spupuz/VibeNVR

v1.30.5 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 1mo Media Servers

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 2 known CVEs

Topics

ffmpeg lightweight local-storage nvr opensource privacy

+1 more

video-surveillance

Affected surfaces

rce_ssrf breaking_upgrade

Summary

AI summary

Updates 🛠️ Key Improvements, 🙌 Contributors, and 🚀 Release v1.30.5 across a mixed release.

Full changelog

🚀 Release v1.30.5

📝 Summary

VibeNVR v1.30.5 is a significant maintenance and code-health update that integrates dozens of critical security patches, architectural refinements, and UI accessibility improvements. We have fully stabilized the engine, mitigated critical path traversal and SQL injection vulnerabilities, and seamlessly integrated go2rtc routing capabilities.

🛠️ Key Improvements

🛡️ Security: Mitigated severe SQL Injection vectors in database migration scripts and neutralized Path Traversal vulnerabilities in avatar upload/deletion pipelines.
🚀 Engine & Core: Resolved a global AI detection deadlock by implementing a robust passive watchdog in AIDetector. Integrated go2rtc proxy lifecycle management.
🎨 Aesthetics & UI: Significantly enhanced accessibility (A11y) across the application with proper ARIA labels. Added an auto-fill "Use these streams" button for ONVIF profiles to improve the camera setup experience.
⚡ Performance: Optimized React Timeline components and Camera Cards with memoization (React.memo) to eliminate unnecessary re-renders. Cleaned up multiple legacy dependencies and unused imports (tarfile, sys).

🙌 Contributors

@spupuz: Core architectural refactoring, RBAC enhancements, and AI watchdog implementation.
@yura.bilous (Юрій Білоус): ONVIF stream auto-fill implementation and Timeline React state fixes.
@google-labs-jules: Automated code health, SAST security audits, and ARIA label accessibility updates.