* update docusaurus to 3.10.2
* bump @types/node to 25.9.6 and ES2022
target ES2022, which already includes ES2020 and ES2021.String, so the lib list was also trimmed
* bump vite to 8.3.0 and vitest to 4.1.11
Swap `@vitejs/plugin-react-swc` for `@vitejs/plugin-react` and add `esbuild` as a devDependency, since `vite-plugin-monaco-editor` requires it and Vite 8 no longer ships it. `keepNames` moves to `build.rolldownOptions.output` because Vite 8 ignores the `esbuild` block. Rolldown's minifier now writes the preload helper's base path as a template literal instead of a double-quoted string, so the nginx `sub_filter` for `return"/BASE_PATH/"` stopped matching and lazy-loaded chunks and their CSS were requested from a literal `/BASE_PATH/` under Home Assistant ingress. The rule now matches the backtick form.
* bump apexcharts to 7.3.0 and react-apexcharts to 2.1.1
Under Vite 8, a default import from a CommonJS package resolves to its whole `module.exports` when `package.json` has `"type": "module"`, so react-apexcharts 1.4.1 handed React an object and every chart crashed. 2.x ships an ESM build. apexcharts 7 no longer sets `window.ApexCharts`, so the chart components now import it for `ApexCharts.exec`, and `ApexAxisChartSeries` is derived in `types/graph.ts` because it's no longer a global type.
* remove unused immer dep
* remove unused cython pin from tensorrt requirements
The pin was added alongside tensorrt 8.5.3 and cuda-python 11.8, which needed Cython to build, and both have since been dropped from this file. Nothing imports Cython at runtime, and `pip3 wheel` runs with build isolation, so any source build gets its own build dependencies. The pin only installed an unused Cython wheel into the TensorRT image.
* require node 20.19 for docs
* Run the frigate service as the frigate user
* Run go2rtc as its own restricted user
* Run nginx as the frigate user with writable state in /tmp/nginx
* Disable bandwidth stats gracefully when not running as root
* Hand TensorRT model cache ownership to the runtime user
* Document non-root operation and per-hardware device access
* Create /media/frigate after the ownership sweep
* Assert non-root services, JWT migration, and escape hatch in CI
* only write the sweep sentinel when a media volume is mounted
* tolerate homekit config chown failures in the go2rtc run script
* chown the s6 log pipe so non-root nginx can reopen /dev/stdout
* set HOME to /config for non-root services
* run smoke nginx -t and the write probe as the runtime user
* re-own the nginx shm cache on service restart
* discard stdout for the unprivileged smoke nginx -t
* unwrap hard-wrapped prose in the installation docs
* report progress during the ownership sweep
* document EXTRA_GROUPS as the only device access path for dropped services
* expand the non-root device access docs with diagnosis steps and udev rules
* document network storage ownership and the remaining detector hardware
* skip lost+found during the ownership sweep
* hand /tmp/cache to the runtime user before services start
* make bundled models readable by the runtime user
* reload nginx by signaling the master instead of parsing its config as root
* harden root writes into unprivileged-owned paths
Restrict the sweep sentinel to a mount at or below /media/frigate so a
parent /media mount cannot bless a later-shadowed volume. Rebuild
/tmp/nginx root-owned each start so root's cp and tempio writes cannot
follow a symlink an unprivileged nginx planted in the previous run.
* collapse the duplicated sentinel comment
* add a service-runs-as-root helper for granular root services
* validate FRIGATE_ROOT_SERVICES and fail fast on unknown names
* let services listed in FRIGATE_ROOT_SERVICES skip the privilege drop
* record the root-services mode in the sentinel and sweep small trees each boot
* cache the runtime ids in the ownership helper
* chown recordings, previews, and exports to the runtime user at create
* chown the database files after init
* recommend FRIGATE_ROOT_SERVICES in the bandwidth stats warning
* assert granular root services in CI
* document FRIGATE_ROOT_SERVICES
* own every directory level created for a recording segment
* clear the cached runtime ids when ownership tests finish
* skip missing media paths in the per-boot ownership sweep
* clarify granular root services docs
* clean up
* install acl for device access grants
* grant runtime users access to mapped device nodes at boot
* assert device access grants in CI
* document automatic device access grants
* stop telling users device access needs host side setup
* clarify the non-root docs
* link the migration script to the repo
* group the manual device setup under one section
* harden against symlink attacks
/config is owned by the unprivileged runtime user after the ownership sweep, so root operations on files there could be redirected by a planted symlink.
- go2rtc HomeKit setup: replace the root yq/jq normalization and chown with an O_NOFOLLOW helper (prepare_homekit.py), so a symlink at go2rtc_homekit.yml can't redirect a root write or chown onto another file
- go2rtc binary override: ignore /config/go2rtc whenever the service runs as root, so a planted binary can't exec as root under FRIGATE_ROOT_SERVICES
- sweep sentinel: read and write it through safe-sentinel, which trusts only a root-owned regular file and never follows a symlink, so it can't be forged to skip the migration or symlinked to clobber a root file
- ownership sweep: chown with -execdir so a parent directory swapped for a symlink mid-walk can't redirect the chown out of the volume
- validate inputs: restrict DEVICE_ACL_PATHS to /dev, require nonzero numeric EXTRA_GROUPS, and reject PUID/PGID that collide with the go2rtc ids
- docs: correct the TLS key ownership note to match what actually happens
* tweak docs
* stop the ownership sweep chasing entries other mechanisms own
* keep custom binaries out of root services only under granular root
* Pull context size from openai models
* Adjust wording based on type of model
* Instruct to not use parenthesis
* Simplify genai config
* Don't use GPU for training
* Use OpenVINO directly to detect if devices are available
* Cleanup
* Update OpenVINO
* Cleanup
* Don't try to use OpenVINO when CPU is set as device
* Catch case where input tensor can't be pre-defined
* Cleanup
* Combine base and arm trt detectors
* Remove unused deps for amd64 build
* Add missing packages and cleanup ldconfig
* Expand packages for tensorflow model training
* Cleanup
* Refactor training to not reserve memory
* Don't support tensorrt detector for amd64 builds
* Add logs for directing users not to use tensorrt detector
* Rework docs
* Fix dockerfile index
* Don't undo jetson fix
* frigate+ pane i18n fix
* catch more exceptions
* explore search result tooltip i18n fix
* i18n fix
* remove comments about deprecated strftime_fmt
* Catch producers exists but is None
* Formatting
* fix live camera view i18n
* Add default role config for proxy users
This allows users to specify a default role for users when using a proxy for auth. This can be useful for users who can't/don't want to define a header mapping for the remote-role header.
* update reference config and auth docs
* clarify face rec camera level config
* clarify auth docs
* Fix onnx not working with openvino
* Update openvino to fix failed npu plugin check
---------
Co-authored-by: Nicolas Mowen <nickmowen213@gmail.com>
* Fix#16845
Maybe after PR #16712 , ffmpeg build with JP6 seem broken with error `/usr/lib/ffmpeg/jetson/bin/ffmpeg: error while loading shared libraries: libavdevice.so.60: cannot open shared object file: No such file or directory`
This PR fixes the issue
* Adding new LD entry for ffmpeg new location
* Update Dockerfile.arm64
* Move LD config to Dockerfile arm64 instead of detector
* Remove unneccessary trt wheels build
* Cleanup
* Try without local cuda
* Keep specific cuda libs only
* Cleanup
* Add newer libcufft
* remove target
* Include more
* Improve ffmpeg versions handling
* Remove fallback from LIBAVFORMAT_VERSION_MAJOR, it should always be set
* Mention ffprobe in custom ffmpeg docs
* Fix ffmpeg extraction
* Fix go2rtc example formatting
* Add fallback back to LIBAVFORMAT_VERSION_MAJOR
* Fix linter
* Format makefiles
* Handle all errors in rocm makefile
* Remove CURRENT_UID and GID from makefile as they are unused
* Removed unused vite.svg asset
* Sort frigate-dictionary
* Add support for yolonas in onnx
* Add correct deps
* Set ld library path
* Refactor cudnn to only be used in amd64
* Add onnx to docs and add explainer at the top
* Undo change
* Update comment
* Remove uneccesary
* Remove line change
