[dependabot]

Bumps the livekit-crates group with 3 updates: livekit, livekit-api and livekit-capture.

Updates livekit from 0.10.0 to 0.10.1

Release notes

Sourced from livekit's releases.

livekit 0.10.1 (2026-11-04)

Fixes

• Pre-encoded video publishing no longer requires a local encoder for its codec, so pre-encoded H265 works on hosts without an H265 encoder, a camera track requesting a codec no local encoder produces now publishes VP8 instead of a codec it cannot encode, and PeerConnectionFactory::video_encoder_codecs reports codec support using a non-exhaustive libwebrtc::video_codec::VideoCodec enum supporting FromStr, with Auto excluding the pre-encoded pass-through backend.
• Preserve distinct frame metadata when queued video frames are captured within the same millisecond, including pre-encoded frames that share an RTP timestamp.
• livekit-signaling: fix teardown gaps on requested close and response timeout - #1568 (@​lukasIO)
• OfferOptions::offer_to_receive_audio and offer_to_receive_video are now Option<bool>. None leaves libwebrtc's option unset, so receive-only transceivers stay receive-only. The default is still Some(false). Single peer connection offers leave both unset and no longer rewrite a=inactive to a=recvonly.
• Space reconnect attempts on the same schedule as livekit-client's DefaultReconnectPolicy (0.3 s, 1.2 s, 2.7 s, 4.8 s, then 7 s, plus up to 1 s of jitter) instead of full jitter, which could spend all ten attempts within a few seconds of outage. The jitter now comes from a randomly keyed hash rather than the clock's sub-second digits, which are all zero on macOS. No new reconnect attempt starts after RECONNECT_MAX_DURATION (60 s), so slow failing attempts cannot keep a room in Reconnecting for minutes. RECONNECT_BACKOFF_MULTIPLIER is deprecated: the schedule is quadratic in the attempt number.
• Add SignalOptions::cancellation_token, which ends a signal session for good: a connect or resume in flight stops with SignalError::Cancelled, and the signal task closes the transport.
• A requested close or restart no longer emits SignalEvent::Close. A join or reconnect response timeout now closes the WebSocket instead of leaving it open.
• A received transcription with an invalid track sid is now dropped with a warning. Before, it made the client panic, which aborts the process in release builds.

livekit-api 0.10.1 (2026-11-04)

Fixes

• livekit-signaling: end a session for good through a cancellation token - #1589 (@​lukasIO)
• livekit-signaling: fix teardown gaps on requested close and response timeout - #1568 (@​lukasIO)

Commits

• 88705b1 Release packages (#1613)
• 58c1f40 jetson h265: encoder and passthrough support (#1451)
• 34d0cc7 livekit-ffi: re-baseline the iOS and Android size budgets (#1623)
• a9489a9 fix(livekit-ffi): build the staticlib and cdylib with LTO (#1631)
• 9bc5e7d livekit-ffi: keep failed requests out of the log (#1599)
• 42c1060 Add OSS Scanner build image and threat model (#1626)
• 23e5b7d Update Rust crate zip to v9.0.5 [SECURITY] (#1624)
• 1da556f use us for frame metadata dict key to prevent collisions (#1607)
• 8dfb32b livekit-signaling: end a session for good through a cancellation token (#1589)
• f445ce8 livekit-signaling: fix teardown gaps on requested close and response timeout ...
• Additional commits viewable in compare view

Updates livekit-api from 0.10.0 to 0.10.1

Release notes

Sourced from livekit-api's releases.

livekit-api 0.10.1 (2026-11-04)

Fixes

• livekit-signaling: end a session for good through a cancellation token - #1589 (@​lukasIO)
• livekit-signaling: fix teardown gaps on requested close and response timeout - #1568 (@​lukasIO)

Commits

• 88705b1 Release packages (#1613)
• 58c1f40 jetson h265: encoder and passthrough support (#1451)
• 34d0cc7 livekit-ffi: re-baseline the iOS and Android size budgets (#1623)
• a9489a9 fix(livekit-ffi): build the staticlib and cdylib with LTO (#1631)
• 9bc5e7d livekit-ffi: keep failed requests out of the log (#1599)
• 42c1060 Add OSS Scanner build image and threat model (#1626)
• 23e5b7d Update Rust crate zip to v9.0.5 [SECURITY] (#1624)
• 1da556f use us for frame metadata dict key to prevent collisions (#1607)
• 8dfb32b livekit-signaling: end a session for good through a cancellation token (#1589)
• f445ce8 livekit-signaling: fix teardown gaps on requested close and response timeout ...
• Additional commits viewable in compare view

Updates livekit-capture from 0.1.8 to 0.1.9

Release notes

Sourced from livekit-capture's releases.

livekit-capture 0.1.9 (2026-11-04)

Fixes

• Pre-encoded video publishing no longer requires a local encoder for its codec, so pre-encoded H265 works on hosts without an H265 encoder, a camera track requesting a codec no local encoder produces now publishes VP8 instead of a codec it cannot encode, and PeerConnectionFactory::video_encoder_codecs reports codec support using a non-exhaustive libwebrtc::video_codec::VideoCodec enum supporting FromStr, with Auto excluding the pre-encoded pass-through backend.
• Drop a transcription with an invalid track sid instead of panicking - #1600 (@​lukasIO)
• Preserve distinct frame metadata when queued video frames are captured within the same millisecond, including pre-encoded frames that share an RTP timestamp.
• livekit-signaling: end a session for good through a cancellation token - #1589 (@​lukasIO)
• livekit-signaling: fix teardown gaps on requested close and response timeout - #1568 (@​lukasIO)
• OfferOptions::offer_to_receive_audio and offer_to_receive_video are now Option<bool>. None leaves libwebrtc's option unset, so receive-only transceivers stay receive-only. The default is still Some(false). Single peer connection offers leave both unset and no longer rewrite a=inactive to a=recvonly.
• Space reconnect attempts on the same schedule as livekit-client's DefaultReconnectPolicy (0.3 s, 1.2 s, 2.7 s, 4.8 s, then 7 s, plus up to 1 s of jitter) instead of full jitter, which could spend all ten attempts within a few seconds of outage. The jitter now comes from a randomly keyed hash rather than the clock's sub-second digits, which are all zero on macOS. No new reconnect attempt starts after RECONNECT_MAX_DURATION (60 s), so slow failing attempts cannot keep a room in Reconnecting for minutes. RECONNECT_BACKOFF_MULTIPLIER is deprecated: the schedule is quadratic in the attempt number.

Commits

• 88705b1 Release packages (#1613)
• 58c1f40 jetson h265: encoder and passthrough support (#1451)
• 34d0cc7 livekit-ffi: re-baseline the iOS and Android size budgets (#1623)
• a9489a9 fix(livekit-ffi): build the staticlib and cdylib with LTO (#1631)
• 9bc5e7d livekit-ffi: keep failed requests out of the log (#1599)
• 42c1060 Add OSS Scanner build image and threat model (#1626)
• 23e5b7d Update Rust crate zip to v9.0.5 [SECURITY] (#1624)
• 1da556f use us for frame metadata dict key to prevent collisions (#1607)
• 8dfb32b livekit-signaling: end a session for good through a cancellation token (#1589)
• f445ce8 livekit-signaling: fix teardown gaps on requested close and response timeout ...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions