From 217420721bb74addffaae6ac9e6e354e14b00bce Mon Sep 17 00:00:00 2001 From: Hiroshi Horie <548776+hiroshihorie@users.noreply.github.com> Date: Mon, 26 Oct 2026 12:57:24 +0800 Subject: [PATCH 1/2] chore: bump flutter_webrtc to 1.6.3 and WebRTC-SDK to 150.7871.04 flutter_webrtc 1.6.3 lets Windows and Linux plugins attach native video processors to local tracks (flutter-webrtc/flutter-webrtc#2233), fixes a Linux deadlock in desktopCapturer.getSources() (#2244), and moves to WebRTC-SDK 150.7871.04 and libwebrtc m150.7871.07. Those drop the compromised eMudhra cross-signed AAA Certificate Services root from the TURN/TLS bundle. Both podspecs pin WebRTC-SDK exactly, like flutter_webrtc's own, so they move to 150.7871.04 together with the flutter_webrtc pin. Android moves to the same version. --- .changes/bump-flutter-webrtc-1.6.3 | 1 + android/build.gradle | 2 +- ios/livekit_client.podspec | 2 +- macos/livekit_client.podspec | 2 +- pubspec.lock | 4 ++-- pubspec.yaml | 2 +- 6 files changed, 7 insertions(+), 6 deletions(-) create mode 100644 .changes/bump-flutter-webrtc-1.6.3 diff --git a/.changes/bump-flutter-webrtc-1.6.3 b/.changes/bump-flutter-webrtc-1.6.3 new file mode 100644 index 000000000..fa6bc5503 --- /dev/null +++ b/.changes/bump-flutter-webrtc-1.6.3 @@ -0,0 +1 @@ +patch type="changed" "Bump flutter_webrtc to 1.6.3 and WebRTC-SDK to 150.7871.04. Windows and Linux can attach native video processors to local tracks, Linux screen share no longer hangs in getSources(), and the bundled TURN/TLS roots no longer include the compromised eMudhra cross-signed AAA Certificate Services root" diff --git a/android/build.gradle b/android/build.gradle index 1df4a933d..97ee768b7 100644 --- a/android/build.gradle +++ b/android/build.gradle @@ -60,7 +60,7 @@ android { dependencies { testImplementation("org.jetbrains.kotlin:kotlin-test") testImplementation("org.mockito:mockito-core:5.0.0") - implementation 'io.github.webrtc-sdk:android:150.7871.01' + implementation 'io.github.webrtc-sdk:android:150.7871.04' implementation 'io.livekit:noise:2.0.0' // Audio device/focus/mode routing. Pinned to the same revision used by // the LiveKit Android SDK (AudioSwitchHandler). diff --git a/ios/livekit_client.podspec b/ios/livekit_client.podspec index 263acd984..d5e665b5a 100644 --- a/ios/livekit_client.podspec +++ b/ios/livekit_client.podspec @@ -16,6 +16,6 @@ Pod::Spec.new do |s| s.static_framework = true s.dependency 'Flutter' - s.dependency 'WebRTC-SDK', '150.7871.01' + s.dependency 'WebRTC-SDK', '150.7871.04' s.dependency 'flutter_webrtc' end diff --git a/macos/livekit_client.podspec b/macos/livekit_client.podspec index f654fdf4c..070f95dc8 100644 --- a/macos/livekit_client.podspec +++ b/macos/livekit_client.podspec @@ -16,6 +16,6 @@ Pod::Spec.new do |s| s.static_framework = true s.dependency 'FlutterMacOS' - s.dependency 'WebRTC-SDK', '150.7871.01' + s.dependency 'WebRTC-SDK', '150.7871.04' s.dependency 'flutter_webrtc' end diff --git a/pubspec.lock b/pubspec.lock index 8de48fd5f..e84804f3c 100644 --- a/pubspec.lock +++ b/pubspec.lock @@ -292,10 +292,10 @@ packages: dependency: "direct main" description: name: flutter_webrtc - sha256: ebf5ceef2897caae425ed65a38b2961c29d9d9a626159418ed460e1a65038c00 + sha256: b98ef03376401e54ff87fc78907b38e562b15ca8424aba589c263eddc3c1ecf9 url: "https://pub.dev" source: hosted - version: "1.6.2+hotfix.4" + version: "1.6.3" glob: dependency: transitive description: diff --git a/pubspec.yaml b/pubspec.yaml index f9c0de441..c5bd4633f 100644 --- a/pubspec.yaml +++ b/pubspec.yaml @@ -54,7 +54,7 @@ dependencies: json_annotation: ^4.12.0 # Fix version to avoid version conflicts between WebRTC-SDK pods, which both this package and flutter_webrtc depend on. - flutter_webrtc: 1.6.2+hotfix.4 + flutter_webrtc: 1.6.3 dart_webrtc: ^1.8.0 # Rust core (livekit-ffi), delivered as a bundled cdylib via Native Assets. From 9afc06154cef31a10548a514764a64f2b8da0bb7 Mon Sep 17 00:00:00 2001 From: Hiroshi Horie <548776+hiroshihorie@users.noreply.github.com> Date: Mon, 26 Oct 2026 12:58:33 +0800 Subject: [PATCH 2/2] chore: require livekit_ffi 0.13.2 livekit_ffi 0.13.2 moves the Rust core to libwebrtc webrtc-a545de4, which drops the compromised eMudhra cross-signed AAA Certificate Services root from its bundled TURN/TLS roots, matching the WebRTC-SDK 150.7871.04 bump. The SDK only calls buildVersion() today, so this changes no behavior. --- .changes/bump-livekit-ffi-0.13.2 | 1 + pubspec.lock | 4 ++-- pubspec.yaml | 2 +- 3 files changed, 4 insertions(+), 3 deletions(-) create mode 100644 .changes/bump-livekit-ffi-0.13.2 diff --git a/.changes/bump-livekit-ffi-0.13.2 b/.changes/bump-livekit-ffi-0.13.2 new file mode 100644 index 000000000..2665cef28 --- /dev/null +++ b/.changes/bump-livekit-ffi-0.13.2 @@ -0,0 +1 @@ +patch type="changed" "Require livekit_ffi 0.13.2, whose libwebrtc no longer bundles the compromised eMudhra cross-signed AAA Certificate Services root" diff --git a/pubspec.lock b/pubspec.lock index e84804f3c..bd89e4b8a 100644 --- a/pubspec.lock +++ b/pubspec.lock @@ -444,10 +444,10 @@ packages: dependency: "direct main" description: name: livekit_ffi - sha256: "98aa7389ac511481617966f2e26e87a29be54e004a97dc2923ffd7af0883c5f2" + sha256: "38ff93b4cb83239d2a4f5a57fe2ea68bd7ff845d1682c4f2c14713b6af04850d" url: "https://pub.dev" source: hosted - version: "0.13.1" + version: "0.13.2" logger: dependency: transitive description: diff --git a/pubspec.yaml b/pubspec.yaml index c5bd4633f..884b44740 100644 --- a/pubspec.yaml +++ b/pubspec.yaml @@ -59,7 +59,7 @@ dependencies: # Rust core (livekit-ffi), delivered as a bundled cdylib via Native Assets. # Native platforms only, see lib/src/ffi/. - livekit_ffi: ^0.13.1 + livekit_ffi: ^0.13.2 dev_dependencies: flutter_test: