LoginSign Up
← Back to all sparks
M

mediasoup

MEETINGS
Velocity5.0

Open-source WebRTC SFU library for building multiparty video conferencing

mediasoup.org ↗

mediasoup is settling a data-channel subchannel API in public, four point releases at a time.

webrtcsfurustdata-channelsmemory-safety
◆Current state
mediasoup is a WebRTC SFU library, and this feed tracks its Rust crate, which moved from 0.24.0 to 0.25.1 in eleven days. The releases are small and single-purpose — usually one PR each — and cluster on two threads: subchannel handling for data channels across piped transports, and worker-level memory and crypto safety. 0.24.0 is the substantive one, carrying three externally reported vulnerability fixes alongside a libsrtp update.
◆Where it's heading
The subchannel work running from 0.24.2 through 0.25.1 is an API being shaped in the open: piped DataConsumers gained subchannel handling, DirectDataProducer.send() gained an optional ignored_subchannel argument, and then 0.25.1 removed that check for the piped case. Four releases to land one coherent behavior means the semantics were worked out against real usage rather than specified up front. The safety fixes in 0.24.0 all came from an outside reporter, which is the normal shape for a library parsing untrusted RTP and SCTP at this layer.
◆Prediction
More point releases on the pipe-transport and subchannel surface are likely while that behavior settles. Nothing in these notes signals a larger 0.26 theme, so a version bump driven by a new capability is not something the feed currently supports predicting.

◆Recent moves

  1. 3d ago

    Piped DataConsumers stop checking ignoredSubchannel

    Walks back part of the behavior added one release earlier: the ignoredSubchannel check no longer applies to piped DataConsumers. It closes out the four-release subchannel thread by exempting the case the option was interfering with.

    View source ↗
  2. 6d ago

    DirectDataProducer.send() gains an ignored_subchannel argument

    Adds an optional ignored_subchannel argument to DirectDataProducer.send(), letting a sender exclude a subchannel at publish time. It is the API-facing half of the subchannel work the two prior releases did inside pipe transports.

    View source ↗
  3. 9d ago

    DataProducerOptions::new_pipe_transport() becomes public

    A one-line visibility change that lets consumers construct pipe-transport data producer options directly instead of routing around a private constructor. Small, but it is the kind of gap that only surfaces once people are actually building on the pipe-transport path.

    View source ↗
  4. 11d ago

    Pipe DataConsumers gain subchannel handling

    The start of the subchannel thread: DataConsumers created over pipe transports now handle subchannels, closing a gap between direct and piped delivery. The three releases after this one refine what that handling should actually do.

    View source ↗
  5. 12d ago

    Worker uses a thread_local buffer on MS_ABORT()

    An internal fix to the worker's abort path, using a thread-local buffer so the crash handler is safe under concurrency. Invisible in normal operation and only relevant when something has already gone wrong.

    View source ↗
  6. 13d ago

    Security fixes in RTP and SCTP parsing, plus a libsrtp update

    The substantive release of this window: an out-of-bounds write in RTP dependency-descriptor parsing, an integer overflow in an SCTP error cause, and a switch to constant-time comparison for SCTP state-cookie MAC and STUN MESSAGE-INTEGRITY verification, all credited to one outside reporter. libsrtp moves to a 3.0.0 beta and SCTP gains a default per-stream buffered-amount-low threshold. For an SFU parsing hostile input from every participant, these are the fixes that matter most in the set.

    View source ↗