@epicgames-ps/lib-pixelstreamingsignalling-ue5.6

0.2.1

Patch Changes

• 9a43ab9: Leave the previous streamer when an SFU subscribes to another. SFUConnection.subscribe overwrote subscribedStreamer without unsubscribing from the old streamer, so the old streamer kept forwarding to the SFU and kept the SFU's listeners. When that old streamer later disconnected, it detached the SFU from the streamer it was actually on and dropped the SFU's players. PlayerConnection already unsubscribes first; the SFU now does the same.
• c37638b: Bound what the signalling server writes to its log. Every message a player sent was written to the log file whole, and the daily file had no size limit, so a client could make the log grow as fast as it could send. Log text and protocol messages longer than 16 KiB are now cut to that length, with their full length noted, and the log files are limited in size and number: by default 14 files of 100 MB, set with logMaxSize and logMaxFiles in InitLogging, or --log_max_size and --log_max_files in wilbur. Files are now kept by count rather than for 14 days.
• e373094: Stop malformed messages from crashing the signalling server. A message whose JSON is null threw from the protocol's message handler, and since that handler runs inside the websocket's message event, any client could take the process down with one frame. Such a message is now rejected and logged, like unparseable JSON. A streamer's disconnectPlayer with a reason over 123 bytes, or one that is not a string, made ws throw in the same way; the reason is now dropped and the player is still disconnected. A non-string endpoint id from a streamer was stored as its id and broke the next streamer registration; it is now treated as no id.
• b52cb35: Limit websocket messages on the streamer, player and SFU ports to 1 MiB. ws accepts up to 100 MiB in one message by default, and signalling messages are a few kilobytes. A connection that sends more is closed with code 1009. Setting maxPayload in streamerWsOptions, playerWsOptions or sfuWsOptions overrides the limit for that port.
• Updated dependencies [e373094]
  • @epicgames-ps/[email protected]

0.2.0

Minor Changes

• c8cd21a: Allow TURN credentials to be issued per connection rather than shared by every session. peerOptions is static, so a credential written there is sent to every peer that ever connects and cannot be changed without a redeploy — the weakness noted in tip 3 of the security guidelines. IServerConfig.peerOptionsProvider is consulted once per connecting peer and returns the peer options for that peer, falling back to peerOptions if it throws. On top of it the signalling server adds --turn_secret (or --turn_secret_file) and --turn_ttl, which give every turn:/turns: entry a time limited username and credential in the form coturn's use-auth-secret mode expects. Default behaviour is unchanged when no secret is supplied. See Docs/Security-Guidelines.md.

Patch Changes

• e9cd872: Stop an unsubscribed player from crashing the signalling server. When a player sends a message without being subscribed, sendToStreamer force-subscribes it to the first available streamer and then forwards through this.subscribedStreamer!. subscribe() can decline — most commonly because maxSubscribers is already reached — and reports that only by leaving subscribedStreamer unset, so the non-null assertions throw a TypeError out of a websocket message handler and take the process down, disconnecting every other player. It now checks the subscription took, and disconnects just that player if it did not.

0.2.1

Patch Changes

• 812a419: - Addressing security issues raised by dependabot. (glob, js-yaml, playwright)
  • Added lint npm script to the root project. Running npm run lint will now run linting over all packages.
• Updated dependencies [812a419]
  • @epicgames-ps/[email protected]

0.2.0

Minor Changes

• 05bebea: Add: Ability to access player id on the frontend.
  QoL: Remove player id stripping from the signalling library.

  It is useful to be able to use the player id as a unique identifier that is common between UE side stats and frontend side stats; however, the player id is not actually exposed to TS/JS because the SS strips it out of signalling messages.

  This change is a backport of "Exposed playerid" (#728)

@epicgames-ps/lib-pixelstreamingsignalling-ue5.6

0.5.1

Patch Changes

• 2d098e4: Leave the previous streamer when an SFU subscribes to another. SFUConnection.subscribe overwrote subscribedStreamer without unsubscribing from the old streamer, so the old streamer kept forwarding to the SFU and kept the SFU's listeners. When that old streamer later disconnected, it detached the SFU from the streamer it was actually on and dropped the SFU's players. PlayerConnection already unsubscribes first; the SFU now does the same.
• 281e6cc: Bound what the signalling server writes to its log. Every message a player sent was written to the log file whole, and the daily file had no size limit, so a client could make the log grow as fast as it could send. Log text and protocol messages longer than 16 KiB are now cut to that length, with their full length noted, and the log files are limited in size and number: by default 14 files of 100 MB, set with logMaxSize and logMaxFiles in InitLogging, or --log_max_size and --log_max_files in wilbur. Files are now kept by count rather than for 14 days.
• 01fd040: Stop malformed messages from crashing the signalling server. A message whose JSON is null threw from the protocol's message handler, and since that handler runs inside the websocket's message event, any client could take the process down with one frame. Such a message is now rejected and logged, like unparseable JSON. A streamer's disconnectPlayer with a reason over 123 bytes, or one that is not a string, made ws throw in the same way; the reason is now dropped and the player is still disconnected. A non-string endpoint id from a streamer was stored as its id and broke the next streamer registration; it is now treated as no id.
• 6d53a43: Limit websocket messages on the streamer, player and SFU ports to 1 MiB. ws accepts up to 100 MiB in one message by default, and signalling messages are a few kilobytes. A connection that sends more is closed with code 1009. Setting maxPayload in streamerWsOptions, playerWsOptions or sfuWsOptions overrides the limit for that port.
• Updated dependencies [01fd040]
  • @epicgames-ps/[email protected]

0.5.0

Minor Changes

• 818a5d1: Allow TURN credentials to be issued per connection rather than shared by every session. peerOptions is static, so a credential written there is sent to every peer that ever connects and cannot be changed without a redeploy — the weakness noted in tip 3 of the security guidelines. IServerConfig.peerOptionsProvider is consulted once per connecting peer and returns the peer options for that peer, falling back to peerOptions if it throws. On top of it the signalling server adds --turn_secret (or --turn_secret_file) and --turn_ttl, which give every turn:/turns: entry a time limited username and credential in the form coturn's use-auth-secret mode expects. Default behaviour is unchanged when no secret is supplied. See Docs/Security-Guidelines.md.

Patch Changes

• 65793ed: Stop an unsubscribed player from crashing the signalling server. When a player sends a message without being subscribed, sendToStreamer force-subscribes it to the first available streamer and then forwards through this.subscribedStreamer!. subscribe() can decline — most commonly because maxSubscribers is already reached — and reports that only by leaving subscribedStreamer unset, so the non-null assertions throw a TypeError out of a websocket message handler and take the process down, disconnecting every other player. It now checks the subscription took, and disconnects just that player if it did not.
• 1b9c43c: Add an optional server-side keepalive that disconnects players whose connection has died without a clean close. Previously KeepaliveMonitor was only used on the client, so a player whose socket dropped silently (sleeping laptop, lost Wi-Fi, killed tab) stayed subscribed until the OS TCP keepalive reaped it, which could hold a maxSubscribers slot in the meantime. The new IServerConfig.playerKeepaliveTimeout controls this; the signalling server exposes it as --player_keepalive_timeout <milliseconds> (default 30000, 0 disables).

0.4.0

Minor Changes

• 568133c: Add extension points so consumers can plug in their own authentication and authorization without the library shipping an auth scheme. Connections now expose the HTTP upgrade request (IStreamer.request / IPlayer.request) so identity attached during a verifyClient check survives to later decisions, and IServerConfig.authorizeStreamerId lets a consumer authorize, override (e.g. namespace per tenant), or reject the id a streamer registers as — the seam for preventing streamer-id squatting. Default behaviour is unchanged when these are not supplied. See Docs/Security-Guidelines.md.

Patch Changes

• 1d54751: Enforce streamer/player subscription when routing signalling messages. Previously StreamerConnection.forwardMessage, StreamerConnection.onDisconnectPlayerRequest and SFUConnection.sendToPlayer resolved their target via the global player registry without checking that the player was subscribed to the sending streamer/SFU. On a signalling server shared by multiple streamers this let one streamer send forged offer/answer/iceCandidate messages to, or disconnect, players belonging to another streamer. These paths now drop messages for players that are not in the streamer's subscribers set. SFU connections now register themselves as a subscriber of their upstream streamer so messages destined for the SFU continue to be forwarded.

0.3.0

Minor Changes

• b0550d4: Add CORS support to the signalling web server. A new IWebServerConfig.cors option registers the cors Express middleware before the rate limiter and any route handlers, so that custom frontends hosted on a different origin can call the REST API (--rest_api) or any other route mounted on the app. Wilbur exposes this through a --cors CLI flag (default off) plus --cors_allowed_origins, --cors_allowed_methods, --cors_allowed_headers, and --cors_credentials. All four sub-options accept comma-separated values and read matching cors* keys from config.json. When --cors is set without an explicit origin list, all origins are allowed.
• 9308aa4: Make the REST API reachable when Wilbur is started with --rest_api but without --serve. Previously the Express app that hosts the /api/* routes was only bound to an HTTP listener inside the serve branch, so with --serve=false --rest_api=true the listener never started and requests were answered by the WebSocket upgrade handler on the player port (426 Upgrade Required). The HTTP listener now starts whenever rest_api or serve is set. Static file serving and the homepage route are gated by a new IWebServerConfig.serveStatic flag (the port listener runs independently of static serving), and the rate limiter is registered before any route handlers so the homepage and any downstream-registered routes are all rate-limited. Wilbur logs at startup which mode it is running in.

Patch Changes

• c3e46a8: - Addressing security issues raised by dependabot. (glob, js-yaml, playwright)
  • Added lint npm script to the root project. Running npm run lint will now run linting over all packages.
• 5696f2e: Make npm run lint work regardless of the directory it's invoked from. Each workspace's eslint.config.mjs now pins parserOptions.tsconfigRootDir to import.meta.dirname, so parserOptions.project resolves relative to the config file's own directory rather than whichever CWD typescript-eslint happens to pick by default. Previously the six workspace configs prefixed project with the workspace directory (e.g. 'Common/tsconfig.cjs.json'), which only worked under one specific typescript-eslint version's resolution behavior and broke CI when run from within the workspace.
• Updated dependencies [c3e46a8]
• Updated dependencies [5696f2e]
  • @epicgames-ps/[email protected]

0.2.1

Patch Changes

• 812a419: - Addressing security issues raised by dependabot. (glob, js-yaml, playwright)
  • Added lint npm script to the root project. Running npm run lint will now run linting over all packages.
• Updated dependencies [812a419]
  • @epicgames-ps/[email protected]

0.2.0

Minor Changes

• 05bebea: Add: Ability to access player id on the frontend.
  QoL: Remove player id stripping from the signalling library.

  It is useful to be able to use the player id as a unique identifier that is common between UE side stats and frontend side stats; however, the player id is not actually exposed to TS/JS because the SS strips it out of signalling messages.

  This change is a backport of "Exposed playerid" (#728)

@epicgames-ps/lib-pixelstreamingsignalling-ue5.6

0.3.1

Patch Changes

• 90c9ef8: Leave the previous streamer when an SFU subscribes to another. SFUConnection.subscribe overwrote subscribedStreamer without unsubscribing from the old streamer, so the old streamer kept forwarding to the SFU and kept the SFU's listeners. When that old streamer later disconnected, it detached the SFU from the streamer it was actually on and dropped the SFU's players. PlayerConnection already unsubscribes first; the SFU now does the same.
• 1c40314: Bound what the signalling server writes to its log. Every message a player sent was written to the log file whole, and the daily file had no size limit, so a client could make the log grow as fast as it could send. Log text and protocol messages longer than 16 KiB are now cut to that length, with their full length noted, and the log files are limited in size and number: by default 14 files of 100 MB, set with logMaxSize and logMaxFiles in InitLogging, or --log_max_size and --log_max_files in wilbur. Files are now kept by count rather than for 14 days.
• f3db311: Stop malformed messages from crashing the signalling server. A message whose JSON is null threw from the protocol's message handler, and since that handler runs inside the websocket's message event, any client could take the process down with one frame. Such a message is now rejected and logged, like unparseable JSON. A streamer's disconnectPlayer with a reason over 123 bytes, or one that is not a string, made ws throw in the same way; the reason is now dropped and the player is still disconnected. A non-string endpoint id from a streamer was stored as its id and broke the next streamer registration; it is now treated as no id.
• bbcccd9: Limit websocket messages on the streamer, player and SFU ports to 1 MiB. ws accepts up to 100 MiB in one message by default, and signalling messages are a few kilobytes. A connection that sends more is closed with code 1009. Setting maxPayload in streamerWsOptions, playerWsOptions or sfuWsOptions overrides the limit for that port.
• Updated dependencies [f3db311]
  • @epicgames-ps/[email protected]

0.3.0

Minor Changes

• 4fcf502: Add extension points so consumers can plug in their own authentication and authorization without the library shipping an auth scheme. Connections now expose the HTTP upgrade request (IStreamer.request / IPlayer.request) so identity attached during a verifyClient check survives to later decisions, and IServerConfig.authorizeStreamerId lets a consumer authorize, override (e.g. namespace per tenant), or reject the id a streamer registers as — the seam for preventing streamer-id squatting. Default behaviour is unchanged when these are not supplied. See Docs/Security-Guidelines.md.
• 47cfc6e: Allow TURN credentials to be issued per connection rather than shared by every session. peerOptions is static, so a credential written there is sent to every peer that ever connects and cannot be changed without a redeploy — the weakness noted in tip 3 of the security guidelines. IServerConfig.peerOptionsProvider is consulted once per connecting peer and returns the peer options for that peer, falling back to peerOptions if it throws. On top of it the signalling server adds --turn_secret (or --turn_secret_file) and --turn_ttl, which give every turn:/turns: entry a time limited username and credential in the form coturn's use-auth-secret mode expects. Default behaviour is unchanged when no secret is supplied. See Docs/Security-Guidelines.md.

Patch Changes

• e1b4d03: Stop an unsubscribed player from crashing the signalling server. When a player sends a message without being subscribed, sendToStreamer force-subscribes it to the first available streamer and then forwards through this.subscribedStreamer!. subscribe() can decline — most commonly because maxSubscribers is already reached — and reports that only by leaving subscribedStreamer unset, so the non-null assertions throw a TypeError out of a websocket message handler and take the process down, disconnecting every other player. It now checks the subscription took, and disconnects just that player if it did not.
• c69198d: Add an optional server-side keepalive that disconnects players whose connection has died without a clean close. Previously KeepaliveMonitor was only used on the client, so a player whose socket dropped silently (sleeping laptop, lost Wi-Fi, killed tab) stayed subscribed until the OS TCP keepalive reaped it, which could hold a maxSubscribers slot in the meantime. The new IServerConfig.playerKeepaliveTimeout controls this; the signalling server exposes it as --player_keepalive_timeout <milliseconds> (default 30000, 0 disables).

0.2.1

Patch Changes

• 7fc2e25: Enforce streamer/player subscription when routing signalling messages. Previously StreamerConnection.forwardMessage, StreamerConnection.onDisconnectPlayerRequest and SFUConnection.sendToPlayer resolved their target via the global player registry without checking that the player was subscribed to the sending streamer/SFU. On a signalling server shared by multiple streamers this let one streamer send forged offer/answer/iceCandidate messages to, or disconnect, players belonging to another streamer. These paths now drop messages for players that are not in the streamer's subscribers set. SFU connections now register themselves as a subscriber of their upstream streamer so messages destined for the SFU continue to be forwarded.

0.2.0

Minor Changes

• c4cb480: Add CORS support to the signalling web server. A new IWebServerConfig.cors option registers the cors Express middleware before the rate limiter and any route handlers, so that custom frontends hosted on a different origin can call the REST API (--rest_api) or any other route mounted on the app. Wilbur exposes this through a --cors CLI flag (default off) plus --cors_allowed_origins, --cors_allowed_methods, --cors_allowed_headers, and --cors_credentials. All four sub-options accept comma-separated values and read matching cors* keys from config.json. When --cors is set without an explicit origin list, all origins are allowed.
• ceaff56: Make the REST API reachable when Wilbur is started with --rest_api but without --serve. Previously the Express app that hosts the /api/* routes was only bound to an HTTP listener inside the serve branch, so with --serve=false --rest_api=true the listener never started and requests were answered by the WebSocket upgrade handler on the player port (426 Upgrade Required). The HTTP listener now starts whenever rest_api or serve is set. Static file serving and the homepage route are gated by a new IWebServerConfig.serveStatic flag (the port listener runs independently of static serving), and the rate limiter is registered before any route handlers so the homepage and any downstream-registered routes are all rate-limited. Wilbur logs at startup which mode it is running in.

Patch Changes

• d72dc6a: - Addressing security issues raised by dependabot. (glob, js-yaml, playwright)
  • Added lint npm script to the root project. Running npm run lint will now run linting over all packages.
• 7a78d64: Make npm run lint work regardless of the directory it's invoked from. Each workspace's eslint.config.mjs now pins parserOptions.tsconfigRootDir to import.meta.dirname, so parserOptions.project resolves relative to the config file's own directory rather than whichever CWD typescript-eslint happens to pick by default. Previously the six workspace configs prefixed project with the workspace directory (e.g. 'Common/tsconfig.cjs.json'), which only worked under one specific typescript-eslint version's resolution behavior and broke CI when run from within the workspace.
• Updated dependencies [d72dc6a]
• Updated dependencies [7a78d64]
  • @epicgames-ps/[email protected]

@epicgames-ps/lib-pixelstreamingfrontend-ue5.6

0.1.4

Patch Changes

• 930c631: Only accept the ss (signalling server url) URL parameter when it is a ws: or wss: url on the page's own hostname, so a crafted link can no longer connect a viewer to another server. A deployment whose signalling server is on a different host can allow it with the new allowedSignallingServerHosts Config option. Urls set through initialSettings or in code are not affected.
• Updated dependencies [e373094]
  • @epicgames-ps/[email protected]

0.1.3

Patch Changes

• c2b26e9: Stop negotiating VP8 when the preferred H264 profile isn't offered by the streamer. The default preferred codec is the browser's first H264 profile (e.g. 42001f on Chrome), chosen before the offer arrives; if the streamer only offered a different profile (e.g. 42e01f), the preference matched nothing and the browser fell back to its own codec order, which starts with VP8. Codecs are now matched on their identifying parameters (H264 profile and packetization mode; VP9/AV1/H265 profile) rather than exact fmtp strings or names, the preferred codec is resolved to the closest one the streamer offered, and if none is offered the streamer's codec order is used instead of the browser's.

0.1.2

Patch Changes

• fd42dcb: Stop the streamer's encoder quality bounds drifting looser on every connect. EncoderSettings.MinQuality/MaxQuality from initialSettings were mirrored into the legacy CompatQualityMin/CompatQualityMax settings, whose listeners convert quality back to QP in floating point and send it as Encoder.MinQP/Encoder.MaxQP. A MaxQuality of 70 becomes 15.300000000000004, which the streamer parses with an integer parse (flooring it to 15) and converts back by rounding (100 * (1 - 15/51) = 70.588 -> 71). Flooring one way and rounding the other is not the identity, and initialSettings is sent per player, so an application configured for 10/70 was running at 12/71 after one viewer, 14/73 after two, and eventually 25/76 — with the raised lower bound also taking away the encoder's room to drop quality under congestion. The mirror is removed: the streamer already applies Encoder.MinQuality/Encoder.MaxQuality verbatim, so nothing is lost, and the QP path is left in place for applications that send MinQP/MaxQP themselves.

0.1.1

Patch Changes

• f72438c: Include generated TypeScript declaration files in the published frontend packages.

0.2.2

Patch Changes

• 812a419: - Addressing security issues raised by dependabot. (glob, js-yaml, playwright)
  • Added lint npm script to the root project. Running npm run lint will now run linting over all packages.
• 7790838: Some versions of Firefox were unable to connect due the changes in PR#694 to overcome this issue and preserve the connectivity fixes from PR#694 we now assume the sdpMLineIndex is always 0 for bundle master media line. This change was tested on many browsers and restores connectivity with FireFox.
• Updated dependencies [812a419]
  • @epicgames-ps/[email protected]

0.2.1

Patch Changes

• c37e0f3: [UE5.7] QoL: Change this.peerConnection.getStats() access to the safer this.peerConnection?.getStats() (#719)
• 81031a8: [UE5.7] Fix: Streaming in iframe broken due to SecurityError checking if XR is supported (#734)

0.2.0

Minor Changes

• 05bebea: Add: Ability to access player id on the frontend.
  QoL: Remove player id stripping from the signalling library.

  It is useful to be able to use the player id as a unique identifier that is common between UE side stats and frontend side stats; however, the player id is not actually exposed to TS/JS because the SS strips it out of signalling messages.

  This change is a backport of "Exposed playerid" (#728)

0.1.1

Patch Changes

• 7e5dfb7: Some versions of Firefox were unable to connect due the changes in PR#694 to overcome this issue and preserve the connectivity fixes from PR#694 we now assume the sdpMLineIndex is always 0 for bundle master media line. This change was tested on many browsers and restores connectivity with FireFox.

0.2.2

Patch Changes

• 4d8a72f: This change fixes an intermittent WebRTC connection failure where even when the appropriate ICE candidates were present the conection would sometimes fail to be made. This was caused due to the order that ICE candidates were being sent (hence the intermittent nature of the issues) and the fact that ICE candidates sent from Pixel Streaming plugin contain sdpMid and sdpMLineIndex. sdpMid and sdpMLineIndex are only necessary in legacy, non bundle, WebRTC streams; however, Pixel Streaming always assumes bundle is used and these attributes can safely be set to empty strings/omitted (respectively). We perform this modification in the frontend library prior to adding the ICE candidate to the peer connection. This change was tested on a wide range of target devices and browsers to ensure there was no adverse side effects prior.

0.2.1

Patch Changes

• 3a9dd03: GitHub action was failing due to a TypeScript oddity introduced in TS 5.7: microsoft/TypeScript#60579
• d90b39f: When building the frontend library not in this repository it would fail due requiring newer node types, so these were added a dev dep.

0.2.0

Minor Changes

• e9a182a: Changes for regression/latency testing.

  Latency Session Test and dump to csv

  Added a new feature to run a variable length latency test session (e.g. a 60s window)
  and dump that stats from the session to two .csv files:

  1. latency.csv - Which contains the video timing stats
  2. stats.csv - Which contains all WebRTC stats the library currently tracks

  To enable the latency session test use the flag/url parameter ?LatencyCSV
  to enable this feature (by default it is disabled and not UI-configurable).

  To use this latency session test feature:

  1. Navigate to http://localhost/?LatencyCSV
  2. Open the stats panel and click the "Run Test" button under the "Session Test" heading.

  4.27 support restored

  Re-shipped UE 4.27 support by restoring the ?BrowserSendOffer flag.
  It was found useful to support running this latency session test against UE 4.27
  for internal historical testing so support for connecting to this version has been restored.

  To connect to a 4.27 project:

  1. Navigate to http://localhost/?BrowserSendOffer
  2. Connect (warning: this option is not compatible with all newer UE versions)

1.1.0

Minor Changes

• 208d100: Add: a html modal for editing text input that is shown on the frontend when user clicks/taps on a streamed UE widget.

  This edit text modal fixes the following:

  • Fix: Users can now input non-latin characters (e.g. Chinese, Japanese, Korean etc.) using IME assistance.
  • Fix: Users on mobile can now type using on-device native on-screen keyboards (which was previously non-functioning).
  • Add: Users can copy/paste from their clipboard into the edit text modal naturally.

  When adding this modal the following was also fixed and extended:

  • Fix: Typing into other frontend widgets (e.g. the settings panel) no longer sends input to the focused UE widget.
  • Add: Exposed a frontend event for when UE sends text input content, meaning customisation of behaviour is now possible.
  • Docs: Added docs explaning this new edit text modal.

  Further details about the edit text modal as mentioned in this PR: #564

@epicgames-ps/lib-pixelstreamingfrontend-ue5.6

0.3.3

Patch Changes

• c4870cf: Only accept the ss (signalling server url) URL parameter when it is a ws: or wss: url on the page's own hostname, so a crafted link can no longer connect a viewer to another server. A deployment whose signalling server is on a different host can allow it with the new allowedSignallingServerHosts Config option. Urls set through initialSettings or in code are not affected.
• Updated dependencies [01fd040]
  • @epicgames-ps/[email protected]

0.3.2

Patch Changes

• d9261da: Stop negotiating VP8 when the preferred H264 profile isn't offered by the streamer. The default preferred codec is the browser's first H264 profile (e.g. 42001f on Chrome), chosen before the offer arrives; if the streamer only offered a different profile (e.g. 42e01f), the preference matched nothing and the browser fell back to its own codec order, which starts with VP8. Codecs are now matched on their identifying parameters (H264 profile and packetization mode; VP9/AV1/H265 profile) rather than exact fmtp strings or names, the preferred codec is resolved to the closest one the streamer offered, and if none is offered the streamer's codec order is used instead of the browser's.

0.3.1

Patch Changes

• 33f8015: Stop the streamer's encoder quality bounds drifting looser on every connect. EncoderSettings.MinQuality/MaxQuality from initialSettings were mirrored into the legacy CompatQualityMin/CompatQualityMax settings, whose listeners convert quality back to QP in floating point and send it as Encoder.MinQP/Encoder.MaxQP. A MaxQuality of 70 becomes 15.300000000000004, which the streamer parses with an integer parse (flooring it to 15) and converts back by rounding (100 * (1 - 15/51) = 70.588 -> 71). Flooring one way and rounding the other is not the identity, and initialSettings is sent per player, so an application configured for 10/70 was running at 12/71 after one viewer, 14/73 after two, and eventually 25/76 — with the raised lower bound also taking away the encoder's room to drop quality under congestion. The mirror is removed: the streamer already applies Encoder.MinQuality/Encoder.MaxQuality verbatim, so nothing is lost, and the QP path is left in place for applications that send MinQP/MaxQP themselves.

0.3.0

Minor Changes

• 9a3404c: Add an AutoEnterVR config flag (#461). When enabled, the player checks for immersive-vr support after the video is initialized and requests the WebXR session automatically. Default is off. Note: browsers may require a user gesture to start a WebXR session; in flows where there is no pending gesture (for example, a fresh-page-load AutoConnect) the request can still be rejected and the player will log a warning.
• 72c5c53: Added Viewport Resolution Scale parameter to request higher resolution streams on small screens

Patch Changes

• e120706: Synthesize a MouseUp after MouseDouble in both mouse controllers so the streamer's pressed-button state stays balanced after a double-click (#10). The plugin treats MouseDouble as a press-class event (RoutePointerDoubleClickEvent / IGenericApplicationMessageHandler::OnMouseDoubleClick) but never synthesizes a release; the browser's preceding mouseup was already consumed by the prior MouseUp, so UE was left thinking the button was still held — manifesting, for example, as camera pans that latched on after a double-click. Behaviour is gated on the new MouseDoubleClickAutoRelease flag (default on); disable it via ?MouseDoubleClickAutoRelease=false or the settings panel to restore pre-fix behaviour for projects that handle the doubleclick release themselves.
• c3e46a8: - Addressing security issues raised by dependabot. (glob, js-yaml, playwright)
  • Added lint npm script to the root project. Running npm run lint will now run linting over all packages.
• 1a2a621: Map the macOS Command (and Windows Meta) keys to UE keycodes 91 (LeftWindowKey) and 92 (RightWindowKey). KeyCodes.ts now contains MetaLeft/MetaRight (and the legacy OSLeft/OSRight) entries, and KeyboardController.getKeycode normalizes the right-Cmd code so it no longer collides with ContextMenu (93) on browsers that report keyCode === 93 for it, and so Firefox-on-Mac (which reports keyCode === 224 for both Cmds) is also handled. Frontend portion of issue #276 — UE-side support for these key codes is tracked separately.
• d932cd9: Fix mouse-button-held tracking so dragging outside the video element keeps sending move and release events to UE (#349). When a button is pressed on the hovering mouse controller, mousemove/mouseup are temporarily moved from the video element to window, with coordinates re-computed against the video element's bounding rect. When all buttons are released, the listeners switch back to the element. This prevents the engine from being left with a stuck button when the user releases outside the video — common with DefaultViewportMouseCaptureMode=CaptureDuringMouseDown.
• 5696f2e: Make npm run lint work regardless of the directory it's invoked from. Each workspace's eslint.config.mjs now pins parserOptions.tsconfigRootDir to import.meta.dirname, so parserOptions.project resolves relative to the config file's own directory rather than whichever CWD typescript-eslint happens to pick by default. Previously the six workspace configs prefixed project with the workspace directory (e.g. 'Common/tsconfig.cjs.json'), which only worked under one specific typescript-eslint version's resolution behavior and broke CI when run from within the workspace.
• Updated dependencies [c3e46a8]
• Updated dependencies [5696f2e]
  • @epicgames-ps/[email protected]

0.2.2

Patch Changes

• 812a419: - Addressing security issues raised by dependabot. (glob, js-yaml, playwright)
  • Added lint npm script to the root project. Running npm run lint will now run linting over all packages.
• 7790838: Some versions of Firefox were unable to connect due the changes in PR#694 to overcome this issue and preserve the connectivity fixes from PR#694 we now assume the sdpMLineIndex is always 0 for bundle master media line. This change was tested on many browsers and restores connectivity with FireFox.
• Updated dependencies [812a419]
  • @epicgames-ps/[email protected]

0.2.1

Patch Changes

• c37e0f3: [UE5.7] QoL: Change this.peerConnection.getStats() access to the safer this.peerConnection?.getStats() (#719)
• 81031a8: [UE5.7] Fix: Streaming in iframe broken due to SecurityError checking if XR is supported (#734)

0.2.0

Minor Changes

• 05bebea: Add: Ability to access player id on the frontend.
  QoL: Remove player id stripping from the signalling library.

  It is useful to be able to use the player id as a unique identifier that is common between UE side stats and frontend side stats; however, the player id is not actually exposed to TS/JS because the SS strips it out of signalling messages.

  This change is a backport of "Exposed playerid" (#728)

0.1.1

Patch Changes

• 7e5dfb7: Some versions of Firefox were unable to connect due the changes in PR#694 to overcome this issue and preserve the connectivity fixes from PR#694 we now assume the sdpMLineIndex is always 0 for bundle master media line. This change was tested on many browsers and restores connectivity with FireFox.

0.2.2

Patch Changes

• 4d8a72f: This change fixes an intermittent WebRTC connection failure where even when the appropriate ICE candidates were present the conection would sometimes fail to be made. This was caused due to the order that ICE candidates were being sent (hence the intermittent nature of the issues) and the fact that ICE candidates sent from Pixel Streaming plugin contain sdpMid and sdpMLineIndex. sdpMid and sdpMLineIndex are only necessary in legacy, non bundle, WebRTC streams; however, Pixel Streaming always assumes bundle is used and these attributes can safely be set to empty strings/omitted (respectively). We perform this modification in the frontend library prior to adding the ICE candidate to the peer connection. This change was tested on a wide range of target devices and browsers to ensure there was no adverse side effects prior.

0.2.1

Patch Changes

• 3a9dd03: GitHub action was failing due to a TypeScript oddity introduced in TS 5.7: microsoft/TypeScript#60579
• d90b39f: When building the frontend library not in this repository it would fail due requiring newer node types, so these were added a dev dep.

0.2.0

Minor Changes

• e9a182a: Changes for regression/latency testing.

  Latency Session Test and dump to csv

  Added a new feature to run a variable length latency test session (e.g. a 60s window)
  and dump that stats from the session to two .csv files:

  1. latency.csv - Which contains the video timing stats
  2. stats.csv - Which contains all WebRTC stats the library currently tracks

  To enable the latency session test use the flag/url parameter ?LatencyCSV
  to enable this feature (by default it is disabled and not UI-configurable).

  To use this latency session test feature:

  1. Navigate to http://localhost/?LatencyCSV
  2. Open the stats panel and click the "Run Test" button under the "Session Test" heading.

  4.27 support restored

  Re-shipped UE 4.27 support by restoring the ?BrowserSendOffer flag.
  It was found useful to support running this latency session test against UE 4.27
  for internal historical testing so support for connecting to this version has been restored.

  To connect to a 4.27 project:

  1. Navigate to http://localhost/?BrowserSendOffer
  2. Connect (warning: this option is not compatible with all newer UE versions)

1.1.0

Minor Changes

• 208d100: Add: a html modal for...

@epicgames-ps/lib-pixelstreamingfrontend-ue5.6

0.3.2

Patch Changes

• 147dbf3: Only accept the ss (signalling server url) URL parameter when it is a ws: or wss: url on the page's own hostname, so a crafted link can no longer connect a viewer to another server. A deployment whose signalling server is on a different host can allow it with the new allowedSignallingServerHosts Config option. Urls set through initialSettings or in code are not affected.
• Updated dependencies [f3db311]
  • @epicgames-ps/[email protected]

0.3.1

Patch Changes

• 8cbcbb2: Stop the streamer's encoder quality bounds drifting looser on every connect. EncoderSettings.MinQuality/MaxQuality from initialSettings were mirrored into the legacy CompatQualityMin/CompatQualityMax settings, whose listeners convert quality back to QP in floating point and send it as Encoder.MinQP/Encoder.MaxQP. A MaxQuality of 70 becomes 15.300000000000004, which the streamer parses with an integer parse (flooring it to 15) and converts back by rounding (100 * (1 - 15/51) = 70.588 -> 71). Flooring one way and rounding the other is not the identity, and initialSettings is sent per player, so an application configured for 10/70 was running at 12/71 after one viewer, 14/73 after two, and eventually 25/76 — with the raised lower bound also taking away the encoder's room to drop quality under congestion. The mirror is removed: the streamer already applies Encoder.MinQuality/Encoder.MaxQuality verbatim, so nothing is lost, and the QP path is left in place for applications that send MinQP/MaxQP themselves.

0.3.0

Minor Changes

• 29a420c: Add an AutoEnterVR config flag (#461). When enabled, the player checks for immersive-vr support after the video is initialized and requests the WebXR session automatically. Default is off. Note: browsers may require a user gesture to start a WebXR session; in flows where there is no pending gesture (for example, a fresh-page-load AutoConnect) the request can still be rejected and the player will log a warning.
• 7c2514d: Added Viewport Resolution Scale parameter to request higher resolution streams on small screens

Patch Changes

• e053841: Synthesize a MouseUp after MouseDouble in both mouse controllers so the streamer's pressed-button state stays balanced after a double-click (#10). The plugin treats MouseDouble as a press-class event (RoutePointerDoubleClickEvent / IGenericApplicationMessageHandler::OnMouseDoubleClick) but never synthesizes a release; the browser's preceding mouseup was already consumed by the prior MouseUp, so UE was left thinking the button was still held — manifesting, for example, as camera pans that latched on after a double-click. Behaviour is gated on the new MouseDoubleClickAutoRelease flag (default on); disable it via ?MouseDoubleClickAutoRelease=false or the settings panel to restore pre-fix behaviour for projects that handle the doubleclick release themselves.
• d72dc6a: - Addressing security issues raised by dependabot. (glob, js-yaml, playwright)
  • Added lint npm script to the root project. Running npm run lint will now run linting over all packages.
• cefa822: Map the macOS Command (and Windows Meta) keys to UE keycodes 91 (LeftWindowKey) and 92 (RightWindowKey). KeyCodes.ts now contains MetaLeft/MetaRight (and the legacy OSLeft/OSRight) entries, and KeyboardController.getKeycode normalizes the right-Cmd code so it no longer collides with ContextMenu (93) on browsers that report keyCode === 93 for it, and so Firefox-on-Mac (which reports keyCode === 224 for both Cmds) is also handled. Frontend portion of issue #276 — UE-side support for these key codes is tracked separately.
• a9f507f: Fix mouse-button-held tracking so dragging outside the video element keeps sending move and release events to UE (#349). When a button is pressed on the hovering mouse controller, mousemove/mouseup are temporarily moved from the video element to window, with coordinates re-computed against the video element's bounding rect. When all buttons are released, the listeners switch back to the element. This prevents the engine from being left with a stuck button when the user releases outside the video — common with DefaultViewportMouseCaptureMode=CaptureDuringMouseDown.
• 7a78d64: Make npm run lint work regardless of the directory it's invoked from. Each workspace's eslint.config.mjs now pins parserOptions.tsconfigRootDir to import.meta.dirname, so parserOptions.project resolves relative to the config file's own directory rather than whichever CWD typescript-eslint happens to pick by default. Previously the six workspace configs prefixed project with the workspace directory (e.g. 'Common/tsconfig.cjs.json'), which only worked under one specific typescript-eslint version's resolution behavior and broke CI when run from within the workspace.
• Updated dependencies [d72dc6a]
• Updated dependencies [7a78d64]
  • @epicgames-ps/[email protected]

0.2.5

Patch Changes

• 5ac48b0: [UE5.6] Fix: Streaming in iframe broken due to SecurityError checking if XR is supported (#734)

0.2.3

Patch Changes

• 7882834: Some versions of Firefox were unable to connect due the changes in PR#694 to overcome this issue and preserve the connectivity fixes from PR#694 we now assume the sdpMLineIndex is always 0 for bundle master media line. This change was tested on many browsers and restores connectivity with FireFox.

0.2.2

Patch Changes

• 4d8a72f: This change fixes an intermittent WebRTC connection failure where even when the appropriate ICE candidates were present the conection would sometimes fail to be made. This was caused due to the order that ICE candidates were being sent (hence the intermittent nature of the issues) and the fact that ICE candidates sent from Pixel Streaming plugin contain sdpMid and sdpMLineIndex. sdpMid and sdpMLineIndex are only necessary in legacy, non bundle, WebRTC streams; however, Pixel Streaming always assumes bundle is used and these attributes can safely be set to empty strings/omitted (respectively). We perform this modification in the frontend library prior to adding the ICE candidate to the peer connection. This change was tested on a wide range of target devices and browsers to ensure there was no adverse side effects prior.

0.2.1

Patch Changes

• 3a9dd03: GitHub action was failing due to a TypeScript oddity introduced in TS 5.7: microsoft/TypeScript#60579
• d90b39f: When building the frontend library not in this repository it would fail due requiring newer node types, so these were added a dev dep.

0.2.0

Minor Changes

• e9a182a: Changes for regression/latency testing.

  Latency Session Test and dump to csv

  Added a new feature to run a variable length latency test session (e.g. a 60s window)
  and dump that stats from the session to two .csv files:

  1. latency.csv - Which contains the video timing stats
  2. stats.csv - Which contains all WebRTC stats the library currently tracks

  To enable the latency session test use the flag/url parameter ?LatencyCSV
  to enable this feature (by default it is disabled and not UI-configurable).

  To use this latency session test feature:

  1. Navigate to http://localhost/?LatencyCSV
  2. Open the stats panel and click the "Run Test" button under the "Session Test" heading.

  4.27 support restored

  Re-shipped UE 4.27 support by restoring the ?BrowserSendOffer flag.
  It was found useful to support running this latency session test against UE 4.27
  for internal historical testing so support for connecting to this version has been restored.

  To connect to a 4.27 project:

  1. Navigate to http://localhost/?BrowserSendOffer
  2. Connect (warning: this option is not compatible with all newer UE versions)

1.1.0

Minor Changes

• 208d100: Add: a html modal for editing text input that is shown on the frontend when user clicks/taps on a streamed UE widget.

  This edit text modal fixes the following:

  • Fix: Users can now input non-latin characters (e.g. Chinese, Japanese, Korean etc.) using IME assistance.
  • Fix: Users on mobile can now type using on-device native on-screen keyboards (which was previously non-functioning).
  • Add: Users can copy/paste from their clipboard into the edit text modal naturally.

  When adding this modal the following was also fixed and extended:

  • Fix: Typing into other frontend widgets (e.g. the settings panel) no longer sends input to the focused UE widget.
  • Add: Exposed a frontend event for when UE sends text input content, meaning customisation of behaviour is now possible.
  • Docs: Added docs explaning this new edit text modal.

  Further details about the edit text modal as mentioned in this PR: #564

@epicgames-ps/lib-pixelstreamingcommon-ue5.6

0.1.1

Patch Changes

• e373094: Stop malformed messages from crashing the signalling server. A message whose JSON is null threw from the protocol's message handler, and since that handler runs inside the websocket's message event, any client could take the process down with one frame. Such a message is now rejected and logged, like unparseable JSON. A streamer's disconnectPlayer with a reason over 123 bytes, or one that is not a string, made ws throw in the same way; the reason is now dropped and the player is still disconnected. A non-string endpoint id from a streamer was stored as its id and broke the next streamer registration; it is now treated as no id.

0.1.4

Patch Changes

• 812a419: - Addressing security issues raised by dependabot. (glob, js-yaml, playwright)
  • Added lint npm script to the root project. Running npm run lint will now run linting over all packages.

@epicgames-ps/lib-pixelstreamingcommon-ue5.6

0.1.6

Patch Changes

• 01fd040: Stop malformed messages from crashing the signalling server. A message whose JSON is null threw from the protocol's message handler, and since that handler runs inside the websocket's message event, any client could take the process down with one frame. Such a message is now rejected and logged, like unparseable JSON. A streamer's disconnectPlayer with a reason over 123 bytes, or one that is not a string, made ws throw in the same way; the reason is now dropped and the player is still disconnected. A non-string endpoint id from a streamer was stored as its id and broke the next streamer registration; it is now treated as no id.

0.1.5

Patch Changes

• c3e46a8: - Addressing security issues raised by dependabot. (glob, js-yaml, playwright)
  • Added lint npm script to the root project. Running npm run lint will now run linting over all packages.
• 5696f2e: Make npm run lint work regardless of the directory it's invoked from. Each workspace's eslint.config.mjs now pins parserOptions.tsconfigRootDir to import.meta.dirname, so parserOptions.project resolves relative to the config file's own directory rather than whichever CWD typescript-eslint happens to pick by default. Previously the six workspace configs prefixed project with the workspace directory (e.g. 'Common/tsconfig.cjs.json'), which only worked under one specific typescript-eslint version's resolution behavior and broke CI when run from within the workspace.

0.1.4

Patch Changes

• 812a419: - Addressing security issues raised by dependabot. (glob, js-yaml, playwright)
  • Added lint npm script to the root project. Running npm run lint will now run linting over all packages.

@epicgames-ps/lib-pixelstreamingcommon-ue5.6

0.1.6

Patch Changes

• f3db311: Stop malformed messages from crashing the signalling server. A message whose JSON is null threw from the protocol's message handler, and since that handler runs inside the websocket's message event, any client could take the process down with one frame. Such a message is now rejected and logged, like unparseable JSON. A streamer's disconnectPlayer with a reason over 123 bytes, or one that is not a string, made ws throw in the same way; the reason is now dropped and the player is still disconnected. A non-string endpoint id from a streamer was stored as its id and broke the next streamer registration; it is now treated as no id.

0.1.5

Patch Changes

• d72dc6a: - Addressing security issues raised by dependabot. (glob, js-yaml, playwright)
  • Added lint npm script to the root project. Running npm run lint will now run linting over all packages.
• 7a78d64: Make npm run lint work regardless of the directory it's invoked from. Each workspace's eslint.config.mjs now pins parserOptions.tsconfigRootDir to import.meta.dirname, so parserOptions.project resolves relative to the config file's own directory rather than whichever CWD typescript-eslint happens to pick by default. Previously the six workspace configs prefixed project with the workspace directory (e.g. 'Common/tsconfig.cjs.json'), which only worked under one specific typescript-eslint version's resolution behavior and broke CI when run from within the workspace.

@epicgames-ps/lib-pixelstreamingfrontend-ui-ue5.6

0.1.2

Patch Changes

• e006bd3: Escape the streamer id, disconnect reason and subscribe failure message before showing them in overlays, and set settings dropdown options as text, so a crafted StreamerId URL parameter can no longer inject HTML into the player page.

0.1.1

Patch Changes

• f72438c: Include generated TypeScript declaration files in the published frontend packages.
• Updated dependencies [f72438c]
  • @epicgames-ps/[email protected]

0.1.3

Patch Changes

• 812a419: - Addressing security issues raised by dependabot. (glob, js-yaml, playwright)
  • Added lint npm script to the root project. Running npm run lint will now run linting over all packages.
• Updated dependencies [812a419]
• Updated dependencies [7790838]
  • @epicgames-ps/[email protected]

0.1.2

Patch Changes

• Updated dependencies [05bebea]
  • @epicgames-ps/[email protected]

0.2.0

Minor Changes

• e9a182a: Changes for regression/latency testing.

  Latency Session Test and dump to csv

  Added a new feature to run a variable length latency test session (e.g. a 60s window)
  and dump that stats from the session to two .csv files:

  1. latency.csv - Which contains the video timing stats
  2. stats.csv - Which contains all WebRTC stats the library currently tracks

  To enable the latency session test use the flag/url parameter ?LatencyCSV
  to enable this feature (by default it is disabled and not UI-configurable).

  To use this latency session test feature:

  1. Navigate to http://localhost/?LatencyCSV
  2. Open the stats panel and click the "Run Test" button under the "Session Test" heading.

  4.27 support restored

  Re-shipped UE 4.27 support by restoring the ?BrowserSendOffer flag.
  It was found useful to support running this latency session test against UE 4.27
  for internal historical testing so support for connecting to this version has been restored.

  To connect to a 4.27 project:

  1. Navigate to http://localhost/?BrowserSendOffer
  2. Connect (warning: this option is not compatible with all newer UE versions)

Patch Changes

• Updated dependencies [e9a182a]
  • @epicgames-ps/[email protected]

1.2.0

Minor Changes

• 208d100: Add: a html modal for editing text input that is shown on the frontend when user clicks/taps on a streamed UE widget.

  This edit text modal fixes the following:

  • Fix: Users can now input non-latin characters (e.g. Chinese, Japanese, Korean etc.) using IME assistance.
  • Fix: Users on mobile can now type using on-device native on-screen keyboards (which was previously non-functioning).
  • Add: Users can copy/paste from their clipboard into the edit text modal naturally.

  When adding this modal the following was also fixed and extended:

  • Fix: Typing into other frontend widgets (e.g. the settings panel) no longer sends input to the focused UE widget.
  • Add: Exposed a frontend event for when UE sends text input content, meaning customisation of behaviour is now possible.
  • Docs: Added docs explaning this new edit text modal.

  Further details about the edit text modal as mentioned in this PR: #564

Patch Changes

• Updated dependencies [208d100]
  • @epicgames-ps/[email protected]

1.1.0

Minor Changes

• 8961c17: Frontend library is no longer a peer dependency but instead now a normal dependency.