FreeSWITCH vs Switcher Studio

FreeSWITCH shipped 1.11.2 in August 2026, three months after the 1.11.0 branch cut that removed roughly thirty modules and migrated the regex engine to PCRE2. Where 1.11.0 was about deleting surface area, 1.11.2 is about auditing what remains: nearly every bug line is a bounds or length check in a parser — STUN attributes, base64 decode, XML entity decoding, RTMP H.264 NAL units, XML-RPC WebSocket frames, MSRP body lengths. Alongside the fixes it adds an interface allowlist and turns on DTLS client-certificate verification against the SDP fingerprint plus opt-in STUN MESSAGE-INTEGRITY checks on inbound ICE. The build system continues moving off self-hosted infrastructure onto GitHub-published artifacts and upstream packages.

The 1.11.x line reads as a deliberate two-step: cut the maintenance surface, then harden what is left. Having removed thirty modules, the project can now afford to audit the media and signaling paths line by line, and the pattern of fixes — untrusted length fields reaching memory writes — suggests a systematic pass rather than incremental reports. The parallel thread is dependency modernization: mod_v8 moved from a custom v8-6.1 fork to upstream libnode, SpanDSP and libvpx were bumped, and Windows builds now pull pre-compiled FFmpeg and libcodec2 rather than building them. Both threads point the same direction — less bespoke code to own.

Expect the hardening pass to continue into the remaining parsers, with the opt-in STUN MESSAGE-INTEGRITY check becoming default once operators have shipped through a release. The build-system migration off files.freeswitch.org appears partway done, so the next release likely finishes moving the remaining assets to GitHub-hosted artifacts.