* reject push endpoints that crash the vapid audience parse
The validator accepted hostnames like "." so https://./x passed, and check_registrations then raised ValueError slicing the endpoint, killing the dispatcher's IPC thread. The validator now rejects empty hostname labels and lives in webpush.py, the audience comes from urlparse, and _build_web_pushers skips stored rows whose endpoint fails validation.
* keep the ipc thread alive when a handler raises
An exception from any dispatcher handler escaped InterProcessCommunicator.read, which only caught ZMQError. The REP thread died owing a reply, so every InterProcessRequestor blocked forever. read now logs the error and replies with an empty response, and Dispatcher.publish and publish_local catch per communicator so one failing communicator can't take down the rest.
* stop push sends from reaching internal addresses
pywebpush posts through requests with redirects enabled, so an endpoint could answer 307 to http://127.0.0.1:5000/api/restart and the sender would follow it into the internal admin port on every alert. Pushers now use a session that never follows redirects, and each send first resolves the endpoint host and skips it unless every address is global.
* keep the previous region grid when the refresh request fails
The IPC reader now replies [] when a handler raises, and process_frames assigned that reply to region_grid unconditionally. The next region lookup then indexed into an empty list and killed the camera's detect process. An empty reply now keeps the current grid until the next daily refresh.
* drop the send-time public address check
Refusing non-global resolved addresses broke Tailscale (100.64.0.0/10), split-horizon DNS and HTTPS_PROXY-only setups, and added little once redirects are no longer followed and TLS verification stays on.
* only skip stored push rows that break the vapid audience
Running the full registration validator over stored rows dropped self-hosted endpoints registered before 0.18 with a non-443 port or a bare / path. _build_web_pushers now skips only non-dict rows, rows with no endpoint, unparsable endpoints and hosts with empty labels, and the warning names the host so the row can be found. Registration still uses the full validator.
* bound recording snapshot lookups by segment length
Ordering the recording snapshot and Frigate+ lookups by stream_type ahead of start_time broke index order, so SQLite fetched and sorted every older recording for the camera on each request (about 100 ms on a 30 day camera, run on the event loop). A start_time lower bound of the frame time minus MAX_SEGMENT_DURATION keeps the lookup to a few rows.
* bound recording overlap queries by segment length
Clip, export, review and recording deletion, debug replay, motion search, and audio transcription found overlapping recordings with an OR clause that gave SQLite no start_time range, so every call read the camera's whole recording history (30 to 300 ms on a 30 day database). The classification and review description point lookups did the same whenever the timestamp had no recording. A shared recording_overlap helper now adds a start_time lower bound of MAX_SEGMENT_DURATION before the range, which drops no rows because segments are always shorter than that.
* probe webrtc before reporting it as not configured
The WebRTC gate read only the Frigate config, so an install with no go2rtc candidates showed WebRTC as not configured, even though go2rtc fills in default candidates at startup (including the internal one under the HA app) and WebRTC often worked. Unset candidates now run the connectivity probe first, and only a failed probe reports not configured. The not-configured reason shows as a neutral note that names the setting and says WebRTC is optional, rather than as a red error.
* validate trusted_proxies at config load
Malformed trusted_proxies entries were only parsed per request in get_remote_addr, so a typo logged a warning on every proxied request and the entry was skipped, collapsing all clients behind that proxy into one rate-limit bucket. The config now rejects unparseable entries at startup and get_remote_addr no longer needs the fallback. Host bits are accepted (192.168.1.1/24 reads as 192.168.1.0/24) so a common typo doesn't take down safe mode, which copies the auth section verbatim.
* remove path data from thumbnail payloads
The thumbnail data carried a full copy of the object's path, which went out as snapshot.path_data in every events message alongside the top level path_data. Nothing reads the snapshot copy, and the path has no length limit, so it only made events payloads larger.
* hide incompatible frigate+ models behind a toggle
* keep the probe failure detail in the not-configured console message
* use a unique id for each show incompatible models toggle
* pad the bottom of the desktop timeline so zoom buttons don't cover segments
* create the admin row when auth is disabled so notification registrations persist
Installs that never enabled auth had no admin row, so registering for notifications returned 200 but saved nothing. Frigate now creates an admin row with an empty password hash when auth is disabled, and treats that empty hash as first-time setup when auth is enabled later so a password is still generated and printed. Registration returns 404 when no user row was updated, and the success toast only shows after the request succeeds. The Users settings page hides Add User and Reset Password when auth is disabled and notes that accounts only apply once built-in auth is enabled.
* Make review user read status consistent with other APIs
* Validate URLs for web push endpoint
* Validate the role for a custom viewer, rate limit password changing
* Cleanup
* Update classification API docs
* Add information to events api
* Fix tag
* Add exports
* Add generic response to model for classification apis
* Add preview API information
* Cleanup
* Cleanup
* Remove torch install
* notification fixes
the pubkey was not being returned if notifications was not enabled at the global level
* Put back
* single condition check for fetching and disabling button
---------
Co-authored-by: Josh Hawkins <32435876+hawkeye217@users.noreply.github.com>
* Fix the `Any` typing hint treewide
There has been confusion between the Any type[1] and the any function[2]
in typing hints.
[1] https://docs.python.org/3/library/typing.html#typing.Any
[2] https://docs.python.org/3/library/functions.html#any
* Fix typing for various frame_shape members
Frame shapes are most likely defined by height and width, so a single int
cannot express that.
* Wrap gpu stats functions in Optional[]
These can return `None`, so they need to be `Type | None`, which is what
`Optional` expresses very nicely.
* Fix return type in get_latest_segment_datetime
Returns a datetime object, not an integer.
* Make the return type of FrameManager.write optional
This is necessary since the SharedMemoryFrameManager.write function can
return None.
* Fix total_seconds() return type in get_tz_modifiers
The function returns a float, not an int.
https://docs.python.org/3/library/datetime.html#datetime.timedelta.total_seconds
* Account for floating point results in to_relative_box
Because the function uses division the return types may either be int or
float.
* Resolve ruff deprecation warning
The config has been split into formatter and linter, and the global
options are deprecated.
* POC: Added FastAPI with one endpoint (get /logs/service)
* POC: Revert error_log
* POC: Converted preview related endpoints to FastAPI
* POC: Converted two more endpoints to FastAPI
* POC: lint
* Convert all media endpoints to FastAPI. Added /media prefix (/media/camera && media/events && /media/preview)
* Convert all notifications API endpoints to FastAPI
* Convert first review API endpoints to FastAPI
* Convert remaining review API endpoints to FastAPI
* Convert export endpoints to FastAPI
* Fix path parameters
* Convert events endpoints to FastAPI
* Use body for multiple events endpoints
* Use body for multiple events endpoints (create and end event)
* Convert app endpoints to FastAPI
* Convert app endpoints to FastAPI
* Convert auth endpoints to FastAPI
* Removed flask app in favour of FastAPI app. Implemented FastAPI middleware to check CSRF, connect and disconnect from DB. Added middleware x-forwared-for headers
* Added starlette plugin to expose custom headers
* Use slowapi as the limiter
* Use query parameters for the frame latest endpoint
* Use query parameters for the media snapshot.jpg endpoint
* Use query parameters for the media MJPEG feed endpoint
* Revert initial nginx.conf change
* Added missing even_id for /events/search endpoint
* Removed left over comment
* Use FastAPI TestClient
* severity query parameter should be a string
* Use the same pattern for all tests
* Fix endpoint
* Revert media routers to old names. Order routes to make sure the dynamic ones from media.py are only used whenever there's no match on auth/etc
* Reverted paths for media on tsx files
* Deleted file
* Fix test_http to use TestClient
* Formatting
* Bind timeline to DB
* Fix http tests
* Replace filename with pathvalidate
* Fix latest.ext handling and disable uvicorn access logs
* Add cosntraints to api provided values
* Formatting
* Remove unused
* Remove unused
* Get rate limiter working
---------
Co-authored-by: Nicolas Mowen <nickmowen213@gmail.com>
