From 65e0b9c6c8ab37b7715c6cd195f8fac98f0ec43b Mon Sep 17 00:00:00 2001 From: Hiroshi Horie <548776+hiroshihorie@users.noreply.github.com> Date: Mon, 26 Oct 2026 23:44:23 +0800 Subject: [PATCH 1/2] docs: add the 2.13.2 changelog section 2.13.2 was released from release/2.13.2, cut from v2.13.1, so main's CHANGELOG went from 2.13.1 to the next release without it. --- CHANGELOG.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 6bef5038c..ebe6141f1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,9 @@ # CHANGELOG +## 2.13.2 + +* Security: Bump flutter_webrtc to 1.6.3 and WebRTC-SDK to 150.7871.04. The bundled TURN/TLS roots no longer include AAA Certificate Services, which cross-signs the compromised eMudhra intermediate CAs (CVE-2026-111943) + ## 2.13.1 * Changed: Bump flutter_webrtc to 1.6.2+hotfix.4, which fixes a crash on iOS and macOS when a video renderer is disposed while frames are still arriving From ccff9c231cceae6356fe587ea6bec385530ba684 Mon Sep 17 00:00:00 2001 From: Hiroshi Horie <548776+hiroshihorie@users.noreply.github.com> Date: Mon, 26 Oct 2026 23:44:33 +0800 Subject: [PATCH 2/2] chore: drop the flutter_webrtc 1.6.3 changeset, released in 2.13.2 livekit_client 2.13.2 already shipped flutter_webrtc 1.6.3 and WebRTC-SDK 150.7871.04, so the next release from main would list the same bump again. --- .changes/bump-flutter-webrtc-1.6.3 | 1 - 1 file changed, 1 deletion(-) delete mode 100644 .changes/bump-flutter-webrtc-1.6.3 diff --git a/.changes/bump-flutter-webrtc-1.6.3 b/.changes/bump-flutter-webrtc-1.6.3 deleted file mode 100644 index fa6bc5503..000000000 --- a/.changes/bump-flutter-webrtc-1.6.3 +++ /dev/null @@ -1 +0,0 @@ -patch type="changed" "Bump flutter_webrtc to 1.6.3 and WebRTC-SDK to 150.7871.04. Windows and Linux can attach native video processors to local tracks, Linux screen share no longer hangs in getSources(), and the bundled TURN/TLS roots no longer include the compromised eMudhra cross-signed AAA Certificate Services root"