OxiMedia 0.1.9 Released — 100% Pure Rust by Default, Four Security Fixes, and oximedia-web Ships

The pure-Rust FFmpeg + OpenCV replacement just went fully sovereign in its default build — and closed four real security holes on the way.

Today we released OxiMedia 0.1.9 — a production-readiness release that makes the default build 100% Pure Rust end to end, fixes four real security vulnerabilities inherited from earlier “demonstration” code, lands ten development waves (21–30) of algorithmic hardening, and ships oximedia-web, a new package of four browser WebAssembly modules running downstream of WebCodecs for the first time.

No C. No C++. No Fortran. As of 0.1.9, cargo check --workspace compiles zero aws-lc-sys, libsqlite3-sys, mlua-sys, shaderc-sys, zstd-sys, openssl-sys, rustfft, or realfft — all of them now absent from the default dependency graph, not merely unused. OxiMedia compiles to a single static binary (or to wasm32-unknown-unknown for the browser) and runs everywhere with one cargo add.

Why OxiMedia 0.1.9 is a game changer

FFmpeg and OpenCV are the de facto standards for media and vision — at a cost:

• FFmpeg is written in C, ships patent-encumbered codecs (H.264, H.265, AAC), and carries a long history of memory-safety CVEs in code that parses attacker-controlled bytes
• OpenCV depends on C++, complex CMake builds, and optional proprietary modules (CUDA, Intel IPP), with heavy system-level dependencies either way
• Both demand a wall of system libraries — ./configure && make or cmake, plus pkg-config, plus whatever your distro happens to ship
• Security-critical media code — SRT/DASH crypto, MP4 box parsing, SQL-backed asset queries — is exactly the code most likely to have been written once, in a hurry, and never revisited

OxiMedia 0.1.9 ends all of that.

• Zero C/C++/Fortran by default. SQLite storage in oximedia-server/oximedia-rights moved from libsqlite3-sys to Pure-Rust oxisql-sqlite-compat; Vulkan compute, Lua scripting, the official AWS SDK, and QUIC transport all moved behind non-default vulkan-backend/lua-scripting/aws-sdk/quic-quinn feature flags; oximedia-audio’s resampler dropped rubato (and with it rustfft/realfft) for a hand-written, Pure-Rust windowed-sinc polyphase resampler.
• Four real security vulnerabilities fixed. SRT payload “encryption” was a homebrew XOR/byte-mixing cipher — now genuine AES-128/192/256-CTR (NIST SP 800-38A) with real PBKDF2-HMAC-SHA256 key derivation and CSPRNG salts. HLS/DASH packager keys moved off SystemTime-seeded pseudo-randomness onto the OS CSPRNG, and passphrase-derived keys now use 100,000-round PBKDF2-HMAC-SHA256 instead of a bare DefaultHasher. MP4 sample-table parsing now bounds-checks attacker-controlled entry counts before allocating, closing a DoS where a ~20-byte crafted file could trigger a multi-gigabyte allocation attempt. And oximedia-mam smart-collection filters no longer splice user input into SQL text — a new column allowlist plus real parameter binding closes a SQL injection hole.
• WebRTC stopped lying about security. DTLS-SRTP used to report a “successful” handshake while handing out an all-zero SRTP master key/salt — plaintext media under a DTLS-protected label. It now refuses the connection outright instead of fabricating one, and is honestly marked Experimental until real DTLS 1.2 + RFC 5764 SRTP key export lands.
• oximedia-web is live — twice, in production. Four independent WASM modules (scopes, color, scale, quality), each #![forbid(unsafe_code)] and sitting downstream of the browser’s own WebCodecs decoder, power both the OxiScope colorist demo and OxiLink’s peer-to-peer video calls — under a combined 512,000 B gzip budget, currently measured at 150,072 B (29%).
• Real color science, not a stub. oximedia-calibrate’s ICC/display color-matrix solver now performs an actual least-squares 3×3 fit (adjugate inverse, condition-number/rank-deficiency guards) instead of returning the identity matrix — verified at ΔE2000 < 2.0 against known-answer fixtures.
• 101,814 tests passing with --all-features (100,160 with default features), 0 failures, 0 clippy warnings, 0 rustfmt diffs, all doctests green — across 114 crates and ~2.95M lines of Rust.

Technical Deep Dive: how the sovereignty push and the security fixes fit together

1. Pure-Rust infrastructure migration. oximedia-server/oximedia-rights (SQLite → oxisql-sqlite-compat via a sqlx-API-shaped compat shim), oximedia-accel (real Vulkan compute behind the new vulkan-backend feature, Pure-Rust CPU/WebGPU fallback by default), oximedia-automation (Lua behind lua-scripting), oximedia-cloud (official AWS SDK behind aws-sdk, with GenericStorage over reqwest + rustls-rustcrypto covering S3-compatible endpoints by default), oximedia-videoip (QUIC behind quic-quinn).
2. Security-hardened protocol and data layer. oximedia-net::srt::crypto (AES-CTR + PBKDF2), oximedia-packager::encryption::KeyGenerator (CSPRNG + PBKDF2, now fallible so a CSPRNG failure surfaces instead of silently producing predictable keys), oximedia-container::demux::mp4::boxes (bounds-checked stts/stsc/stsz/stco/co64/stss/ctts parsers), oximedia-mam::collection::CollectionManager (ALLOWED_ASSET_COLUMNS allowlist + BindValue parameter binding), and oximedia-net::webrtc::dtls (honest failure in place of a fabricated handshake).
3. oximedia-web (web/) — a separate, nested Cargo workspace of four dependency-free wasm32-unknown-unknown crates, each with a hand-written JS/TS wrapper (web/js/, ~1,900 lines combined, matching .d.ts declarations) and a cargo-deny-gated dependency allowlist (web/deny.toml, web/allowed-deps.txt) enforced by local CI-gate shell scripts (build.sh, size-gate.sh, dep-gate.sh), not just convention.
4. Algorithmic hardening, Waves 21–30. oximedia-calibrate’s least-squares color solver headlines a batch that also fixed six pre-existing bugs (oximedia-restore Wiener-filter gain and wow/flutter processing, oximedia-audio-analysis Hann-window and synthesis attenuation, oximedia-graph node collisions, SILK NSQ SNR), and landed new capability for general use: oximedia-proxy cache warming, oximedia-align bit-exact descriptor caching, and an oximedia-search P@k/R@k/AP/MAP evaluation harness.

Getting Started

cargo add oximedia

Probe a file and transcode it with quality control — straight from the crate’s own docs:

use oximedia::prelude::*;

// Probe a media file
let data = std::fs::read("video.webm")?;
let result = probe_format(&data)?;
println!("Format: {:?}, Confidence: {:.1}%",
    result.format, result.confidence * 100.0);

// Transcode with quality control
let pipeline = TranscodePipeline::builder()
    .input("input.mkv")
    .video_codec(VideoCodec::Av1)
    .audio_codec(AudioCodec::Opus)
    .output("output.webm")
    .build()?;

pipeline.run().await?;

Or reach for the CLI directly:

cargo install oximedia-cli
oximedia probe -i video.webm
oximedia transcode -i input.mkv -o output.webm --codec av1

What’s New in 0.1.9

• Security: real AES-CTR + PBKDF2 for SRT payload encryption; CSPRNG + PBKDF2 for HLS/DASH packager keys; bounds-checked MP4 sample-table parsing (closes a DoS); WebRTC DTLS-SRTP now fails honestly instead of faking a handshake; SQL injection closed in oximedia-mam smart collections via an allowlist and real parameter binding; cargo-audit advisories re-triaged for the new dependency set.
• Changed: the default build is 100% Pure Rust — SQLite, Vulkan, Lua, the AWS SDK, QUIC, tantivy’s columnar compression, actix-web’s response compression, azure_core’s TLS stack, and oximedia-audio’s resampler all moved off C dependencies or behind opt-in features; a tuned [profile.release] (lto = "thin", codegen-units = 1, strip = true) landed at the workspace root; sqlx trimmed to Postgres-only; fifteen duplicated dependency declarations centralized into [workspace.dependencies].
• Added: oximedia-web (four WASM modules, JS/TS wrappers, the OxiScope demo, a headless-Chrome benchmark harness); rust-toolchain.toml; CONTRIBUTING.md/SECURITY.md/CODE_OF_CONDUCT.md; ten new cargo-fuzz targets (AAF, ASS, OpenEXR, FFV1, JPEG XL, SubRip, TIFF, TTML, WebVTT, Y4M parsers); real doctests and a compile-only feature-matrix test harness on the oximedia facade crate; an end-to-end CLI smoke-test suite.
• Fixed: a root-workspace tokio feature-unification bug that broke the oximedia-wasm wasm32 build; dishonest WASM decoder classes removed from oximedia-wasm (they produced no real output); a wasm32 zero-warnings sweep across six crates; 13 .expect()/.unwrap() call sites removed from oximedia-server; a bind-parameter mismatch in oximedia-mam list filters that would have failed at execution time; the oxiarc-* dependency family realigned at a uniform 0.3.6.
• Improved: oximedia-web’s scopes/color/scale kernels retuned for real per-frame performance (monomorphised FMA accumulators, repacked LUT lattice points, vectorised scope conversion) while holding the combined gzip footprint at 150,072 B against a 512,000 B budget.

Tips

• Re-enable C-backed fast paths explicitly, if you need them. vulkan-backend, lua-scripting, aws-sdk, and quic-quinn are opt-in now, not default:

  [dependencies]
  oximedia = { version = "0.1.9", features = ["full"] }
  

  or enable just the one you need on its underlying crate (e.g. oximedia-accel’s vulkan-backend) if you don’t want the rest.
• Don’t route confidential media over WebRTC yet. DtlsEndpoint::handshake() now returns an error instead of a fake all-zero-key “success” — treat WebRTC media transport as Experimental until real DTLS 1.2 + RFC 5764 SRTP key export lands.
• Try oximedia-web locally. @cooljapan/oximedia-web isn’t published to npm yet — packaging is prepared but publish is pending. Clone the repo and run web/scripts/serve.sh, then open /demo/ for the OxiScope colorist demo; the same modules run OxiLink in production.
• SQLite migration is transparent. If you use oximedia-archive’s or oximedia-dedup’s sqlite feature, you’re already on Pure-Rust oxisql-sqlite-compat — no code changes on your end, just rebuild against 0.1.9.
• Prove your own feature combination builds. oximedia/tests/feature_matrix.rs checks every Cargo feature flag independently (cargo check --no-default-features --features <flag>, parsed straight from the crate’s own Cargo.toml) — copy the pattern if you maintain a custom feature subset downstream.

This is the foundation

OxiMedia is the pure-Rust media and computer-vision layer of the COOLJAPAN ecosystem, and 0.1.9 leans on its siblings directly:

• OxiONNX — the Pure-Rust ONNX runtime behind every opt-in oximedia-ml pipeline (scene classification, shot-boundary detection, aesthetic scoring, object detection, face embedding), still zero symbols linked by default.
• OxiFFT — the spectral engine behind phase correlation, log-mel spectrograms, and audio analysis.
• SciRS2 — scientific-computing primitives (linalg, SIMD) for the CV and signal paths.
• OxiArc — Pure-Rust compression (oxiarc-archive, oxiarc-lz4, oxiarc-zstd, oxiarc-deflate) for containers and archival, realigned at a uniform 0.3.6 this release.
• OxiSQL — oxisql-sqlite-compat now backs every SQLite-persisted path in oximedia-server, oximedia-rights, oximedia-archive, and oximedia-dedup.
• OxiLink — a live, production peer-to-peer video-call app built directly on oximedia-web’s WASM modules, with its entire signalling-server source published at 62 lines.

Repository: https://github.com/cool-japan/oximedia

Star the repo if you think a media framework’s “encryption” should be real cryptography, not homebrew XOR — and its “successful” handshakes should mean what they say.

The era of choosing between FFmpeg’s C memory-safety CVEs and OpenCV’s CMake build hell is over. Pure Rust media is here — fast, safe, and sovereign.

— KitaSan at COOLJAPAN OÜ July 14, 2026