opensensor/lightNVR v0.47.3

Release v0.47.3

on GitHub

🤖 AI-Generated Changelog

Added

• Introduced lightnvr-rs: a CI-generated Rust build transpiled from the C sources, with Docker and .deb release support
• Displayed FFmpeg runtime version on the system Versions tab
• Updated go2rtc fork with upstream 1.9.15 changes

Changed

• Switched to page-based pagination for active recording validation in performance tests
• Cancelled superseded CI workflow runs automatically per pull request or ref
• Cancelled a PR branch's runs as soon as it is merged
• Updated npm maintenance dependencies before release
• Aligned legacy web versions during release preparation
• Refreshed documentation screenshots from a live 0.47.2 instance
• Rewrote the README around current LightNVR capabilities

Fixed

• Enforced elapsed-time deadline for batch deletion polling to prevent indefinite waits
• Preserved recording selection when batch deletion is cancelled
• Rejected signed and malformed recording IDs before single deletion
• Required two hex digits when decoding URL escapes
• Bounded header counts and replaced JSON headers without exhausting capacity
• Rejected NUL-truncated URL identities and preserved atomic JSON responses
• Decoded bounded URL values and preserved response bodies on allocation failure
• Validated supported batch deletion filter fields before dispatch
• Validated recording reads and deletion bounds before dispatch; accounted for rejected IDs
• Exposed accurate accessible batch deletion progress states
• Settled batch deletion cancellation and isolated sequential polling lifecycles
• Preserved exact recording IDs through batch deletion authorization and workers
• Rolled back failed tag edits and serialized optimistic writes
• Preserved active recording identity across timeline poll phases
• Preserved exact timeline IDs across JSON, UI, exports, and API discovery
• Rejected oversized timeline ID lists before lookup and preserved query-limit behavior
• Batched timeline detection summaries with correct ownership and authorization
• Preserved fractional timeline bounds while rejecting malformed dates
• Serialized motion request dispatch and pulse rollback with generation changes
• Reclaimed stale pulse tokens using a complete inventory snapshot
• Rejected untracked motion actions before dispatching side effects
• Fixed camera-scoped coverage detection lookup and tested bucket boundaries
• Shared pulse scheduling failure cleanup and tested attribute errors
• Wired toast exit animation and localized its dismiss control
• Initialized shared toast container synchronously
• Validated component containers before resolving discriminator mappings
• Rejected unsupported path-item references before contract generation
• Fixed private JSON cache policy for large recording-test diffs
• Corrected detector process matching and covered system-info parsing
• Fixed incident history validation and fullscreen dialog visibility
• Validated recording duration across segments in performance tests
• Used transitive SOD linkage for executables and unit tests

Security

• Validated recording reads and bounds before dispatching deletions to prevent unauthorized access
• Rejected NUL-truncated URL identities to prevent path confusion attacks
• Bounded URL value decoding to prevent buffer overflows
• Required strict two-hex-digit URL escape sequences to prevent injection via malformed encoding
• Bounded request header counts to prevent resource exhaustion

🔗 Full Changelog: 0.47.2...v0.47.3