[erikhortsch]

What changed

• livekit-rtc/rust-sdks: submodule 5a656c4 (livekit-ffi v0.12.80) → 7f3ddc0 (livekit-ffi v0.13.2). download_ffi.py reads the FFI version from the submodule's livekit-ffi/Cargo.toml, so wheels now bundle 0.13.2.
• livekit-rtc/livekit/rtc/_proto/capture_pb2.py / .pyi: regenerated. capture.proto is the only FFI proto that changed between v0.12.80 and v0.13.2. The diff is additive: the CaptureError.kind enum and the GStreamer source config messages.

This follows the same shape as #822 and #829.

Why

On 2026-10-20 the keys of eight eMudhra intermediate CAs were disclosed as compromised. They are cross-signed by AAA Certificate Services.

• fix: update CA trust dependencies (eMudhra intermediate CA compromise) #881 covers the Python CA trust dependencies.
• libwebrtc inside the FFI checks TURN/TLS certificates against its own compiled-in roots (rtc_base/ssl_roots.h). Every FFI before 0.13.2 still includes AAA there.
• livekit-ffi 0.13.2 (Bump libwebrtc to webrtc-a545de4 (drop compromised eMudhra roots) rust-sdks#1562) moves to libwebrtc webrtc-a545de4, whose refreshed roots drop AAA. 0.13.1 fixed only the Rust TLS side.

What else comes with 0.12.80 → 0.13.2

For the protobuf/C-ABI surface this SDK uses, livekit-ffi's changelog says 0.13.0 "builds unchanged". The 0.13.0 breaking changes are the UniFFI package renames for Swift, Android and Flutter.

The full list is in the livekit-ffi changelog (0.12.81 to 0.13.2). It includes data stream recipient targeting, Room::close finality, RPC reply handling after the recipient leaves, and the VAAPI/NVENC fixes.

Note: the livekit-ffi/v0.13.2 tag sits on 7f3ddc0, one commit after the knope release commit. The published 0.13.2 binaries therefore also include livekit/rust-sdks#1527 (negotiated data channels, used only with protocol ≥ 18 and single PC).

Testing

• Proto regeneration uses the exact toolchain from build-rtc.yml: protoc 25.1, mypy-protobuf 3.6.0, protobuf < 5. As a check, regenerating against the old submodule reproduces main's committed stubs byte for byte.
• I downloaded the 0.13.2 linux-x86_64 FFI and ran pytest tests/rtc without the e2e suites: 79 passed, 18 skipped.
  • 3 tests failed (test_agc, test_apm, test_resampler), only because the LFS wav fixtures were not fetched in my checkout.
  • import livekit.rtc loads the 0.13.2 library.
• make type-check passes. ruff check passes.

Release

There is an open release PR, #889 (livekit v1.1.22), cut before this bump, so it still bundles FFI 0.12.80. After this merges, re-dispatching "Publish to PyPI" (livekit, patch) supersedes #889. The new release PR then needs 2 approvals (release gate).

---

Generated by Claude Code

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[erikhortsch]

All 12 Test jobs in Build RTC were cancelled at the 6-hour timeout. I don't think this PR causes it:

• Every test passes, and the hang comes after the last test file. The job log (ubuntu-latest, Python 3.12) reaches livekit-rtc/tests/test_rpc_interceptors.py ........................ [ 99%] at 16:34:15. After that, pytest never exits, and the runner kills it at 22:33.

• The same hang, at the same spot and timing out the same way, happens on PRs that still use FFI 0.12.80:

  • chore(deps): update dependency livekit-client to v2.22.4 #810 (run 39780894591, cancelled after 6h)
  • the release PR livekit v1.1.22 #889 (run 39704079615)

  So it's already on main, not something 0.13.2 introduced.

• The other checks are green: protobuf generation (no diff), wheel builds on all platforms, the API tests, type-check and the release gate.

I don't know of a fix yet. #892 changes FfiQueue locking, but I haven't confirmed it addresses this exit hang. I'm not re-running, since a re-run would take another 6 hours and fail the same way.

---

Generated by Claude Code

[cloudwebrtc]

I’ve just created a PR for a minor update v1.2.0; once it’s merged, it just needs one more reviewer before it can be released.
#897

[erikhortsch]

@cloudwebrtc thanks! Heads up: #897 was cut at 00:02 UTC from b8e7bd8 (#895). This PR merged three minutes later as d6d1655, so the release/rtc-v1.2.0 branch (cfa1f65) still pins livekit-rtc/rust-sdks at 5a656c4, which is livekit-ffi v0.12.80. Releasing #897 as it is would not ship the libwebrtc roots fix.

Re-dispatching "Publish to PyPI" (livekit, minor) from main now should replace #897 with a release PR that includes FFI 0.13.2.

---

Generated by Claude Code

[cloudwebrtc]

@erikhortsch Alright, I’ve just merged the updates from main into release/rtc-v1.2.0.