* update version
* Restrict ffmpeg: go2rtc sources added through the API
go2rtc expands ffmpeg: sources into an exec: command line built from the
source's #key=value parameters, so the echo/expr/exec prefix check on
PUT /go2rtc/streams could be bypassed to run arbitrary ffmpeg arguments.
Sources submitted through the API now only accept the ffmpeg: parameters
the UI and docs use (video, audio, hardware with preset names, plus
numeric width/height/rotate/bitrate/timeout and async). Quotes,
whitespace, #raw, #input, #drawtext and unknown parameters are rejected
unless GO2RTC_ALLOW_ARBITRARY_EXEC is set. Sources defined in the config
file are unchanged.
Fixes GHSA-qjjw-3v66-279f
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Only allow existing streams on proxied go2rtc live paths
nginx proxies /live/mse/api/ws, /live/webrtc/api/ws and /api/go2rtc/webrtc
straight to go2rtc, which creates a new ad hoc stream from any src that is
not an existing stream name and starts the producer it describes. Any
authenticated user, including the built-in viewer role, could use this to
launch arbitrary go2rtc sources without going through the restricted-source
checks on PUT /go2rtc/streams.
The /auth subrequest now denies these paths unless every src names an
existing stream: a camera or its live stream, a go2rtc stream from the
config, or a stream go2rtc reports at runtime. This applies to every role,
and the runtime lookup fails closed when go2rtc cannot be reached.
Fixes GHSA-93xj-hg88-ffg7
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Ignore GO2RTC_ALLOW_ARBITRARY_EXEC in environment_vars
environment_vars installs every key into the Frigate process environment
at startup, so an admin could enable GO2RTC_ALLOW_ARBITRARY_EXEC from the
config and turn off the restricted go2rtc source checks on the API. The
override is meant to be set by the operator in the container environment
(or the Home Assistant add-on options), so it is now skipped with a
warning when it appears in environment_vars.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Apply go2rtc source restrictions to config/save and config/set
go2rtc.streams written through config/save or config/set were only
filtered at startup, which blocks echo/expr/exec and the map form but not
the ffmpeg: parameters that PUT /go2rtc/streams now rejects. Saving a
stream this way and restarting bypassed the API restriction.
Both endpoints now reject a change that adds a go2rtc stream source that
fails is_restricted_go2rtc_api_source, or a map-form source, unless
GO2RTC_ALLOW_ARBITRARY_EXEC is set. Sources already in the saved config
for the same stream are left alone, so streams configured on disk keep
working and resubmitting the whole file from the config editor succeeds.
config/set restores the previous file when it rejects a change.
Follow-up to GHSA-qjjw-3v66-279f
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Match go2rtc stream-proxy paths the way nginx does
/auth compared the raw $request_uri path against the three go2rtc
stream-proxy paths exactly, while nginx matches its prefix locations
against the normalized URI. Encoded characters, repeated slashes, dot
segments or a suffix on the path skipped the stream check even though
nginx still proxied the request to go2rtc.
The go2rtc stream locations now set a variable that the auth subrequest
forwards as X-Go2rtc-Stream-Proxy (client headers are not forwarded, so it
cannot be spoofed). As a fallback, /auth also normalizes the path like
nginx (percent-decoding, merging slashes, resolving dot segments) and
prefix matches it, and splits the raw URI by hand since urlparse reads a
leading // as a host.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Parse config stream changes with Frigate's YAML loader
The go2rtc stream check on config/save and config/set parsed the config
with the safe loader and treated a parse error as an empty config, while
Frigate and the go2rtc startup script use the round-trip loader. Input
that only the round-trip loader accepts, such as a tagged root map, hid
new stream sources from the check.
The check now uses the same round-trip loader and rejects the request
when the new config cannot be parsed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Resolve go2rtc stream placeholders the same way everywhere
The go2rtc startup script expanded stream sources with str.format(),
which also supports attribute and index access, while the config API
check used substitute_frigate_vars and fell back to the raw string when a
placeholder could not be resolved. A placeholder the API check could not
resolve could therefore expand into a restricted source at startup.
The startup script now uses substitute_frigate_vars, like the rest of the
config, and the API check rejects a stream source whose placeholders
cannot be resolved. The startup script's own copy of the FRIGATE_* env
var map is removed; the shared one also honors CREDENTIALS_DIRECTORY.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Accept codec sample rates in ffmpeg: go2rtc sources
The ffmpeg: parameter allowlist only accepted plain names for video,
audio and hardware, so the documented HomeKit source with
#audio=opus/16000 was rejected by PUT /go2rtc/streams, config/save and
config/set. Names may now carry a numeric /rate suffix. A rate without a
name is still rejected. All ffmpeg: sources in the docs pass the check.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Restore the environment after go2rtc exec override tests
Tests that removed or set GO2RTC_ALLOW_ARBITRARY_EXEC did not restore a
value that was already present, so later tests could run with a changed
security setting. They now use patch.dict on os.environ.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Revert the go2rtc startup script to str.format substitution
Restores create_config.py to its state on master. The config API check
rejects any stream source whose {FRIGATE_*} placeholders it cannot
resolve with substitute_frigate_vars, and for every source it accepts,
str.format() at startup either produces the same string or fails and
stops go2rtc startup. Changing the startup script is therefore not
needed for the fix, and leaving it alone avoids a conflict with dev,
which already moved this script to the new env helpers.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Explain why a go2rtc stream change was rejected
A stream source with an undefined or malformed {FRIGATE_*} placeholder
was reported as a restricted source, which reads like a security block
when the user made a typo. The config API now reports unknown variables
and invalid placeholders separately from restricted sources.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* Update version
* Create scaffolding for case management (#21293)
* implement case management for export apis (#21295)
* refactor vainfo to search for first GPU (#21296)
use existing LibvaGpuSelector to pick appropritate libva device
* Case management UI (#21299)
* Refactor export cards to match existing cards in other UI pages
* Show cases separately from exports
* Add proper filtering and display of cases
* Add ability to edit and select cases for exports
* Cleanup typing
* Hide if no unassigned
* Cleanup hiding logic
* fix scrolling
* Improve layout
* Camera connection quality indicator (#21297)
* add camera connection quality metrics and indicator
* formatting
* move stall calcs to watchdog
* clean up
* change watchdog to 1s and separately track time for ffmpeg retry_interval
* implement status caching to reduce message volume
* Export filter UI (#21322)
* Get started on export filters
* implement basic filter
* Implement filtering and adjust api
* Improve filter handling
* Improve navigation
* Cleanup
* handle scrolling
* Refactor temperature reporting for detectors and implement Hailo temp reading (#21395)
* Add Hailo temperature retrieval
* Refactor `get_hailo_temps()` to use ctxmanager
* Show Hailo temps in system UI
* Move hailo_platform import to get_hailo_temps
* Refactor temperatures calculations to use within detector block
* Adjust webUI to handle new location
---------
Co-authored-by: tigattack <10629864+tigattack@users.noreply.github.com>
* Camera-specific hwaccel settings for timelapse exports (correct base) (#21386)
* added hwaccel_args to camera.record.export config struct
* populate camera.record.export.hwaccel_args with a cascade up to camera then global if 'auto'
* use new hwaccel args in export
* added documentation for camera-specific hwaccel export
* fix c/p error
* missed an import
* fleshed out the docs and comments a bit
* ruff lint
* separated out the tips in the doc
* fix documentation
* fix and simplify reference config doc
* Add support for GPU and NPU temperatures (#21495)
* Add rockchip temps
* Add support for GPU and NPU temperatures in the frontend
* Add support for Nvidia temperature
* Improve separation
* Adjust graph scaling
* Exports Improvements (#21521)
* Add images to case folder view
* Add ability to select case in export dialog
* Add to mobile review too
* Add API to handle deleting recordings (#21520)
* Add recording delete API
* Re-organize recordings apis
* Fix import
* Consolidate query types
* Add media sync API endpoint (#21526)
* add media cleanup functions
* add endpoint
* remove scheduled sync recordings from cleanup
* move to utils dir
* tweak import
* remove sync_recordings and add config migrator
* remove sync_recordings
* docs
* remove key
* clean up docs
* docs fix
* docs tweak
* Media sync API refactor and UI (#21542)
* generic job infrastructure
* types and dispatcher changes for jobs
* save data in memory only for completed jobs
* implement media sync job and endpoints
* change logs to debug
* websocket hook and types
* frontend
* i18n
* docs tweaks
* endpoint descriptions
* tweak docs
* use same logging pattern in sync_recordings as the other sync functions (#21625)
* Fix incorrect counting in sync_recordings (#21626)
* Update go2rtc to v1.9.13 (#21648)
Co-authored-by: Eugeny Tulupov <eugeny.tulupov@spirent.com>
* Refactor Time-Lapse Export (#21668)
* refactor time lapse creation to be a separate API call with ability to pass arbitrary ffmpeg args
* Add CPU fallback
* Optimize empty directory cleanup for recordings (#21695)
The previous empty directory cleanup did a full recursive directory
walk, which can be extremely slow. This new implementation only removes
directories which have a chance of being empty due to a recent file
deletion.
* Implement llama.cpp GenAI Provider (#21690)
* Implement llama.cpp GenAI Provider
* Add docs
* Update links
* Fix broken mqtt links
* Fix more broken anchors
* Remove parents in remove_empty_directories (#21726)
The original implementation did a full directory tree walk to find and remove
empty directories, so this implementation should remove the parents as well,
like the original did.
* Implement LLM Chat API with tool calling support (#21731)
* Implement initial tools definiton APIs
* Add initial chat completion API with tool support
* Implement other providers
* Cleanup
* Offline preview image (#21752)
* use latest preview frame for latest image when camera is offline
* remove frame extraction logic
* tests
* frontend
* add description to api endpoint
* Update to ROCm 7.2.0 (#21753)
* Update to ROCm 7.2.0
* ROCm now works properly with JinaV1
* Arcface has compilation error
* Add live context tool to LLM (#21754)
* Add live context tool
* Improve handling of images in request
* Improve prompt caching
* Add networking options for configuring listening ports (#21779)
* feat: add X-Frame-Time when returning snapshot (#21932)
Co-authored-by: Florent MORICONI <170678386+fmcloudconsulting@users.noreply.github.com>
* Improve jsmpeg player websocket handling (#21943)
* improve jsmpeg player websocket handling
prevent websocket console messages from appearing when player is destroyed
* reformat files after ruff upgrade
* Allow API Events to be Detections or Alerts, depending on the Event Label (#21923)
* - API created events will be alerts OR detections, depending on the event label, defaulting to alerts
- Indefinite API events will extend the recording segment until those events are ended
- API event start time is the actual start time, instead of having a pre-buffer of record.event_pre_capture
* Instead of checking for indefinite events on a camera before deciding if we should end the segment, only update last_detection_time and last_alert_time if frame_time is greater, which should have the same effect
* Add the ability to set a pre_capture number of seconds when creating a manual event via the API. Default behavior unchanged
* Remove unnecessary _publish_segment_start() call
* Formatting
* handle last_alert_time or last_detection_time being None when checking them against the frame_time
* comment manual_info["label"].split(": ")[0] for clarity
* ffmpeg Preview Segment Optimization for "high" and "very_high" (#21996)
* Introduce qmax parameter for ffmpeg preview encoding
Added PREVIEW_QMAX_PARAM to control ffmpeg encoding quality.
* formatting
* Fix spacing in qmax parameters for preview quality
* Adapt to new Gemini format
* Fix frame time access
* Remove exceptions
* Cleanup
---------
Co-authored-by: Josh Hawkins <32435876+hawkeye217@users.noreply.github.com>
Co-authored-by: tigattack <10629864+tigattack@users.noreply.github.com>
Co-authored-by: Andrew Roberts <adroberts@gmail.com>
Co-authored-by: Eugeny Tulupov <zhekka3@gmail.com>
Co-authored-by: Eugeny Tulupov <eugeny.tulupov@spirent.com>
Co-authored-by: John Shaw <1753078+johnshaw@users.noreply.github.com>
Co-authored-by: Eric Work <work.eric@gmail.com>
Co-authored-by: FL42 <46161216+fl42@users.noreply.github.com>
Co-authored-by: Florent MORICONI <170678386+fmcloudconsulting@users.noreply.github.com>
Co-authored-by: nulledy <254504350+nulledy@users.noreply.github.com>
* chore: i18n use cache key
* Fix indentation in Dockerfile for pip command
* Add build argument for GIT_COMMIT_HASH in CI workflow
* Add short-sha output to action.yml
* Update build args to use short SHA output
* build: use vite .env
* Remove unnecessary newline in Dockerfile
* Define proxy host variable in vite.config.ts
Add a new line to define the proxy host variable.
* Install peewee type hints
* Models now have proper types
* Fix iterator type
* Enable debug builds with dev reqs installed
* Install as wheel
* Fix cast type
* Format makefiles
* Handle all errors in rocm makefile
* Remove CURRENT_UID and GID from makefile as they are unused
* Removed unused vite.svg asset
* Sort frigate-dictionary
* Make main frigate build non rpi specific and build rpi using base image
* Add boards to sidebar
* Fix docker build
* Fix docs build
* Update pr branch for testing
* remove target from rpi build
* Remove manual build
* Add push build for rpi
* fix typos, improve wording
* Add arm build for rpi
* Cleanup and add default github ref name
* Cleanup docker build file system
* Setup to use docker bake
* Add ci/cd for bake
* Fix path
* Fix devcontainer
* Set targets
* Fix build
* Fix syntax
* Add wheels target
* Move dev container to trt
* Update key and fix rpi local
* Move requirements files and set intermediate targets
* Add back --load
* Update docs for community board development
* Update installation docs to reflect different builds available
* Update docs with official and community supported headers
* Update codeowners docs
* Update docs
* Assemble main and standard builds
* Change order of pushes
* Remove community board after successful build
* Fix rpi bake file names
* Migrate db path to /config
* Ensure oneshot runs
* Put logic inside of Frigate's run
* Use new db default path in code
* Fix missing config dir
* Upgrade yq to 4.33.3
* Initial WIP dockerfile and scripts to add tensorrt support
* Add tensorRT detector
* WIP attempt to install TensorRT 8.5
* Updates to detector for cuda python library
* TensorRT Cuda library rework WIP
Does not run
* Fixes from rebase to detector factory
* Fix parsing output memory pointer
* Handle TensorRT logs with the python logger
* Use non-async interface and convert input data to float32. Detection runs without error.
* Make TensorRT a separate build from the base Frigate image.
* Add script and documentation for generating TRT Models
* Add support for TensorRT devcontainer
* Add labelmap to trt model script and docs. Cleanup of old scripts.
* Update detect to normalize input tensor using model input type
* Add config for selecting GPU. Fix Async inference. Update documentation.
* Update some CUDA libraries to clean up version warning
* Add CI stage to build TensorRT tag
* Add note in docs for image tag and model support
* Log all services to RAM
* Fix tests workdir
* Rotate logs when they reach 10MB and keep only 1 archive
* Gracefully handle shutdown
* Add note about gracetime not working
* Fix logs permission, create fake logs for devcontainer
* Remove empty line
* Update docker/rootfs/etc/services.d/frigate/run
* Fix fake Frigate shebang
* fix makefile variable
* add branch for testing
* fix arm32 build
* use amd64 for web build
* install wheels in a separate layer for better parallel builds
* try build-push-action
* try using gh context
* use short sha
* cleanup
* Make it easier to run the devcontainer
* Some more improvements
* Tidy up few other things
* Better name stages
* Fix CI
* Setup everything with one click
* Allow to set IMAGE_OWNER
* Change IMAGE_OWNER to IMAGE_REPO
* Fix CI with IMAGE_REPO
* Fix nodejs installation
* Test devcontainer build as part of CI
* Build devcontainer in its own job
* Fix devcontainer cli installation
* Fix devcontainer build
* Fix devcontainer build in CI again
* Enable buildkit only
* Increase coverage of devcontainer test
* Fix devcontainer start in CI
* Ensure latest version of docker compose is used
* Fix install compose action
* Disable CI stuff which does not work until we fix them
* try a different approach for build_web
* add automatic image builds
* build web first
* try disabling log file
* chown dir
* use volume
* set cache path
* test a push
* limit to dev/master branch commits
