spupuz/VibeNVR

v1.29.7 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 5h Media Servers

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

ffmpeg lightweight local-storage nvr opensource privacy

+1 more

video-surveillance

Affected surfaces

auth deps

ReleasePort's take

Light signal

editorial:auto 3h

Masked RTSP passwords in stream connection error notifications to prevent credential leakage; removed the legacy `stream_url` schema from stream routing.

Why it matters: Credential exposure risk eliminated by masking RTSP passwords; migration required before the deprecated `stream_url` schema is fully retired, impacting configuration pipelines.

Summary

AI summary

Updates 🛠️ Key Improvements, 🙌 Contributors, and 🚀 Release v1.29.7 across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Security	High	Masked RTSP passwords in stream connection error notifications to prevent credential leakage. Masked RTSP passwords in stream connection error notifications to prevent credential leakage. Source: llm_adapter@2026-06-05 Confidence: high	—
Breaking	High	Removed the legacy `stream_url` schema from stream routing. Removed the legacy `stream_url` schema from stream routing. Source: llm_adapter@2026-06-05 Confidence: high	—
Feature
Feature	Medium	Automatically restart recordings if the transcoder fallback crashes, adding AI Passthrough fallback safety with dynamic bounding boxes. Automatically restart recordings if the transcoder fallback crashes, adding AI Passthrough fallback safety with dynamic bounding boxes. Source: llm_adapter@2026-06-05 Confidence: high	—
Feature	Low	Display a distinct `DISABLED` status badge for inactive cameras. Display a distinct `DISABLED` status badge for inactive cameras. Source: llm_adapter@2026-06-05 Confidence: high	—
Feature	Low	Cleared the internal health cache on camera stop to prevent stale green badges. Cleared the internal health cache on camera stop to prevent stale green badges. Source: llm_adapter@2026-06-05 Confidence: high	—
Feature	Low	Fully adapted Timeline and Live View dropdowns for dark-mode. Fully adapted Timeline and Live View dropdowns for dark-mode. Source: llm_adapter@2026-06-05 Confidence: high	—
Dependency	Low	Bumped `react-router` to version 7.16.0. Bumped `react-router` to version 7.16.0. Source: llm_adapter@2026-06-05 Confidence: high	—
Bugfix	Medium	Fixed PostgreSQL array parsing for AI motion detection with pinned secure dependencies. Fixed PostgreSQL array parsing for AI motion detection with pinned secure dependencies. Source: llm_adapter@2026-06-05 Confidence: high	—
Bugfix	Medium	Bumped RTSP connection timeouts to 30 seconds for better support of slow networks and VPN setups. Bumped RTSP connection timeouts to 30 seconds for better support of slow networks and VPN setups. Source: llm_adapter@2026-06-05 Confidence: high	—

Full changelog

🚀 Release v1.29.7

📝 Summary

This patch release brings significant stability improvements to the recording engine, enhanced security for stream management, and polished dark-mode aesthetics for the frontend. We've introduced robust fallback mechanisms for AI passthrough and transcoder processes, ensuring continuous recording even under high-load or failure conditions. Additionally, new visual indicators and improved RTSP timeouts make managing cameras on slow networks more intuitive than ever.

🛠️ Key Improvements

🚀 Engine & Recording: Automatically restart recordings if the transcoder fallback crashes, and introduced AI Passthrough fallback safety with dynamic bounding boxes.
🚀 Streaming: Bumped RTSP connection timeouts to 30s to better support slow networks and VPN setups, while optimizing stream routing by removing the legacy stream_url schema.
🛡️ Security: Masked RTSP passwords in stream connection error notifications to prevent credential leakage in logs, and fixed PostgreSQL array parsing for AI motion detection with pinned secure dependencies.
🎨 Aesthetics & UI: Display a distinct DISABLED status badge for inactive cameras, and cleared the internal health cache on camera stop to prevent stale green badges. Fully adapted Timeline and Live View dropdowns for dark-mode.
📚 Documentation: Added comprehensive support and configuration instructions for Coral M.2 (PCIe) accelerators to the Wiki.
📦 Dependencies: Bumped react-router to v7.16.0.

🙌 Contributors

@Lion-killer: Fixed UI dark-mode adaptation for overlay/transparent select dropdowns across the Timeline and Live View (#40).
@app/dependabot: Bumped react-router dependency and resolved package-lock conflicts (#42).

Full Changelog: https://github.com/spupuz/VibeNVR/compare/v1.29.6...v1.29.7

Breaking Changes

Removed legacy `stream_url` schema from stream routing configuration

Security Fixes

Masked RTSP passwords in stream connection error notifications to prevent credential leakage in logs

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track spupuz/VibeNVR

Get notified when new releases ship.

About spupuz/VibeNVR

All releases →

Related context

Related tools

Earlier breaking changes

v1.28.3 Must update docker-compose.yml with TZ variable for all services