Update module github.com/pion/rtp to v2

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/pion/rtp	v1.10.5 → v2.0.0

---

Release Notes

pion/rtp (github.com/pion/rtp)

v2.0.0

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "on sunday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

• 🔍 Trigger a full review

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[devin-ai-integration]

Devin Review found 1 potential issue.

View 1 additional finding in Devin Review.

[devin-ai-integration]

🟡 Dependency upgrade left the project depending on two copies of the same library

A second copy of the RTP library is listed as a required direct dependency (github.com/pion/rtp/v2 v2.0.0 at go.mod:21) while every source file still uses the old copy, so the upgrade is incomplete and the extra entry is unused.
Impact: The project now declares an unused dependency alongside the old one; dependency-tidiness checks fail and the intended upgrade did not actually happen.

Unused v2 module requirement and incomplete go.sum entry

All Go sources still import github.com/pion/rtp (v1): localtrack.go:29, pkg/synchronizer/track.go:25, pkg/interceptor/pacerinteceptor.go:7, pkg/interceptor/limitsizeinteceptor.go:7, pkg/samplebuilder/samplebuilder.go:26, e2ee/trackdecryptor.go:22, plus tests and examples. Nothing imports github.com/pion/rtp/v2, so go mod tidy would drop the new require line (and any tidy-check in CI would flag the diff).

Additionally go.sum only contains the /go.mod hash for the new module (go.sum:236) and no h1: module-zip hash, so as soon as any code does import v2 the build fails with a missing go.sum entry. Note that pion also depends on v1 transitively via pion/webrtc/v4 and pion/interceptor, so a real migration requires updating those too.

---

Was this helpful? React with 👍 or 👎 to provide feedback.