Josh Hawkins 39567b37eb restrict go2rtc ${VAR} expansion in stream sources ...

go2rtc expands ${NAME:default} over the raw config text before parsing it, and falls back to the inline default when NAME is unset, so a stream source like ${NOPE:exec:<cmd>} passed the exec gate and go2rtc then ran the command. On master the API accepted the plain form, and startup accepted the ${{...}} form because .format collapsed it to ${...} after the check would have caught it. Any stream source containing ${ is now restricted unless GO2RTC_ALLOW_ARBITRARY_EXEC is set, the same as exec sources.

2026-10-19 22:31:22 -05:00

..

ffmpeg

Upgrade ffmpeg to 8 by default (#23393)

2026-06-03 12:28:28 -05:00

go2rtc

restrict go2rtc ${VAR} expansion in stream sources

2026-10-19 22:31:22 -05:00

nginx

don't log an nginx warning for every authenticated request (#24682)

2026-10-16 07:44:39 -05:00