WAIT — Slowing — last commit 5mo ago

• Last commit 5mo ago
• 14 active contributors
• Distributed ownership (top contributor 27% of recent commits)
• Apache-2.0 licensed
• ⚠ Slowing — last commit 5mo ago
• ⚠ No CI workflows detected
• ⚠ No test directory detected
• ⚠ Scorecard: default branch unprotected (0/10)

_{Computed from maintenance signals — commit recency, contributor breadth, bus factor, license, CI, tests, cross-checked against OpenSSF Scorecard}

ExoPlayer is a deprecated Android media player library that provides flexible, extensible playback of audio and video across a wide range of formats, protocols, and streaming technologies. It abstracts Android's lower-level MediaPlayer API and adds support for HLS, DASH, SmoothStreaming, HTTP Progressive downloads, and custom protocols through pluggable renderers (audio, video, text, metadata). The core innovation is its architecture: decode and render are decoupled, allowing apps to replace components (custom decoders, output surfaces) without touching the player engine. Multi-module Gradle structure: root build.gradle defines shared config (via common_library_config.gradle, core_settings.gradle, constants.gradle). Core modules live under library/ (not shown in file list but typical), demo apps under demos/ (e.g., demos/cast/ contains a Cast receiver demo with Android manifest, resources, and sample Java activities). Build output is configurable via externalBuildDir property.

Android app developers (especially those building streaming media apps, video platforms, or music services) who need fine-grained control over playback behavior, adaptive bitrate streaming, DRM protection, or custom rendering. Originally Google's first-party library; now users are expected to migrate to androidx/media (Media3).

This repository is officially deprecated as of 2024-04-03. The last release was exoplayer:2.19.1; no further releases are planned. No new commits are being pushed to the dev-v2 branch. While the codebase is stable and production-proven (years of use in real apps), it is no longer maintained—all new development moved to https://github.com/androidx/media.

High risk for new projects. This repo receives zero maintenance; the team explicitly directs all users to migrate to Media3. The dependency chain is frozen at Gradle 7.2.2, Kotlin 1.8.20, and Android Gradle Plugin 7.2.2—these will accumulate security and compatibility issues. Any bug discovered will not be fixed here. Existing apps using ExoPlayer 2.x should plan migration immediately.

Nothing. As of 2024-04-03, all development halted on this repository. The dev-v2 branch stopped receiving commits. The team is focused on androidx/media (Media3). Any remaining issues in this repo will not be addressed.

git clone https://github.com/google/ExoPlayer.git
cd ExoPlayer
# Review README.md and RELEASENOTES.md
# Then migrate to androidx/media — see https://developer.android.com/guide/topics/media/media3/getting-started/migration-guide
# If you must build locally:
./gradlew build  # Requires JDK 11+, Android SDK

Note: Do not start a new project with this. Use androidx/media instead.

Daily commands: This is a library, not a runnable app. To build and run the demo:

cd demos/cast
../gradlew assembleDebug  # Builds APK for Cast demo app
../gradlew installDebug   # Installs to connected device

Or open in Android Studio, select the castdemo module, and hit Run.

• README.md — Declares the repository is deprecated and directs all users to migrate to AndroidX Media3 at https://github.com/androidx/media
• build.gradle — Root build configuration that establishes Gradle plugin versions and dependency resolution strategy for the entire Android media player project
• RELEASENOTES.md — Documents release history and version changes; essential for understanding API evolution and breaking changes between versions
• demos/main/src/main/java/com/google/android/exoplayer2/demo/PlayerActivity.java — Primary demo entry point showing the core ExoPlayer integration pattern and usage conventions
• CONTRIBUTING.md — Specifies contribution guidelines and code standards that all pull requests must follow
• SECURITY.md — Outlines security reporting procedures and vulnerability disclosure policy
• constants.gradle — Centralizes version constants and dependency versions used across all modules

• ExoPlayer Core (Java, Android Handler threads, Listener pattern) — Main media player orchestrator; manages playback state, timeline, renderers, and event dispatch
  • Failure mode: Playback stops; no audio or video output; state inconsistency if renderer crashes
• MediaSource (HLS/DASH) —

Add a New Demo Application

1. Create a new demo module directory under demos/ following the pattern: demos/{demo_name}/ (demos/)
2. Create build.gradle for the new demo with AndroidPlugin configuration referencing common_library_config.gradle (demos/main/build.gradle)
3. Add main Activity class under src/main/java/com/google/android/exoplayer2/{demo_name}/ (demos/main/src/main/java/com/google/android/exoplayer2/demo/PlayerActivity.java)
4. Create AndroidManifest.xml declaring activities and required permissions in src/main/ (demos/main/src/main/AndroidManifest.xml)
5. Add layout XML files under src/main/res/layout/ for UI components (demos/main/src/main/res/layout/main_activity.xml)
6. Reference new demo in root build.gradle or settings.gradle module includes (build.gradle)

Update Project Dependencies & Versions

1. Define new dependency versions in constants.gradle under the appropriate section (androidX, exoplayer, etc.) (constants.gradle)
2. Update build.gradle dependencies block to use the new version constant (build.gradle)
3. Verify Gradle plugin versions in buildscript/dependencies are compatible (build.gradle)
4. Run ./gradlew dependencies to validate dependency resolution and detect conflicts (build.gradle)

Create a New Release

1. Document release notes and version bump in RELEASENOTES.md with breaking changes and features (RELEASENOTES.md)
2. Update version constant in constants.gradle or relevant build.gradle files (constants.gradle)
3. Create release branch and tag following semantic versioning: release-v2.X.Y (README.md)
4. Trigger release CI/CD pipeline via GitHub Actions (if configured in .github/workflows/) (.github/pull_request_template.md)

• Android ExoPlayer 2.x — Provides extensible media player foundation with support for HLS, DASH, SmoothStreaming, and custom protocols; replaces deprecated MediaPlayer
• Gradle Build System — Industry standard for Android project configuration, dependency management, and multi-module builds
• Android Jetpack/AndroidX — Modern Android library ecosystem; project uses androidx.* packages for long-term support and backward compatibility
• OpenGL for Video Processing — Enables GPU-accelerated video rendering and real-time frame manipulation (e.g., bitmap overlays in demos/gl)
• Google Cast Framework — Integrates Chromecast support for casting playback to external devices (demos/cast demonstrates this)

• Repository deprecated in favor of AndroidX Media3

  • Why: Consolidate media playback into AndroidX ecosystem for unified maintenance and modern Kotlin-first APIs
  • Consequence: This repo (v2.19.1) receives no new features; users must migrate code and dependencies to androidx.media3 packages

• Multiple demo applications in single repo

  • Why: Showcase different ExoPlayer use cases (basic playback, Chromecast, GL processing) in reference implementations
  • Consequence: Increased repo size and complexity; each demo is independently buildable but shares core ExoPlayer dependency

• Heavy use of abstract base classes and factories (e.g., MediaSource, Renderer)

  • Why: Extensibility: developers can implement custom media sources, renderers, or decoders
  • Consequence: Steeper learning curve; onboarding requires understanding factory patterns and interface hierarchies

• This repository is deprecated; no new active development occurs
• Not a replacement for platform MediaPlayer; ExoPlayer is an optional, higher-level abstraction
• Does not handle DRM key distribution or license server integration (DRM handling is delegated to platform/OEM implementations)
• Not a lightweight, minimal media player; designed for feature-rich, production use cases
• Does not provide UI components; PlayerActivity in demos is reference implementation only

1. This is a deprecated project—any issue opened or PR submitted will be ignored. All effort should go to androidx/media. 2. Gradle version locked to 7.2.2—newer Android SDK versions may have compatibility issues; use JDK 11 or earlier. 3. Native C++ code: modules under library/core/src/main/jni/ require Android NDK setup; builds can fail silently if NDK is missing or mismatched. 4. Build artifacts: externalBuildDir property can override the default build directory—check your local build config if builds appear to go to unexpected locations. 5. No CI on this repo—GitHub Actions and build validation are not running; the code quality degrades over time.

• Pluggable Renderers Architecture — ExoPlayer's core design separates decoding from rendering; understanding how to implement a custom Renderer (audio, video, text, metadata) is the key to extending the player for custom outputs or formats.
• Adaptive Bitrate Streaming (ABR) and Bandwidth Estimation — ExoPlayer includes algorithms to switch between quality levels (HLS, DASH) based on estimated network bandwidth; grasping TrackSelector and BandwidthMeter is crucial for streaming apps.
• MediaCodec Surface and TextureView Rendering — ExoPlayer uses Android's MediaCodec API to decode video and outputs to a SurfaceTexture; understanding surface lifecycle and OpenGL integration is essential for custom video effects or overlays.
• Data Source Abstraction and Protocol Handlers — ExoPlayer's DataSource interface allows pluggable protocol handlers (HTTP, HLS manifest fetch, custom schemes); this abstraction enables DRM, caching, and load-balancing logic.
• Extractor Pattern for Format Demuxing — Extractors parse container formats (MP4, Matroska, MPEG-TS, FLV) and emit samples; implementing a custom Extractor lets you support proprietary or unusual formats.
• Digital Rights Management (DRM) Integration via MediaDrm — ExoPlayer wraps Android's MediaDrm API to license and decrypt protected content (Widevine, PlayReady, ClearKey); this is mandatory for commercial video services.
• Ring Buffer and Circular Frame Queueing — ExoPlayer's renderer uses ring buffers to decouple decode and render threads; understanding this pattern prevents memory leaks and synchronization bugs in high-throughput playback.

• androidx/media — The official successor to this deprecated ExoPlayer repo; all active development and maintenance happens here—users must migrate their code to Media3 (androidx.media3).
• google/ExoPlayer — This is the deprecated repo itself; included for clarity that any new work should be in androidx/media instead.
• android/platform_frameworks_av — AOSP media framework that ExoPlayer wraps and extends; understanding the underlying MediaCodec, MediaExtractor, and AudioTrack APIs is essential for deep ExoPlayer development.
• FFmpeg/FFmpeg — Canonical open-source multimedia library; ExoPlayer's native codecs and parsers (especially for less common formats) often reference or reimplement FFmpeg logic.
• shaka-project/shaka-player — Alternative adaptive streaming player for web; useful reference if you need to understand DASH/HLS parsing algorithms that ExoPlayer also implements.

To work on one of these in Claude Code or Cursor, paste: Implement the "<title>" PR idea from CLAUDE.md, working through the checklist as the task list.

Add deprecation migration guide with automated code examples in CONTRIBUTING.md

The repo is officially deprecated with users needing to migrate to androidx/media. While CONTRIBUTING.md exists, it lacks specific guidance on how to contribute to this deprecated repo or notes about the migration path. This PR should add a 'Migration Path' section that clearly documents: (1) why the repo is deprecated, (2) links to the migration script, (3) guidelines for contributors deciding whether to submit PRs here vs androidx/media. This helps reduce contributor confusion and improves the developer experience for those still on ExoPlayer 2.x.

• [ ] Open CONTRIBUTING.md and add a 'Migration & Deprecation' section at the top
• [ ] Reference the official migration guide URL and script from androidx/media
• [ ] Create a decision tree: 'Should I contribute here or to androidx/media?'
• [ ] Link to the migration guide from README.md as well for visibility
• [ ] Test that all links are valid and point to correct androidx/media resources

Add GitHub Action workflow to run security vulnerability checks on deprecated dependencies

The build.gradle shows this project uses older tool versions (Gradle 7.2.2, Kotlin 1.8.20). With the repo deprecated and no longer receiving updates, a contributor should add a GitHub Action that automatically scans for known CVEs in dependencies using tools like OWASP Dependency-Check or Snyk. This protects users still using ExoPlayer 2.x and demonstrates due diligence for a deprecated project. The workflow should be named something like 'dependency-check.yml' in .github/workflows/.

• [ ] Create .github/workflows/dependency-check.yml (new file)
• [ ] Add OWASP Dependency-Check or Snyk action that runs on pull requests and schedule (weekly)
• [ ] Configure the action to fail the build if high-severity CVEs are found in build.gradle dependencies
• [ ] Add a badge to README.md showing dependency check status
• [ ] Document the rationale in a comment: 'Deprecated projects need security scanning for users still in migration'

Document demo app build and run instructions with specific Android API requirements

The demos/ directory contains Cast and GL demo apps (demos/cast/, demos/gl/) but their README.md files are minimal. New contributors or users want to know: minimum API levels, required Play Services versions, how to build each demo, and known issues. This PR should enhance demos/README.md and demos/cast/README.md + demos/gl/README.md with: (1) step-by-step build instructions, (2) minimum Android API level for each demo, (3) required Play Services/Cast Framework versions from build.gradle, (4) troubleshooting section for common build errors.

• [ ] Review demos/cast/build.gradle and demos/gl/build.gradle for minSdkVersion and key dependencies
• [ ] Expand demos/README.md with a table showing each demo's requirements and build commands
• [ ] Create/enhance demos/cast/README.md with Cast-specific setup (CastContext, receiver app ID, etc.)
• [ ] Create/enhance demos/gl/README.md with GL rendering prerequisites
• [ ] Add a 'Troubleshooting' section addressing common Gradle/API level issues for deprecated AGP versions
• [ ] Include a note: 'These demos are deprecated; see androidx/media demos for current examples'

• Migrate the Cast demo to Media3: The demos/cast/ module still references old com.google.android.exoplayer2 packages; updating it to androidx.media3 would be a good learning exercise (even though the repo won't accept the PR, you'd learn the migration process).
• Add JUnit 5 tests for PlayerManager: The demo's demos/cast/src/main/java/.../PlayerManager.java has no visible unit tests; writing tests for lifecycle, state transitions, and error handling would improve code quality and demonstrate testing practices (as a learning exercise for your own fork).
• Document the Renderer architecture: The codebase has audio, video, text, and metadata Renderers, but there is no architecture guide in docs/ explaining how to implement a custom Renderer; creating this doc in your own fork would deepen your understanding of the extensibility model.

This deprecated ExoPlayer repository presents significant security risks due to its official deprecation status and lack of active maintenance. No security patches will be provided for this codebase. Build tools (Gradle, Kotlin) are outdated and may contain unpatched vulnerabilities. The primary recommendation is immediate migration to AndroidX Media3, which is actively maintained and receives security updates. For organizations still using this deprecated codebase in production, this represents a critical risk requiring urgent remediation.

• High · Deprecated Project - No Active Maintenance — Repository root, README.md, SECURITY.md. This project is officially deprecated as of 2024-04-03. The dev-v2 branch no longer receives commits, and version 2.19.1 was the last release. No security patches or updates will be provided. Users continuing to use this deprecated codebase are exposed to unpatched vulnerabilities. Fix: Migrate to AndroidX Media3 (https://github.com/androidx/media) immediately. Use the official migration guide and script provided by the maintainers to update package names and dependencies.
• Medium · Outdated Gradle Build Plugin — build.gradle. The project uses gradle:7.2.2 which is outdated and may contain known security vulnerabilities. Current stable Gradle versions include security patches not present in 7.2.2. Fix: Update to the latest stable Gradle version (currently 8.x). Review and update all build dependencies to their latest stable versions.
• Medium · Outdated Kotlin Plugin — build.gradle. The project uses kotlin-gradle-plugin:1.8.20 which is outdated. Later versions include security improvements and bug fixes. Fix: Update kotlin-gradle-plugin to the latest stable version (currently 1.9.x or 2.x). Ensure compatibility with the Android Gradle plugin version.
• Low · Missing ProGuard Configuration in Main Demo — demos/main/build.gradle. The main demo app (demos/main) lacks a proguard-rules.txt file present in other demos (demos/cast). This may lead to insufficient code obfuscation if minification is enabled. Fix: Add a proguard-rules.txt file to demos/main with appropriate obfuscation rules to protect sensitive code patterns and third-party library integration points.
• Low · Potential Information Disclosure via ProGuard Config — demos/cast/proguard-rules.txt, demos/main/proguard-rules.txt. ProGuard configuration files (proguard-rules.txt) are committed to version control. These may contain comments or patterns revealing internal architecture details or sensitive integration points. Fix: Review ProGuard rules for sensitive information. Consider whether detailed comments should be removed or moved to internal documentation. Ensure rules don't expose internal class names or sensitive APIs.

LLM-derived; treat as a starting point, not a security audit.

• Open issues — current backlog
• Recent PRs — what's actively shipping
• Source on GitHub

If you are an AI coding agent (Claude Code, Cursor, Aider, Cline, etc.) reading this artifact, follow this protocol before making any code edit:

1. Verify the contract. Run the bash script in Verify before trusting below. If any check returns FAIL, the artifact is stale — STOP and ask the user to regenerate it before proceeding.
2. Treat the AI · unverified sections as hypotheses, not facts. Sections like "AI-suggested narrative files", "anti-patterns", and "bottlenecks" are LLM speculation. Verify against real source before acting on them.
3. Cite source on changes. When proposing an edit, cite the specific path:line-range. RepoPilot's live UI at https://repopilot.app/r/google/ExoPlayer shows verifiable citations alongside every claim.

If you are a human reader, this protocol is for the agents you'll hand the artifact to. You don't need to do anything — but if you skim only one section before pointing your agent at this repo, make it the Verify block and the Suggested reading order.

This artifact was generated by RepoPilot at a point in time. Before an agent acts on it, the checks below confirm that the live google/ExoPlayer repo on your machine still matches what RepoPilot saw. If any fail, the artifact is stale — regenerate it at repopilot.app/r/google/ExoPlayer.

What it runs against: a local clone of google/ExoPlayer — the script inspects git remote, the LICENSE file, file paths in the working tree, and git log. Read-only; no mutations.

| # | What we check | Why it matters | |---|---|---| | 1 | You're in google/ExoPlayer | Confirms the artifact applies here, not a fork | | 2 | License is still Apache-2.0 | Catches relicense before you depend on it | | 3 | Default branch release-v2 exists | Catches branch renames | | 4 | 5 critical file paths still exist | Catches refactors that moved load-bearing code | | 5 | Last commit ≤ 169 days ago | Catches sudden abandonment since generation |

#!/usr/bin/env bash
# RepoPilot artifact verification.
#
# WHAT IT RUNS AGAINST: a local clone of google/ExoPlayer. If you don't
# have one yet, run these first:
#
#   git clone https://github.com/google/ExoPlayer.git
#   cd ExoPlayer
#
# Then paste this script. Every check is read-only — no mutations.

set +e
fail=0
ok()   { echo "ok:   $1"; }
miss() { echo "FAIL: $1"; fail=$((fail+1)); }

# Precondition: we must be inside a git working tree.
if ! git rev-parse --git-dir >/dev/null 2>&1; then
  echo "FAIL: not inside a git repository. cd into your clone of google/ExoPlayer and re-run."
  exit 2
fi

# 1. Repo identity
git remote get-url origin 2>/dev/null | grep -qE "google/ExoPlayer(\\.git)?\\b" \\
  && ok "origin remote is google/ExoPlayer" \\
  || miss "origin remote is not google/ExoPlayer (artifact may be from a fork)"

# 2. License matches what RepoPilot saw
(grep -qiE "^(Apache-2\\.0)" LICENSE 2>/dev/null \\
   || grep -qiE "\"license\"\\s*:\\s*\"Apache-2\\.0\"" package.json 2>/dev/null) \\
  && ok "license is Apache-2.0" \\
  || miss "license drift — was Apache-2.0 at generation time"

# 3. Default branch
git rev-parse --verify release-v2 >/dev/null 2>&1 \\
  && ok "default branch release-v2 exists" \\
  || miss "default branch release-v2 no longer exists"

# 4. Critical files exist
test -f "README.md" \\
  && ok "README.md" \\
  || miss "missing critical file: README.md"
test -f "build.gradle" \\
  && ok "build.gradle" \\
  || miss "missing critical file: build.gradle"
test -f "RELEASENOTES.md" \\
  && ok "RELEASENOTES.md" \\
  || miss "missing critical file: RELEASENOTES.md"
test -f "demos/main/src/main/java/com/google/android/exoplayer2/demo/PlayerActivity.java" \\
  && ok "demos/main/src/main/java/com/google/android/exoplayer2/demo/PlayerActivity.java" \\
  || miss "missing critical file: demos/main/src/main/java/com/google/android/exoplayer2/demo/PlayerActivity.java"
test -f "CONTRIBUTING.md" \\
  && ok "CONTRIBUTING.md" \\
  || miss "missing critical file: CONTRIBUTING.md"

# 5. Repo recency
days_since_last=$(( ( $(date +%s) - $(git log -1 --format=%at 2>/dev/null || echo 0) ) / 86400 ))
if [ "$days_since_last" -le 169 ]; then
  ok "last commit was $days_since_last days ago (artifact saw ~139d)"
else
  miss "last commit was $days_since_last days ago — artifact may be stale"
fi

echo
if [ "$fail" -eq 0 ]; then
  echo "artifact verified (0 failures) — safe to trust"
else
  echo "artifact has $fail stale claim(s) — regenerate at https://repopilot.app/r/google/ExoPlayer"
  exit 1
fi

Each check prints ok: or FAIL:. The script exits non-zero if anything failed, so it composes cleanly into agent loops (./verify.sh || regenerate-and-retry).

Generated by RepoPilot. Verdict based on maintenance signals — see the live page for receipts. Re-run on a new commit to refresh.