[vikramdattu]

Summary

• Bump libsrtp submodule from the v2.8.0 release tag (24b3bf8) to 2_x_dev HEAD d33b8ff — the merge of mbedTLS 4 / PSA Crypto support on 2_x_dev cisco/libsrtp#813, which adds mbedTLS 4 / PSA Crypto support to the 2.x mbedTLS adapters. The adapters self-select on MBEDTLS_VERSION_MAJOR, so mbedTLS 3 (IDF v5.x) code paths are untouched.
• Drop the idf <6 cap from idf_component.yml — this was gated on exactly this upstream work (the manifest comment referenced mbedTLS 4 support on 2_x_dev — plans? cisco/libsrtp#812). Component version 2.8.0 → 2.8.0~1.
• CI: build get_started + test_apps on release-v6.0 in addition to v5.4/v5.5.

Verification

• test_apps builds clean on IDF v6.0.2 (target esp32, mbedTLS 4.1.0) — full link, exit 0.
• mbedTLS 4 runtime behaviour is covered upstream by mbedTLS 4 / PSA Crypto support on 2_x_dev cisco/libsrtp#813's CI (srtp_driver roundtrips against mbedTLS 4.1.0); the mbedTLS 3 path continues to be exercised by this repo's host_test on v5.4/v5.5.

Notes

• host_test stays on IDF v5.x: the IDF v6 linux target currently fails to link any PSA-using app — libtfpsacrypto.a references mbedtls_ms_time / esp_mbedtls_mem_* that live in archives earlier on the link line (static archive ordering, IDF-side; reproduced with IDF's own libs, independent of libsrtp). .build-test-rules.yml documents this next to the disable rule.
• No upstream 2.x release tag carries mbedTLS 4 / PSA Crypto support on 2_x_dev cisco/libsrtp#813 yet (latest is v2.8.0), so this pins the merge commit by SHA; switch to the tag when upstream cuts v2.8.1 / v2.9.
• Sequenced after feat(libsrtp): add component (libsrtp v2.8.0 + ESP-IDF mbedTLS port) #1060 (component introduction, merged).

---

Note

Medium Risk
Touches SRTP crypto integration and moves off a release tag to a dev commit; scope is mostly CI/manifest with upstream adapters handling mbedTLS 3 vs 4.

Overview
Enables the libsrtp ESP-IDF component on ESP-IDF v6 by advancing the upstream submodule pin from v2.8.0 to 2_x_dev d33b8ff (cisco/libsrtp#813), which adds mbedTLS 4 / PSA Crypto adapters that pick paths at compile time via MBEDTLS_VERSION_MAJOR.

The manifest idf: ">=5.4,<6" upper bound is removed so v6 is allowed; component version is 2.8.0~1 with SBOM/metadata updated for the new pin. CI builds get_started and test_apps on release-v6.0, and .build-test-rules.yml no longer skips v6 for those apps. host_test remains disabled on IDF v6 with a clarified reason (IDF linux link ordering for PSA apps, not libsrtp).

^{Reviewed by Cursor Bugbot for commit bf40da3. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vikramdattu]

@david-cermak PTAL

[vikramdattu]

@david-cermak @euripedesrocha I have added a separate commit for version bump using the cz script. PTAL

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit bf40da3. Configure here.}

[cursor]

Submodule pin missing from commit

High Severity

This commit drops the IDF <6 cap, records SBOM hash d33b8ff, and re-enables IDF v6 builds, but the components/libsrtp/libsrtp gitlink is not updated in the same commit. Checkouts still resolve the old v2.8.0 tree without mbedTLS 4 adapters, so IDF v6 consumers fail to build while metadata claims support.

Additional Locations (2)

• components/libsrtp/sbom_libsrtp.yml#L4-L7
• components/libsrtp/.build-test-rules.yml#L7-L26

 

^{Reviewed by Cursor Bugbot for commit bf40da3. Configure here.}

[vikramdattu]

False alarm. The main commit which relaxes the IDF version check also contains the sha update and the tests are extended to IDF 6.0 as well in the same commit

[david-cermak]

LGTM!