Skip to content

spupuz/VibeNVR

v1.30.8 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo Media Servers
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

ffmpeg lightweight local-storage nvr opensource privacy
+1 more
video-surveillance

Affected surfaces

rbac

Summary

AI summary

Updates 🛠️ Key Improvements, 🚀 Release v1.30.8, and 🙌 Contributors across a mixed release.

Full changelog

🚀 Release v1.30.8

📝 Summary

This release focuses on delivering a significantly improved, faster, and more secure user experience. We've introduced major accessibility (a11y) enhancements across the UI, fortified our Role-Based Access Control (RBAC), and drastically optimized our database query patterns to eliminate N+1 bottlenecks.

🛠️ Key Improvements

  • Performance (Bolt): Completely eliminated N+1 query issues in camera fetching and permission checks. Camera lists now load instantly regardless of the scale of the deployment.
  • 🎨 Accessibility (Palette): Comprehensive ARIA label implementations across Live View, PTZ controls, and custom form inputs. VibeNVR is now more accessible to screen readers and keyboard users.
  • 🛡️ Security (Sentinel): Standardized RBAC Dependency Injection within the Logs Router, ensuring strict boundary enforcements and un-bypassable viewer restrictions.
  • 🐛 Bug Fixes: Addressed the WS connection handler to properly accept AI metadata packets (p_type=2).

🙌 Contributors

  • @spupuz: Huge thanks to Alessandro for driving this massive batch of UI, Security, and Performance PRs!

Security Fixes

  • RBAC Dependency Injection in Logs Router ensures un-bypassable viewer restrictions

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track spupuz/VibeNVR

Get notified when new releases ship.

Sign up free

About spupuz/VibeNVR

All releases →

Related context

Earlier breaking changes

  • v1.29.7 Removed the legacy `stream_url` schema from stream routing.
  • v1.28.3 Must update docker-compose.yml with TZ variable for all services

Beta — feedback welcome: [email protected]