Fixes and improvements

General

• require browser POST requests to have an allowed origin (#6238) Browsers can send POST requests without performing any preflight request and without checking whether the request origin is present in Access-Control-Allow-Origin. Intercept these requests and check server-side whether the origin is allowed, blocking the request if it is not.
• conf: fix comparison and sharing of the default authInternalUsers (#6205)
• h265: fix DTS extraction of streams with long-term reference pictures (bluenviron/mediacommon#371)
• pmp4: support stsz with a constant sample size (#5803) (bluenviron/mediacommon#373)
• pmp4, fmp4: restore check on inbound H265 SPS (bluenviron/mediacommon#374) A valid H265 SPS is required for marshaling back an MP4, so we have to resume checking them.
• pmp4: support tracks without edts (bluenviron/mediacommon#375) The edit box is optional (ISO/IEC 14496-12, 8.6.5), but tracks without it were rejected with "unexpected box 'mdia'".
• pmp4: return seek errors from GetPayload (bluenviron/mediacommon#376) GetPayload checked the wrong variable after seeking, therefore a failed seek was ignored and the payload was read from the current position of the reader.
• pmp4, fmp4: correctly fill HvcC NumTemporalLayers / TemporalIdNested from SPS (bluenviron/mediacommon#379)
• pmp4: support tracks longer than 2^32 ticks (bluenviron/mediacommon#377)

RTSP

• rtpmjpeg: reject reserved quantization value 127 (bluenviron/gortsplib#1161) RFC 2435 reserves quantization values 100-127, but the guard used Quantization < 127
• mpeg4audiolatm: don't panic on a layer that reuses the config (bluenviron/gortsplib#1162)
• sdp: support oversized numbers in origin (#5949) (bluenviron/gortsplib#1171)

RTMP

• correctly fill HvcC NumTemporalLayers / TemporalIdNested from SPS (bluenviron/gortmplib#129)
• reader: support standalone SEIs from DJI drones (#5221) (bluenviron/gortmplib#130)

HLS

• make the server manage sessions (#6239) Sessions are now managed by the HLS server, detaching their lifecycle from muxers. This also comes with a performance improvement, since finding a session now traverses a single mutex, and not two channels like before.
• return 404 when a session is valid but muxer is closed (#5736) (#6240) HLS sessions are now kept open for up to 30 seconds after a muxer is closed. This allows the server to handle incoming requests belonging to these sessions and to classify then as 404 rather than 401.
• change error returned in case session is not found (#6241) match the RTSP behavior and return a "session not found" message rather than an "authentication error", which is reserved for creating sessions, not for using them.
• muxer: return 404 when closed (bluenviron/gohlslib#394)

WebRTC

• fix AV1 getting stuck by stripping padding (#5632) (#5774) (#6242) AV1 OBU padding is generated by several encoders. Stripping it has been demonstrated to solve most situations in which browsers get stuck when playing such streams.
• fix stuck decoding with DJI drones (#5221) (#6051) (#6243) Streams from DJI drones contain SEI units with payload type 5 and a specific UUID that seem to cause stuck videos on Chrome and Firefox. Filter out these units.
• add ability to exclude interfaces (#5788)

Dependencies

• code.cloudfoundry.org/bytefmt updated from v0.88.0 to v0.90.0
• github.com/MicahParks/keyfunc/v3 updated from v3.8.1 to v3.8.2
• github.com/abema/go-mp4 updated from v1.7.1 to v1.7.3
• github.com/bluenviron/gohlslib/v2 updated from v2.4.4 to v2.4.5
• github.com/bluenviron/gortmplib updated from v1.0.2 to v1.0.3
• github.com/bluenviron/gortsplib/v5 updated from v5.6.5 to v5.6.6
• github.com/bluenviron/mediacommon/v2 updated from v2.9.4 to v2.9.5
• github.com/gin-contrib/pprof updated from v1.5.4 to v1.5.5
• github.com/matthewhartstonge/argon2 updated from v1.5.7 to v1.6.3
• github.com/pion/ice/v4 updated from v4.4.1 to v4.4.2
• github.com/pion/interceptor updated from v0.1.47 to v0.1.48
• github.com/pion/sdp/v3 updated from v3.0.19 to v3.0.20
• github.com/pion/transport/v4 updated from v4.1.0 to v4.1.1
• github.com/pion/webrtc/v4 updated from v4.2.19 to v4.2.20
• golang.org/x/crypto updated from v0.55.0 to v0.57.0
• golang.org/x/net updated from v0.58.0 to v0.59.0
• golang.org/x/sync updated from v0.22.0 to v0.23.0
• golang.org/x/sys updated from v0.47.0 to v0.48.0
• golang.org/x/term updated from v0.45.0 to v0.46.0
• github.com/bytedance/gopkg updated from v0.1.3 to v0.1.4
• github.com/bytedance/sonic updated from v1.15.0 to v1.15.2
• github.com/bytedance/sonic/loader updated from v0.5.0 to v0.5.1
• github.com/cloudwego/base64x updated from v0.1.6 to v0.1.7
• github.com/gabriel-vasile/mimetype updated from v1.4.12 to v1.4.13
• github.com/gin-contrib/sse updated from v1.1.0 to v1.1.1
• github.com/go-playground/validator/v10 updated from v10.30.1 to v10.30.3
• github.com/goccy/go-json updated from v0.10.5 to v0.10.6
• github.com/klauspost/cpuid/v2 updated from v2.3.0 to v2.4.0
• github.com/mattn/go-isatty updated from v0.0.20 to v0.0.23
• github.com/pelletier/go-toml/v2 updated from v2.2.4 to v2.4.3
• github.com/pion/dtls/v3 updated from v3.1.5 to v3.1.8
• github.com/pion/mdns/v2 updated from v2.1.0 to v2.2.0
• github.com/pion/srtp/v3 updated from v3.0.13 to v3.0.15
• github.com/pion/stun/v3 removed
• github.com/pion/turn/v5 updated from v5.0.13 to v5.1.0
• go.mongodb.org/mongo-driver/v2 updated from v2.5.0 to v2.8.0
• golang.org/x/arch updated from v0.22.0 to v0.29.0
• golang.org/x/text updated from v0.41.0 to v0.42.0
• google.golang.org/protobuf updated from v1.36.10 to v1.36.11
• github.com/pion/stun/v4 v4.0.0 added
• hls.js updated from v1.7.2 to v1.7.3

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.09.20

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.09.20

Changes

• build: pin the frontend builder image to the last QEMU-safe digest (300bf79)
• fix: align the row action icons across both download tables (ec01524)
• fix: stop offering a dead Start button on queued downloads (closes #1081) (a6d81d4)

What's Changed

• refactor(gui): split app_icon around an AppIconExt trait by @AprilNEA in #1422
• fix(gui): hold a config reload until the agent connects by @AprilNEA in #1416
• refactor(ipc): own the client handshake once and guard it with ast-grep by @AprilNEA in #1424
• refactor(core): name the process roles, host profiles, and environment knobs once by @AprilNEA in #1426
• refactor(ipc,cli): bound the handshake once and give the CLI one agent door by @AprilNEA in #1427
• refactor(core): build every worker runtime in one place by @AprilNEA in #1428
• refactor(core): spell the app bundle's layout once by @AprilNEA in #1429
• docs(infra): add openlogi workflow skills by @AprilNEA in #1409
• docs(infra): refine agent guidance and diagnostic workflows by @AprilNEA in #1485
• refactor(cli): give the command modules that carry code a file of their own by @AprilNEA in #1494
• refactor(hidpp): split the pending-request queue and the mock channel out of channel.rs by @AprilNEA in #1495
• refactor(hook): split the macOS backend by responsibility by @AprilNEA in #1496
• refactor(hook): split the Linux backend into the evdev hook and the foreground watcher by @AprilNEA in #1497
• chore: drop an unused dependency, a dead parameter, and stale docs by @AprilNEA in #1487
• refactor(gui): let state mutators own their events and views share one relevance filter by @AprilNEA in #1505
• refactor(gui): give write-on-release sliders one component by @AprilNEA in #1506
• refactor(ipc): own the observe loop's connection state in one Observer by @AprilNEA in #1507
• perf(gui): resolve each device's assets once per asset generation by @AprilNEA in #1508
• refactor(gui): say what the state types are by @AprilNEA in #1509
• refactor(core): give the key vocabulary one owner by @AprilNEA in #1488
• refactor(core): give seven copied decisions one owner each by @AprilNEA in #1489
• refactor(xtask): spell xtask's waits and its bundle builder in the workspace's vocabulary by @AprilNEA in #1490
• ci(windows): run the tests on Windows by @AprilNEA in #1491
• refactor(device): drop the capture paths nothing calls and type the session errors by @AprilNEA in #1500
• refactor(core): split the config module by concern by @AprilNEA in #1511
• refactor(device): split the inventory and probe modules by responsibility by @AprilNEA in #1512
• refactor(device): call durations that bound a wait timeouts by @AprilNEA in #1513
• refactor(device): run gesture and keyboard capture through one session skeleton by @AprilNEA in #1501
• refactor(device): share one pending-restore token between capture and host switch by @AprilNEA in #1502
• refactor(agent): run the capture watchers on one harness and name the device-access handles by @AprilNEA in #1503
• refactor: say what eight identifiers are by @AprilNEA in #1517
• refactor(camera): suffix the macOS backends like the other platforms' by @AprilNEA in #1518
• refactor(gui): move the F-key geometry into function_row/key_points.rs by @AprilNEA in #1525
• refactor(agent): move the device list and re-apply plan into orchestrator/devices.rs by @AprilNEA in #1526
• refactor(gui): split the AppState tests by what they exercise by @AprilNEA in #1527
• refactor(inject): run scripts and workflows once, over four platform hooks by @AprilNEA in #1529
• refactor(core): split the config tests by what they exercise by @AprilNEA in #1530
• refactor(device): split the inventory and gesture capture tests by what they exercise by @AprilNEA in #1531
• refactor(agent): split the orchestrator tests by what they exercise by @AprilNEA in #1532
• refactor(hidpp): split the channel tests by what they exercise by @AprilNEA in #1533
• refactor(device): move the host-switch session's tests to host_switch/tests.rs by @AprilNEA in #1535
• refactor(agent): move the button runtime's worker loop into button/worker.rs by @AprilNEA in #1536
• refactor(inject): break the macOS injector into scroll, browser and SPI modules by @AprilNEA in #1537
• refactor(gui): move the mouse view's binding labels and tests out of view.rs by @AprilNEA in #1538
• refactor(gui): move the camera panel's row builders into controls/rows.rs by @AprilNEA in #1539
• feat(gui): detect and display installation sources by @AprilNEA in #1515
• docs(gui): mend the desktop crate's intra-doc links by @AprilNEA in #1541
• chore: release v0.8.6 by @AprilNEA[bot] in #1481

Full Changelog: v0.8.5...v0.8.6