chore: bump librtmp2 to 0.4.0 (0.1.5) by AlexanderWagnerDev · Pull Request #82 · OpenRTMP/librtmp2-server

AlexanderWagnerDev · 2026-07-14T20:49:51Z

Summary

Release librtmp2-server 0.1.5 with the published librtmp2 0.4.0 crate.
Use the registry-only crates.io dependency with the tls feature instead of the temporary Git revision pin.
Update Cargo.lock to the crates.io source and published checksum.
Update README, changelog, and agent guidance to document the registry dependency.
Keep the RTMP/HTTP E2E test compatible with the current librtmp2::types::Frame API.

Validation

Summary by CodeRabbit

New Features
- Added validation for publish, play, and statistics access keys, including format and minimum-length requirements.
- Invalid or legacy short access keys are now rejected consistently across HTTP and database lookups.
Changed
- Updated the project to version 0.1.5.
- Updated protocol, architecture, maturity, and build documentation.
- Updated the RTMP dependency to version 0.4.0 for improved reproducibility.

Replace marketing-style feature claims with what is actually wired into the live session path versus parser-only library code.

Pin librtmp2 0.4.0 via git until crates.io release, update inherited protocol docs, and fix Frame initializer in RTMP HTTP E2E test. Co-authored-by: Cursor <cursoragent@cursor.com>

coderabbitai · 2026-07-14T20:50:14Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

📝 Walkthrough

Walkthrough

Changes

Release and librtmp2 integration

Layer / File(s)	Summary
librtmp2 release integration `Cargo.toml`, `AGENTS.md`, `CHANGELOG.md`, `README.md`, `tests/rtmp_http_e2e.rs`	The project version moves to 0.1.5, librtmp2 is pinned to git revision 0.4.0, documentation and release links are updated, and the RTMP frame test uses default fields for the expanded frame shape.

Access-key validation

Layer / File(s)	Summary
Centralized access-key validation `src/keygen.rs`, `src/http.rs`	Access-key length and character validation, padding helpers, and the shared validation message are centralized in `keygen`; HTTP validation delegates to them and adds coverage for valid and invalid keys.
Lookup enforcement and authorization tests `src/db.rs`, `src/rtmp_bridge.rs`	Database lookups reject invalid keys before querying, fixtures generate normalized keys, and RTMP bridge tests use keys from inserted stream records.
Legacy-key regression coverage `src/db.rs`	A regression test verifies that short publish, play, and stats keys return missing lookup results.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant DbLookup
  participant keygen
  participant SQLDatabase
  DbLookup->>keygen: is_valid_access_key(key)
  keygen-->>DbLookup: valid or invalid
  DbLookup->>SQLDatabase: query valid access key
  SQLDatabase-->>DbLookup: lookup result

Possibly related PRs

OpenRTMP/librtmp2-server#23: Updates the librtmp2 dependency source used by the server.
OpenRTMP/librtmp2-server#24: Changes the librtmp2 dependency pin and source revision.
OpenRTMP/librtmp2-server#43: Modifies the HTTP access-key validation logic shared by this change.

Suggested reviewers: claude

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 70.37% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: bumping librtmp2 to 0.4.0 for the 0.1.5 release.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch chore/librtmp2-0.4.0

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

Replace rev pin with branch feat/ertmp-v2-multitrack-0.4.0. Document registry-only dependency after librtmp2 merge and crates.io publish. Co-authored-by: Cursor <cursoragent@cursor.com>

Co-authored-by: Cursor <cursoragent@cursor.com>

AlexanderWagnerDev · 2026-07-14T23:13:39Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit ffc5621. Configure here.}

AlexanderWagnerDev · 2026-07-14T23:18:15Z

@coderabbitai full review

coderabbitai · 2026-07-14T23:18:21Z

✅ Action performed

Full review finished.

Your plan includes PR reviews subject to rate limits. More reviews will be available in 40 minutes.

qodo-code-review · 2026-07-15T00:23:53Z

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

Context used

✅ Compliance rules (platform): 4 rules

✅ Cross-repo context

Explored: repo: OpenRTMP/librtmp2 (sha: 99a23475)

Explored: repo: AlexanderWagnerDev/nginx-obs-automatic-low-bitrate-switching (sha: e0a22df8)

Explored: repo: OpenRTMP/librtmp2-server-panel (sha: 7e8efee9)

1. librtmp2 uses git source ✓ Resolved 📘 Rule violation § Compliance

Description

Cargo.toml pins librtmp2 via a git rev, which is not a published crates.io-only dependency.
This violates the requirement to use a published crates.io version for librtmp2 and increases
supply-chain/audit risk.

Code

Cargo.toml[20]

+librtmp2 = { version = "0.4.0", git = "https://github.com/OpenRTMP/librtmp2", rev = "ad021f97631cd2033abaee43e711bc406ca10c17", features = ["tls"] }

Evidence
PR Compliance ID 2107461 requires librtmp2 to be a published crates.io dependency. The modified
dependency line in Cargo.toml uses a git URL and pinned revision instead of a registry-only
dependency declaration.
Rule 2107461: librtmp2 must use a published crates.io version, not a local path dependency
Cargo.toml[20-20]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`librtmp2` is currently sourced from a git repository + pinned `rev`, but compliance requires using a published crates.io version (and not sourcing it from non-registry locations).

## Issue Context
The dependency entry includes `git = "https://github.com/OpenRTMP/librtmp2"` and `rev = "..."`, which makes builds depend on a git source rather than crates.io.

## Fix Focus Areas
- Cargo.toml[18-20]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Previous review results

Review updated until commit 870e3be

Results up to commit a76a527

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. librtmp2 uses git source ✓ Resolved 📘 Rule violation § Compliance

Description

Cargo.toml pins librtmp2 via a git rev, which is not a published crates.io-only dependency.
This violates the requirement to use a published crates.io version for librtmp2 and increases
supply-chain/audit risk.

Code

Cargo.toml[20]

+librtmp2 = { version = "0.4.0", git = "https://github.com/OpenRTMP/librtmp2", rev = "ad021f97631cd2033abaee43e711bc406ca10c17", features = ["tls"] }

Evidence
PR Compliance ID 2107461 requires librtmp2 to be a published crates.io dependency. The modified
dependency line in Cargo.toml uses a git URL and pinned revision instead of a registry-only
dependency declaration.
Rule 2107461: librtmp2 must use a published crates.io version, not a local path dependency
Cargo.toml[20-20]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`librtmp2` is currently sourced from a git repository + pinned `rev`, but compliance requires using a published crates.io version (and not sourcing it from non-registry locations).

## Issue Context
The dependency entry includes `git = "https://github.com/OpenRTMP/librtmp2"` and `rev = "..."`, which makes builds depend on a git source rather than crates.io.

## Fix Focus Areas
- Cargo.toml[18-20]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

qodo-code-review · 2026-07-15T00:34:40Z

Code review by qodo was updated up to the latest commit 6914405

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/update-pr82-librtmp2.yml:
- Around line 17-21: Set persist-credentials to false in the actions/checkout
step for the “Check out PR branch” workflow step, then configure authentication
explicitly only immediately before the final push. Ensure the cargo update and
cargo check steps run without GitHub token credentials available in .git/config.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 24f36fa9-d24c-4d7c-a88c-269ffddfd130

📥 Commits

Reviewing files that changed from the base of the PR and between a76a527 and bb6180d.

⛔ Files ignored due to path filters (1)

Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

.github/workflows/update-pr82-librtmp2.yml

cursor · 2026-07-15T13:36:53Z

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_43466939-3be0-4a25-b99b-21659de9a7a8)

qodo-code-review · 2026-07-15T13:39:13Z

Code review by qodo was updated up to the latest commit 7ce4f51

qodo-code-review · 2026-07-15T15:11:13Z

Code review by qodo was updated up to the latest commit 870e3be

AlexanderWagnerDev and others added 2 commits July 14, 2026 22:06

docs: align README with code-accurate implementation status

df5bf80

Replace marketing-style feature claims with what is actually wired into the live session path versus parser-only library code.

chore: bump librtmp2 to 0.4.0 (0.1.5)

3e57d44

Pin librtmp2 0.4.0 via git until crates.io release, update inherited protocol docs, and fix Frame initializer in RTMP HTTP E2E test. Co-authored-by: Cursor <cursoragent@cursor.com>

chore: track librtmp2 0.4.0 via git branch until crates.io

ab85c76

Replace rev pin with branch feat/ertmp-v2-multitrack-0.4.0. Document registry-only dependency after librtmp2 merge and crates.io publish. Co-authored-by: Cursor <cursoragent@cursor.com>

AlexanderWagnerDev assigned AlexanderWagnerDev and unassigned AlexanderWagnerDev Jul 14, 2026

AlexanderWagnerDev and others added 5 commits July 14, 2026 23:17

chore: refresh librtmp2 lock to latest 0.4.0 branch (617d3d2)

042c91d

Co-authored-by: Cursor <cursoragent@cursor.com>

fix: pin librtmp2 to validated PR head

021226f

Update Cargo.lock

abd57d7

chore: stage librtmp2 dependency refresh

cb703a8

ci: validate librtmp2 dependency refresh

5d9081c

cursor Bot reviewed Jul 14, 2026

View reviewed changes

Comment thread .github/workflows/apply-pr82-dependency-fix.yml Outdated

github-actions Bot and others added 2 commits July 14, 2026 23:01

fix: pin server to validated librtmp2 revision

9ad2b55

docs: clarify validated librtmp2 revision

ffc5621

cursor Bot reviewed Jul 14, 2026

View reviewed changes

docs: update 0.1.5 changelog date

a76a527

qodo-code-review Bot reviewed Jul 15, 2026

View reviewed changes

Comment thread Cargo.toml Outdated

AlexanderWagnerDev and others added 5 commits July 15, 2026 02:29

chore: add one-shot dependency refresh for PR 82

ab216d3

Update Cargo.lock

bb6180d

fix: simplify PR 82 dependency refresh

9c8e69b

fix: refresh librtmp2 dependency pin

43b84cd

chore: clarify reproducible librtmp2 pin

6914405

coderabbitai Bot reviewed Jul 15, 2026

View reviewed changes

Comment thread .github/workflows/update-pr82-librtmp2.yml Outdated

fix: reject legacy short access keys

7ce4f51

AlexanderWagnerDev and others added 3 commits July 15, 2026 17:06

chore: apply crates.io librtmp2 0.4.0 migration

0e025b2

chore: use crates.io librtmp2 0.4.0

d23067a

docs: clarify crates.io dependency source

870e3be

Uh oh!

Conversation

AlexanderWagnerDev commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Validation

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

Sequence Diagram(s)

❌ Failed checks (1 warning)

Uh oh!

Uh oh!

AlexanderWagnerDev commented Jul 14, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

AlexanderWagnerDev commented Jul 14, 2026

Uh oh!

coderabbitai Bot commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

qodo-code-review Bot commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review by Qodo

Previous review results

Uh oh!

Uh oh!

qodo-code-review Bot commented Jul 15, 2026

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor Bot commented Jul 15, 2026

Bugbot couldn't run - usage limit reached

Uh oh!

qodo-code-review Bot commented Jul 15, 2026

Uh oh!

qodo-code-review Bot commented Jul 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

AlexanderWagnerDev commented Jul 14, 2026 •

edited

Loading

coderabbitai Bot commented Jul 14, 2026 •

edited

Loading

coderabbitai Bot commented Jul 14, 2026 •

edited

Loading

qodo-code-review Bot commented Jul 15, 2026 •

edited

Loading