❌

Lees weergave

↗️

v0.16.17

✇Stalwart
Door: github-actions[bot]

[0.16.17] - 2026-08-10

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

  • IMAP:
  • WebDAV: Range and If-Range header support on file downloads (RFC 7233) (#2377).
  • Spam filter: url_original expression variable for Url rules.

Changed

  • Memory allocator: Replaced the unmaintained jemallocator crate with tikv-jemallocator (contributed by @checkraisefold).
  • ACME registry: Use description as label property.

Fixed

  • MTA:
    • Certificates for domains publishing an enforcing MTA-STS policy are always validated, even in the fallback TLS strategy.
    • DSN delivery date uses wrong timestamp.
    • FUTURERELEASE HOLDUNTIL uses Unix timestamps instead of RFC 3339 date-times.
  • JMAP:
    • EmailSubmission/query filtering on undoStatus contradicts EmailSubmission/get, reporting held FUTURERELEASE submissions as final instead of pending.
    • EmailSubmission/get requests without an ids argument iterates the wrong index.
  • CardDAV: Accept: text/vcard version negotiation is ignored whenever another parameter such as q or charset follows version=.
  • Calendar: Server-side scheduling messages place the text/calendar part outside the multipart/alternative and disposed as an attachment.
  • Sharing: Accounts holding the impersonate permission never have their ACL grants collected, so shared items are never listed in JMAP sessions, CalDAV/CardDAV discovery or IMAP.
  • IMAP:
    • COPY/MOVE into a shared folder fails with NO [ALREADYEXISTS] when the destination account already holds the message, leaving the message in the source mailbox and clients in a retry loop.
    • BODYSTRUCTURE and ENVELOPE return MIME parameters, Content-Description, subjects and display names as raw UTF-8 even to sessions that never enabled UTF8=ACCEPT.

Check binary attestation here

  •  
  • ↗️
↗️

v1.20.0

✇MediaMTX
Door: github-actions[bot]

New major features

General

  • support forwarding streams natively (#5558) It is now possible to define forward destinations for each path configuration. For each destination, the server will create a client that will forward the stream to the intended destination. Supported protocols are RTSP, RTMP, SRT. API and metrics have also been improved to allow monitoring the new forwarding system. Documentation: https://mediamtx.org/docs/features/forward

Media-Over-QUIC

  • support publishing and reading through native QUIC (#6039)
  • support draft-17 (#6040)
  • support draft-16 (#6045)

Fixes and improvements

General

  • docs: add missing MoQ ports (#5983)
  • Add OpenAPI definition of the Playback server (#5546)
  • fix support for regexp groups greater than 10 (#6033)

Media-Over-QUIC

  • increase max namespace field count to 32 (#6043)
  • link primitives to draft-17 sections (#6044)

RTSP

  • fix inability to read some AV1 streams with RTSP (#6001) (#6006) Since v1.16.0, temporal unit delimiters were not stripped from AV1 streams anymore. This has been restored, healing AV1 streams read with RTSP.
  • log write errors (#6023)
  • make multicast errors on single interfaces non-fatal (bluenviron/gortsplib#1115) (#5574) When writing multicast packets to several interfaces at one, a write error to a single interface was fatal and prevented writing to the other ones. Fix this.

RTMP

  • server: fix parsing URL from multitrack OBS (#6007) (bluenviron/gortmplib#93)
  • client: change mapping between URL and tcURL, app, streamKey (bluenviron/gortmplib#94) (#4676) URLs passed to clients are now mapped into RTMP-native fields (tcURL, app, streamKey) in this way: tcURL contains URL without credentials and without fragment, app contains path and query of tcURL, streamKey contains the fragment.
  • client: fix compatibility with YouTube (#5558) (bluenviron/gortmplib#95)

HLS

WebRTC

  • sort tracks in a deterministic way (#5988) (#5989) When ingesting tracks with WebRTC, track order was randomized, preventing multi-track always-available streams from working reliably, since they require tracks to be ordered in a precise way. WebRTC tracks are not ordered by MID, RID, trackID and streamID respectively.
  • fix packet corruption when reading G722 (#6000)
  • reset recomputed audio PTS if it drifts too much (#6021)
  • fix "packet lost" error when routing streams from WebRTC (#6034) Chrome sometimes sends empty packets, that are discarded by the server, but the sequence number of following packets is not recomputed, leading downstream packet loss detectors to emit errors. This is fixed.

SRT

  • improve log clarity (#5990) use message 'passphrase not provided by client' when clients do not provide passphrases.
  • show stream ID in logs (#6018)
  • close sources immediately when path is closed (#6038)

Dependencies

  • code.cloudfoundry.org/bytefmt updated from v0.82.0 to v0.83.0
  • github.com/MicahParks/jwkset updated from v0.11.0 to v0.11.3
  • github.com/MicahParks/keyfunc/v3 updated from v3.8.0 to v3.8.1
  • github.com/bluenviron/gohlslib/v2 updated from v2.4.1 to v2.4.2
  • github.com/bluenviron/gortmplib updated from v0.4.1 to v1.0.0
  • github.com/bluenviron/gortsplib/v5 updated from v5.6.2 to v5.6.3
  • github.com/go-git/go-billy/v5 updated from v5.9.0 to v5.9.1
  • github.com/go-git/go-git/v5 updated from v5.19.1 to v5.19.2
  • github.com/pion/ice/v4 updated from v4.3.0 to v4.4.0
  • github.com/pion/interceptor updated from v0.1.46 to v0.1.47
  • github.com/pion/webrtc/v4 updated from v4.2.17 to v4.2.18
  • github.com/quic-go/quic-go updated from v0.60.0 to v0.61.0
  • github.com/quic-go/webtransport-go updated from v0.11.1 to v0.12.0
  • github.com/pion/sctp updated from v1.11.0 to v1.11.1
  • golang.org/x/time updated from v0.14.0 to v0.15.0

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

  •  
  • ↗️
↗️

v0.16.16

✇Stalwart
Door: github-actions[bot]

[0.16.16] - 2026-08-02

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

  • JMAP Email Delivery Push Notifications (draft-ietf-jmap-emailpush-03)
  • MTA: Allow System Sieve scripts to access orcpt during the DATA stage.

Changed

  • S3: accessKey can now be read from an environment variable or file.

Fixed

  • Meilisearch: Verify index existence using GET instead of creating a new task which times out on busy servers.
  • Branding: Stalwart logo flashes before the per-tenant logo is loaded on the login page.
  • Calendar: iMIP and alarm notification messages embed the default logo using bare LF line endings, producing a single 4247 octet line that strict SMTP relays reject with line too long.
  • DMARC: Failure reports state Identity-Alignment: none when a mechanism authenticated successfully but against an identity that is not aligned with the From domain.
  • Redis: Task and queue locks are never released after a worker dies, because failed lock attempts refresh the lock expiry.
  • Recovery mode: Download WebUI if missing.
  • Logging: The systemd journal tracer omits the parent span's fields.
  • MTA:
    • BDAT chunks sent without a valid MAIL FROM are answered with 552 5.3.4 Message too big for system instead of 503 5.5.1.
    • A maxMessageSize of 0 rejects every message with 552 5.3.4 Message too big for system instead of disabling the size limit.
  • Windows: Listeners bound to the unspecified IPv6 address ([::]), including all defaults, refuse IPv4 connections such as 127.0.0.1, since IPV6_V6ONLY is enabled by default on Windows.

Check binary attestation here

  •  
  • ↗️
↗️

v0.16.15

✇Stalwart
Door: github-actions[bot]

[0.16.15] - 2026-07-26

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

Changed

Fixed

  • JMAP:
    • Email/copy should return alreadyExists when copying a message to a mailbox that already contains it.
    • Email/copy with onSuccessDestroyOriginal destroys the copy's creation id instead of the source Email id.
    • CalendarEvent/set does not generate a uid on create when the client omits it.
    • CalendarEvent/set does not refresh the updated property (iCalendar DTSTAMP) on create or update.
    • EmailSubmission/set rejects valid recipients whose domain is itself a public suffix (e.g. gov.in, co.uk).
    • Requests are rejected with notRequest when a method name contains a JSON-escaped solidus (e.g. Core\/echo).
  • MTA: Panic when MTA-STS is disabled and a remote MTA fetched /.well-known/mta-sts.txt.
  • Auth: Scoped credentials with SysApiKeyCreate or SysApiKeyUpdate permissions can regain its own account's full rights.
  • Web Push: Valid VAPID keys are rejected when PEM-encoded with explicit EC parameters, in SEC1 (EC PRIVATE KEY) format, or with a leading byte-order mark.
  • Encryption at rest: Appended messages are encrypted for accounts that did not opt in to encryptOnAppend.
  • Cache: Account caches silently discard entries larger than a single quick-cache shard, causing constant database rebuilds.
  • Registry: Id references (e.g. #certificate-...) fail to resolve on defaultCertificateId, defaultAdminRoleIds, listenerIds and publicKey.
  • Search: reindex drops calendar and contact index tasks for accounts with fewer than a full batch of items.
  • Migration: Abort --import when the target already contains data in the key range being imported.
  • Cluster: Broadcast subscriber re-subscribes after every message, losing bursts of cluster broadcasts during the reconnect window.
  • Enterprise: Per-tenant logo is not shown on the OAuth login password and OTP screens, which are served from the server's canonical host rather than the tenant domain.

Check binary attestation here

  •  
  • ↗️
↗️

v1.19.3

✇MediaMTX
Door: github-actions[bot]

Fixes and improvements

General

  • fix error message (#5922) 'all' is a synonym for 'all_others'
  • fix clearing lists with environment variables (#5410) (#5924) MTX_AUTHINTERNALUSERS_0_IPS, MTX_LOGDESTINATIONS and MTX_RTSPTRANSPORTS can now be used to clear their corresponding list by setting them to an empty value.
  • add runOnOnline / runOnOffline hooks (#5399) (#5956) These are triggered and a stream is online (i.e. not just provided by an offline segment).
  • rename runOnReady into runOnAvailable, runOnNotReady into runOnUnavailable (#5957)
  • fix wrong PTS and wrong playback of alwaysAvailableFile (#5436) (#5960) PTS offset of samples was not properly considered, and sleep between samples was PTS-based instead of being DTS-based.
  • avoid potential timing attack when validating SHA256 credentials (#5961) The == operator is vulnerable to timing attacks as it short-circuits on a mismatch. Use ConstantTimeCompare to avoid this vector. Co-authored-by: Tristan Matthews tmatth@videolan.org
  • normalize authentication error messages (#5421) (#5959) Log authentication errors as soon as possible, use the "warn" level, use the same message whatever the author or protocol.
  • adjust code to prevent security scan false positives (#5963) about string escaping.
  • ask for credentials only in case of protocols that support it (#5966) When clients connect with some protocols (SRT, RTMP), they are unable to provide credentials even if they are asked to. In this case, it's useless to wait for credentials, and it's better to immediately log authentication errors and apply the anti-brute force algorithm.
  • docs: add fail2ban integration (#5016) (#5967)
  • add comment to prevent security scan false positives (#5973)
  • pmp4: fix support for ctts version 0 (#5436) (bluenviron/mediacommon#343)

API

  • generate most of OpenAPI automatically (#5918) enums and structs are now generated automatically. This eliminates some inconsistencies and makes development easier.

Media-Over-QUIC

  • fix race condition during startup (#5965) allocate the HTTP server only after the MoQ server has been initialized.
  • fix several panics and OOM errors (#5964) Check for limits before allocating memory by using sizes passed from the remote peer. Also add fuzzing to all MoQ primitives.
  • support draft-19 of the specification (#5968) * support draft-19 of the specification * support subscribing the same track multiple times.
  • prevent excessive CPU consumption in reorderer (#5976) do not iterate by maxGroupID (passed by user) but iterate by internal pending packets (uncontrolled by user).

WebRTC

  • prevent cross-origin unauthorized access (#5975) when a user had previously inserted credentials into a MediaMTX instance through a browser, and AllowOrigins was set to a wildcard, third-party websites visited by the user were allowed to read streams without restrictions. This is now prevented by returning "*" in Access-Control-Allow-Origins when AllowOrigins is a wildcard, a behavior that prevents browsers from sharing credentials with third-party websites.

RTSP

HLS

  • prevent cross-origin unauthorized access (#5975) when a user had previously inserted credentials into a MediaMTX instance through a browser, and AllowOrigins was set to a wildcard, third-party websites visited by the user were allowed to read streams without restrictions. This is now prevented by returning "*" in Access-Control-Allow-Origins when AllowOrigins is a wildcard, a behavior that prevents browsers from sharing credentials with third-party websites.

SRT

  • fix compatibility with StreamToStudio app (#5414) (#5928)

Dependencies

  • code.cloudfoundry.org/bytefmt updated from v0.78.0 to v0.82.0
  • github.com/alecthomas/kong updated from v1.15.0 to v1.16.0
  • github.com/bluenviron/gohlslib/v2 updated from v2.4.0 to v2.4.1
  • github.com/bluenviron/gortmplib updated from v0.4.0 to v0.4.1
  • github.com/bluenviron/gortsplib/v5 updated from v5.6.1 to v5.6.2
  • github.com/bluenviron/mediacommon/v2 updated from v2.9.1 to v2.9.2
  • github.com/matthewhartstonge/argon2 updated from v1.5.5 to v1.5.6
  • github.com/pion/ice/v4 updated from v4.2.8-0.20260604162030-72f5001c4596 to v4.3.0
  • github.com/pion/interceptor updated from v0.1.45 to v0.1.46
  • github.com/pion/rtcp updated from v1.2.16 to v1.2.17
  • github.com/pion/rtp updated from v1.10.2 to v1.10.5
  • github.com/pion/webrtc/v4 updated from v4.2.15 to v4.2.17
  • github.com/pires/go-proxyproto updated from v0.12.0 to v0.15.0
  • github.com/quic-go/webtransport-go updated from v0.11.0 to v0.11.1
  • golang.org/x/crypto updated from v0.53.0 to v0.54.0
  • golang.org/x/net updated from v0.56.0 to v0.57.0
  • golang.org/x/sync updated from v0.21.0 to v0.22.0
  • golang.org/x/sys updated from v0.46.0 to v0.47.0
  • golang.org/x/term updated from v0.44.0 to v0.45.0
  • github.com/pion/datachannel updated from v1.6.0 to v1.6.2
  • github.com/pion/dtls/v3 updated from v3.1.4 to v3.1.5
  • github.com/pion/sctp updated from v1.10.0 to v1.11.0
  • github.com/pion/stun/v3 updated from v3.1.5 to v3.1.6
  • github.com/pion/turn/v5 updated from v5.0.9 to v5.0.12
  • golang.org/x/text updated from v0.38.0 to v0.40.0

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

  •  
  • ↗️
↗️

v0.16.14

✇Stalwart
Door: github-actions[bot]

[0.16.14] - 2026-07-20

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

  • Use of Voluntary Application Server Identification (VAPID) in JMAP Web Push (RFC 9749).

Changed

Fixed

  • IMAP:
    • Mailbox object-quota only enforced in JMAP.
    • Pipelined STORE and EXPUNGE can execute out of order.
  • JMAP:
    • Read-only sharee cannot set isSubscribed on a shared mailbox.
    • Web Push payloads with Content-Encoding: aes128gcm should not be base64-encoded but sent as raw bytes.
    • Stale push subscription can block verification of a new one.
    • PushSubscription/set rejects the unpadded base64url keys the W3C Push API produces.
    • Email/import does not send push notifications for imported messages.
    • CalendarEvent/set silently ignores ifInState.
  • CalDAV: calendar-query REPORT returns empty calendar-data for JMAP-created events.
  • MTA:
    • DMARC is skipped when MAIL FROM SPF is unavailable.
    • queue_name variable not available in rate limiter expressions.
  • Calendar:
    • No expanded occurrences are returned for a daily recurrences crossing DST.
    • Uppercase MAILTO calendar addresses become invalid SMTP recipients.
    • Scheduling invitations on a shared, non-owned calendar fail with MAIL FROM unauthorized.
  • HTTP: Disable allowedEndpoints expression in recovery mode.
  • Telemetry: Tasks are serialized to the wrong store when using separate stores for telemetry and data.

Check binary attestation here

  •  
  • ↗️
↗️

v0.16.13

✇Stalwart
Door: github-actions[bot]

[0.16.13] - 2026-07-12

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

  • FreeBSD support.

Changed

Fixed

  • OAuth resource indicators: Accept imap, smtp, pop3 and sieve as valid resource indicators for OAuth access tokens.
  • PostgreSQL: Incomplete channel binding implementation.
  • JMAP:
    • VacationResponse: isEnabled reset to false whenever properties are changed.
    • Capabilities: Return RFC-3339-conformant UTCDate literals in capabilities: min 0001-01-01T00:00:00Z, max 9999-12-31T23:59:59Z.
  • Directory: Update local groups only when the external directory includes a group attribute.
  • DNS Management:
    • CAA management deletes too third-party CAA entries.
    • Multiple provider fixes (see dns-update crate changelog).
  • Reject invalid duration values (e.g. 1h30m).
  • Branding: Custom logos for domains do not work.
  • Sieve: add Received headers to auto-generated messages and detect loops.
  • MTA: Resume queue processing does not work.
  • Misconfigured in-memory store cannot be recovered in recovery mode.

Check binary attestation here

  •  
  • ↗️
↗️

v0.16.12

✇Stalwart
Door: github-actions[bot]

[0.16.12] - 2026-07-06

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

Changed

Fixed

  • DANE: Treat DNSSEC bogus as a temporary failures to prevent downgrade attacks.
  • OIDC provider:
    • ECDSA private key support for SEC1 format.
    • Allow ports in redirect_uri for loopback addresses.
  • OIDC directory:
    • Removing a user from all groups does not sync the changes correctly.
    • Fetch name and group claims from userinfo endpoint when missing from the JWT token.
  • PostgreSQL: Include error chain in error messages.
  • Prometheus: event counters are exported with incorrect metric names.
  • Registry: Changing the type of an existing account from user to group panics.
  • Masked emails: Return UnknownRecipient only for disabled or expired masked emails.
  • IDN: sanitize_email rejects valid Punycode domains.
  • Auto-ban: IP block expiration ignores per-reason ban durations.
  • Meilisearch: Limit the text search scope using attributesToSearchOn.
  • CalDAV: calendar-query REPORT returns invalid HTTP 404 when no events match the query.
  • Snowflake past id generation fails when the provided duration is longer than 4 years.
  • Calendar scheduling: Wrong RSVP base URL is used.
  • Network listener: Accept loop spins all CPU cores with no back-off when the process hits EMFILE (too many open files).
  • Cluster: Broadcast MTA queue refresh events to all nodes.

Check binary attestation here

  •  
  • ↗️
↗️

v1.19.2

✇MediaMTX
Door: github-actions[bot]

Fixes and improvements

General

  • playback: fix panic when MP4 muxer flushes with no samples (#5867)
  • redact sensitive headers in HTTP debug logs (#5873)
  • fix(recordstore): decode timezone offset minutes correctly (#5884)
  • improve HTTP server performance (#5886) log incoming requests without cloning.
  • prevent truncation of 64-bit values on 32-bit platforms (#5902)

RTSP

WebRTC

  • skip unresolvable webrtcAdditionalHosts entries instead of aborting (#5845)

RPI Camera

  • support encoding primary stream with MJPEG (2/2) (#5892)
  • support encoding secondary stream with H264 (2/2) (#4485) (#5898)
  • add unified rpiCameraH264Profile, rpiCameraH264Level params (#5894) These replace rpiCameraHardwareH264Profile, rpiCameraHardwareH264Level, rpiCameraSoftwareH264Profile, rpiCameraSoftwareH264Level.
  • fix race condition that prevents decoding the stream (bluenviron/mediamtx-rpicamera#109) (#5861) When a player immediately connects to a newly-created stream, SPS/PPS might not be available, neither in the SDP and neither in-band. Prevent the issue by always sending SPS/PPS in-band.
  • improve performance by computing frame size once (bluenviron/mediamtx-rpicamera#111)
  • fix wrong timestamp being passed to openh264 (bluenviron/mediamtx-rpicamera#114)

Dependencies

  • code.cloudfoundry.org/bytefmt updated from v0.76.0 to v0.78.0
  • github.com/abema/go-mp4 updated from v1.6.0 to v1.7.1
  • github.com/bluenviron/gortsplib/v5 updated from v5.6.0 to v5.6.1
  • github.com/bluenviron/mediacommon/v2 updated from v2.9.0 to v2.9.1
  • github.com/matthewhartstonge/argon2 updated from v1.5.4 to v1.5.5
  • github.com/pion/sdp/v3 updated from v3.0.18 to v3.0.19
  • github.com/quic-go/webtransport-go updated from v0.10.0 to v0.11.0
  • github.com/pion/srtp/v3 updated from v3.0.11 to v3.0.12
  • github.com/bluenviron/mediamtx-rpicamera updated from v2.6.0 to v2.8.0

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

  •  
  • ↗️
↗️

v0.16.11

✇Stalwart
Door: github-actions[bot]

[0.16.11] - 2026-06-25

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

  • Encryption-at-rest: Support for AES-256-GCM and ChaCha20-Poly1305 for S/MIME (#161).
  • S3: Support for allowInvalidCerts option to allow connecting to S3 endpoints with invalid TLS certificates.
  • Redis Sentinel support as an in-memory store and cluster coordinator backend (#2430).

Changed

Fixed

  • DANE: Verify DNSSEC is supported by the resolver before attempting to validate TLSA records.
  • TLS: Update search index when file-backed certificates are refreshed.
  • JMAP: Principal/query returns broad results when a name or email filter cannot be resolved.
  • Webhooks: event IDs collide for same event type emitted in the same second.

Check binary attestation here

  •  
  • ↗️
↗️

v0.16.10

✇Stalwart
Door: github-actions[bot]

[0.16.10] - 2026-06-21

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

  • International Domain Names (IDN) support (#207).
  • OAuth:
  • HTTP: Add redirectRoot option to Http object to allow redirecting requests to the root path to a different path (e.g. /account).
  • ACME: reuseKey option to allow reusing private keys in renewals.
  • IMAP:

Changed

Fixed

  • JMAP conformance (pass the jmap-test-suite tests):
    • Methods are only available if their capability is in using.
    • Reject requests that do not specify application/json in the Content-Type header.
    • Require accountId argument on requests.
    • Return unparsable ids in notFound / notUpdated / notDestroyed / notCopied instead of dropping them.
    • Default calendars and address books are not subscribed by default.
    • */set: Unchanged immutable id property is rejected on update.
    • */query and */queryChanges: nullrejected asnotRequest`.
    • Email/query:
      • Improper anchor handling.
      • Total miscount when collapseThreads is enabled.
      • Wrong sort order on hasKeyword, allInThreadHaveKeyword, and someInThreadHaveKeyword conditions.
      • Non-standard header values are not searchable.
    • Email/copy: Take the source message id from the value's id property.
    • Email/set: Bump reference-resolution max_depth from 1 to 2.
    • Email/import: Reject blobs that do not contain valid messages.
    • EmailSubmission/set: return sendAt and undoStatus in the created response.
    • Mailbox/set: Return alreadyExists instead of invalidProperties when creating a mailbox with an existing name.
    • SearchSnippet/get: incorrect response structure.
    • Thread/changes: emit a container delete when a thread becomes empty.
    • VacationResponse/set: incorrect singleton handling.
  • IMAP: Discard oversized non-synchronizing literals (#2768).
  • DANE: Improper TLSA record validation (#2328 - credits to @vdukhovni).
  • OIDC: Add default domain name to groups that are not email addresses.
  • RocksDB: Enable blob garbage collection to reclaim disk space from deleted blobs.
  • Sieve: include statements ignore capitalisation of sub-script names (#1643)
  • Cache: Invalidate negative email caches when an account is created.
  • Troubleshoot tool: Use the configured source IP address when connecting to remote servers (#2867).

Check binary attestation here

  •  
  • ↗️
↗️

v0.16.9

✇Stalwart
Door: github-actions[bot]

[0.16.9] - 2026-06-15

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

  • ACME: Allow specifying a preferred certificate chain.

Changed

Fixed

  • JMAP: */changes methods leak ids of non-shared objects (reported by @5ud0er).
  • Sieve: Do not allow invalid certs in http_header function.
  • FoundationDB: Fix read version cache expiration logic.
  • MTA: Re-scheduling or editing a queued message reports success but persists nothing for recipients in a non-default virtual queue.
  • CardDAV: Version requests included in address-data are ignored.
  • ACME: Add freshness check when renewing certificates.
  • Autodiscover v2: Read email address from query parameters.
  • Sieve: Do not keep copies of redirected messages when keep is not specified.
  • Registry: Object ids are parsed as numbers.

Check binary attestation here

  •  
  • ↗️
↗️

v1.19.1

✇MediaMTX
Door: github-actions[bot]

Fixes and improvements

General

  • support using regexp groups in every part of a source URL (#5766) (#5779)
  • improve anti-brute force mechanism (#5835) delay authentication failure responses by a random amount of time, use the same anti-brute force mechanism with all users.
  • limit size of HTTP requests shown in debug logs (#5858)
  • print body of selected HTTP responses when log level is debug (#5859)

Media-over-QUIC

  • fix race condition when closing server (#5836) some sessions were hanging if they were concurrently being closed by the remote peer.
  • rename moqHTTPS2Address into moqHTTP2Address, moqHTTPS3Address into moqHTTP3Address (#5841)

RTSP

  • support PROXY protocol (#5754) Support PROXY protocol v1/v2 on RTMP, RTMPS, RTSP, and RTSPS TCP listeners so real client IPs are visible when running behind L4 proxies (nginx stream, HAProxy, AWS NLB).
  • restore support for H264 packetization-mode 0 (#5846) (#5857) H264 streams with packetization-mode=0 cannot be routed with UDP since packets are too big. Inbound streams with packetization-mode=0 are blocked by the server since v1.19.0 but this caused compatibility issues with some cameras. The server is now able to receive such streams with TCP, and automatically remuxes them in streams with packetization-mode=1, which can be routed freely.

RTMP

  • support PROXY protocol (#5754) Support PROXY protocol v1/v2 on RTMP, RTMPS, RTSP, and RTSPS TCP listeners so real client IPs are visible when running behind L4 proxies (nginx stream, HAProxy, AWS NLB).

Dependencies

  • code.cloudfoundry.org/bytefmt updated from v0.74.0 to v0.76.0
  • github.com/bluenviron/gortsplib/v5 updated from v5.5.4 to v5.6.0
  • github.com/pion/ice/v4 updated from v4.2.7 to v4.2.8-0.20260604162030-72f5001c4596
  • github.com/pion/webrtc/v4 updated from v4.2.14 to v4.2.15
  • github.com/quic-go/quic-go updated from v0.59.0 to v0.60.0
  • golang.org/x/crypto updated from v0.52.0 to v0.53.0
  • golang.org/x/net updated from v0.55.0 to v0.56.0
  • golang.org/x/sync updated from v0.20.0 to v0.21.0
  • golang.org/x/sys updated from v0.45.0 to v0.46.0
  • golang.org/x/term updated from v0.43.0 to v0.44.0
  • github.com/pion/dtls/v3 updated from v3.1.3 to v3.1.4
  • github.com/pion/stun/v3 updated from v3.1.4 to v3.1.5
  • github.com/pion/turn/v5 updated from v5.0.7 to v5.0.9
  • golang.org/x/text updated from v0.37.0 to v0.38.0
  • github.com/pires/go-proxyproto v0.12.0 added

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

  •  
  • ↗️
↗️

v0.16.8

✇Stalwart
Door: github-actions[bot]

[0.16.8] - 2026-06-06

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

Changed

  • OAuth: Rework access tokens to an AES-256-GCM-SIV AEAD format that carries the account name for proxy routing.
  • Added more internal TLDs to the domain validation.

Fixed

  • MTA:
    • Sub-addressing with external directories returns 550 Mailbox not found.
    • Disabled aliases continue receiving messages.
  • JMAP for File Storage: FileNode/get returns a stale state string.
  • Make SieveSystemInterpreter.defaultReturnPath and MtaQueueQuota.match optional expressions.
  • Rate limiter panics when periods under 1 second are used.
  • CalDAV/CardDAV: Calendar events, contacts, calendars and address books deleted via JMAP do not write a vanished tombstone.
  • DNS updater: bump to dns-update-v0.5.1.

Check binary attestation here

  •  
  • ↗️
↗️

v1.19.0

✇MediaMTX
Door: github-actions[bot]

New major features

Media-over-QUIC

  • support reading and publishing with Media-over-QUIC (#5815) Media-over-QUIC is a streaming protocol built upon cutting edge protocols (QUIC, HTTP3) and browser APIs (WebTransport, WebCodecs). It's slightly faster than WebRTC, has an advanced data recovery mechanism, it supports additional codecs (FLAC) and is less complicated to route. Check the documentation for instructions and details.

RTMP

  • support reading and writing FLAC (#5778) (#5789)

HLS

  • support reading and publishing FLAC (#5778) (#5791)

Fixes and improvements

General

  • Add user agent field to RTMP, RTSP, WebRTC, and HLS (#5753)
  • add --check-version command line flag (#5786) this allows to check whether a new version is available without upgrading.
  • use file name suffix for OS-specific code wherever possible (#5787)
  • fix two hot reloading cases (#5817) * reload SRT server when metrics server is reloaded * reload API server when RTMPS server is reloaded

RTSP

RTMP

HLS

WebRTC

  • make JavaScript internal variables private (#5804)
  • fix connectivity after network changes (#5097) (#5818)

RPI Camera

Dependencies

  • code.cloudfoundry.org/bytefmt updated from v0.72.0 to v0.74.0
  • github.com/abema/go-mp4 updated from v1.5.0 to v1.6.0
  • github.com/bluenviron/gohlslib/v2 updated from v2.3.2 to v2.4.0
  • github.com/bluenviron/gortmplib updated from v0.3.2 to v0.4.0
  • github.com/bluenviron/gortsplib/v5 updated from v5.5.3 to v5.5.4
  • github.com/bluenviron/mediacommon/v2 updated from v2.8.3 to v2.9.0
  • github.com/go-git/go-git/v5 updated from v5.19.0 to v5.19.1
  • github.com/matthewhartstonge/argon2 updated from v1.5.3 to v1.5.4
  • github.com/pion/ice/v4 updated from v4.2.5 to v4.2.7
  • github.com/pion/transport/v4 updated from v4.0.1 to v4.0.2
  • github.com/pion/webrtc/v4 updated from v4.2.12 to v4.2.14
  • golang.org/x/crypto updated from v0.51.0 to v0.52.0
  • golang.org/x/net updated from v0.54.0 to v0.55.0
  • golang.org/x/sys updated from v0.44.0 to v0.45.0
  • github.com/pion/dtls/v3 updated from v3.1.2 to v3.1.3
  • github.com/pion/sctp updated from v1.9.5 to v1.10.0
  • github.com/pion/srtp/v3 updated from v3.0.10 to v3.0.11
  • github.com/pion/stun/v3 updated from v3.1.2 to v3.1.4
  • github.com/pion/turn/v5 updated from v5.0.3 to v5.0.7
  • github.com/quic-go/webtransport-go v0.10.0 added
  • golang.org/x/sync v0.20.0 added
  • github.com/dunglas/httpsfv v1.1.0 added
  • github.com/bluenviron/mediamtx-rpicamera updated from v2.5.7 to v2.6.0

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

  •  
  • ↗️
↗️

v0.16.7

✇Stalwart
Door: github-actions[bot]

[0.16.7] - 2026-05-28

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

Changed

Fixed

  • Log rejected messages to tracing store.
  • MTA:
    • Always update next DSN notify times.
    • Expand lists and resolve catch-all addresses when building autogenerated messages.
  • Sharing: Includes resource that themselves carry a direct ACL grant and are leaves.
  • Tasks cannot be deleted in OSS builds.
  • Directory: Per-domain external directory resolution fails.
  • DNS updater: Keep external TXT records when updating RRSet.
  • HTTP: Reject requests from blocked IPs when Keep-Alive is enabled.

Check binary attestation here

  •  
  • ↗️
↗️

v0.16.6

✇Stalwart
Door: github-actions[bot]

[0.16.6] - 2026-05-20

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

  • Added 58 new DNS provider integrations (see dns-update crate for details).
  • DNS updater: Log DNS record types and values.
  • Sieve: Allow User Sieve scripts to access orcpt.
  • MTA: Log when messages are rejected or discarded by the spam classifier.

Changed

Fixed

  • DAV: acl-principal-prop-set REPORT enforced the wrong privilege.
  • JMAP: Thread/get did not filter by per-mailbox ACLs on shared accounts.
  • IMAP: UID FETCH N:* could miss messages moved into a SELECTed mailbox by another connection.
  • DNS updater:
    • Skip v=spf1 a -all records for apex domains.
    • RFC2136 TSIG: regression related to multiplexer.
    • Route53: Chunk TXT records when they exceed 255 characters.
  • ACME:
    • Update defaultCertificateId when renewing a certificate that is currently set as default.
    • Perform DNS-01 authorizations sequentially to avoid race conditions in some DNS providers.
  • Allow internal TLDs and special characters in e-mail addresses.
  • Websocket: Perform case insensitive matching during upgrade.
  • LDAP: Synchronize accounts when expanding mailing list recipients.
  • Sieve: replace action adds an extra From header.
  • ACL: Orphaned ACL entries for deleted accounts cause JMAP session errors.

Check binary attestation here

  •  
  • ↗️
↗️

v1.18.2

✇MediaMTX
Door: github-actions[bot]

Fixes and improvements

RTSP

RTMP

HLS

  • fix error 500 caused by in-stream params (bluenviron/gohlslib#355) (#5728) (#5745) PR bluenviron/gohlslib#344 caused a regression. Many codecs (AV1, H264, H265, VP9) use in-stream parameters, that were not taken into consideration anymore when generating init.mp4 and playlists. This has been solved.

WebRTC

RPI Camera

  • support changing text overlay dynamically (#5270) (#5748)

Dependencies

  • code.cloudfoundry.org/bytefmt updated from v0.70.0 to v0.72.0
  • github.com/Masterminds/semver/v3 updated from v3.4.0 to v3.5.0
  • github.com/bluenviron/gohlslib/v2 updated from v2.3.1 to v2.3.2
  • github.com/bluenviron/gortmplib updated from v0.3.1 to v0.3.2
  • github.com/bluenviron/gortsplib/v5 updated from v5.5.2 to v5.5.3
  • github.com/datarhei/gosrt updated from v0.10.0 to v0.11.0
  • github.com/fsnotify/fsnotify updated from v1.10.0 to v1.10.1
  • github.com/go-git/go-billy/v5 updated from v5.8.0 to v5.9.0
  • github.com/go-git/go-git/v5 updated from v5.18.0 to v5.19.0
  • github.com/gookit/color updated from v1.6.0 to v1.6.1
  • github.com/matthewhartstonge/argon2 updated from v1.5.2 to v1.5.3
  • github.com/pion/rtp updated from v1.10.1 to v1.10.2
  • golang.org/x/crypto updated from v0.50.0 to v0.51.0
  • golang.org/x/net updated from v0.53.0 to v0.54.0
  • golang.org/x/sys updated from v0.43.0 to v0.44.0
  • golang.org/x/term updated from v0.42.0 to v0.43.0
  • github.com/cyphar/filepath-securejoin updated from v0.4.1 to v0.6.1
  • github.com/pjbgf/sha1cd updated from v0.3.2 to v0.6.0
  • golang.org/x/text updated from v0.36.0 to v0.37.0
  • github.com/bluenviron/mediamtx-rpicamera updated from v2.5.6 to v2.5.7

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

  •  
  • ↗️
↗️

v0.16.5

✇Stalwart
Door: github-actions[bot]

[0.16.5] - 2026-05-11

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

  • is_ip_in_cidr expression function for CIDR matching.

Changed

  • Bump mail-auth to 0.9 (which bumps hickory-resolver to 0.26).
  • Deprecated RFC2136 SIG(0) support as it is no longer supported by hickory.

Fixed

  • JMAP:
    • Patching ids containing digits in JSON Pointers fails.
    • Patching nested objects with null values fails.
  • External directories:
    • SQL: Return Failed instead of Error when the query returns no results.
    • LDAP: Impersonation fails when the user has not logged in before.
  • Network: Attempt binding to IPv4 when binding to IPv6 fails with EAFNOSUPPORT error.
  • Bootstrap: Timeout after 30 seconds when probing the data store.
  • HTTP: Use permissive CORS headers for .well-known endpoints.
  • ACME:
    • Include apex domains when requesting certificates for subdomains.
    • Use the public suffix list to determine the zone name when no origin is provided.
  • MTA:
    • Allow rescheduling recipients with permanent failures.
    • Process reports using original RCPT before rewriting.
  • Autodiscover v2 endpoint unreachable.
  • DNS update (via dns-update crate):
    • OVH + Google Cloud DNS: Fix FQDN handling for MX and SRV records.
    • Route53: Fix changeset error resolution.
    • deSEC: Use empty subname for apex records instead of @, which the API rejects.
    • Cloudflare: Wrap TXT record content in double quotes (RFC 1035) to suppress dashboard warnings.
  • iCalendar/JSCalendar (via calcard crate):
    • Support STATUS:CANCELLED mapping from VTODO to JSCalendar.
    • Fixed duration parsing for zero duration PT0S.

Check binary attestation here

  •  
  • ↗️
↗️

v0.16.4

✇Stalwart
Door: github-actions[bot]

[0.16.4] - 2026-05-05

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

Changed

Fixed

  • Live tracing in community and OSS versions.
  • Timezone changes from the AccountSettings object return invalidProperties.
  • mail-parser panic with certain messages containing corrupted attachments.
  • Pagination by anchor for queued messages, tasks and metrics.
  • Spam filter: Use original instead of rewritten RCPT on checks.
  • JMAP:
    • References in nested objects not resolved.
    • AddressBook/query fetches wrong resources.
  • Import tool fails to restore registry entries.
  • FDB: Allow multiple FoundationDB instances in the same process.
  • Autoconfig: Return %EMAILADDRESS% when no email address is provided.
  • Quota: Include Sieve scripts in quota recalculations.

Check binary attestation here

  •  
  • ↗️
↗️

v0.16.3

✇Stalwart
Door: github-actions[bot]

[0.16.3] - 2026-04-30

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

Changed

  • Replaced STALWART_HTTPS_PORT with STALWART_PUBLIC_URL.
  • App Passwords now begin with app_ instead of app to avoid issues with some clients that do not support spaces in passwords.

Fixed

  • Directory:
    • Invalidate caches when group memberships change on an external directory.
    • OIDC: errors instead of "failed to decode token".
    • OIDC: Recovery admin access.
    • User impersonation.
  • Tasks:
    • Delete locked tasks.
    • Queue pagination by anchor.
  • Log viewer: All events show as INFO.
  • Registry: Allow changing object variants.
  • Node id renewal.
  • DNS Updater: Fix Route53 serialization format.

Check binary attestation here

  •  
  • ↗️
↗️

v1.18.1

✇MediaMTX
Door: github-actions[bot]

Fixes and improvements

General

  • prevent code injection in case of MTX_QUERY in hooks (#5707) When MTX_QUERY is used explicitly in hooks, for instance "curl http://something/?$MTX_QUERY", it can be used to inject arbitrary commands. MTX_QUERY is now url-encoded to prevent any abuse regardless of the configuration.
  • use temporary redirects instead of permanent redirects (#5710) this prevents unwanted caching.

HLS

  • prevent open redirect attacks (#5708)
  • support reading and writing KLV (#5604)
  • add hlsCDNSecret (#5716) this allows to serve HLS streams behind a CDN in a simplified way, compatible with the new HLS session system.
  • add public attribute to cache-control header (bluenviron/gohlslib#349)
  • allow caching non-low-latency playlists (bluenviron/gohlslib#350)

WebRTC

  • prevent open redirect attacks (#5708)

RPI Camera

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

  •  
  • ↗️
↗️

v1.18.0

✇MediaMTX
Door: github-actions[bot]

New major features

HLS

  • track sessions (#962) (#5683) sessions are now tracked through cookies or query parameters. This provides the ability to inspect sessions through logs, metrics and API, allows more precise tracking of outbound bytes, decreases load on external HTTP authentication URLs since they are now called once per session and not once per request.
  • support serving streams with a CDN (#5696)

Fixes and improvements

General

  • improve listener labels (#5635) add a label after every "listener opened on :XXX" message that mentions protocols of every listener.
  • dump unencrypted TLS sessions (#5624) when dumpPackets is true, embed TLS master keys into the dump, in a format which is natively compatible with Wireshark.
  • use "token" as query parameter key to pass tokens (#5647) the legacy "jwt" query parameter key is still supported.
  • deprecate authJWTInHTTPQuery and disable JWTs in query parameters (#5648) This fixes a long standing security flaw. Even though it's a breaking change, few users should be impacted since this feature has been discouraged for some time.
  • expose token passed as query parameter to HTTP authentication too (#5649) this allows to parse tokens coming from RTSP and RTMP without additional effort.
  • playback: return errors as JSON (#5656) this is aligned with all other HTTP-based services.
  • prevent out-of-memory errors (#5674) impose a maximum size on body of incoming HTTP requests and responses.
  • metrics: improve performance (#5663) use string.Builder instead of string concatenation
  • metrics: add labels to the output (#5687) group metrics under visible, distinct labels.
  • metrics: fix filtering by type=rtmp_conns and type=rtmps_conns (#5689)
  • metrics: add readerType attribute to the path_readers metric (#5690) this allows to filter path readers by type.
  • metrics: use an enum for parsing metrics type (#5692)
  • metrics: fix race condition when reloading configuration (#5693)
  • docs: add scaling page (#5695)

API

  • sort path readers (#5691)

RTSP

HLS

  • return JSON with error message in case path conf is not available (#5655) this behavior is aligned with WebRTC one.
  • improve muxer performance (#5660) use a mutex instead of a channel to get current instance.
  • fix running linter when there are unstaged git changes (bluenviron/gohlslib#336)
  • client: use redirected URL when reloading playlist (bluenviron/gohlslib#340) this allows to store and use tokens and signed URLs.
  • client: support reading KLV (bluenviron/gohlslib#337)
  • prevent out-of-memory errors (bluenviron/gohlslib#343)
  • muxer: generate init segment once (bluenviron/gohlslib#344) Previously, the init segment was regenerated in case of codec parameter changes, but changing the init segment has been proved to cause video and audio discontinuities on iOS. Now the init file contains starting parameters only and never changes during the stream lifetime.
  • client: increase size limit of segments and parts (bluenviron/gohlslib#345)
  • return a custom error when body size limit is exceeded (bluenviron/gohlslib#346)
  • muxer: store non-low-latency playlists and init files on disk (bluenviron/gohlslib#348)

Dependencies

  • code.cloudfoundry.org/bytefmt updated from v0.67.0 to v0.69.0
  • github.com/alecthomas/kong updated from v1.14.0 to v1.15.0
  • github.com/bluenviron/gohlslib/v2 updated from v2.2.9 to v2.3.0
  • github.com/bluenviron/gortsplib/v5 updated from v5.5.1 to v5.5.2
  • github.com/go-git/go-git/v5 updated from v5.17.2 to v5.18.0
  • github.com/matthewhartstonge/argon2 updated from v1.4.6 to v1.5.2
  • github.com/pion/ice/v4 updated from v4.2.2 to v4.2.5
  • golang.org/x/crypto updated from v0.49.0 to v0.50.0
  • golang.org/x/sys updated from v0.42.0 to v0.43.0
  • golang.org/x/term updated from v0.41.0 to v0.42.0
  • github.com/pion/stun/v3 updated from v3.1.1 to v3.1.2
  • github.com/pion/turn/v4 removed
  • golang.org/x/net updated from v0.52.0 to v0.53.0
  • golang.org/x/text updated from v0.35.0 to v0.36.0
  • golang.org/x/time updated from v0.12.0 to v0.14.0
  • github.com/pion/turn/v5 v5.0.3 added
  • hls.js updated from v1.6.15 to v1.6.16

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

  •  
  • ↗️
↗️

v1.17.1

✇MediaMTX
Door: github-actions[bot]

Fixes and improvements

General

  • prevent directory traversal attacks (#5602) Path names are used as part of paths in several components: in the recorder, in the playback server and in every HTTP-based component (WebRTC, HLS, API). Special characters that allow to escape from the intended directory are now forbidden in order to prevent directory traversal attacks.

RTSP

RTMP

WebRTC

  • fix random absolute timestamps with Opus, G711 and LPCM (#5597) When rewriting audio RTP timestamps in WebRTC egress, NTP was derived using regenerated packet timestamps minus the incoming RTP base timestamp. That mixed timestamp domains and could shift absolute time by an arbitrary offset while still exposing mapping as available. Fix by using a consistent outgoing RTP domain in rewritten audio paths
  • strip TWCC extension of incoming RTP packets (#5146) (#5605) The TWCC extension is used as part of the WebRTC congestion control algorithm placed between the publisher and the server. If this extension is routed untouched from the server to readers, it messes with the congestion control algorithm present between the server and each reader. Remove it.

RPI Camera

Dependencies

  • github.com/bluenviron/gortmplib updated from v0.3.0 to v0.3.1
  • github.com/bluenviron/gortsplib/v5 updated from v5.5.0 to v5.5.1
  • github.com/gin-contrib/pprof updated from v1.5.3 to v1.5.4
  • github.com/go-git/go-git/v5 updated from v5.17.0 to v5.17.2
  • github.com/pion/ice/v4 updated from v4.2.1 to v4.2.2
  • github.com/pion/webrtc/v4 updated from v4.2.9 to v4.2.11
  • github.com/pion/sctp updated from v1.9.2 to v1.9.4
  • github.com/bluenviron/mediamtx-rpicamera updated from v2.5.4 to v2.5.5

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

  •  
  • ↗️
↗️

v1.17.0

✇MediaMTX
Door: github-actions[bot]

New major features

WebRTC

  • support publishing multiple video/audio renditions (#5573) this allows to receive multiple video tracks from OBS Studio with the new WebRTC Simulcast feature introduced in v32.1.0.

API

  • provide track details (#5307) (#5333) (#1726) (#5585)
  • add user field to RTSP, RTMP, SRT, WebRTC conns and sessions (https://github.com/bluenviron/mediamtx/issues/5104) (#5565)
  • add RTSP reported lost packets (#5198) (#5579) The new outboundRtpPacketsReportedLost property allows to track RTP packets that have been reported lost by readers. Furthermore, stats now have a "inbound" or "outbound" prefix to improve readability.
  • rename WebRTC stats to match RTSP ones (#5581)
  • add new stats (#5582) - RTSPSession.outboundRTPPacketsDiscarded - Path.inboundFramesInError - SRTConn.outboundFramesDiscarded - WebRTCSession.outboundFramesDiscarded - RTMPConn.outboundFramesDiscarded - HLSMuxer.outboundFramesDiscarded

Fixes and improvements

General

  • avoid buffering HTTP response body in loggerWriter (#5552) loggerWriter was shadow-copying every response byte into a bytes.Buffer to report the body size, causing the entire response to be accumulated in memory for the lifetime of each request. Replace the buffer with a plain int counter since dump() only ever reported the byte count anyway.
  • optionally validate JWT iss and aud claims (#5569)
  • metrics: add two missing SRT stats (#5580)

API

  • add deprecated fields to the OpenAPI definition (#5575)
  • add missing enums and move all enums in dedicated components (#5576)

RTSP

HLS

WebRTC

  • fix panic with WHIP POST authentication failures (#5566)

Dependencies

  • code.cloudfoundry.org/bytefmt updated from v0.64.0 to v0.67.0
  • github.com/abema/go-mp4 updated from v1.4.1 to v1.5.0
  • github.com/bluenviron/gohlslib/v2 updated from v2.2.8 to v2.2.9
  • github.com/bluenviron/gortsplib/v5 updated from v5.4.0 to v5.5.0
  • github.com/bluenviron/mediacommon/v2 updated from v2.8.2 to v2.8.3
  • golang.org/x/crypto updated from v0.48.0 to v0.49.0
  • golang.org/x/sys updated from v0.41.0 to v0.42.0
  • golang.org/x/term updated from v0.40.0 to v0.41.0
  • golang.org/x/net updated from v0.51.0 to v0.52.0
  • golang.org/x/text updated from v0.34.0 to v0.35.0

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

  •  
  • ↗️
↗️

v1.16.3

✇MediaMTX
Door: github-actions[bot]

Fixes and improvements

General

  • fill product version of Windows executable (#5167) (#5511)
  • improve JSON decoder performance (#5526) avoid decoding JSON twice.
  • fix panic when setting writeQueueSize to zero (#5360) (#5527)
  • prevent using alwaysAvailableFile and alwaysAvailableTracks together (#5529)
  • improve playback precision of alwaysAvailable offline segment (#5530)
  • fix MPEG-4 audio configuration not matching error (#5468) (#5533) This happened when using alwaysAvailableFile and a MPEG-4 audio track.
  • fix corrupted video with alwaysAvailableFile (#5534) when alwaysAvailableFile points to a file with a H265 or H264 track, server is started, an online stream is published and then closed, video was getting corrupted since the online video was overriding the parameters of the offline video.
  • fix audio from alwaysAvailableFile not being streamed (#5535)
  • fix alwaysAvailableFile restarting when a publisher fails (#5536) when a publisher try to start an online stream and there's an error, alwaysAvailableFile restarted without any reason.
  • revert to Go 1.25 (#5521) (#5538) It seems like Go 1.26 is causing segmentation faults, related to channels, on Windows.
  • inherit MPEG-4 audio type from alwaysAvailableFile (#5539)
  • mpegts: properly compute PTS of async KLV frames (bluenviron/mediacommon#291) (bluenviron/mediacommon#311) Store last valid PTS as soon as possible, by parsing PES headers in advance, then use this PTS as timestamp of KLV frames without PTS.

HLS

Dependencies

  • Go updated from 1.26 to 1.25
  • github.com/asticode/go-astits updated from v1.14.0 to v1.15.0
  • github.com/bluenviron/gohlslib/v2 updated from v2.2.6 to v2.2.8
  • github.com/bluenviron/gortsplib/v5 updated from v5.3.2 to v5.4.0
  • github.com/bluenviron/mediacommon/v2 updated from v2.8.0 to v2.8.2
  • github.com/gin-gonic/gin updated from v1.11.0 to v1.12.0
  • github.com/go-git/go-billy/v5 updated from v5.7.0 to v5.8.0
  • github.com/go-git/go-git/v5 updated from v5.16.5 to v5.17.0
  • github.com/bytedance/sonic updated from v1.14.0 to v1.15.0
  • github.com/bytedance/sonic/loader updated from v0.3.0 to v0.5.0
  • github.com/cloudflare/circl updated from v1.6.1 to v1.6.3
  • github.com/gabriel-vasile/mimetype updated from v1.4.8 to v1.4.12
  • github.com/go-playground/validator/v10 updated from v10.27.0 to v10.30.1
  • github.com/quic-go/quic-go updated from v0.57.0 to v0.59.0
  • github.com/ugorji/go/codec updated from v1.3.0 to v1.3.1
  • golang.org/x/arch updated from v0.20.0 to v0.22.0
  • golang.org/x/net updated from v0.50.0 to v0.51.0
  • google.golang.org/protobuf updated from v1.36.9 to v1.36.10
  • github.com/bytedance/gopkg v0.1.3 added
  • go.mongodb.org/mongo-driver/v2 v2.5.0 added

Security

Binaries are compiled from source code by the Release workflow without human intervention.

You can verify that binaries have been produced by the workflow by using GitHub Attestations:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

  •  
  • ↗️
↗️

v1.16.2

✇MediaMTX
Door: github-actions[bot]

Fixes and improvements

General

  • support X-Forwarded-Proto in playback server (#4970) (#5445) allow reverse proxies to change the schema of URLs returned by the server through the X-Forwarded-Proto header.
  • make config file YAML 1.2 compliant (#5345) (#5456)
  • replace YAML parser (#5461) switch from the unmaintained gopkg.in/yaml to goccy/go-yaml
  • deprecate unix+rtp (#5318) (#4999) (#5351) (#5470) Unix socket are stream-based connections, while RTP requires packet-based connections. While packet-based Unix sockets exist (unixgram), no client supports them. Consequently we are forced to deprecate unix+rtp.
  • fix codec parameters not being loaded from alwaysAvailableFile (#5484)
  • warn when alwaysAvailableFile is not MP4 (#5483)
  • suggest using JWTs in query parameters for RTSP and RTMP (#5267) (#5493) In case of RTSP and RTMP, JWTs cannot be used as passwords since there's a size limit. Therefore, documentation is updated to suggest passing JWT through query parameters, and authJWTInHTTPQuery is updated to act on HTTP requests only.
  • fix error 400 with parallel describe and publish requests (#5095) (#5502) When a path is dynamic, and the path receives multiple describe and publish requests in parallel, describe requests might cause the path to be deleted, and this might cause pending publish requests to fail, since the path has been deleted. This patch improves the situation by checking for pending requests before deleting a path.
  • add integrated packet dumper (#5488) this allows to dump any incoming and outgoing packet, to disk, in pcapng format.
  • log packet sizes if UDPMaxPayloadSize is exceeded (#4668)
  • improve video/audio sync of alwaysAvailable (#5443) (#5508) store elapsed time once for the entire stream and start PTS of sub streams from there.
  • improve pmp4 and fmp4 parser robustness (bluenviron/mediacommon#299)
  • mp4: fix H265 + iOS compatibility (bluenviron/mediacommon#290) On iOS, H265 requires the hvc1 box instead of the hev1 box.
  • h264: prevent Annex-B from decoding more NALUs than MaxNALUsPerAccessUnit (bluenviron/mediacommon#303)
  • improve H264 and MPEG-4 video performance (#4971) (bluenviron/mediacommon#304)
  • mp4: fill reserved fields properly (bluenviron/mediacommon#307)
  • mpegts: parse Opus channel configuration (#5002) (bluenviron/mediacommon#309)

API

  • add conns to RTSP Sessions (#5454) this allows to find connections associated with a RTSP session.

RTMP

  • prevent legacy clients from reading multiple video/audio tracks (#5478)
  • fix marshaling H264 VideoExCodedFrames (#4996) (bluenviron/gortmplib#46) These messages were marshaled wrongly, causing errors when trying to read H264 tracks with an ID >= 1.
  • support reading H265 with video codec id 12 (#5105) (bluenviron/gortmplib#48)

HLS

  • client: support storing and sending cookies (#5444)

WebRTC

  • allow tuning WHEP timeouts (#5027) (#5479) add whepHandshakeTimeout, whepTrackGatherTimeout, whepSTUNGatherTimeout
  • add whepBearerTokenParameter (#3796) (#5486) this allows to pass Authorization: Bearer to servers that require it.

SRT

  • set timeout of idle peers to readTimeout (#5489)

RPI Camera

Dependencies

  • Go updated from 1.25 to 1.26
  • code.cloudfoundry.org/bytefmt updated from v0.63.0 to v0.64.0
  • github.com/MicahParks/keyfunc/v3 updated from v3.7.0 to v3.8.0
  • github.com/bluenviron/gohlslib/v2 updated from v2.2.5 to v2.2.6
  • github.com/bluenviron/gortmplib updated from v0.2.1 to v0.3.0
  • github.com/bluenviron/gortsplib/v5 updated from v5.3.1 to v5.3.2
  • github.com/bluenviron/mediacommon/v2 updated from v2.7.1 to v2.8.0
  • github.com/datarhei/gosrt updated from v0.9.0 to v0.10.0
  • github.com/go-git/go-git/v5 updated from v5.16.4 to v5.16.5
  • github.com/matthewhartstonge/argon2 updated from v1.4.5 to v1.4.6
  • github.com/pion/ice/v4 updated from v4.2.0 to v4.2.1
  • github.com/pion/sdp/v3 updated from v3.0.17 to v3.0.18
  • github.com/pion/webrtc/v4 updated from v4.2.3 to v4.2.9
  • golang.org/x/crypto updated from v0.47.0 to v0.48.0
  • golang.org/x/sys updated from v0.40.0 to v0.41.0
  • golang.org/x/term updated from v0.39.0 to v0.40.0
  • gopkg.in/yaml.v2 removed
  • github.com/goccy/go-yaml updated from v1.18.0 to v1.19.2
  • github.com/pion/dtls/v3 updated from v3.0.10 to v3.1.2
  • golang.org/x/net updated from v0.49.0 to v0.50.0
  • golang.org/x/text updated from v0.33.0 to v0.34.0
  • github.com/google/gopacket v1.1.19 added
  • github.com/bluenviron/mediamtx-rpicamera updated from v2.5.3 to v2.5.4

Security

Binaries are compiled from source code by the Release workflow without human intervention.

You can verify that binaries have been produced by the workflow by using GitHub Attestations:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

  •  
  • ↗️
↗️

v1.16.1

✇MediaMTX
Door: github-actions[bot]

Fixes and improvements

General

  • fix typo in error message ('alwaysAvailableVideo' -> 'alwaysAvailableFile') (#5417)
  • emit structured logs with nanosecond precision (#4924) (#5404)
  • set default udpMaxPayloadSize to an IPv6 compatible value (#4882) (#5402) When using IPv6, there are 20 bytes less available for UDP payload, which has been adjusted accordingly.
  • add authHTTPFingerprint (#5413) (#5422)
  • add additional checks on always-available streams (#5408) make sure that published streams match MPEG-4 audio, G711 and LPCM parameters declared in configuration or used by the offline file.
  • improve JSON error message (#5412) (#5433)
  • pmp4: improve compatibility (#5423) (bluenviron/mediacommon#298)

RTSP

RPI Camera

Dependencies

  • code.cloudfoundry.org/bytefmt updated from v0.62.0 to v0.63.0
  • github.com/alecthomas/kong updated from v1.13.0 to v1.14.0
  • github.com/bluenviron/gortsplib/v5 updated from v5.3.0 to v5.3.1
  • github.com/bluenviron/mediacommon/v2 updated from v2.7.0 to v2.7.1
  • github.com/pion/interceptor updated from v0.1.43 to v0.1.44
  • github.com/pion/rtp updated from v1.10.0 to v1.10.1
  • github.com/bluenviron/mediamtx-rpicamera updated from v2.5.2 to v2.5.3

Security

Binaries are compiled from source code by the Release workflow without human intervention.

You can verify that binaries have been produced by the workflow by using GitHub Attestations:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

  •  
  • ↗️
↗️

v1.16.0

✇MediaMTX
Door: github-actions[bot]

New major features

General

  • add always available streams (#5335) When the publisher or source of a stream is offline, the server can be configured to fill gaps in the stream with a video that is played on repeat until a publisher comes back online. This allows readers to stay connected regardless of the state of the stream. The offline video and any future online stream are concatenated without decoding or re-encoding packets, using the original codec.

API

  • add available, availableTime, online, onlineTime properties (#5391) these replace ready and readyTime and allow to monitor the new "always-available" feature.

WebRTC

  • support reading KLV tracks (#4722)

Fixes and improvements

General

  • move away from balenalib Docker images (#5313)
  • print OS and Arch in first log line (#5315)
  • print last decode error (#5319) decode errors are still grouped together, but the last one is now printed.
  • print last processing error (#5323)
  • use the same filtering process for every codec (#5324) this allows to apply features that were previously implemented for single codecs (like RTP packet resizing), to any codec, and simplifies future development.
  • prevent several configuration errors (#5368)
  • fix typos in documentation (#5370)
  • fix overriding default user with environment variables (#5371) MTX_AUTHINTERNALUSERS_0_USER and MTX_AUTHINTERNALUSERS_0_PASS are now working even when the configuration file is present.
  • prevent setting empty usernames with environment variables (#5373)
  • fix panic with environment variables (#5374) this happened when loading deprecated slices of structs with environment variables.
  • prevent setting slices to null (#5375) In Golang, slices can be set to nil, while in most other languages they cannot. This causes compatibility issues, especially because the OpenAPI definition of the API does not allow slices to be nil. This prevents slices from being set to nil through JSON/YAML, and also sets default slices to an empty list instead of nil.
  • Update hlsEncryption documentation on Low-Latency HLS requirements (#5379)
  • fix race condition when closing HTTP servers (#5390) when a HTTP server is closed, open connections are now immediately closed and open routines are waited before the server is considered closed.
  • deprecate fallback (#5388) The fallback feature worked with RTSP only and did not allow readers to resume the original stream. It has been replaced by alwaysAvailable.
  • mpegts: add E-AC-3 (Dolby Digital Plus) codec support (bluenviron/mediacommon#272)
  • mpeg4audio: support channel_config=0 (bluenviron/mediacommon#273)
  • mpeg4audio: in ASC, prefer marshaling legacy ChannelConfig when available (bluenviron/mediacommon#280)
  • pmp4: increase compatibility (bluenviron/mediacommon#293)
  • pmp4: support MP4s with data before track definitions (bluenviron/mediacommon#294)

API

  • improve OpenAPI definition (#5380) add uint64, uint, uuid, move WebRTCICEServer into dedicated schema

RTSP

  • fix log labels of RTSPS listeners (#5367) use "TCP/RTSPS", "UDP/SRTP", "UDP/SRTCP" to refer to secure listeners
  • add rtspUDPSourcePortRange param (#5363) (#5397)

HLS

  • fix playback starting point for VOD streams without EXT-X-PLAYLIST-TYPE (bluenviron/gohlslib#308)
  • client: return every unit before an error (bluenviron/gohlslib#314) In case of an error, downloaded unit that were not processed yet were discarded. Now they are returned before the client exits.

WebRTC

  • print incoming data channel messages (#5357)

RPI Camera

Dependencies

  • code.cloudfoundry.org/bytefmt updated from v0.59.0 to v0.62.0
  • github.com/bluenviron/gohlslib/v2 updated from v2.2.4 to v2.2.5
  • github.com/bluenviron/gortmplib updated from v0.2.0 to v0.2.1
  • github.com/bluenviron/gortsplib/v5 updated from v5.2.2 to v5.3.0
  • github.com/bluenviron/mediacommon/v2 updated from v2.6.0 to v2.7.0
  • github.com/golang-jwt/jwt/v5 updated from v5.3.0 to v5.3.1
  • github.com/matthewhartstonge/argon2 updated from v1.4.4 to v1.4.5
  • github.com/pion/ice/v4 updated from v4.1.0 to v4.2.0
  • github.com/pion/interceptor updated from v0.1.42 to v0.1.43
  • github.com/pion/rtp updated from v1.9.0 to v1.10.0
  • github.com/pion/transport/v3 removed
  • github.com/pion/webrtc/v4 updated from v4.2.1 to v4.2.3
  • golang.org/x/crypto updated from v0.46.0 to v0.47.0
  • golang.org/x/sys updated from v0.39.0 to v0.40.0
  • golang.org/x/term updated from v0.38.0 to v0.39.0
  • github.com/pion/datachannel updated from v1.5.10 to v1.6.0
  • github.com/pion/dtls/v3 updated from v3.0.9 to v3.0.10
  • github.com/pion/sctp updated from v1.9.0 to v1.9.2
  • github.com/pion/srtp/v3 updated from v3.0.9 to v3.0.10
  • github.com/pion/stun/v3 updated from v3.0.2 to v3.1.1
  • github.com/pion/turn/v4 updated from v4.1.3 to v4.1.4
  • golang.org/x/net updated from v0.48.0 to v0.49.0
  • golang.org/x/text updated from v0.32.0 to v0.33.0
  • github.com/pion/transport/v4 v4.0.1 added
  • github.com/bluenviron/mediamtx-rpicamera updated from v2.5.1 to v2.5.2

Security

Binaries are compiled from source through the Release workflow without human intervention, preventing any external interference.

You can verify that binaries have been produced by the workflow by using GitHub Attestations:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

  •  
  • ↗️
↗️

v1.15.6

✇MediaMTX
Door: github-actions[bot]

Fixes and improvements

General

  • add structured logging (#5219)
  • fix 1-minute offset when recording a H264 WebRTC track (#5275) (#5278)
  • disable syslog logging on macOS (#5005) (#5295)
  • set syslog priority and do not write level and date to syslog (#4923) (#5296) When writing log entries to syslog, pass the level (WARN, INFO, etc) directly to syslog. Avoid writing level and date. This provides a better integration and allows to use syslog search tools.

RTSP

  • avoid setupping back channels (#5074) (#5289)
  • Support URI format sent by HappyTime ONVIF and RTSP clients during (bluenviron/gortsplib#964)
  • fix medias wrongly marked as back channels (#5074) (bluenviron/gortsplib#970) Some cameras mark medias as back channels even though they are not. Try to detect this by checking whether in full the SDP there are both back channels and standard channels, unmarking back channels otherwise.
  • when there are back channels, add recvonly attribute to standard channels (bluenviron/gortsplib#971)

SRT

  • fix broken connections in case of high latency (#3756) (#5282) When listening and accepting an incoming connection request, the response might be received by the peer with some delay due to latency. This causes the peer to send a second connection request, that is not detected as duplicate because the first connection request has already been removed from the map that is used to check for duplicates (connReqs), so it is treated as a brand new connection request, breaking the first connection. This patch fixes the issue by introducing another map (connByPeer) that is used to check whether a connection request is associated to an already-accepted connection.

Dependencies

  • code.cloudfoundry.org/bytefmt updated from v0.58.0 to v0.59.0
  • github.com/bluenviron/gortmplib updated from v0.1.2 to v0.2.0
  • github.com/bluenviron/gortsplib/v5 updated from v5.2.1 to v5.2.2
  • github.com/bluenviron/mediacommon/v2 updated from v2.5.3 to v2.6.0
  • github.com/matthewhartstonge/argon2 updated from v1.4.3 to v1.4.4
  • github.com/pion/ice/v4 updated from v4.0.13 to v4.1.0
  • github.com/pion/rtp updated from v1.8.26 to v1.9.0
  • github.com/pion/sdp/v3 updated from v3.0.16 to v3.0.17
  • github.com/pion/webrtc/v4 updated from v4.1.7 to v4.2.1
  • golang.org/x/crypto updated from v0.45.0 to v0.46.0
  • golang.org/x/sys updated from v0.38.0 to v0.39.0
  • golang.org/x/term updated from v0.37.0 to v0.38.0
  • github.com/pion/dtls/v3 updated from v3.0.8 to v3.0.9
  • github.com/pion/sctp updated from v1.8.41 to v1.9.0
  • github.com/pion/stun/v3 updated from v3.0.1 to v3.0.2
  • github.com/quic-go/qpack updated from v0.5.1 to v0.6.0
  • github.com/quic-go/quic-go updated from v0.54.1 to v0.57.0
  • go.uber.org/mock removed
  • golang.org/x/mod removed
  • golang.org/x/net updated from v0.47.0 to v0.48.0
  • golang.org/x/sync removed
  • golang.org/x/text updated from v0.31.0 to v0.32.0
  • golang.org/x/time updated from v0.9.0 to v0.12.0
  • golang.org/x/tools removed

Security

Binaries are compiled from source through the Release workflow without human intervention, preventing any external interference.

You can verify that binaries have been produced by the workflow by using GitHub Attestations:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

  •  
  • ↗️
❌