@camstack/server 1.2.452 → 1.2.454

package/dist/api/oauth2/private-host.js

@@ -4,7 +4,7 @@
  *
  * Used by `/api/oauth2/authorize` to admit a `redirect_uri` whose host the hub
  * cannot know in advance — a self-hosted Home Assistant at
- * `http://192.168.1.40:8123/auth/external/callback`. Pairing "private host" with
+ * `http://192.168.x.x:8123/auth/external/callback`. Pairing "private host" with
  * "exact path" is what keeps that from being a wildcard prefix: a public host
  * never satisfies it, so the worst an attacker can aim a code at is a machine
  * they already need LAN presence to read.

package/dist/api/trpc/client-ip.js

@@ -101,7 +101,7 @@ function extractUserAgent(req) {
     return null;
 }
 /**
- * Strip an IPv4-mapped IPv6 prefix (`::ffff:192.168.1.5` → `192.168.1.5`)
+ * Strip an IPv4-mapped IPv6 prefix (`::ffff:192.168.x.x` → `192.168.x.x`)
  * and any zone id (`fe80::1%en0` → `fe80::1`) so the range checks below
  * see a clean address.
  */
@@ -216,13 +216,13 @@ function isPrivateIpv4(ip) {
     if (a === undefined || b === undefined)
         return false;
     if (a === 10)
-        return true; // 10.0.0.0/8
+        return true; // 10.x.x.x/8
     if (a === 127)
         return true; // 127.0.0.0/8 loopback
     if (a === 172 && b >= 16 && b <= 31)
         return true; // 172.16.0.0/12
     if (a === 192 && b === 168)
-        return true; // 192.168.0.0/16
+        return true; // 192.168.x.x/16
     if (a === 169 && b === 254)
         return true; // 169.254.0.0/16 link-local
     return false;

package/dist/api/trpc/device-config-secret-redaction.js

@@ -347,7 +347,7 @@ function redactConfigEntries(data) {
  *
  * The stream surfaces (`cameraStreams.getRtspEntries`,
  * `streamBroker.getRtspEntry`, `deviceOps.getStreamSources`, …) hand a
- * non-admin caller `rtsp://admin:hunter2@192.168.1.139/…` verbatim: a
+ * non-admin caller `rtsp://admin:hunter2@192.168.x.x/…` verbatim: a
  * read-only token can open every camera by copy-pasting the string. These
  * are NOT config blobs, so {@link redactRecord} never sees them — the leak
  * lives in a plain `url` / `mutedUrl` string field.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.452",
+  "version": "1.2.454",
   "license": "MIT",
   "private": false,
   "files": [
@@ -37,18 +37,18 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.325",
-    "@camstack/addon-agent-ui": "1.2.170",
-    "@camstack/addon-auth": "1.2.124",
-    "@camstack/addon-decoder-nodeav": "1.2.117",
-    "@camstack/addon-notifiers": "1.2.124",
-    "@camstack/addon-pipeline": "1.2.323",
-    "@camstack/addon-pipeline-orchestrator": "1.2.278",
-    "@camstack/addon-post-analysis": "1.2.327",
-    "@camstack/sdk": "1.2.119",
-    "@camstack/system": "1.2.350",
-    "@camstack/types": "1.2.302",
-    "@camstack/ui-library": "1.2.228",
+    "@camstack/addon-admin-ui": "1.2.328",
+    "@camstack/addon-agent-ui": "1.2.172",
+    "@camstack/addon-auth": "1.2.126",
+    "@camstack/addon-decoder-nodeav": "1.2.119",
+    "@camstack/addon-notifiers": "1.2.126",
+    "@camstack/addon-pipeline": "1.2.325",
+    "@camstack/addon-pipeline-orchestrator": "1.2.280",
+    "@camstack/addon-post-analysis": "1.2.331",
+    "@camstack/sdk": "1.2.120",
+    "@camstack/system": "1.2.352",
+    "@camstack/types": "1.2.303",
+    "@camstack/ui-library": "1.2.230",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",