iss and aud claims (#5569)
• metrics: add two missing SRT stats (#5580)

API

• add deprecated fields to the OpenAPI definition (#5575)
• add missing enums and move all enums in dedicated components (#5576)

RTSP

• fix rtsps scheme not being used in requests (#5236) (#5544)
• support unwrapping MPEG-TS tracks (#5476) this allows to use MPEG-TS tracks with other protocols and with the recording system
• client: fix support for hostnames in source and dest headers (bluenviron/gortsplib#1009) (#5304) (bluenviron/gortsplib#1014)
• allocate a rtp sender for each server session (bluenviron/gortsplib#1021) this produces more realistic statistics and in the future will allow to implement per-session statistics and packet retransmission.
• store reported lost RTP packets in stats (#5198) (bluenviron/gortsplib#1023)

HLS

• muxer: support muxing KLS with MPEG-TS (bluenviron/gohlslib#327)
• client: fix deadlock when processing fMP4s (bluenviron/gohlslib#333) (bluenviron/gohlslib#334)

WebRTC

• fix panic with WHIP POST authentication failures (#5566)

Dependencies

• code.cloudfoundry.org/bytefmt updated from v0.64.0 to v0.67.0
• github.com/abema/go-mp4 updated from v1.4.1 to v1.5.0
• github.com/bluenviron/gohlslib/v2 updated from v2.2.8 to v2.2.9
• github.com/bluenviron/gortsplib/v5 updated from v5.4.0 to v5.5.0
• github.com/bluenviron/mediacommon/v2 updated from v2.8.2 to v2.8.3
• golang.org/x/crypto updated from v0.48.0 to v0.49.0
• golang.org/x/sys updated from v0.41.0 to v0.42.0
• golang.org/x/term updated from v0.40.0 to v0.41.0
• golang.org/x/net updated from v0.51.0 to v0.52.0
• golang.org/x/text updated from v0.34.0 to v0.35.0

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

Fixes and improvements

General

• fill product version of Windows executable (#5167) (#5511)
• improve JSON decoder performance (#5526) avoid decoding JSON twice.
• fix panic when setting writeQueueSize to zero (#5360) (#5527)
• prevent using alwaysAvailableFile and alwaysAvailableTracks together (#5529)
• improve playback precision of alwaysAvailable offline segment (#5530)
• fix MPEG-4 audio configuration not matching error (#5468) (#5533) This happened when using alwaysAvailableFile and a MPEG-4 audio track.
• fix corrupted video with alwaysAvailableFile (#5534) when alwaysAvailableFile points to a file with a H265 or H264 track, server is started, an online stream is published and then closed, video was getting corrupted since the online video was overriding the parameters of the offline video.
• fix audio from alwaysAvailableFile not being streamed (#5535)
• fix alwaysAvailableFile restarting when a publisher fails (#5536) when a publisher try to start an online stream and there's an error, alwaysAvailableFile restarted without any reason.
• revert to Go 1.25 (#5521) (#5538) It seems like Go 1.26 is causing segmentation faults, related to channels, on Windows.
• inherit MPEG-4 audio type from alwaysAvailableFile (#5539)
• mpegts: properly compute PTS of async KLV frames (bluenviron/mediacommon#291) (bluenviron/mediacommon#311) Store last valid PTS as soon as possible, by parsing PES headers in advance, then use this PTS as timestamp of KLV frames without PTS.

HLS

• client: fix initial packet loss after astits upgrade (bluenviron/gohlslib#331)

Dependencies

• Go updated from 1.26 to 1.25
• github.com/asticode/go-astits updated from v1.14.0 to v1.15.0
• github.com/bluenviron/gohlslib/v2 updated from v2.2.6 to v2.2.8
• github.com/bluenviron/gortsplib/v5 updated from v5.3.2 to v5.4.0
• github.com/bluenviron/mediacommon/v2 updated from v2.8.0 to v2.8.2
• github.com/gin-gonic/gin updated from v1.11.0 to v1.12.0
• github.com/go-git/go-billy/v5 updated from v5.7.0 to v5.8.0
• github.com/go-git/go-git/v5 updated from v5.16.5 to v5.17.0
• github.com/bytedance/sonic updated from v1.14.0 to v1.15.0
• github.com/bytedance/sonic/loader updated from v0.3.0 to v0.5.0
• github.com/cloudflare/circl updated from v1.6.1 to v1.6.3
• github.com/gabriel-vasile/mimetype updated from v1.4.8 to v1.4.12
• github.com/go-playground/validator/v10 updated from v10.27.0 to v10.30.1
• github.com/quic-go/quic-go updated from v0.57.0 to v0.59.0
• github.com/ugorji/go/codec updated from v1.3.0 to v1.3.1
• golang.org/x/arch updated from v0.20.0 to v0.22.0
• golang.org/x/net updated from v0.50.0 to v0.51.0
• google.golang.org/protobuf updated from v1.36.9 to v1.36.10
• github.com/bytedance/gopkg v0.1.3 added
• go.mongodb.org/mongo-driver/v2 v2.5.0 added

Security

Binaries are compiled from source code by the Release workflow without human intervention.

You can verify that binaries have been produced by the workflow by using GitHub Attestations:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

Fixes and improvements

General

• support X-Forwarded-Proto in playback server (#4970) (#5445) allow reverse proxies to change the schema of URLs returned by the server through the X-Forwarded-Proto header.
• make config file YAML 1.2 compliant (#5345) (#5456)
• replace YAML parser (#5461) switch from the unmaintained gopkg.in/yaml to goccy/go-yaml
• deprecate unix+rtp (#5318) (#4999) (#5351) (#5470) Unix socket are stream-based connections, while RTP requires packet-based connections. While packet-based Unix sockets exist (unixgram), no client supports them. Consequently we are forced to deprecate unix+rtp.
• fix codec parameters not being loaded from alwaysAvailableFile (#5484)
• warn when alwaysAvailableFile is not MP4 (#5483)
• suggest using JWTs in query parameters for RTSP and RTMP (#5267) (#5493) In case of RTSP and RTMP, JWTs cannot be used as passwords since there's a size limit. Therefore, documentation is updated to suggest passing JWT through query parameters, and authJWTInHTTPQuery is updated to act on HTTP requests only.
• fix error 400 with parallel describe and publish requests (#5095) (#5502) When a path is dynamic, and the path receives multiple describe and publish requests in parallel, describe requests might cause the path to be deleted, and this might cause pending publish requests to fail, since the path has been deleted. This patch improves the situation by checking for pending requests before deleting a path.
• add integrated packet dumper (#5488) this allows to dump any incoming and outgoing packet, to disk, in pcapng format.
• log packet sizes if UDPMaxPayloadSize is exceeded (#4668)
• improve video/audio sync of alwaysAvailable (#5443) (#5508) store elapsed time once for the entire stream and start PTS of sub streams from there.
• improve pmp4 and fmp4 parser robustness (bluenviron/mediacommon#299)
• mp4: fix H265 + iOS compatibility (bluenviron/mediacommon#290) On iOS, H265 requires the hvc1 box instead of the hev1 box.
• h264: prevent Annex-B from decoding more NALUs than MaxNALUsPerAccessUnit (bluenviron/mediacommon#303)
• improve H264 and MPEG-4 video performance (#4971) (bluenviron/mediacommon#304)
• mp4: fill reserved fields properly (bluenviron/mediacommon#307)
• mpegts: parse Opus channel configuration (#5002) (bluenviron/mediacommon#309)

API

• add conns to RTSP Sessions (#5454) this allows to find connections associated with a RTSP session.

RTMP

• prevent legacy clients from reading multiple video/audio tracks (#5478)
• fix marshaling H264 VideoExCodedFrames (#4996) (bluenviron/gortmplib#46) These messages were marshaled wrongly, causing errors when trying to read H264 tracks with an ID >= 1.
• support reading H265 with video codec id 12 (#5105) (bluenviron/gortmplib#48)

HLS

• client: support storing and sending cookies (#5444)

WebRTC

• allow tuning WHEP timeouts (#5027) (#5479) add whepHandshakeTimeout, whepTrackGatherTimeout, whepSTUNGatherTimeout
• add whepBearerTokenParameter (#3796) (#5486) this allows to pass Authorization: Bearer to servers that require it.

SRT

• set timeout of idle peers to readTimeout (#5489)

RPI Camera

• fix cross-compilation (bluenviron/mediamtx-rpicamera#89)
• fix kernel warning when closing camera (#4988) (bluenviron/mediamtx-rpicamera#88) close camera and encoder handlers properly.

Dependencies

• Go updated from 1.25 to 1.26
• code.cloudfoundry.org/bytefmt updated from v0.63.0 to v0.64.0
• github.com/MicahParks/keyfunc/v3 updated from v3.7.0 to v3.8.0
• github.com/bluenviron/gohlslib/v2 updated from v2.2.5 to v2.2.6
• github.com/bluenviron/gortmplib updated from v0.2.1 to v0.3.0
• github.com/bluenviron/gortsplib/v5 updated from v5.3.1 to v5.3.2
• github.com/bluenviron/mediacommon/v2 updated from v2.7.1 to v2.8.0
• github.com/datarhei/gosrt updated from v0.9.0 to v0.10.0
• github.com/go-git/go-git/v5 updated from v5.16.4 to v5.16.5
• github.com/matthewhartstonge/argon2 updated from v1.4.5 to v1.4.6
• github.com/pion/ice/v4 updated from v4.2.0 to v4.2.1
• github.com/pion/sdp/v3 updated from v3.0.17 to v3.0.18
• github.com/pion/webrtc/v4 updated from v4.2.3 to v4.2.9
• golang.org/x/crypto updated from v0.47.0 to v0.48.0
• golang.org/x/sys updated from v0.40.0 to v0.41.0
• golang.org/x/term updated from v0.39.0 to v0.40.0
• gopkg.in/yaml.v2 removed
• github.com/goccy/go-yaml updated from v1.18.0 to v1.19.2
• github.com/pion/dtls/v3 updated from v3.0.10 to v3.1.2
• golang.org/x/net updated from v0.49.0 to v0.50.0
• golang.org/x/text updated from v0.33.0 to v0.34.0
• github.com/google/gopacket v1.1.19 added
• github.com/bluenviron/mediamtx-rpicamera updated from v2.5.3 to v2.5.4

Security

Binaries are compiled from source code by the Release workflow without human intervention.

You can verify that binaries have been produced by the workflow by using GitHub Attestations:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

Fixes and improvements

General

• fix typo in error message ('alwaysAvailableVideo' -> 'alwaysAvailableFile') (#5417)
• emit structured logs with nanosecond precision (#4924) (#5404)
• set default udpMaxPayloadSize to an IPv6 compatible value (#4882) (#5402) When using IPv6, there are 20 bytes less available for UDP payload, which has been adjusted accordingly.
• add authHTTPFingerprint (#5413) (#5422)
• add additional checks on always-available streams (#5408) make sure that published streams match MPEG-4 audio, G711 and LPCM parameters declared in configuration or used by the offline file.
• improve JSON error message (#5412) (#5433)
• pmp4: improve compatibility (#5423) (bluenviron/mediacommon#298)

RTSP

• rtpreceiver: fix panic (bluenviron/gortsplib#994)
• support Amatek AR-N3222F NVR (bluenviron/gortsplib#989)
• rtpreceiver: fix TotalReceived computation (bluenviron/gortsplib#995) one packet was missing.

RPI Camera

• fix unsetting rpiCameraAWBGains (#4935) (bluenviron/mediamtx-rpicamera#85)

Dependencies

• code.cloudfoundry.org/bytefmt updated from v0.62.0 to v0.63.0
• github.com/alecthomas/kong updated from v1.13.0 to v1.14.0
• github.com/bluenviron/gortsplib/v5 updated from v5.3.0 to v5.3.1
• github.com/bluenviron/mediacommon/v2 updated from v2.7.0 to v2.7.1
• github.com/pion/interceptor updated from v0.1.43 to v0.1.44
• github.com/pion/rtp updated from v1.10.0 to v1.10.1
• github.com/bluenviron/mediamtx-rpicamera updated from v2.5.2 to v2.5.3

Security

Binaries are compiled from source code by the Release workflow without human intervention.

You can verify that binaries have been produced by the workflow by using GitHub Attestations:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

New major features

General

• add always available streams (#5335) When the publisher or source of a stream is offline, the server can be configured to fill gaps in the stream with a video that is played on repeat until a publisher comes back online. This allows readers to stay connected regardless of the state of the stream. The offline video and any future online stream are concatenated without decoding or re-encoding packets, using the original codec.

API

• add available, availableTime, online, onlineTime properties (#5391) these replace ready and readyTime and allow to monitor the new "always-available" feature.

WebRTC

• support reading KLV tracks (#4722)

Fixes and improvements

General

• move away from balenalib Docker images (#5313)
• print OS and Arch in first log line (#5315)
• print last decode error (#5319) decode errors are still grouped together, but the last one is now printed.
• print last processing error (#5323)
• use the same filtering process for every codec (#5324) this allows to apply features that were previously implemented for single codecs (like RTP packet resizing), to any codec, and simplifies future development.
• prevent several configuration errors (#5368)
• fix typos in documentation (#5370)
• fix overriding default user with environment variables (#5371) MTX_AUTHINTERNALUSERS_0_USER and MTX_AUTHINTERNALUSERS_0_PASS are now working even when the configuration file is present.
• prevent setting empty usernames with environment variables (#5373)
• fix panic with environment variables (#5374) this happened when loading deprecated slices of structs with environment variables.
• prevent setting slices to null (#5375) In Golang, slices can be set to nil, while in most other languages they cannot. This causes compatibility issues, especially because the OpenAPI definition of the API does not allow slices to be nil. This prevents slices from being set to nil through JSON/YAML, and also sets default slices to an empty list instead of nil.
• Update hlsEncryption documentation on Low-Latency HLS requirements (#5379)
• fix race condition when closing HTTP servers (#5390) when a HTTP server is closed, open connections are now immediately closed and open routines are waited before the server is considered closed.
• deprecate fallback (#5388) The fallback feature worked with RTSP only and did not allow readers to resume the original stream. It has been replaced by alwaysAvailable.
• mpegts: add E-AC-3 (Dolby Digital Plus) codec support (bluenviron/mediacommon#272)
• mpeg4audio: support channel_config=0 (bluenviron/mediacommon#273)
• mpeg4audio: in ASC, prefer marshaling legacy ChannelConfig when available (bluenviron/mediacommon#280)
• pmp4: increase compatibility (bluenviron/mediacommon#293)
• pmp4: support MP4s with data before track definitions (bluenviron/mediacommon#294)

API

• improve OpenAPI definition (#5380) add uint64, uint, uuid, move WebRTCICEServer into dedicated schema

RTSP

• fix log labels of RTSPS listeners (#5367) use "TCP/RTSPS", "UDP/SRTP", "UDP/SRTCP" to refer to secure listeners
• add rtspUDPSourcePortRange param (#5363) (#5397)

HLS

• fix playback starting point for VOD streams without EXT-X-PLAYLIST-TYPE (bluenviron/gohlslib#308)
• client: return every unit before an error (bluenviron/gohlslib#314) In case of an error, downloaded unit that were not processed yet were discarded. Now they are returned before the client exits.

WebRTC

• print incoming data channel messages (#5357)

RPI Camera

• move away from balenalib Docker images (bluenviron/mediamtx-rpicamera#82)

Dependencies

• code.cloudfoundry.org/bytefmt updated from v0.59.0 to v0.62.0
• github.com/bluenviron/gohlslib/v2 updated from v2.2.4 to v2.2.5
• github.com/bluenviron/gortmplib updated from v0.2.0 to v0.2.1
• github.com/bluenviron/gortsplib/v5 updated from v5.2.2 to v5.3.0
• github.com/bluenviron/mediacommon/v2 updated from v2.6.0 to v2.7.0
• github.com/golang-jwt/jwt/v5 updated from v5.3.0 to v5.3.1
• github.com/matthewhartstonge/argon2 updated from v1.4.4 to v1.4.5
• github.com/pion/ice/v4 updated from v4.1.0 to v4.2.0
• github.com/pion/interceptor updated from v0.1.42 to v0.1.43
• github.com/pion/rtp updated from v1.9.0 to v1.10.0
• github.com/pion/transport/v3 removed
• github.com/pion/webrtc/v4 updated from v4.2.1 to v4.2.3
• golang.org/x/crypto updated from v0.46.0 to v0.47.0
• golang.org/x/sys updated from v0.39.0 to v0.40.0
• golang.org/x/term updated from v0.38.0 to v0.39.0
• github.com/pion/datachannel updated from v1.5.10 to v1.6.0
• github.com/pion/dtls/v3 updated from v3.0.9 to v3.0.10
• github.com/pion/sctp updated from v1.9.0 to v1.9.2
• github.com/pion/srtp/v3 updated from v3.0.9 to v3.0.10
• github.com/pion/stun/v3 updated from v3.0.2 to v3.1.1
• github.com/pion/turn/v4 updated from v4.1.3 to v4.1.4
• golang.org/x/net updated from v0.48.0 to v0.49.0
• golang.org/x/text updated from v0.32.0 to v0.33.0
• github.com/pion/transport/v4 v4.0.1 added
• github.com/bluenviron/mediamtx-rpicamera updated from v2.5.1 to v2.5.2

Security

Binaries are compiled from source through the Release workflow without human intervention, preventing any external interference.

You can verify that binaries have been produced by the workflow by using GitHub Attestations:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

Fixes and improvements

General

• add structured logging (#5219)
• fix 1-minute offset when recording a H264 WebRTC track (#5275) (#5278)
• disable syslog logging on macOS (#5005) (#5295)
• set syslog priority and do not write level and date to syslog (#4923) (#5296) When writing log entries to syslog, pass the level (WARN, INFO, etc) directly to syslog. Avoid writing level and date. This provides a better integration and allows to use syslog search tools.

RTSP

• avoid setupping back channels (#5074) (#5289)
• Support URI format sent by HappyTime ONVIF and RTSP clients during (bluenviron/gortsplib#964)
• fix medias wrongly marked as back channels (#5074) (bluenviron/gortsplib#970) Some cameras mark medias as back channels even though they are not. Try to detect this by checking whether in full the SDP there are both back channels and standard channels, unmarking back channels otherwise.
• when there are back channels, add recvonly attribute to standard channels (bluenviron/gortsplib#971)

SRT

• fix broken connections in case of high latency (#3756) (#5282) When listening and accepting an incoming connection request, the response might be received by the peer with some delay due to latency. This causes the peer to send a second connection request, that is not detected as duplicate because the first connection request has already been removed from the map that is used to check for duplicates (connReqs), so it is treated as a brand new connection request, breaking the first connection. This patch fixes the issue by introducing another map (connByPeer) that is used to check whether a connection request is associated to an already-accepted connection.

Dependencies

• code.cloudfoundry.org/bytefmt updated from v0.58.0 to v0.59.0
• github.com/bluenviron/gortmplib updated from v0.1.2 to v0.2.0
• github.com/bluenviron/gortsplib/v5 updated from v5.2.1 to v5.2.2
• github.com/bluenviron/mediacommon/v2 updated from v2.5.3 to v2.6.0
• github.com/matthewhartstonge/argon2 updated from v1.4.3 to v1.4.4
• github.com/pion/ice/v4 updated from v4.0.13 to v4.1.0
• github.com/pion/rtp updated from v1.8.26 to v1.9.0
• github.com/pion/sdp/v3 updated from v3.0.16 to v3.0.17
• github.com/pion/webrtc/v4 updated from v4.1.7 to v4.2.1
• golang.org/x/crypto updated from v0.45.0 to v0.46.0
• golang.org/x/sys updated from v0.38.0 to v0.39.0
• golang.org/x/term updated from v0.37.0 to v0.38.0
• github.com/pion/dtls/v3 updated from v3.0.8 to v3.0.9
• github.com/pion/sctp updated from v1.8.41 to v1.9.0
• github.com/pion/stun/v3 updated from v3.0.1 to v3.0.2
• github.com/quic-go/qpack updated from v0.5.1 to v0.6.0
• github.com/quic-go/quic-go updated from v0.54.1 to v0.57.0
• go.uber.org/mock removed
• golang.org/x/mod removed
• golang.org/x/net updated from v0.47.0 to v0.48.0
• golang.org/x/sync removed
• golang.org/x/text updated from v0.31.0 to v0.32.0
• golang.org/x/time updated from v0.9.0 to v0.12.0
• golang.org/x/tools removed

Security

Binaries are compiled from source through the Release workflow without human intervention, preventing any external interference.

You can verify that binaries have been produced by the workflow by using GitHub Attestations:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

Fixes and improvements

General

• apidocs: fix compatibility with OpenAPI 3.0 (#5210) double-precision numbers are now represented as double.
• playback: support concatenating segments with long gaps (#5172) Thanks to the new mtxi MP4 box, it's possible to check whether two segments are consecutive without involving dates or timestamps. When the new mtxi box is present in both segments, do not check if the end of the first segment corresponds to the start of the second segment.
• recorder: reset when absolute time drifts from stream time (#4778) (#5239) the server now detects when system time changes too much and restarts recordings when that happens.
• playback: fix crash (#5240) (#5250) when requesting a recording with the mp4 format, if there are two tracks and the second track has no samples, the server crashed. This fixes the issue.
• fix panic when changing log file to a nonexisting directory (#5132) (#5249)
• h264: fix regression in DTS extractor (#5207) (bluenviron/mediacommon#263)
• h264: increase MaxNALUsPerAccessUnit (bluenviron/mediacommon#262) Some parrot drones use slice-encoding with 45 independent slices, resulting in frames consisting of 48 NALUs.
• pmp4: fix crash when unmarshaling and there are no samples (#5240) (bluenviron/mediacommon#267)
• fmp4: Correctly parse trun v0 sample composition time offset (bluenviron/mediacommon#268)
• h265: fix DTS extraction with multiple slices (#5071) (bluenviron/mediacommon#269)

API

• always reply with JSON in case of success or failure (#5252) Reply with "status": "ok" in case of success, and with "status": "error" in case of error. This makes the API more accessible and user friendly.

RTSP

• fix crash when setupping tracks between stream changes (#5253) (#5257)
• Allow 1 byte of extra padding at mikey message (bluenviron/gortsplib#953)

RTMP

• prevent dropping initial video and audio frames (bluenviron/gortmplib#26)

Dependencies

• github.com/bluenviron/gortmplib updated from v0.1.1 to v0.1.2
• github.com/bluenviron/gortsplib/v5 updated from v5.2.0 to v5.2.1
• github.com/bluenviron/mediacommon/v2 updated from v2.5.1 to v2.5.3
• github.com/go-git/go-billy/v5 updated from v5.6.2 to v5.7.0
• github.com/go-git/go-git/v5 updated from v5.16.3 to v5.16.4
• github.com/pion/ice/v4 updated from v4.0.10 to v4.0.13
• github.com/pion/rtp updated from v1.8.25 to v1.8.26
• github.com/pion/webrtc/v4 updated from v4.1.6 to v4.1.7
• github.com/pion/dtls/v3 updated from v3.0.7 to v3.0.8
• github.com/pion/mdns/v2 updated from v2.0.7 to v2.1.0
• github.com/pion/sctp updated from v1.8.40 to v1.8.41
• github.com/pion/srtp/v3 updated from v3.0.8 to v3.0.9
• github.com/pion/stun/v3 updated from v3.0.0 to v3.0.1
• github.com/pion/turn/v4 updated from v4.1.1 to v4.1.3

Security

Binaries are compiled from source through the Release workflow without human intervention, preventing any external interference.

You can verify that binaries have been produced by the workflow by using GitHub Attestations:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.04.28

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.04.28

Changes

• allow filtering out members-only videos in subscriptions (closes #971) (5d96a58)

[0.16.2] - 2026-04-28

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

• OIDC: Fallback to userinfo endpoint when JWT token does not contain an email claim.
• S3: verifyAfterWrite option to verify that objects have persisted after writing.

Changed

• Allow HTTP to be used for configuring the server.

Fixed

• LDAP: Generate valid credentialId when there are password changes.
• TLS: Disable cipher suited option disables wrong ciphers.
• DNS Updater:
  • BunnyDNS: Use subdomain as name of record instead of FQDN.
  • RFC2136: Chunk TXT records.
• Skip invalid entries in log files.

Check binary attestation here

Changelog

Others

• cc605ac: Added shutdown group (#1732) (@mabbas007)
• b297f3a: Format pending countdown as MM:SS (#1727) (@phuonganh2601)
• af655d3: build(deps-dev): bump vite from 7.3.1 to 7.3.2 in /frontend (@dependabot[bot])
• 6df1205: update deps (@seriousm4x)

Github Actions

• aabd8c1: gh-action: bump dependabot/fetch-metadata from 2 to 3 (@dependabot[bot])
• 24e218b: gh-action: bump pnpm/action-setup from 5 to 6 (@dependabot[bot])

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.04.26

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.04.26

Changes

• implement time-clipped downloads (closes #969, replaces #907) (4f83174)
• title filter for subscriptions (closes #968) (91ee831)
• Bump aquasecurity/trivy-action in the github-actions group (d89a5dd)

[0.16.1] - 2026-04-25

This version includes multiple breaking changes. If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

• OIDC: Extract username from JWT token.
• system('node_hostname') and system('node_role') expression variables to retrieve the local node hostname and cluster role respectively.

Changed

Fixed

• JMAP:
  • Invalid receivedAt headers after importing (#2939).
  • Sorting order issues when emails lack receivedAt headers.
• IMAP: Fix BINARY fetch responses (#2940).
• WebDAV: Fix ACL validation for target folders.
• ACME: Allow requesting apex domain certificates.
• Hostname issues:
  • Accept RFC 6761 reserved TLDs during bootstrap.
  • Allow hostnames without TLDs in remote server settings.
• Reverse proxy issues.
• OSS builds.
• DNS Updater:
  • RFC2136: TSIG secret not base64 decoded.
  • Google DNS: Chunk TXT records when they exceed 255 characters.
  • Cloudflare:
    • Fix CAA record updates.
    • Check zone subdomains when finding zones

Check binary attestation here

Releases Notes for 29.7.9

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

Windows intel x32 releases are marked -ia32-

ChangeLog:

• #2394
• Uses electron 40.9.2
• Updates to draw.io core 29.7.9.

32.1.2 Hotfix Changes

• Fixed scene list selection lag regression present in 32.1.0 and 32.1.1 [Warchamp7]
• Fixed nested menu appearance [Warchamp7]
• Fixed warnings about non-existent properties in some themes [Warchamp7]

32.1.1 Hotfix Changes

• Fixed missing audio mixer tooltips [Warchamp7]
• Fixed audio mixer minimum width being too large [Warchamp7]
• Fixed audio mixer sorting weight for global and pinned sources [Warchamp7]
• Fixed disabled sources appearing in audio mixer [Warchamp7]
• Fixed missing toolbar actions for audio mixer [Warchamp7]
• Fixed incorrect colors in audio mixer [Warchamp7]
• Fixed audio deduplication incorrectly applying when an audio output capture source is set to monitor only [pkviet]

32.1 New Features

• Overhauled the Audio Mixer [Warchamp7]
  • Adjusted the horizontal layout
  • Adjusted the vertical layout
  • Added button to swap layouts to the toolbar
  • Changed the default layout to vertical
  • Added button to toggle audio monitoring
  • Sources in the preview are now shown while in Studio Mode
  • Added ability to pin audio sources
    • Pinned sources are always displayed
    • Global audio sources are always pinned
  • Added ability to display sources set to hide
  • Added ability to display sources that are not in the current scene
• Added WebRTC Simulcast Support [Sean-Der]
• Added missing undo/redo actions for scene items [cg2121]
  • Scale filtering, blending mode, blending method, deinterlacing mode and deinterlacing field order
• Added partial support for Canvases to obs-websocket [exeldro/tt2468/Warchamp7]

32.1 Changes

• Improved security of browser sources using local files [Warchamp7]
• Improved plugin manager by allowing enabling/disabling missing plugins [Warchamp7]
• Removed "Source" from source names [Warchamp7]
• Updated the Edit Transform dialog [Warchamp7]
• Changed copying a scene item to copy all properties [cg2121/Warchamp7]
• Disabled dock animations [Warchamp7]
• Moved transition preview button to button box [exeldro]
• Rearranged default dock positions [Warchamp7]
• Increased media source playback slider update rate [Warchamp7]
• Enabled palette for Light theme audio mixer [Warchamp7]
• Changed default bitrates to 6000 kbps [mihawk90]

32.1 Bug Fixes

• Fixed a crash if some source data was null [Penwy]
• Fixed a crash on Linux when changing profiles or on application shutdown [hoshinolina]
• Fixed a possible crash on macOS during application shutdown if YouTube docks were active [PatTheMav]
• Fixed an issue where projector resolutions had decimals [Warchamp7]
• Fixed sync of Preview/Program size and positioning [Warchamp7]
• Refactored OBSBasic::Save to only save frontend canvas scenes/groups [dsaedtler]
• Fixed NAL type for HEVC caption/BPM SEIs [dsaedtler]
• Fixed an issue where video scaling could be incorrect in multivideo encoder scenarios [dsaedtler]
• Fixed an issue with chapter markers having incorrect time when using file splitting [garyholmes]
• Fixed an issue where some recordings could have black thumbnails [derrod]
• Fixed an issue where the NVIDIA Blur and Background Blur could have banding or look splotchy [pkviet]
• Fixed an issue where macOS Screen Capture would select an item for capture by default [jcm93]
• Fixed an issue with PipeWire when capturing a device that does not require a framerate [tytan652]
• Fixed an issue where PipeWire Camera framerates listed could be incorrect [tytan652]
• Fixed an issue where HDR video playback in Media Source could be darker than expected [xtfo]
• Fixed an issue that could cause OBS to become unable to change profiles or video settings [exeldro]
• Fixed an issue that could cause transitions to become locked [Warchamp7]

Checksums

OBS-Studio-32.1.2-Sources.tar.gz: c6532380c68a75327fe8b551461adeca8f184dcbe4015096251a6de76362a554
OBS-Studio-32.1.2-Ubuntu-24.04-x86_64-dbsym.ddeb: 3cf56a96de5d0b45f641e8415d3dacc1e47dfc897ba5bcd118b3af05a9ea76da
OBS-Studio-32.1.2-Ubuntu-24.04-x86_64.deb: a3bb1b0176604dad9e22710e057f0fdd76e8afb600e0e1914c30464ae49908e8
OBS-Studio-32.1.2-Windows-arm64-PDBs.zip: 609c4cd849f8d225b021a5f50a080c31af8beb1b5275f2b0088318ab80b0ed78
OBS-Studio-32.1.2-Windows-arm64.zip: 5e1e400e1b49d2019c97c928873229336c8e0b56df488663532376485746328e
OBS-Studio-32.1.2-Windows-x64-Installer.exe: 94d180c1fc481ccc307b95513f795d088d63ac4f61ad3253c2ac0d94d0844110
OBS-Studio-32.1.2-Windows-x64-PDBs.zip: 8105fed359f3437819264b0ebb1c50db6d3bb30de1a65d4a3049e3c14f88deb8
OBS-Studio-32.1.2-Windows-x64.zip: 8d97e4563bd8d22d03e63042aa7dccede1d555c9bd35ce8a9e5019b0d0201bf6
OBS-Studio-32.1.2-macOS-Apple-dSYMs.tar.xz: eea32d7c022237e163a02f8f2fdc26c8b1a0d4a4fc3fb49aaf14df7b59b3d668
OBS-Studio-32.1.2-macOS-Apple.dmg: 2aeb3aaa99544fefd557f10ac6550e73df71540dd57528b2a1e6f39a55ebacfb
OBS-Studio-32.1.2-macOS-Intel-dSYMs.tar.xz: 6a06ed32e0626cafcb7d4f53074b80e63329c1c99309c7f5898d469ed0ef307c
OBS-Studio-32.1.2-macOS-Intel.dmg: f7febee4c52e97930ffa9d8bcae79ee4c60c411827688cfbe36bc53edc51616e

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.04.21

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.04.21

Changes

• upgrade dependencies (abb9492)
• cr fixes (23de982)
• Updated import and fixed race condition (0ea934c)

[0.16.0] - 2026-04-20

This version includes multiple breaking changes. If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

• Web UI rewritten from the ground up using the JMAP management API, featuring a refreshed design and addressing 76 enhancement requests and bug fixes.
• CLI rewritten from the ground up to use the JMAP management API.
• Security enhancements:
  • Password strength enforcement using the zxcvbn algorithm
  • Password expiration, rotation policies and IP address restrictions for user accounts
  • App Passwords with limited access (#1609), labels (#2255), IP address restrictions and expiration dates
  • API keys with limited access, labels, IP address restrictions and expiration dates
  • Auto-ban comments and details about the triggering event (#1321)
  • Auto-ban expiration after a configurable time period (#964)
• DNS Management:
  • Automatic DNS management of MX, TXT, CNAME, SRV, CAA and TLSA records (#463 #1017 #1419 #2438 #1370 #1406 #1371)
  • Automatic update of TLSA records when ACME certificates change (#1664)
  • RFC2136 SIG(0) support (#856)
  • Route53 provider support (contributed by @jimmystewpot)
  • Google Cloud DNS provider support (contributed by @jimmystewpot)
  • Bunny provider support (contributed by @angeloanan)
  • Porkbun provider support (contributed by @jeffesquivels)
  • DNSimple provider support (contributed by @NelsonVides)
  • Spaceship provider support (contributed by @matserix)
• DKIM:
  • Automatic DKIM key generation, rotation and DNS management (#368 #961)
  • Store DKIM keys in the database (#1264)
  • Ignore insecure signatures when verifying DKIM (#1068 #467)
• ACME/TLS:
  • DNS-PERSIST-01 ACME challenge support (#2837)
  • Renew certificates on demand, view certificate details (#675 #1162 #2566)
  • CAA record support (#468) with accounturi parameter (#1933)
  • TLSA records publishing restricted to 3 1 1 and 2 1 1 (#2193)
• OIDC and OAuth:
  • JWT token validation without requesting userinfo from the OIDC provider.
  • Audience (aud) claim (#2603) and scope validation support.
  • Groups support (#1448)
  • RFC 7636 - Proof Key for Code Exchange by OAuth Public Clients
• LDAP:
  • Separate filter for groups (#1841)
  • Improve support for OpenLDAP schemas (#760)
  • Improve and simplify LDAP settings (#2194 #2174)
• Directory:
  • Masked email addresses for enhanced privacy (Enterprise)
  • Domain aliases (#583)
  • E-mail alias descriptions and option to disable aliases (#506)
  • Account archiving and un-deletion (#2767) (Enterprise)
  • Per-domain directory backends (Enterprise)
• Account configuration and discovery:
  • Automatic Configuration of Email, Calendar, and Contact Server Settings (draft-mailmaint-uaautoconf-04) (#2201)
  • MS Autodiscover V2 support (#679)
• Sieve: Allow deactivating scripts without deleting them (#1251).
• Tracing: Enable events only mode (#2276)
• Clustering:
  • Automatic cluster node ID generation and management.
  • Unified cluster management (#960)
  • Outbound MTA role (#1692)

Changed

• Replaced REST API with JMAP API (#2262 #959 #1480)
• Removed support for Authenticated Received Chain (ARC) sealing (learn more).
• Directory: Removed smtp, imap and memory directory backends.
• Use aws-lc for cryptographic operations instead of ring.
• Use rustls-platform-verifier for TLS certificate verification instead of webpki (#247).

Fixed

• Directory:
  • Cannot remove built-in "admin" role from user once it was assigned (#1467)
  • Delete associated records (#963)
  • Updated Role permissions not applied (#2038)
  • Recreated account cannot log in until server is restarted (#1469)
  • Subaddressing does not work for groups (#475)
  • New LDAP aliases are rejected (#1318).
  • Validate account and group names (#2209)
• MTA:
  • RCPT TO stage settings improvements (#2217 #394)
  • Relay to IP addresses (#838)
  • Duplicate delivery inverted check
  • SASL challenge responses include invalid Go ahead text
• JMAP:
  • Fix inMailboxOtherThan query logic.
  • Fix hasAttachment search field (#2778)
• IMAP:
  • Increment argument max length to 8000 bytes
  • ACL: Add RIGHTS capability (#2762)
  • ACL: Fix ACL SET permission override.
• WebDAV:
  • Return 304 NOT_MODIFIED on If-None-Match
  • Use RFC 2616 instead of RFC 1123 for date formatting
  • Fix ACL container/item mismatch in reports.
  • CalDAV: Allow organized properties to be present in PUT requests if they are equal to the existing ones.
  • CalDAV: Enforce cumulative iCalendar instances cap in CalDAV free-busy REPORT handler
• Configuration: Prefix parsing issues (#2495)
• OIDC: JWKS Exposes Symmetric Signing Key
• SQLite: Fix thread pool exhaustion.
• PostgreSQL: Use clean recycling method on connection pool
• Meilisearch: Make id sorteable.
• ACME: Fix wrong origin for subdomain updates (#2360)
• Spam filter: Skip invalid messages during training.
• Calendar: Include minutes in localized invite templates (#2828)
• HTTP: Fix 204 CORS preflight responses

Check binary attestation here

Releases Notes for 29.7.8

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

Windows intel x32 releases are marked -ia32-

ChangeLog:

• Uses electron 40.9.1
• #2371 , #2160 , #331 , #2380 , #2383 , #2162 , #2376 , #1430 , #2320, #2143
• Updates to draw.io core 29.7.8.

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.04.18

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.04.18

Changes

• fix yt-dlp options overrides (closes #958) (e9f979b)

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.04.16

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.04.16

Changes

• upgrade dependencies (ab42325)
• fix PUBLIC_HOST_URL without a trailing slash (closes #959) (1a32eba)
• don't run workflow on README changes (29ccc42)
• add more CORS details (f2d71cb)

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.04.13

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.04.13

Changes

• fix asterisk CORS_ALLOWED_ORIGINS, mentioned in #955 (03f71fd)

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.04.12

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.04.12

Changes

• fix pnpm build (210c607)
• Bump softprops/action-gh-release from 2 to 3 in the github-actions group (3818969)
• fix yt-dlp options examples (4330d3b)
• update documentation (06c4a2c)