Frigate NVR Updates: Trust Boundaries and Timing Bugs
Today's changes closed a security gap where the internal auth port could drift from what nginx actually bound, and fixed a set of timing-related bugs spanning the timeline UI, worker startup, and motion preview cropping. The common thread is state going stale between when something is configured and when it's actually applied.
Duration: PT2M22S
Episode overview
This episode is a short developer briefing from Frigate NVR Updates.
It explains recent repository work in plain language.
- Show: Frigate NVR Updates
- Published: 2026-08-05T13:17:49Z
- Audio duration: PT2M22S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Good afternoon, it's August 5th, and here's your Frigate NVR briefing.
The theme running through today's merges is state drift — code that trusted a value at the wrong moment, after something else had already moved on.
Start with security. PR 23909 fixes a real exposure: the internal auth endpoint grants anonymous admin access based on comparing a request's server port against the configured internal listening port. The problem is that nginx binds its ports once at container startup and never reloads, but the auth check was…
Second theme: race conditions at startup. Commit e73a14d fixes a case where worker processes could miss configuration updates entirely. Persisted profile settings and runtime toggles were broadcast over a plain publish-subscribe channel with no retry, so a worker that started before the message went out simply never…
Third theme: UI state falling out of sync with rapid input. The same commit fixes a bug where dragging the timeline handlebar quickly could exceed React's update limit and crash the whole app — worst on motion search. The fix throttles state commits and moves fast-changing values directly to the DOM instead of…
Rounding out the batch, PR 23903 fixes…