mediasoup 3.20.8 → 3.20.10

package/node/lib/test/test-WebRtcServer.js

@@ -96,7 +96,6 @@ test('worker.createWebRtcServer() succeeds', async () => {
         tcpServers: [{ ip: '127.0.0.1', port: port2 }],
         webRtcTransportIds: [],
         localIceUsernameFragments: [],
-        tupleHashes: [],
     });
     // API not exposed in the interface.
     expect(ctx.worker.webRtcServersForTesting.size).toBe(1);
@@ -154,7 +153,6 @@ test('worker.createWebRtcServer() with portRange succeeds', async () => {
         tcpServers: [{ ip: '127.0.0.1', port: port2 }],
         webRtcTransportIds: [],
         localIceUsernameFragments: [],
-        tupleHashes: [],
     });
     // API not exposed in the interface.
     expect(ctx.worker.webRtcServersForTesting.size).toBe(1);
@@ -200,7 +198,6 @@ test('worker.createWebRtcServer() without specifying port/portRange succeeds', a
         tcpServers: [{ ip: '127.0.0.1', port: expect.any(Number) }],
         webRtcTransportIds: [],
         localIceUsernameFragments: [],
-        tupleHashes: [],
     });
     // API not exposed in the interface.
     expect(ctx.worker.webRtcServersForTesting.size).toBe(1);
@@ -403,7 +400,6 @@ test('router.createWebRtcTransport() with webRtcServer succeeds and transport is
         localIceUsernameFragments: [
             { /* localIceUsernameFragment: xxx, */ webRtcTransportId: transport.id },
         ],
-        tupleHashes: [],
     });
     transport.close();
     expect(transport.closed).toBe(true);
@@ -419,7 +415,6 @@ test('router.createWebRtcTransport() with webRtcServer succeeds and transport is
         tcpServers: [{ ip: '127.0.0.1', port: port2 }],
         webRtcTransportIds: [],
         localIceUsernameFragments: [],
-        tupleHashes: [],
     });
 }, 2000);
 test('router.createWebRtcTransport() with webRtcServer succeeds and webRtcServer is closed', async () => {
@@ -482,7 +477,6 @@ test('router.createWebRtcTransport() with webRtcServer succeeds and webRtcServer
         localIceUsernameFragments: [
             { /* localIceUsernameFragment: xxx, */ webRtcTransportId: transport.id },
         ],
-        tupleHashes: [],
     });
     // Let's restart ICE in the transport so it should add a new entry in
     // localIceUsernameFragments in the WebRtcServer.
@@ -496,7 +490,6 @@ test('router.createWebRtcTransport() with webRtcServer succeeds and webRtcServer
             { /* localIceUsernameFragment: xxx, */ webRtcTransportId: transport.id },
             { /* localIceUsernameFragment: yyy, */ webRtcTransportId: transport.id },
         ],
-        tupleHashes: [],
     });
     const onObserverClose = jest.fn();
     webRtcServer.observer.once('close', onObserverClose);

package/node/lib/test/test-Worker.js

@@ -71,7 +71,6 @@ test('mediasoup.createWorker() succeeds', async () => {
         dtlsCertificateFile: path.join(__dirname, 'data', 'dtls-cert.pem'),
         dtlsPrivateKeyFile: path.join(__dirname, 'data', 'dtls-key.pem'),
         libwebrtcFieldTrials: 'WebRTC-Bwe-AlrLimitedBackoff/Disabled/',
-        disableLiburing: true,
         appData: { foo: 456 },
     });
     expect(worker2.constructor.name).toBe('WorkerImpl');

package/npm-scripts.mjs

@@ -8,7 +8,9 @@ import * as tar from 'tar';
 import pkg from './package.json' with { type: 'json' };
 
 const IS_WINDOWS = os.platform() === 'win32';
-const MAYOR_VERSION = pkg.version.split('.')[0];
+// Main Git branch is 'v' concatenated with the major SEMVER number of the
+// "version" field in package.json.
+const MAIN_BRANCH = `v${pkg.version.split('.')[0]}`;
 const PYTHON = getPython();
 const PIP_INVOKE_DIR = path.resolve('worker/pip_invoke');
 const WORKER_RELEASE_DIR = 'worker/out/Release';
@@ -17,8 +19,6 @@ const WORKER_RELEASE_BIN = IS_WINDOWS
 	: 'mediasoup-worker';
 const WORKER_RELEASE_BIN_PATH = `${WORKER_RELEASE_DIR}/${WORKER_RELEASE_BIN}`;
 const WORKER_PREBUILD_DIR = 'worker/prebuild';
-const GH_OWNER = 'versatica';
-const GH_REPO = 'mediasoup';
 
 // Paths for ESLint to check.
 const ESLINT_PATHS = [
@@ -27,6 +27,7 @@ const ESLINT_PATHS = [
 	'knip.config.mjs',
 	'node/src',
 	'npm-scripts.mjs',
+	'rust-scripts.mjs',
 	'worker/scripts',
 ];
 
@@ -47,6 +48,7 @@ const PRETTIER_PATHS = [
 	'node/src',
 	'npm-scripts.mjs',
 	'package.json',
+	'rust-scripts.mjs',
 	'tsconfig.json',
 	'worker/scripts',
 ];
@@ -136,14 +138,20 @@ async function run() {
 			break;
 		}
 
+		case 'prepublishOnly': {
+			prepublishOnly();
+
+			break;
+		}
+
 		case 'typescript:build': {
-			buildTypescript({ force: true });
+			buildTypescript({ force: true, args: taskArgs });
 
 			break;
 		}
 
 		case 'typescript:watch': {
-			watchTypescript();
+			watchTypescript({ args: taskArgs });
 
 			break;
 		}
@@ -215,7 +223,7 @@ async function run() {
 		}
 
 		case 'test:node': {
-			testNode();
+			testNode({ args: taskArgs });
 
 			break;
 		}
@@ -227,7 +235,7 @@ async function run() {
 		}
 
 		case 'coverage:node': {
-			coverageNode();
+			coverageNode({ args: taskArgs });
 
 			break;
 		}
@@ -245,7 +253,7 @@ async function run() {
 		}
 
 		case 'release': {
-			await release();
+			await release({ args: taskArgs });
 
 			break;
 		}
@@ -317,7 +325,7 @@ function deleteNodeLib() {
 	fs.rmSync('node/lib', { recursive: true, force: true });
 }
 
-function buildTypescript({ force }) {
+function buildTypescript({ force, args = '' }) {
 	// Skip JavaScript code generation if the output already exists, unless forced.
 	if (!force && fs.existsSync('node/lib')) {
 		return;
@@ -327,15 +335,15 @@ function buildTypescript({ force }) {
 
 	deleteNodeLib();
 
-	executeCmd(`tsc ${taskArgs}`);
+	executeCmd(`tsc ${args}`);
 }
 
-function watchTypescript() {
+function watchTypescript({ args = '' } = {}) {
 	logInfo('watchTypescript()');
 
 	deleteNodeLib();
 
-	executeCmd(`tsc --watch ${taskArgs}`);
+	executeCmd(`tsc --watch ${args}`);
 }
 
 function buildWorker() {
@@ -487,10 +495,10 @@ function flatcWorker() {
 	executeCmd(`"${PYTHON}" -m invoke -r worker flatc`);
 }
 
-function testNode() {
+function testNode({ args = '' } = {}) {
 	logInfo('testNode()');
 
-	executeCmd(`jest --silent false --detectOpenHandles ${taskArgs}`);
+	executeCmd(`jest --silent false --detectOpenHandles ${args}`);
 }
 
 function testWorker() {
@@ -501,10 +509,10 @@ function testWorker() {
 	executeCmd(`"${PYTHON}" -m invoke -r worker test`);
 }
 
-function coverageNode() {
+function coverageNode({ args = '' } = {}) {
 	logInfo('coverageNode()');
 
-	executeCmd(`jest --coverage ${taskArgs}`);
+	executeCmd(`jest --coverage ${args}`);
 	executeCmd('open-cli coverage/lcov-report/index.html');
 }
 
@@ -522,6 +530,26 @@ function installNodeDeps() {
 	executeCmd('npm audit --prefix worker/scripts');
 }
 
+/**
+ * `prepublishOnly` is run by NPM only on `npm publish` (not on `npm pack`,
+ * `npm install` or `npm ci`). We use it to forbid publishing mediasoup from a
+ * local machine. The package must only be published by the
+ * `mediasoup-npm-publish.yaml` workflow, which runs inside GitHub Actions (where
+ * GITHUB_ACTIONS environment variable is set to 'true') and uses OIDC trusted
+ * publishing.
+ */
+function prepublishOnly() {
+	logInfo('prepublishOnly()');
+
+	if (process.env.GITHUB_ACTIONS !== 'true') {
+		logError(
+			"prepublishOnly() | refusing to 'npm publish' outside of GitHub Actions: mediasoup is published only by the mediasoup-npm-publish.yaml workflow (triggered by pushing a release tag via 'npm run release')"
+		);
+
+		exitWithError();
+	}
+}
+
 function publishDryRun() {
 	logInfo('publishDryRun()');
 
@@ -542,6 +570,18 @@ function publishDryRun() {
 async function checkRelease() {
 	logInfo('checkRelease()');
 
+	// Verify that CHANGELOG.md has an entry for the new version (and grab its
+	// changes, used as the GitHub release body) before the slow build steps.
+	let versionChanges;
+
+	try {
+		versionChanges = await getVersionChanges();
+	} catch (error) {
+		logError(`checkRelease() | ${error.message}`);
+
+		exitWithError();
+	}
+
 	installNodeDeps();
 	await flatcNode({ force: true });
 	buildTypescript({ force: true });
@@ -553,41 +593,64 @@ async function checkRelease() {
 	// Validate packaging (the `files` list in package.json) before the
 	// irreversible release steps (git push, GitHub release, npm publish).
 	publishDryRun();
+
+	return { versionChanges };
 }
 
-async function release() {
+async function release({ args = '' } = {}) {
 	logInfo('release()');
 
-	let octokit;
-	let versionChanges;
+	const version = args.trim();
 
-	try {
-		octokit = await getOctokit();
-		versionChanges = await getVersionChanges();
-	} catch (error) {
-		logError(error.message);
+	if (!/^\d+\.\d+\.\d+$/.test(version)) {
+		logError(
+			`release() | a SEMVER 'x.y.z' argument is required, but got '${version}'`
+		);
+
+		exitWithError();
+	}
+
+	// Must be on the main branch.
+	const branch = execSync('git rev-parse --abbrev-ref HEAD', {
+		encoding: 'utf-8',
+	}).trim();
+
+	if (branch !== MAIN_BRANCH) {
+		logError(
+			`release() | must be on '${MAIN_BRANCH}' branch, but it is on '${branch}' branch`
+		);
 
 		exitWithError();
 	}
 
+	// Clean working tree required before bumping the version.
+	checkGitClean();
+
+	// Lint, test, build, publish dry-run, and verify the CHANGELOG entry (of the
+	// previous version still in package.json, which is harmless).
 	await checkRelease();
-	executeCmd(`git commit -am '${pkg.version}'`);
-	executeCmd(`git tag -a ${pkg.version} -m '${pkg.version}'`);
-	executeCmd(`git push origin v${MAYOR_VERSION}`);
-	executeCmd(`git push origin '${pkg.version}'`);
-
-	logInfo('creating release in GitHub');
-
-	await octokit.repos.createRelease({
-		owner: GH_OWNER,
-		repo: GH_REPO,
-		name: pkg.version,
-		body: versionChanges,
-		tag_name: pkg.version,
-		draft: false,
-	});
 
-	executeInteractiveCmd('npm publish');
+	// Bump the version in package.json + package-lock.json and in CHANGELOG.md.
+	executeCmd(`npm version ${version} --no-git-tag-version`);
+	await updateChangelog(version);
+
+	// Commit the bump, tag it, and push both. The pushed tag triggers
+	// `mediasoup-npm-publish.yaml`, which checks, creates the GitHub release and
+	// publishes to NPM; on its success `mediasoup-worker-prebuild.yaml` builds
+	// and uploads the prebuilt binaries.
+	//
+	// The commit message carries a "[no-ci]" marker so the regular branch CI
+	// workflows (node, worker, rust, fuzzer, codeql) skip this commit: it only
+	// bumps version/CHANGELOG (no code change) and its parent already passed CI,
+	// and the release is driven by the tag-triggered workflows instead.
+	//
+	// NOTE: "[no-ci]" (with a hyphen) is a custom marker, NOT GitHub's native
+	// "[skip ci]"/"[no ci]" (which would also skip mediasoup-npm-publish, since
+	// the tag push shares this same commit).
+	executeCmd(`git commit -am 'release ${version} [no-ci]'`);
+	executeCmd(`git tag -a ${version} -m '${version}'`);
+	executeCmd(`git push origin ${MAIN_BRANCH}`);
+	executeCmd(`git push origin '${version}'`);
 }
 
 function ensureDir(dir) {
@@ -636,8 +699,10 @@ async function prebuildWorker() {
 	}
 }
 
-// Returns a Promise resolving to true if a mediasoup-worker prebuilt binary
-// was downloaded and uncompressed, false otherwise.
+/**
+ * Returns a Promise resolving to true if a mediasoup-worker prebuilt binary was
+ * downloaded and uncompressed, false otherwise.
+ */
 async function downloadPrebuiltWorker() {
 	const releaseBase =
 		process.env.MEDIASOUP_WORKER_PREBUILT_DOWNLOAD_BASE_URL ||
@@ -757,19 +822,21 @@ async function downloadPrebuiltWorker() {
 	});
 }
 
-async function getOctokit() {
-	if (!process.env.GITHUB_TOKEN) {
-		throw new Error('missing GITHUB_TOKEN environment variable');
-	}
-
-	// NOTE: Load dep on demand since it's a devDependency.
-	const { Octokit } = await import('@octokit/rest');
+function checkGitClean() {
+	logInfo('checkGitClean()');
 
-	const octokit = new Octokit({
-		auth: process.env.GITHUB_TOKEN,
+	const status = execSync('git status --porcelain', {
+		encoding: 'utf-8',
+		stdio: ['ignore', 'pipe', 'ignore'],
 	});
 
-	return octokit;
+	if (status.trim()) {
+		logError(
+			'checkGitClean() | Git working tree is not clean, commit or stash your changes first'
+		);
+
+		exitWithError();
+	}
 }
 
 async function getVersionChanges() {
@@ -785,9 +852,26 @@ async function getVersionChanges() {
 		const entry = entries[idx];
 
 		if (entry.type === 'heading' && entry.text === pkg.version) {
-			const changes = entries[idx + 1].raw;
+			// Collect every token after the matching heading until the next heading.
+			// NOTE: We cannot just use `entries[idx + 1].raw` because `marked`
+			// inserts a `space` token between the heading and its content.
+			let changes = '';
+
+			for (let next = idx + 1; next < entries.length; ++next) {
+				if (entries[next].type === 'heading') {
+					break;
+				}
 
-			return changes;
+				changes += entries[next].raw;
+			}
+
+			changes = changes.trim();
+
+			if (changes) {
+				return changes;
+			}
+
+			break;
 		}
 	}
 
@@ -797,11 +881,43 @@ async function getVersionChanges() {
 	);
 }
 
-function executeCmd(command) {
-	logInfo(`executeCmd(): ${command}`);
+async function updateChangelog(version) {
+	logInfo(`updateChangelog() [version:${version}]`);
+
+	// NOTE: Load dep on demand since it's a devDependency.
+	const marked = await import('marked');
+
+	const changelog = fs.readFileSync('./CHANGELOG.md', { encoding: 'utf-8' });
+	const tokens = marked.lexer(changelog);
+
+	// Locate the top "### NEXT" heading.
+	const nextHeading = tokens.find(
+		token =>
+			token.type === 'heading' && token.depth === 3 && token.text === 'NEXT'
+	);
+
+	if (!nextHeading) {
+		throw new Error("no '### NEXT' heading found in CHANGELOG.md");
+	}
+
+	// Insert "### <version>" right below "### NEXT" (keeping the empty "### NEXT"
+	// for future unreleased changes), preserving the heading's trailing newlines.
+	const updatedChangelog = changelog.replace(
+		nextHeading.raw,
+		`### NEXT\n\n### ${version}${nextHeading.raw.slice('### NEXT'.length)}`
+	);
+
+	fs.writeFileSync('./CHANGELOG.md', updatedChangelog);
+}
+
+function executeCmd(command, { cwd } = {}) {
+	logInfo(`executeCmd(): ${command}${cwd ? ` [cwd:${cwd}]` : ''}`);
 
 	try {
-		execSync(command, { stdio: ['ignore', process.stdout, process.stderr] });
+		execSync(command, {
+			cwd,
+			stdio: ['ignore', process.stdout, process.stderr],
+		});
 	} catch (error) {
 		logError(`executeCmd() failed, exiting: ${error}`);
 
@@ -809,11 +925,12 @@ function executeCmd(command) {
 	}
 }
 
-function executeInteractiveCmd(command) {
-	logInfo(`executeInteractiveCmd(): ${command}`);
+// eslint-disable-next-line no-unused-vars
+function executeInteractiveCmd(command, { cwd } = {}) {
+	logInfo(`executeInteractiveCmd(): ${command}${cwd ? ` [cwd:${cwd}]` : ''}`);
 
 	try {
-		execSync(command, { stdio: 'inherit', env: process.env });
+		execSync(command, { cwd, stdio: 'inherit', env: process.env });
 	} catch (error) {
 		logError(`executeInteractiveCmd() failed, exiting: ${error}`);
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "mediasoup",
-	"version": "3.20.8",
+	"version": "3.20.10",
 	"description": "Cutting Edge WebRTC Video Conferencing",
 	"contributors": [
 		"Iñaki Baz Castillo <ibc@aliax.net> (https://inakibaz.me)",
@@ -75,6 +75,7 @@
 	"scripts": {
 		"prepare": "node npm-scripts.mjs prepare",
 		"postinstall": "node npm-scripts.mjs postinstall",
+		"prepublishOnly": "node npm-scripts.mjs prepublishOnly",
 		"typescript:build": "node npm-scripts.mjs typescript:build",
 		"typescript:watch": "node npm-scripts.mjs typescript:watch",
 		"worker:build": "node npm-scripts.mjs worker:build",
@@ -98,7 +99,9 @@
 		"coverage:node": "node npm-scripts.mjs coverage:node",
 		"publish:dry-run": "node npm-scripts.mjs publish:dry-run",
 		"release:check": "node npm-scripts.mjs release:check",
-		"release": "node npm-scripts.mjs release"
+		"release": "node npm-scripts.mjs release",
+		"release:rust:check": "node rust-scripts.mjs release:check",
+		"release:rust": "node rust-scripts.mjs release"
 	},
 	"dependencies": {
 		"debug": "^4.4.3",
@@ -110,26 +113,25 @@
 	},
 	"devDependencies": {
 		"@eslint/js": "^10.0.1",
-		"@octokit/rest": "^22.0.1",
 		"@types/debug": "^4.1.13",
 		"@types/ini": "^4.1.1",
 		"@types/jest": "^30.0.0",
-		"@types/node": "^25.9.3",
+		"@types/node": "^26.0.0",
 		"eslint": "^10.5.0",
 		"eslint-config-prettier": "^10.1.8",
 		"eslint-plugin-jest": "^29.15.2",
 		"eslint-plugin-prettier": "^5.5.6",
-		"globals": "^17.6.0",
-		"ini": "^6.0.0",
+		"globals": "^17.7.0",
+		"ini": "^7.0.0",
 		"jest": "^30.4.2",
-		"knip": "^6.17.1",
+		"knip": "^6.18.0",
 		"marked": "^18.0.5",
 		"open-cli": "^9.0.0",
 		"pick-port": "^2.2.1",
 		"prettier": "^3.8.4",
 		"ts-jest": "^29.4.11",
 		"typescript": "^6.0.3",
-		"typescript-eslint": "^8.61.1",
+		"typescript-eslint": "^8.62.0",
 		"werift-sctp": "^0.0.11"
 	}
 }

package/worker/fbs/webRtcServer.fbs

@@ -12,17 +12,11 @@ table IceUserNameFragment {
     web_rtc_transport_id: string (required);
 }
 
-table TupleHash {
-    tuple_hash: uint64;
-    web_rtc_transport_id: string (required);
-}
-
 table DumpResponse {
     id: string (required);
     udp_sockets: [IpPort] (required);
     tcp_servers: [IpPort] (required);
     web_rtc_transport_ids: [string] (required);
     local_ice_username_fragments: [IceUserNameFragment] (required);
-    tuple_hashes: [TupleHash] (required);
 }
 

package/worker/include/RTC/ICE/StunPacket.hpp

@@ -113,7 +113,21 @@ namespace RTC
 				FINGERPRINT        = 0x8028,
 				ICE_CONTROLLED     = 0x8029,
 				ICE_CONTROLLING    = 0x802A,
-				NOMINATION         = 0xC001
+				/**
+				 * In libwebrtc native code, STUN_ATTR_NOMINATION is defined as 0xC001.
+				 * However that value is not defined in any RFC/draft, not even in the
+				 * draft that defines the NOMINATION attribute.
+				 *
+				 * @see https://datatracker.ietf.org/doc/html/draft-thatcher-ice-renomination
+				 * @see https://issues.webrtc.org/issues/496629058
+				 */
+				NOMINATION_OLD = 0xC001,
+				/**
+				 * Value of the NOMINATION attribute in the new specification.
+				 *
+				 * @see https://juberti.github.io/draft-renomination/draft-thatcher-tsvwg-renomination.html
+				 */
+				NOMINATION = 0x0030
 			};
 
 			// Authentication result.
@@ -290,7 +304,12 @@ namespace RTC
 
 			uint32_t GetNomination() const
 			{
-				const auto* attribute = GetAttribute(StunPacket::AttributeType::NOMINATION);
+				auto* attribute = GetAttribute(StunPacket::AttributeType::NOMINATION);
+
+				if (!attribute)
+				{
+					attribute = GetAttribute(StunPacket::AttributeType::NOMINATION_OLD);
+				}
 
 				if (!attribute)
 				{

package/worker/include/RTC/NackGenerator.hpp

@@ -48,7 +48,7 @@ namespace RTC
 		};
 
 	public:
-		explicit NackGenerator(Listener* listener, SharedInterface* shared, unsigned int sendNackDelayMs);
+		explicit NackGenerator(Listener* listener, SharedInterface* shared, uint32_t sendNackDelayMs);
 		~NackGenerator() override;
 
 		bool ReceivePacket(const RTC::RTP::Packet* packet, bool isRecovered);
@@ -76,7 +76,7 @@ namespace RTC
 		// Passed by argument.
 		Listener* listener{ nullptr };
 		SharedInterface* shared{ nullptr };
-		unsigned int sendNackDelayMs{ 0u };
+		uint32_t sendNackDelayMs{ 0u };
 		// Allocated by this.
 		TimerHandleInterface* timer{ nullptr };
 		// Others.

package/worker/include/RTC/RTP/RtpStreamRecv.hpp

@@ -49,7 +49,7 @@ namespace RTC
 			  RTP::RtpStreamRecv::Listener* listener,
 			  SharedInterface* shared,
 			  RTP::RtpStream::Params& params,
-			  unsigned int sendNackDelayMs,
+			  uint32_t sendNackDelayMs,
 			  bool useRtpInactivityCheck);
 			~RtpStreamRecv() override;
 
@@ -105,7 +105,7 @@ namespace RTC
 
 		private:
 			// Passed by argument.
-			unsigned int sendNackDelayMs{ 0u };
+			uint32_t sendNackDelayMs{ 0u };
 			bool useRtpInactivityCheck{ false };
 			// Others.
 			// Packets expected at last interval.