This release includes 3 security fixes for security teams reviewing exposed deployments.
Topics
+1 more
Affected surfaces
Summary
AI summaryAutomatic orphan recovery and corrupted‑file cleanup are added with a new max movie length config.
Full changelog
Full Changelog: https://github.com/spupuz/VibeNVR/compare/v1.10.3...v1.11.0
VibeNVR v1.11.0 — Recording Management & Orphan Recovery
This release introduces comprehensive recording management with automatic orphan recovery, corrupted‑file cleanup, and improved recording configuration.
🎬 Recording Management & Orphan Recovery
✨ New Features
Automatic Orphan Recovery
- Startup Recovery: Automatically scans for recordings on disk that are missing from the database and imports them 30 seconds after backend startup.
- Manual Recovery: A new “Recover Orphaned Recordings” button is available under
Settings → Maintenance for on‑demand recovery. - Thumbnail Generation: Missing thumbnails are automatically generated during recovery.
Corrupted Video Cleanup
- Automatic Detection: Identifies incomplete or corrupted video files (e.g., missing moov atom, zero duration).
- Auto‑Cleanup: Removes corrupted files from both disk and database.
- Deleted Camera Cleanup: Files belonging to removed cameras are automatically purged.
Maximum Movie Length Configuration
- Slider UI: New slider for configuring
max_movie_length(range: 1–5 minutes). - Smart Defaults: New cameras default to 120 seconds (2 minutes).
- Auto‑Correction: Invalid values (0 or >300) are automatically corrected.
🐛 Bug Fixes
- Thumbnail Deletion: Thumbnails now delete correctly when removing events from the timeline.
- Clone Settings: Cloning settings no longer overwrites the camera’s active/disabled status.
- Missing Thumbnails: Recovered recordings now properly generate thumbnails.
🔒 Security
- Admin‑only endpoint for orphan recovery with 5‑minute rate limiting.
- Strict path validation prevents directory traversal in all file operations.
- Audit logging added for administrative actions.
- All changes reviewed to ensure no new vulnerabilities were introduced.
📋 Technical Changes
- Added
sync_recordings.pyfor comprehensive orphan management. - Updated
sync-orphansAPI endpoint with rate limiting. - Fixed indentation bug in
events.pythumbnail deletion. - Added
is_video_valid()for corruption detection.
🚀 Upgrade Notes
After upgrading, the system will automatically:
- Import any orphaned recordings found on disk
- Generate missing thumbnails
- Clean up corrupted or incomplete video files
- Remove files belonging to deleted cameras
No manual intervention required.
Security Fixes
- Strict path validation prevents directory traversal in all file operations
- Admin‑only orphan recovery endpoint now limited to 5 requests per minute
- Audit logging added for administrative actions
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About spupuz/VibeNVR
All releases →Related context
Related tools
Earlier breaking changes
- v1.28.3 Must update docker-compose.yml with TZ variable for all services
Beta — feedback welcome: [email protected]