Update CI configs to v0.12.7

.github/workflows/fuzz.yaml

@@ -23,5 +23,5 @@ jobs:
   fuzz:
     uses: pion/.goassets/.github/workflows/fuzz.reusable.yml@main
     with:
-      go-version: "1.25" # auto-update/latest-go-version
+      go-version: "1.27" # auto-update/latest-go-version
       fuzz-time: "60s"

.github/workflows/goassets-automerge.yml

@@ -0,0 +1,96 @@
+#
+# DO NOT EDIT THIS FILE
+#
+# It is automatically copied from https://github.com/pion/.goassets repository.
+# If this repository should have package specific CI config,
+# remove the repository name from .goassets/.github/workflows/assets-sync.yml.
+#
+# If you want to update the shared CI config, send a PR to
+# https://github.com/pion/.goassets instead of this repository.
+#
+# SPDX-FileCopyrightText: 2026 The Pion community <https://pion.ly>
+# SPDX-License-Identifier: MIT
+
+name: Auto-merge .goassets updates
+on:
+  pull_request_target:
+    types: [opened]
+  workflow_run:
+    workflows: [API, CodeQL, Fuzz, Go mod tidy, Lint, REUSE Compliance Check, Test]
+    types: [completed]
+    branches: [sync-assets-*]
+
+permissions:
+  checks: read
+  contents: write
+  pull-requests: write
+  statuses: read
+
+concurrency:
+  group: goassets-automerge-${{ github.event.pull_request.head.ref || github.event.workflow_run.head_branch }}
+  cancel-in-progress: false
+
+jobs:
+  auto-merge:
+    if: >-
+      github.repository_owner == 'pion' &&
+      ((github.event_name == 'pull_request_target' &&
+        github.event.pull_request.user.login == 'pionbot' &&
+        github.event.pull_request.base.ref == 'main' &&
+       github.event.pull_request.head.repo.full_name == github.repository) ||
+       (github.event_name == 'workflow_run' &&
+        github.event.workflow_run.conclusion == 'success' &&
+        github.event.workflow_run.head_repository.full_name == github.repository))
+    runs-on: ubuntu-26.04
+    timeout-minutes: 60
+    steps:
+      - name: Validate .goassets PR
+        id: pr
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPOSITORY: ${{ github.repository }}
+          HEAD: ${{ github.event.pull_request.head.ref || github.event.workflow_run.head_branch }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.event.workflow_run.head_sha }}
+        run: |
+          if ! [[ "$HEAD" =~ ^sync-assets-v[0-9]+\.[0-9]+\.[0-9]+$ ]] &&
+             ! [[ "$REPOSITORY" == "pion/ci-sandbox" && "$HEAD" == "sync-assets-main" ]]; then
+            exit 0
+          fi
+
+          # Fetch current PR data: reruns may refer to a closed PR or an old commit.
+          gh api --method GET "repos/$REPOSITORY/pulls" \
+            -f state=open -f base=main -f head="${REPOSITORY%%/*}:$HEAD" |
+            jq -r --arg repository "$REPOSITORY" --arg head "$HEAD" --arg sha "$HEAD_SHA" '
+              .[] | select(
+                .user.login == "pionbot" and
+                .state == "open" and
+                .draft == false and
+                .base.ref == "main" and
+                .head.repo.full_name == $repository and
+                .head.ref == $head and
+                .head.sha == $sha and
+                .title == ("Update CI configs to " + ($head | ltrimstr("sync-assets-")))
+              ) | "url=\(.html_url)"
+            ' >> "$GITHUB_OUTPUT"
+
+      - name: Approve
+        if: steps.pr.outputs.url != ''
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_URL: ${{ steps.pr.outputs.url }}
+        run: gh pr review "$PR_URL" --approve
+
+      - name: Wait for required checks
+        if: steps.pr.outputs.url != ''
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_URL: ${{ steps.pr.outputs.url }}
+        run: gh pr checks "$PR_URL" --required --watch --fail-fast
+
+      - name: Merge
+        if: steps.pr.outputs.url != ''
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_URL: ${{ steps.pr.outputs.url }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.event.workflow_run.head_sha }}
+        run: gh pr merge "$PR_URL" --rebase --match-head-commit "$HEAD_SHA"

.github/workflows/release.yml

@@ -21,4 +21,4 @@ jobs:
   release:
     uses: pion/.goassets/.github/workflows/release.reusable.yml@main
     with:
-      go-version: "1.25" # auto-update/latest-go-version
+      go-version: "1.27" # auto-update/latest-go-version

.github/workflows/test.yaml

@@ -23,7 +23,7 @@ jobs:
     uses: pion/.goassets/.github/workflows/test.reusable.yml@main
     strategy:
       matrix:
-        go: ["1.25", "1.24"] # auto-update/supported-go-version-list
+        go: ["1.27", "1.26"] # auto-update/supported-go-version-list
       fail-fast: false
     with:
       go-version: ${{ matrix.go }}
@@ -33,7 +33,7 @@ jobs:
     uses: pion/.goassets/.github/workflows/test-i386.reusable.yml@main
     strategy:
       matrix:
-        go: ["1.25", "1.24"] # auto-update/supported-go-version-list
+        go: ["1.27", "1.26"] # auto-update/supported-go-version-list
       fail-fast: false
     with:
       go-version: ${{ matrix.go }}
@@ -42,7 +42,7 @@ jobs:
     uses: pion/.goassets/.github/workflows/test-windows.reusable.yml@main
     strategy:
       matrix:
-        go: ["1.25", "1.24"] # auto-update/supported-go-version-list
+        go: ["1.27", "1.26"] # auto-update/supported-go-version-list
       fail-fast: false
     with:
       go-version: ${{ matrix.go }}
@@ -51,13 +51,13 @@ jobs:
     uses: pion/.goassets/.github/workflows/test-macos.reusable.yml@main
     strategy:
       matrix:
-        go: ["1.25", "1.24"] # auto-update/supported-go-version-list
+        go: ["1.27", "1.26"] # auto-update/supported-go-version-list
       fail-fast: false
     with:
       go-version: ${{ matrix.go }}
 
   test-wasm:
     uses: pion/.goassets/.github/workflows/test-wasm.reusable.yml@main
     with:
-      go-version: "1.25" # auto-update/latest-go-version
+      go-version: "1.27" # auto-update/latest-go-version
     secrets: inherit

.github/workflows/tidy-check.yaml

@@ -22,4 +22,4 @@ jobs:
   tidy:
     uses: pion/.goassets/.github/workflows/tidy-check.reusable.yml@main
     with:
-      go-version: "1.25" # auto-update/latest-go-version
+      go-version: "1.27" # auto-update/latest-go-version

.golangci.yml

@@ -78,6 +78,8 @@ linters:
     - wrapcheck        # Checks that errors returned from external packages are wrapped
     - wsl              # Whitespace Linter - Forces you to use empty lines!
   settings:
+    lll:
+      line-length: 320
     staticcheck:
       checks:
         - all
@@ -105,6 +107,9 @@ linters:
     govet:
       enable:
         - shadow
+    gosec:
+      excludes:
+        - G117 # noisy secret/password field-name checks.
     revive:
       rules:
         # Prefer 'any' type alias over 'interface{}' for Go 1.18+ compatibility
@@ -151,5 +156,5 @@ formatters:
   exclusions:
     generated: lax
 issues:
-  max-issues-per-linter: 0
   max-same-issues: 0
+  max-issues-per-linter: 0

pkg/rfc8888/rfc8888.go

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: 2025 The Pion community <https://pion.ly>
+// SPDX-FileCopyrightText: 2026 The Pion community <https://pion.ly>
 // SPDX-License-Identifier: MIT
 
 // Package rfc8888 is deprecated. Use ccfb instead.