Baresip v4.12.0 (2026-09-30)

• Feature: Send Custom X-Headers on Outbound Calls
• audio: thread-safe usage of psize and ptime in tx_thread()
• jbuf: safer jbuf_set_id
• audio: add mutex lock for aubuf statistics
• test: add testing of peerconn and vidfilt
• audio: fix format name in ausrc format mismatch warning
• ci: remove brew fdk-aac package (discontinued)
• test: fix peerconn and vidfilt
• cmake: use variable for libdir libbaresip.pc.in
• aureceiver: stats cleanup
• rtprecv: tiny cleanup for startup
• rtprecv: add stop flag fixes race condition
• auresamp: alloc for implicit format conversion
• aureceiver: fix decoder sample format and cleanup
• audio: use RE_ATOMIC for muted flag
• gst,play: fix err handling

libre v4.12.0 (2026-09-30)

• OOB write in AV1 DD decoder template_fdiffs() via unbounded while loop
• TLS certificate identity check is skipped when the peer is addressed by IP literal: any CA-issued cert is accepted and reported as verified
• json,odict: optimize memory and lookup performance
• sys: add sys_exec, sys_texec and sys_cexec (UNIX only)
• sip/transp: verify WSS server identity against the target host
• fmt/pl: optimize pl_strstr, pl_strchr and pl_strrchr
• cmake: use variable for libdir in libbaresip.pc.in
• sipreg/sipreg_unregister: call response handler on error
• tls,test: add strict IP-literal SAN TLS verification (no SNI)
• dd: implement out of bound checks
• base64: fix not detected base64_decode olen overflow
• httpauth/digest: fix MD5 default hash handler