Full Changelog: https://github.com/spupuz/VibeNVR/compare/v1.28.2...v1.28.3

🚀 Release v1.28.3

[!IMPORTANT]
ACTION REQUIRED: This release introduces significant infrastructure improvements. To ensure proper logging and session stability, you MUST update your docker-compose.yml ( docker-compose-prod.yml ) and .env files. Specifically, ensure the TZ variable is set for all services and review your COOKIE_SECURE settings (now defaulting to auto).

📝 Summary

This release focuses on Dynamic Session Security and Log Standardization. We have resolved the common "No session cookie" issue for local network users by implementing a protocol-aware cookie management system. Additionally, we have unified the logging architecture across all containers to improve auditability and troubleshooting.

🛠️ Key Improvements

• 🛡️ Security: Dynamic Cookie Logic. VibeNVR now implements COOKIE_SECURE=auto. The system automatically detects if the request is over HTTP (Local IP) or HTTPS (Remote Proxy). The Secure flag is dynamically toggled, ensuring a "zero-config" experience for local users while maintaining high-grade protection on public networks.
• 📊 Auditability: Standardized Logging. All system logs (Backend, Engine, Frontend) now use a unified timestamp format (YYYY-MM-DD HH:MM:SS). We have also introduced Automatic Log Redaction; sensitive data such as RTSP credentials and Bearer tokens are now automatically masked in stdout.
• 🌍 Infrastructure: Timezone Synchronization. The entire Docker stack now respects the TZ environment variable, ensuring that all log events and recording timestamps correlate perfectly with your local time.

⚠️ Infrastructure Updates (Detailed)

1. Timezone Support: Add the TZ=${TZ:-Europe/Rome} variable to all services in your compose file. This ensures your logs match your actual time, making event correlation much easier.
2. Dynamic Cookies: The system now defaults to COOKIE_SECURE=auto. You can remove any manual COOKIE_SECURE=false overrides from your .env file unless you have a non-standard reverse proxy configuration.
3. Log Auditability: The backend now uses a root TokenRedactingFilter. If you share your logs for support, you can be confident that passwords and tokens are redacted at the source.

Audit & Verification Status

• ✅ Security Audit: All SAST and RBAC checks passed.
• ✅ Functional Tests: 60/60 tests passed, including session persistence on local/remote protocols.
• ✅ Documentation: Synchronized across README, SECURITY.md, CONTEXT.md, AGENTS.md, and the official Wiki.

VibeNVR — Modern, Secure, and Zero-Config.