Update renovate and pinning behavior, run tools from go.mod (#4759)

- Renovate

config:recommended (config:base is deprecated) and matchPackageNames globs instead of the deprecated matchPackagePrefixes.
Vulnerability alerts get a fast path: 2-day quarantine, no concurrency/hourly/schedule limits.
Go modules are no longer grouped into one "go deps" PR — each gets its own, so a bad bump can be reverted alone. The pion modules stay grouped as a documented exception: they're co-released and interdependent, so individual PRs wouldn't build.
First-party github.com/livekit/** skips the 2-week quarantine.
go.mod's go directive is no longer an update target — the build toolchain is pinned in the Dockerfile instead.
Dockerfile deps get pinDigests; the golang image is ungrouped with separateMinorPatch so a patch and a minor bump are each separately approvable.
Custom manager to bump the builder image's -alpineA.B suffix together with its digest, which the stock docker manager holds fixed.

- Pinning

Both Dockerfiles pin golang and alpine by digest alongside the readable tag.
GOTOOLCHAIN=local so a go.mod bump fails loudly instead of silently downloading a different toolchain.
apk upgrade in the runtime stage — a digest pin plus the 2-week quarantine would otherwise ship base-package CVEs Alpine has already fixed. This relies on a cold layer cache, which holds today because the release workflow configures no buildx cache; there's a comment saying so.
Workflows resolve the Go version from the Dockerfile via .github/scripts/go-version.sh, so tests, releases and images share one toolchain.

- Tools

All four code generators now come from the module graph, and tools/tools.go (the pre-Go-1.24 blank-import idiom) is replaced by go.mod tool directives:

tool	how	why
goimports	go tool	lives in x/tools — its own module is the one being selected
gotestfmt	go tool	zero dependencies, nothing to skew
wire	go run	pins x/tools v0.24.1; building it in our graph changes its output
counterfeiter	go run	unchanged, matches its //go:generate directives

The wire distinction is load-bearing. Building wire inside our module raises it from the x/tools v0.24.1 it pins to our v0.48.0, and that module version difference changes what it generates: it falls back to v/v2/v3 instead of deriving real identifiers from the type. wire_gen.go is regenerated here to match the in-module build — a cosmetic rename of 9 lines, with no other change to the generated code.

golangci-lint deliberately keeps its action rather than becoming a tool: it pins its own x/tools (v0.44.0 vs our v0.48.0) for the analyzers it bundles, adding it to go.mod would double our go.mod/go.sum (158→338 / 441→889 lines), and the action supplies caching, only-new-issues and PR annotations that invoking a binary can't. Its version stays manual by request.

.github/scripts/go-version.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+# Copyright 2026 LiveKit, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#
+# Print the Go toolchain version pinned by a Dockerfile's golang builder image.
+#
+#   usage: .github/scripts/go-version.sh [dockerfile]   (default: Dockerfile)
+#
+# The pinned `golang:X.Y.Z-alpineA.B@sha256:...` builder image is the single source
+# of truth, and Renovate keeps it current via an approvable PR. Each workflow reads
+# the version out of the Dockerfile it builds against (setup-go cannot parse a
+# Dockerfile itself), so a job's Go runtime always matches the image it produces.
+#
+# Deliberately NOT derived from go.mod's `go` directive: that is the module
+# minimum, owned by the toolchain and by dependency requirements, and the go
+# command may rewrite it to a bare major.minor.
+set -euo pipefail
+
+dockerfile="${1:-Dockerfile}"
+
+if [ ! -f "$dockerfile" ]; then
+  echo "$dockerfile: no such file" >&2
+  exit 1
+fi
+
+version=$(sed -nE 's/^FROM[[:space:]]+golang:([0-9]+\.[0-9]+\.[0-9]+)[^[:space:]]*.*/\1/p' "$dockerfile" | sort -u)
+
+if [ -z "$version" ]; then
+  echo "$dockerfile: no pinned 'FROM golang:X.Y.Z-...' base image found" >&2
+  exit 1
+fi
+
+if [ "$(printf '%s\n' "$version" | wc -l)" -ne 1 ]; then
+  echo "$dockerfile pins more than one Go version: $(echo $version)" >&2
+  exit 1
+fi
+
+echo "$version"

.github/workflows/buildtest.yaml

@@ -35,29 +35,34 @@ jobs:
           auto-start: true
       - run: redis-cli ping
 
+      # Test with the same Go toolchain the published image is built with
+      - name: Resolve Go version
+        id: go-version
+        run: |
+          # Assign first so a failed lookup trips `set -e`; inside echo its exit
+          # status would be discarded and an empty version written.
+          version=$(.github/scripts/go-version.sh Dockerfile)
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
-          go-version: "^1.26"
-
-      - name: Set up gotestfmt
-        run: go install github.com/gotesttools/gotestfmt/v2/cmd/gotestfmt@v2.4.1
+          go-version: ${{ steps.go-version.outputs.version }}
 
       - name: Replace mutexes
         run: |
           go get github.com/sasha-s/go-deadlock
           grep -rl sync.Mutex ./pkg | xargs sed -i 's/sync\.Mutex/deadlock\.Mutex/g'
           grep -rl sync.RWMutex ./pkg | xargs sed -i 's/sync\.RWMutex/deadlock\.RWMutex/g'
-          go install golang.org/x/tools/cmd/goimports@latest
-          grep -rl deadlock.Mutex ./pkg | xargs goimports -w
-          grep -rl deadlock.RWMutex ./pkg | xargs goimports -w
+          grep -rl deadlock.Mutex ./pkg | xargs go tool goimports -w
+          grep -rl deadlock.RWMutex ./pkg | xargs go tool goimports -w
           go mod tidy
 
+      # Run mage at the version go.mod pins, rather than the mage-action's
+      # `version: latest`, so the binary matches the mage/mg library the magefile is
+      # compiled against and Renovate owns the version like any other module.
       - name: Mage Build
-        uses: magefile/mage-action@a662bd8c29d8106879588cfff83b2faf6e6f59db # v4
-        with:
-          version: latest
-          args: build
+        run: go run github.com/magefile/mage build
 
       - name: Lint
         uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
@@ -67,7 +72,7 @@ jobs:
       - name: Test
         run: |
           set -euo pipefail
-          MallocNanoZone=0 go test -race -json -v ./... 2>&1 | tee /tmp/gotest.log | gotestfmt
+          MallocNanoZone=0 go test -race -json -v ./... 2>&1 | tee /tmp/gotest.log | go tool gotestfmt
 
       # Upload the original go test log as an artifact for later review.
       - name: Upload test log

.github/workflows/docker.yaml

@@ -43,19 +43,28 @@ jobs:
             type=semver,pattern=v{{version}}
             type=semver,pattern=v{{major}}.{{minor}}
 
+      # Generate with the same Go toolchain the published image is built with
+      - name: Resolve Go version
+        id: go-version
+        run: |
+          # Assign first so a failed lookup trips `set -e`; inside echo its exit
+          # status would be discarded and an empty version written.
+          version=$(.github/scripts/go-version.sh Dockerfile)
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
-          go-version-file: "go.mod"
+          go-version: ${{ steps.go-version.outputs.version }}
 
       - name: Download Go modules
         run: go mod download
 
+      # Run mage at the version go.mod pins, rather than the mage-action's
+      # `version: latest`, so the binary matches the mage/mg library the magefile is
+      # compiled against and Renovate owns the version like any other module.
       - name: Generate code
-        uses: magefile/mage-action@a662bd8c29d8106879588cfff83b2faf6e6f59db # v4
-        with:
-          version: latest
-          args: generate
+        run: go run github.com/magefile/mage generate
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4

.github/workflows/release.yaml

@@ -32,10 +32,19 @@ jobs:
       - name: Fetch all tags
         run: git fetch --force --tags
 
+      # Release with the same Go toolchain the published image is built with
+      - name: Resolve Go version
+        id: go-version
+        run: |
+          # Assign first so a failed lookup trips `set -e`; inside echo its exit
+          # status would be discarded and an empty version written.
+          version=$(.github/scripts/go-version.sh Dockerfile)
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
-          go-version-file: "go.mod"
+          go-version: ${{ steps.go-version.outputs.version }}
 
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7

Dockerfile

@@ -12,7 +12,12 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM golang:1.26-alpine AS builder
+# Pinned by digest so the build is reproducible even if the tag is republished.
+# The tag is kept alongside it for readability; Renovate updates both together.
+# This image is also the single source of truth for the Go toolchain: CI reads the
+# version out of this line (see .github/scripts/go-version.sh) so tests and images
+# always run the same runtime.
+FROM golang:1.26.6-alpine3.24@sha256:af8d6740070b8906d12eae1c3e3ea0957fb63f492051ea05e354c38ef9fe88df AS builder
 
 ARG TARGETPLATFORM
 ARG TARGETARCH
@@ -20,6 +25,10 @@ RUN echo building for "$TARGETPLATFORM"
 
 WORKDIR /workspace
 
+# Build with exactly the toolchain in this image; fail (don't silently download)
+# if go.mod ever requires a newer version, so the pinned image stays authoritative.
+ENV GOTOOLCHAIN=local
+
 # Copy the Go Modules manifests
 COPY go.mod go.mod
 COPY go.sum go.sum
@@ -31,12 +40,20 @@ RUN go mod download
 COPY cmd/ cmd/
 COPY pkg/ pkg/
 COPY test/ test/
-COPY tools/ tools/
 COPY version/ version/
 
 RUN CGO_ENABLED=0 GOOS=linux GOARCH=$TARGETARCH GO111MODULE=on go build -a -o livekit-server ./cmd/server
 
-FROM alpine
+FROM alpine:3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
+
+# Pull the latest security patches for base packages within the pinned Alpine
+# release. The digest above is only refreshed by a Renovate PR, so without this
+# an image can ship base-package CVEs that Alpine has already fixed.
+# NOTE: this relies on the build starting with a cold layer cache, which is true
+# today because the release workflow configures no buildx cache. If cache-from/
+# cache-to is ever added, this layer needs a cache-busting ARG (as ../cloud does
+# with SECURITY_REFRESH) or it will be served stale.
+RUN apk upgrade --no-cache
 
 COPY --from=builder /workspace/livekit-server /livekit-server
 

cmd/test-server/Dockerfile

@@ -14,12 +14,19 @@
 
 # Mock LiveKit API server for SDK conformance testing. Build from the repo
 # root:  docker build -f cmd/test-server/Dockerfile -t livekit/test-server .
-FROM golang:1.26-alpine AS builder
+#
+# Pinned by digest so the build is reproducible even if the tag is republished.
+# The tag is kept alongside it for readability; Renovate updates both together.
+FROM golang:1.26.6-alpine3.24@sha256:af8d6740070b8906d12eae1c3e3ea0957fb63f492051ea05e354c38ef9fe88df AS builder
 
 ARG TARGETARCH
 
 WORKDIR /workspace
 
+# Build with exactly the toolchain in this image; fail (don't silently download)
+# if go.mod ever requires a newer version, so the pinned image stays authoritative.
+ENV GOTOOLCHAIN=local
+
 COPY go.mod go.mod
 COPY go.sum go.sum
 RUN go mod download
@@ -30,7 +37,12 @@ COPY version/ version/
 
 RUN CGO_ENABLED=0 GOOS=linux GOARCH=$TARGETARCH GO111MODULE=on go build -a -o livekit-test-server ./cmd/test-server
 
-FROM alpine
+FROM alpine:3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
+
+# Pull the latest security patches for base packages within the pinned Alpine
+# release; the digest above is only refreshed by a Renovate PR. See the note in
+# the repo-root Dockerfile about the cold-cache assumption.
+RUN apk upgrade --no-cache
 
 COPY --from=builder /workspace/livekit-test-server /livekit-test-server
 

go.mod

@@ -25,7 +25,6 @@ require (
 	github.com/livekit/psrpc v0.7.3
 	github.com/mackerelio/go-osstat v0.2.8
 	github.com/magefile/mage v1.17.2
-	github.com/maxbrunsfeld/counterfeiter/v6 v6.12.2
 	github.com/mitchellh/go-homedir v1.1.0
 	github.com/moby/moby/client v0.5.1
 	github.com/olekukonko/tablewriter v1.1.4
@@ -73,9 +72,11 @@ require (
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/goccy/go-json v0.10.6 // indirect
 	github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
+	github.com/gotesttools/gotestfmt/v2 v2.4.1 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
 	github.com/mattn/go-colorable v0.1.15 // indirect
 	github.com/mattn/go-isatty v0.0.22 // indirect
+	github.com/maxbrunsfeld/counterfeiter/v6 v6.12.2 // indirect
 	github.com/moby/moby/api v1.55.0 // indirect
 	github.com/nyaruka/phonenumbers v1.8.1 // indirect
 	github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 // indirect
@@ -94,6 +95,7 @@ require (
 	go.opentelemetry.io/proto/otlp v1.10.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
 	golang.org/x/exp v0.0.0-20260727155853-b88d891fe743 // indirect
+	golang.org/x/telemetry v0.0.0-20260708182218-49f421fb7959 // indirect
 	golang.org/x/time v0.15.0 // indirect
 )
 
@@ -155,6 +157,13 @@ require (
 	google.golang.org/grpc v1.83.0 // indirect
 )
 
+tool (
+	github.com/google/wire/cmd/wire
+	github.com/gotesttools/gotestfmt/v2/cmd/gotestfmt
+	github.com/maxbrunsfeld/counterfeiter/v6
+	golang.org/x/tools/cmd/goimports
+)
+
 replace github.com/pion/webrtc/v4 => github.com/livekit/webrtc-pion/v4 v4.2.18-warp.1
 
 replace github.com/pion/dtls/v3 => github.com/livekit/dtls/v3 v3.1.5-warp.1

go.sum

@@ -107,6 +107,8 @@ github.com/google/wire v0.7.0 h1:JxUKI6+CVBgCO2WToKy/nQk0sS+amI9z9EjVmdaocj4=
 github.com/google/wire v0.7.0/go.mod h1:n6YbUQD9cPKTnHXEBN2DXlOp/mVADhVErcMFb0v3J18=
 github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
 github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
+github.com/gotesttools/gotestfmt/v2 v2.4.1 h1:Ml+KPqPocp/KckpizL+tgsy/dlddI4/z2w6lgS7YIFE=
+github.com/gotesttools/gotestfmt/v2 v2.4.1/go.mod h1:oQJg2KZ2aGoqEbMC2PDaAeBYm0tOkocgixK9FzsCdp4=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 h1:5VipnvEpbqr2gA2VbM+nYVbkIF28c5ZQfqCBQ5g2xfk=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0/go.mod h1:Hyl3n6Twe1hvtd9XUXDec4pTvgMSEixRuQKPTMH2bNs=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
@@ -402,6 +404,8 @@ golang.org/x/sys v0.0.0-20220319134239-a9b59b0215f8/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
 golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/telemetry v0.0.0-20260708182218-49f421fb7959 h1:RJhm5l6Fo4rmEIcndxDllNhhf/fAx8qIm4t6A7vpm2A=
+golang.org/x/telemetry v0.0.0-20260708182218-49f421fb7959/go.mod h1:LV7u5Oco+Z/g6XI7PqN+EUUUGGkEcmB1uj2ceI0fOVg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=

magefile.go

@@ -51,9 +51,14 @@ func init() {
 	}
 }
 
-// explicitly reinstall all deps
+// downloads module deps at the versions pinned in go.mod
+//
+// Code generators are not installed here: they run as `go run <pkg>` from their
+// //go:generate directives (see pkg/service/wire_gen.go and the counterfeiter
+// directives under pkg/), so they always execute at the version go.mod pins and
+// Renovate keeps them current alongside every other module.
 func Deps() error {
-	return installTools(true)
+	return mageutil.Run(context.Background(), "go mod download")
 }
 
 // builds LiveKit server
@@ -109,9 +114,6 @@ func BuildLinux() error {
 
 func Deadlock() error {
 	ctx := context.Background()
-	if err := mageutil.InstallTool("golang.org/x/tools/cmd/goimports", "latest", false); err != nil {
-		return err
-	}
 	if err := mageutil.Run(ctx, "go get github.com/sasha-s/go-deadlock"); err != nil {
 		return err
 	}
@@ -121,7 +123,7 @@ func Deadlock() error {
 	if err := mageutil.Pipe("grep -rl sync.RWMutex ./pkg", "xargs sed -i  -e s/sync.RWMutex/deadlock.RWMutex/g"); err != nil {
 		return err
 	}
-	if err := mageutil.Pipe("grep -rl deadlock.Mutex\\|deadlock.RWMutex ./pkg", "xargs goimports -w"); err != nil {
+	if err := mageutil.Pipe("grep -rl deadlock.Mutex\\|deadlock.RWMutex ./pkg", "xargs go tool goimports -w"); err != nil {
 		return err
 	}
 	if err := mageutil.Run(ctx, "go mod tidy"); err != nil {
@@ -137,7 +139,7 @@ func Sync() error {
 	if err := mageutil.Pipe("grep -rl deadlock.RWMutex ./pkg", "xargs sed -i  -e s/deadlock.RWMutex/sync.RWMutex/g"); err != nil {
 		return err
 	}
-	if err := mageutil.Pipe("grep -rl sync.Mutex\\|sync.RWMutex ./pkg", "xargs goimports -w"); err != nil {
+	if err := mageutil.Pipe("grep -rl sync.Mutex\\|sync.RWMutex ./pkg", "xargs go tool goimports -w"); err != nil {
 		return err
 	}
 	if err := mageutil.Run(context.Background(), "go mod tidy"); err != nil {
@@ -199,7 +201,7 @@ func Clean() {
 
 // regenerate code
 func Generate() error {
-	mg.Deps(installDeps, generateWire)
+	mg.Deps(generateWire)
 
 	fmt.Println("generating...")
 	return mageutil.Run(context.Background(), "go generate ./...")
@@ -207,40 +209,13 @@ func Generate() error {
 
 // code generation for wiring
 func generateWire() error {
-	mg.Deps(installDeps)
 	if !checksummer.IsChanged() {
 		return nil
 	}
 
 	fmt.Println("wiring...")
 
-	wire, err := mageutil.GetToolPath("wire")
-	if err != nil {
-		return err
-	}
-	cmd := exec.Command(wire)
-	cmd.Dir = "pkg/service"
-	mageutil.ConnectStd(cmd)
-	if err := cmd.Run(); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-// implicitly install deps
-func installDeps() error {
-	return installTools(false)
-}
-
-func installTools(force bool) error {
-	tools := map[string]string{
-		"github.com/google/wire/cmd/wire": "latest",
-	}
-	for t, v := range tools {
-		if err := mageutil.InstallTool(t, v, force); err != nil {
-			return err
-		}
-	}
-	return nil
+	// Matches the //go:generate directive in pkg/service/wire_gen.go, so running
+	// wire here and running `go generate ./...` produce the same output.
+	return mageutil.RunDir(context.Background(), "pkg/service", "go run github.com/google/wire/cmd/wire")
 }

pkg/service/wire_gen.go

@@ -86,23 +86,23 @@ func InitializeServer(conf *config.Config, currentNode routing.LocalNode) (*Live
 	}
 	rtcEgressLauncher := NewEgressLauncher(egressClient, ioInfoService, objectStore)
 	topicFormatter := rpc.NewTopicFormatter()
-	roomClient, err := rpc.NewTypedRoomClient(clientParams)
+	v, err := rpc.NewTypedRoomClient(clientParams)
 	if err != nil {
 		return nil, err
 	}
-	participantClient, err := rpc.NewTypedParticipantClient(clientParams)
+	v2, err := rpc.NewTypedParticipantClient(clientParams)
 	if err != nil {
 		return nil, err
 	}
-	roomService, err := NewRoomService(limitConfig, apiConfig, router, roomAllocator, objectStore, rtcEgressLauncher, topicFormatter, roomClient, participantClient)
+	roomService, err := NewRoomService(limitConfig, apiConfig, router, roomAllocator, objectStore, rtcEgressLauncher, topicFormatter, v, v2)
 	if err != nil {
 		return nil, err
 	}
-	agentDispatchInternalClient, err := rpc.NewTypedAgentDispatchInternalClient(clientParams)
+	v3, err := rpc.NewTypedAgentDispatchInternalClient(clientParams)
 	if err != nil {
 		return nil, err
 	}
-	agentDispatchService := NewAgentDispatchService(limitConfig, agentDispatchInternalClient, topicFormatter, roomAllocator, router)
+	agentDispatchService := NewAgentDispatchService(limitConfig, v3, topicFormatter, roomAllocator, router)
 	egressService := NewEgressService(egressClient, rtcEgressLauncher, ioInfoService, roomService)
 	ingressConfig := getIngressConfig(conf)
 	ingressClient, err := rpc.NewIngressClient(clientParams)
@@ -117,11 +117,11 @@ func InitializeServer(conf *config.Config, currentNode routing.LocalNode) (*Live
 	}
 	sipService := NewSIPService(sipConfig, nodeID, messageBus, sipClient, sipStore, roomService, telemetryService)
 	rtcService := NewRTCService(conf, roomAllocator, router, telemetryService)
-	whipParticipantClient, err := rpc.NewTypedWHIPParticipantClient(clientParams)
+	v4, err := rpc.NewTypedWHIPParticipantClient(clientParams)
 	if err != nil {
 		return nil, err
 	}
-	serviceWHIPService, err := NewWHIPService(conf, router, roomAllocator, clientParams, topicFormatter, whipParticipantClient)
+	serviceWHIPService, err := NewWHIPService(conf, router, roomAllocator, clientParams, topicFormatter, v4)
 	if err != nil {
 		return nil, err
 	}
@@ -146,8 +146,8 @@ func InitializeServer(conf *config.Config, currentNode routing.LocalNode) (*Live
 	if err != nil {
 		return nil, err
 	}
-	authHandler := getTURNAuthHandlerFunc(turnAuthHandler)
-	server, err := newInProcessTurnServer(conf, authHandler)
+	v5 := getTURNAuthHandlerFunc(turnAuthHandler)
+	server, err := newInProcessTurnServer(conf, v5)
 	if err != nil {
 		return nil, err
 	}

renovate.json

@@ -1,34 +1,79 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["config:base", "helpers:pinGitHubActionDigests"],
+  "extends": [
+    "config:recommended",
+    "helpers:pinGitHubActionDigests"
+  ],
   "minimumReleaseAge": "2 weeks",
   "commitBody": "Generated by renovateBot",
+  "prConcurrentLimit": 5,
+  "vulnerabilityAlerts": {
+    "enabled": true,
+    "minimumReleaseAge": "2 days",
+    "prConcurrentLimit": 0,
+    "prHourlyLimit": 0,
+    "schedule": []
+  },
   "packageRules": [
     {
-      "schedule": "before 6am every monday",
       "matchManagers": ["github-actions"],
       "groupName": "github workflows"
     },
     {
-      "schedule": "before 6am every monday",
       "matchManagers": ["dockerfile"],
-      "groupName": "docker deps"
+      "groupName": "docker deps",
+      "pinDigests": true
     },
     {
-      "schedule": "before 6am every monday",
+      "description": "Go modules are never grouped: each module gets its own PR so a bad bump can be reverted on its own",
       "matchManagers": ["gomod"],
-      "groupName": "go deps"
+      "groupName": null
     },
     {
+      "description": "Exception to the rule above: the pion modules are co-released and depend on each other, so bumping them one at a time produces PRs that don't build",
       "matchManagers": ["gomod"],
-      "matchPackagePrefixes": ["github.com/pion"],
+      "matchPackageNames": ["github.com/pion{/,}**"],
       "groupName": "pion deps"
     },
     {
+      "description": "First-party deps, no need to quarantine new releases",
       "matchManagers": ["gomod"],
-      "matchPackagePrefixes": ["github.com/livekit"],
-      "groupName": "livekit deps"
+      "matchPackageNames": [
+        "github.com/livekit{/,}**"
+      ],
+      "minimumReleaseAge": null
+    },
+    {
+      "description": "The go directive is the module minimum, owned by the go toolchain and dependency requirements; the build toolchain is pinned in the Dockerfile builder image instead",
+      "matchManagers": ["gomod"],
+      "matchDepTypes": ["golang"],
+      "enabled": false
+    },
+    {
+      "description": "Build toolchain pin (Dockerfile golang image): a patch bump (stays on the current minor) and a minor bump each get their own approvable PR",
+      "matchManagers": ["dockerfile"],
+      "matchPackageNames": ["golang"],
+      "groupName": null,
+      "separateMinorPatch": true
     }
   ],
-  "postUpdateOptions": ["gomodTidy"]
+  "customManagers": [
+    {
+      "customType": "regex",
+      "description": "Bump the builder image's Alpine suffix (golang:X.Y.Z-alpineA.B) along with its pinned digest. The base docker manager only bumps the Go version and holds the Alpine suffix fixed. This looks up the golang image (not alpine) with regex versioning that treats the Alpine minor as the version to bump and the Go version as the fixed compatibility, so Renovate only proposes an Alpine that actually exists as a published golang tag. The digest is captured so a suffix bump rewrites the pin instead of leaving a stale one.",
+      "managerFilePatterns": [
+        "/(^|/)Dockerfile$/",
+        "/(^|/)[^/]*\\.Dockerfile$/"
+      ],
+      "matchStrings": ["FROM golang:(?<currentValue>\\d+\\.\\d+\\.\\d+-alpine\\d+\\.\\d+)@(?<currentDigest>sha256:[0-9a-f]+)"],
+      "datasourceTemplate": "docker",
+      "depNameTemplate": "golang",
+      "versioningTemplate": "regex:^(?<compatibility>\\d+\\.\\d+\\.\\d+)-alpine(?<major>\\d+)\\.(?<minor>\\d+)$"
+    }
+  ],
+  "postUpdateOptions": [
+    "gomodTidy"
+  ],
+  "schedule": ["before 9am on monday"],
+  "updateNotScheduled": false
 }

tools/tools.go

@@ -1,23 +0,0 @@
-// Copyright 2023 LiveKit, Inc.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//go:build tools
-// +build tools
-
-package tools
-
-import (
-	_ "github.com/google/wire/cmd/wire"
-	_ "github.com/maxbrunsfeld/counterfeiter/v6"
-)