Fixes and improvements
General
- require browser POST requests to have an allowed origin (#6238) Browsers can send POST requests without performing any preflight request and without checking whether the request origin is present in Access-Control-Allow-Origin. Intercept these requests and check server-side whether the origin is allowed, blocking the request if it is not.
- conf: fix comparison and sharing of the default authInternalUsers (#6205)
- h265: fix DTS extraction of streams with long-term reference pictures (bluenviron/mediacommon#371)
- pmp4: support stsz with a constant sample size (#5803) (bluenviron/mediacommon#373)
- pmp4, fmp4: restore check on inbound H265 SPS (bluenviron/mediacommon#374) A valid H265 SPS is required for marshaling back an MP4, so we have to resume checking them.
- pmp4: support tracks without edts (bluenviron/mediacommon#375) The edit box is optional (ISO/IEC 14496-12, 8.6.5), but tracks without it were rejected with "unexpected box 'mdia'".
- pmp4: return seek errors from GetPayload (bluenviron/mediacommon#376) GetPayload checked the wrong variable after seeking, therefore a failed seek was ignored and the payload was read from the current position of the reader.
- pmp4, fmp4: correctly fill HvcC NumTemporalLayers / TemporalIdNested from SPS (bluenviron/mediacommon#379)
- pmp4: support tracks longer than 2^32 ticks (bluenviron/mediacommon#377)
RTSP
- rtpmjpeg: reject reserved quantization value 127 (bluenviron/gortsplib#1161) RFC 2435 reserves quantization values 100-127, but the guard used
Quantization < 127 - mpeg4audiolatm: don't panic on a layer that reuses the config (bluenviron/gortsplib#1162)
- sdp: support oversized numbers in origin (#5949) (bluenviron/gortsplib#1171)
RTMP
- correctly fill HvcC NumTemporalLayers / TemporalIdNested from SPS (bluenviron/gortmplib#129)
- reader: support standalone SEIs from DJI drones (#5221) (bluenviron/gortmplib#130)
HLS
- make the server manage sessions (#6239) Sessions are now managed by the HLS server, detaching their lifecycle from muxers. This also comes with a performance improvement, since finding a session now traverses a single mutex, and not two channels like before.
- return 404 when a session is valid but muxer is closed (#5736) (#6240) HLS sessions are now kept open for up to 30 seconds after a muxer is closed. This allows the server to handle incoming requests belonging to these sessions and to classify then as 404 rather than 401.
- change error returned in case session is not found (#6241) match the RTSP behavior and return a "session not found" message rather than an "authentication error", which is reserved for creating sessions, not for using them.
- muxer: return 404 when closed (bluenviron/gohlslib#394)
WebRTC
- fix AV1 getting stuck by stripping padding (#5632) (#5774) (#6242) AV1 OBU padding is generated by several encoders. Stripping it has been demonstrated to solve most situations in which browsers get stuck when playing such streams.
- fix stuck decoding with DJI drones (#5221) (#6051) (#6243) Streams from DJI drones contain SEI units with payload type 5 and a specific UUID that seem to cause stuck videos on Chrome and Firefox. Filter out these units.
- add ability to exclude interfaces (#5788)
Dependencies
- code.cloudfoundry.org/bytefmt updated from v0.88.0 to v0.90.0
- github.com/MicahParks/keyfunc/v3 updated from v3.8.1 to v3.8.2
- github.com/abema/go-mp4 updated from v1.7.1 to v1.7.3
- github.com/bluenviron/gohlslib/v2 updated from v2.4.4 to v2.4.5
- github.com/bluenviron/gortmplib updated from v1.0.2 to v1.0.3
- github.com/bluenviron/gortsplib/v5 updated from v5.6.5 to v5.6.6
- github.com/bluenviron/mediacommon/v2 updated from v2.9.4 to v2.9.5
- github.com/gin-contrib/pprof updated from v1.5.4 to v1.5.5
- github.com/matthewhartstonge/argon2 updated from v1.5.7 to v1.6.3
- github.com/pion/ice/v4 updated from v4.4.1 to v4.4.2
- github.com/pion/interceptor updated from v0.1.47 to v0.1.48
- github.com/pion/sdp/v3 updated from v3.0.19 to v3.0.20
- github.com/pion/transport/v4 updated from v4.1.0 to v4.1.1
- github.com/pion/webrtc/v4 updated from v4.2.19 to v4.2.20
- golang.org/x/crypto updated from v0.55.0 to v0.57.0
- golang.org/x/net updated from v0.58.0 to v0.59.0
- golang.org/x/sync updated from v0.22.0 to v0.23.0
- golang.org/x/sys updated from v0.47.0 to v0.48.0
- golang.org/x/term updated from v0.45.0 to v0.46.0
- github.com/bytedance/gopkg updated from v0.1.3 to v0.1.4
- github.com/bytedance/sonic updated from v1.15.0 to v1.15.2
- github.com/bytedance/sonic/loader updated from v0.5.0 to v0.5.1
- github.com/cloudwego/base64x updated from v0.1.6 to v0.1.7
- github.com/gabriel-vasile/mimetype updated from v1.4.12 to v1.4.13
- github.com/gin-contrib/sse updated from v1.1.0 to v1.1.1
- github.com/go-playground/validator/v10 updated from v10.30.1 to v10.30.3
- github.com/goccy/go-json updated from v0.10.5 to v0.10.6
- github.com/klauspost/cpuid/v2 updated from v2.3.0 to v2.4.0
- github.com/mattn/go-isatty updated from v0.0.20 to v0.0.23
- github.com/pelletier/go-toml/v2 updated from v2.2.4 to v2.4.3
- github.com/pion/dtls/v3 updated from v3.1.5 to v3.1.8
- github.com/pion/mdns/v2 updated from v2.1.0 to v2.2.0
- github.com/pion/srtp/v3 updated from v3.0.13 to v3.0.15
- github.com/pion/stun/v3 removed
- github.com/pion/turn/v5 updated from v5.0.13 to v5.1.0
- go.mongodb.org/mongo-driver/v2 updated from v2.5.0 to v2.8.0
- golang.org/x/arch updated from v0.22.0 to v0.29.0
- golang.org/x/text updated from v0.41.0 to v0.42.0
- google.golang.org/protobuf updated from v1.36.10 to v1.36.11
- github.com/pion/stun/v4 v4.0.0 added
- hls.js updated from v1.7.2 to v1.7.3
Security
Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.
Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:
ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx
You can verify checksums of binaries by downloading checksums.sha256 and running:
cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check