[erikhortsch]

What changed

• webrtc-sys/build/src/lib.rs: WEBRTC_TAG goes from webrtc-89d790b to webrtc-a545de4. Nothing else in the repo (workflows, scripts, docs) pins 89d790b.
• .changeset/bump_libwebrtc_a545de4.md: patch bumps for webrtc-sys-build and the crates the changeset check requires downstream of it (webrtc-sys, libwebrtc, livekit, livekit-capture, livekit-ffi).

Why

On 2026-10-20 the keys of eight eMudhra intermediate CAs were disclosed as compromised. These intermediates are cross-signed by AAA Certificate Services. libwebrtc checks TURN/TLS certificates against roots compiled into rtc_base/ssl_roots.h. The build pinned today (webrtc-89d790b, from webrtc-sdk/webrtc m150_release) still has AAA in that list, and all 7 AAA-cross-signed test chains from the disclosure pass openssl verify against those roots.

webrtc-sdk/webrtc fd5c784 ("Update ssl_roots.h (#317)", a cherry-pick of upstream webrtc-review 510080) refreshes the roots. With it, all 14 test chains fail. m150_release is now at a545de4, which includes that commit.

Caveat: since webrtc-b9233c3-2 (webrtc-sdk/webrtc#277), TURN/TLS falls back to the OS trust store when the compiled-in anchors find no path. This PR removes AAA from the compiled-in anchors only. A host whose OS store still trusts AAA Certificate Services may still accept these chains through that fallback.

Other m150_release commits since 89d790b that touch areas webrtc-sys uses:

• a545de4: frame cryptor gets key_size in KeyProviderOptions (default 128, 256 is opt-in). Covered below.
• 51c367e: stops logging raw_key/derived_key at LS_INFO.
• 67c4578: verifies server-injected frame payloads before it skips decryption.
• 0385653: AddTransceiver returns INVALID_STATE on a closed PeerConnection.
• Platform-only changes: 67366b1 (macOS/Catalyst privacy manifest), f828b40 and 5d83551 (Android).

Dependency: build release not published yet

This PR needs the webrtc-a545de4 release from .github/workflows/webrtc-builds.yml. That release does not exist yet. Someone will push the webrtc-a545de4 tag on main @ 524123e to create it. Until it is published, CI will fail when it tries to download the prebuilt libwebrtc. That is why this PR is a draft.

Related upstream build PR: webrtc-sdk/webrtc-build#83

KeyProviderOptions key_size

The new field should not break webrtc-sys:

• webrtc-sys/src/frame_cryptor.cpp:105-121 default-constructs webrtc::KeyProviderOptions rtc_options; and then assigns each field by name. It does not use aggregate or positional initialization. The new field keeps its default of 128, the same as current behavior.
• The cxx shared struct ffi::KeyProviderOptions at webrtc-sys/src/frame_cryptor.rs:23 is a separate livekit_ffi type. It does not have to mirror the upstream struct.

This PR makes no change to either file. Exposing 256-bit keys would be a separate change.

Testing

No build was possible because the prebuilts are not published yet. rustfmt --check passes on the changed file. .github/scripts/changeset_detect.py reports that the changeset covers all affected packages.

---

Generated by Claude Code

[github-actions]

Changeset ✓

This PR includes a changeset covering all affected packages:

Package	Bump
libwebrtc	patch
livekit	patch
livekit-capture	patch
livekit-ffi	patch
webrtc-sys	patch
webrtc-sys-build	patch

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[erikhortsch]

The CI failures here are all failed to download webrtc: 404 Not Found from webrtc-sys/build.rs. CI ran before the webrtc-a545de4 release existed. The tag is now pushed, on main @ 524123e, and WebRTC builds run 202 is building it. I'll re-run CI once the release has its assets.

Reviewers should know this build also ships two fixes that are on main but not in any pinned build. WEBRTC_TAG has stayed at webrtc-89d790b, while the build scripts at 524123e include:

• webrtc-sys: keep NativeAudioSource send streams out of AudioState #1491: NativeAudioSource send streams no longer remain in AudioState, which fixes a use-after-free crash on the ADM capture thread. Its build was webrtc-51c367e.
• webrtc-sys: prefix the bundled ffmpeg symbols to prevent collisions #1534: the bundled ffmpeg symbols get an LK_ prefix to avoid collisions with an external ffmpeg. Its build was webrtc-9f6a87a.

So merging this moves users from 89d790b to a build that also has those two changes.

---

Generated by Claude Code

[erikhortsch]

CI update, now that the webrtc-a545de4 release is published:

• Builds: all 11 targets pass, compiled and linked against the new prebuilts.
• Feature Combinations (per-commit): all 11 targets pass.
• Tests (aarch64-apple-darwin): passes, including the e2e, transport, core-module and RPC steps.
• Tests (x86_64-pc-windows-msvc): still running.
• Tests (x86_64-unknown-linux-gnu): stuck in "Install linux dependencies" (sudo apt update && apt install …). The first attempt sat there for 1h35m before I cancelled it, and the re-run is stuck at the same step. This isn't caused by this PR. The same step is hanging on main (Tests run 39878251633, started 00:27 UTC) and on livekit-capture: Join capture pumps instead of emitting a source event #1547 (runs from 19:44 and 23:07 UTC, still in progress). The step installs system packages and never reaches the code. There's no fix for this in the PR. Once apt on the runners recovers, the job just needs a re-run.

---

Generated by Claude Code