Add data tracks schema metadata

.changeset/great-birds-work.md

@@ -0,0 +1,5 @@
+---
+"@livekit/protocol": patch
+---
+
+add local protojson with permissive defaults

.changeset/sip-fix-trunk-encryption.md

@@ -0,0 +1,6 @@
+---
+"@livekit/protocol": patch
+"github.com/livekit/protocol": patch
+---
+
+Fix SIP trunk-level MediaEncryption being silently dropped on outbound and inbound calls. The early `req.Upgrade()` / `rule.Upgrade()` calls pinned `Media.Encryption` to the (legacy) request/rule field before the trunk's MediaEncryption was merged, causing INVITEs to omit SRTP when only the trunk had it configured.

.github/workflows/generate.yaml

@@ -33,7 +33,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: ">=1.20"
+          go-version: ">=1.26"
 
       - name: Go mod tidy
         run: go mod tidy

.golangci.yml

@@ -2,8 +2,18 @@ version: "2"
 linters:
   default: none
   enable:
+    - depguard
     - staticcheck
   settings:
+    depguard:
+      rules:
+        protojson:
+          files:
+            - "$all"
+            - "!**/utils/protojson/**"
+          deny:
+            - pkg: google.golang.org/protobuf/encoding/protojson
+              desc: use github.com/livekit/protocol/utils/protojson instead — it sets DiscardUnknown by default to avoid schema-drift footguns
     staticcheck:
       checks:
         - "all"
@@ -14,3 +24,5 @@ linters:
         - "-ST1022"
         - "-SA1019"
         - "-QF1008"
+  exclusions:
+    generated: strict

CHANGELOG.md

@@ -1,5 +1,27 @@
 # github.com/livekit/protocol
 
+## 1.45.8
+
+### Patch Changes
+
+- Allow setting a list of SIP codecs for SDP. - [#1530](https://github.com/livekit/protocol/pull/1530) ([@dennwc](https://github.com/dennwc))
+
+- fix: ensure we don't reject tokens on unknown fields - [#1536](https://github.com/livekit/protocol/pull/1536) ([@davidzhao](https://github.com/davidzhao))
+
+## 1.45.7
+
+### Patch Changes
+
+- feat(agents): add session events for amd - [#1526](https://github.com/livekit/protocol/pull/1526) ([@chenghao-mou](https://github.com/chenghao-mou))
+
+## 1.45.6
+
+### Patch Changes
+
+- Add turn detection protobufs - [#1485](https://github.com/livekit/protocol/pull/1485) ([@chenghao-mou](https://github.com/chenghao-mou))
+
+- fix change set for eot changes - [#1515](https://github.com/livekit/protocol/pull/1515) ([@chenghao-mou](https://github.com/chenghao-mou))
+
 ## 1.45.5
 
 ## 1.45.4

agent/environment.go

@@ -0,0 +1,24 @@
+package agent
+
+import "fmt"
+
+const MaxDeploymentLength = 64
+
+func ValidateDeployment(deployment string) error {
+	if deployment == "" {
+		return nil
+	}
+	if len(deployment) > MaxDeploymentLength {
+		return fmt.Errorf("deployment exceeds %d bytes", MaxDeploymentLength)
+	}
+	for i := 0; i < len(deployment); i++ {
+		c := deployment[i]
+		switch {
+		case c == '_':
+			return fmt.Errorf("deployment contains reserved character %q", c)
+		case c <= ' ' || c == 0x7f:
+			return fmt.Errorf("deployment contains whitespace or control byte at position %d", i)
+		}
+	}
+	return nil
+}

auth/grants.go

@@ -22,19 +22,15 @@ import (
 	"go.uber.org/zap"
 	"go.uber.org/zap/zapcore"
 	"golang.org/x/exp/slices"
-	"google.golang.org/protobuf/encoding/protojson"
 
 	"github.com/livekit/protocol/livekit"
 	"github.com/livekit/protocol/logger"
 	"github.com/livekit/protocol/utils"
+	"github.com/livekit/protocol/utils/protojson"
 )
 
 type RoomConfiguration livekit.RoomConfiguration
 
-var tokenMarshaler = protojson.MarshalOptions{
-	EmitDefaultValues: false,
-}
-
 var ErrSensitiveCredentials = errors.New("room configuration should not contain sensitive credentials")
 
 func (c *RoomConfiguration) Clone() *RoomConfiguration {
@@ -45,7 +41,7 @@ func (c *RoomConfiguration) Clone() *RoomConfiguration {
 }
 
 func (c *RoomConfiguration) MarshalJSON() ([]byte, error) {
-	return tokenMarshaler.Marshal((*livekit.RoomConfiguration)(c))
+	return protojson.Marshal((*livekit.RoomConfiguration)(c))
 }
 
 func (c *RoomConfiguration) UnmarshalJSON(data []byte) error {

auth/verifier_test.go

@@ -18,7 +18,9 @@ import (
 	"testing"
 	"time"
 
+	"github.com/go-jose/go-jose/v3"
 	"github.com/go-jose/go-jose/v3/json"
+	"github.com/go-jose/go-jose/v3/jwt"
 	"github.com/stretchr/testify/require"
 
 	"github.com/livekit/protocol/auth"
@@ -95,6 +97,51 @@ func TestVerifier(t *testing.T) {
 		require.EqualValues(t, attrs, decoded.Attributes)
 	})
 
+	t.Run("unknown fields are ignored for forward compatibility", func(t *testing.T) {
+		// Simulate a token issued by a newer client whose claims include fields
+		// this server does not yet know about. The server should still accept the
+		// token rather than failing with `unknown field`. This guards against
+		// requiring server upgrades before client upgrades can roll out.
+		sig, err := jose.NewSigner(
+			jose.SigningKey{Algorithm: jose.HS256, Key: []byte(secret)},
+			(&jose.SignerOptions{}).WithType("JWT"),
+		)
+		require.NoError(t, err)
+
+		claims := map[string]interface{}{
+			"iss": apiKey,
+			"sub": "me",
+			"nbf": jwt.NewNumericDate(time.Now()),
+			"exp": jwt.NewNumericDate(time.Now().Add(time.Minute)),
+			// unknown top-level claim grants field
+			"someFutureGrant": map[string]interface{}{"enabled": true},
+			"video": map[string]interface{}{
+				"roomJoin": true,
+				"room":     "myroom",
+				// unknown field inside a known grant
+				"someFutureVideoField": "future-value",
+			},
+			"roomConfig": map[string]interface{}{
+				"name": "myroom",
+				// unknown field inside a protojson-decoded message
+				"someFutureRoomConfigField": "future-value",
+			},
+		}
+		token, err := jwt.Signed(sig).Claims(claims).CompactSerialize()
+		require.NoError(t, err)
+
+		v, err := auth.ParseAPIToken(token)
+		require.NoError(t, err)
+
+		_, decoded, err := v.Verify(secret)
+		require.NoError(t, err)
+		require.NotNil(t, decoded.Video)
+		require.Equal(t, "myroom", decoded.Video.Room)
+		require.True(t, decoded.Video.RoomJoin)
+		require.NotNil(t, decoded.RoomConfig)
+		require.Equal(t, "myroom", decoded.RoomConfig.Name)
+	})
+
 	t.Run("nil permissions are handled", func(t *testing.T) {
 		grant := &auth.VideoGrant{
 			Room:     "myroom",

go.mod

@@ -1,6 +1,6 @@
 module github.com/livekit/protocol
 
-go 1.25.0
+go 1.26
 
 require (
 	buf.build/go/protoyaml v0.6.0
@@ -30,28 +30,28 @@ require (
 	github.com/stretchr/testify v1.11.1
 	github.com/twitchtv/twirp v8.1.3+incompatible
 	github.com/zeebo/xxh3 v1.0.2
-	go.opentelemetry.io/otel v1.40.0
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.39.0
-	go.opentelemetry.io/otel/sdk v1.40.0
-	go.opentelemetry.io/otel/trace v1.40.0
+	go.opentelemetry.io/otel v1.43.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0
+	go.opentelemetry.io/otel/sdk v1.43.0
+	go.opentelemetry.io/otel/trace v1.43.0
 	go.uber.org/atomic v1.11.0
 	go.uber.org/multierr v1.11.0
 	go.uber.org/zap v1.27.0
 	go.uber.org/zap/exp v0.3.0
 	golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b
-	golang.org/x/mod v0.29.0
-	golang.org/x/sys v0.40.0
-	golang.org/x/text v0.31.0
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217
-	google.golang.org/grpc v1.77.0
-	google.golang.org/protobuf v1.36.10
+	golang.org/x/mod v0.34.0
+	golang.org/x/sys v0.43.0
+	golang.org/x/text v0.36.0
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260427160629-7cedc36a6bc4
+	google.golang.org/grpc v1.80.0
+	google.golang.org/protobuf v1.36.11
 	gopkg.in/yaml.v3 v3.0.1
 )
 
 require (
 	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.6-20250625184727-c923a0c2a132.1 // indirect
 	buf.build/go/protovalidate v0.13.1 // indirect
-	cel.dev/expr v0.24.0 // indirect
+	cel.dev/expr v0.25.1 // indirect
 	github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
@@ -61,7 +61,7 @@ require (
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/google/cel-go v0.25.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.3 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/klauspost/compress v1.18.0 // indirect
 	github.com/klauspost/cpuid/v2 v2.2.11 // indirect
@@ -88,12 +88,12 @@ require (
 	github.com/stoewer/go-strcase v1.3.1 // indirect
 	github.com/wlynxg/anet v0.0.5 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.39.0 // indirect
-	go.opentelemetry.io/otel/metric v1.40.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.9.0 // indirect
-	golang.org/x/crypto v0.45.0 // indirect
-	golang.org/x/net v0.47.0 // indirect
-	golang.org/x/sync v0.18.0 // indirect
-	golang.org/x/tools v0.38.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 // indirect
+	go.opentelemetry.io/otel/metric v1.43.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.10.0 // indirect
+	golang.org/x/crypto v0.50.0 // indirect
+	golang.org/x/net v0.53.0 // indirect
+	golang.org/x/sync v0.20.0 // indirect
+	golang.org/x/tools v0.43.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260427160629-7cedc36a6bc4 // indirect
 )