frigate

This is a maintenance release for Frigate 0.18 that includes bugfixes and minor changes.

Images

• ghcr.io/blakeblackshear/frigate:0.18.1
• ghcr.io/blakeblackshear/frigate:0.18.1-standard-arm64
• ghcr.io/blakeblackshear/frigate:0.18.1-tensorrt
• ghcr.io/blakeblackshear/frigate:0.18.1-rk
• ghcr.io/blakeblackshear/frigate:0.18.1-rocm
• ghcr.io/blakeblackshear/frigate:0.18.1-tensorrt-jp6
• ghcr.io/blakeblackshear/frigate:0.18.1-synaptics

What's Changed

Security Fixes

• GHSA-x2ch-x8hv-75xf: Fix camera name collision bypassing admin check by @hawkeye217 in https://github.com/blakeblackshear/frigate/pull/24516
• GHSA-935r-r3xx-6gmw: Pass only the request path to auth by @hawkeye217 in https://github.com/blakeblackshear/frigate/pull/24602
• GHSA-6hh9-gv48-g8q6: Skip malformed webpush subscriptions at startup by @hawkeye217 in https://github.com/blakeblackshear/frigate/pull/24604

Notable Changes

• Reduce Intel QSV hwaccel CPU usage for cameras with a high incoming frame rate by @NickM-27 in https://github.com/blakeblackshear/frigate/pull/24384
• Fix semantic search reindexing by @hawkeye217 in https://github.com/blakeblackshear/frigate/pull/24407
• Back off restarts when a recording stream goes stale by @hawkeye217 in https://github.com/blakeblackshear/frigate/pull/24420
• Lock ZMQ sockets shared across threads by @hawkeye217 in https://github.com/blakeblackshear/frigate/pull/24607

Other Changes

• update labels/faq by @blakeblackshear in https://github.com/blakeblackshear/frigate/pull/23759
• Clarify profile docs by @hawkeye217 in https://github.com/blakeblackshear/frigate/pull/24267
• Add UI field messages for recording and notifications by @hawkeye217 in https://github.com/blakeblackshear/frigate/pull/24272
• Handle sub labeled objects to still show up in review filter by @NickM-27 in https://github.com/blakeblackshear/frigate/pull/24391
• Fix explore paging for non-date sorts by @hawkeye217 in https://github.com/blakeblackshear/frigate/pull/24392
• Remove invalid hardware acceleration step in recording troubleshooting by @NickM-27 in https://github.com/blakeblackshear/frigate/pull/24395
• Add version/release link to docs site by @hawkeye217 in https://github.com/blakeblackshear/frigate/pull/24410
• Update keywords used in docs to match UI by @NickM-27 in https://github.com/blakeblackshear/frigate/pull/24436
• Add more guards for dynamically removed cameras by @hawkeye217 in https://github.com/blakeblackshear/frigate/pull/24450
• Fix ffmpeg default record preset in reference config by @lin-xianming in https://github.com/blakeblackshear/frigate/pull/24451
• Clarify MQTT docs by @hawkeye217 in https://github.com/blakeblackshear/frigate/pull/24441
• Tweaks by @hawkeye217 in https://github.com/blakeblackshear/frigate/pull/24484
• Detail XDNA2 community detector by @mitchins in https://github.com/blakeblackshear/frigate/pull/24480
• Delete timeline entries when expiring events without clips by @hawkeye217 in https://github.com/blakeblackshear/fr

Images

• ghcr.io/blakeblackshear/frigate:0.18.0
• ghcr.io/blakeblackshear/frigate:0.18.0-standard-arm64
• ghcr.io/blakeblackshear/frigate:0.18.0-tensorrt
• ghcr.io/blakeblackshear/frigate:0.18.0-rk
• ghcr.io/blakeblackshear/frigate:0.18.0-rocm
• ghcr.io/blakeblackshear/frigate:0.18.0-tensorrt-jp6
• ghcr.io/blakeblackshear/frigate:0.18.0-synaptics

Full changelog: https://github.com/blakeblackshear/frigate/compare/v0.17.2...v0.18.0

Major Changes for 0.18.0

Breaking Changes

There are several breaking changes in this release, Frigate will attempt to update the configuration automatically. In some cases manual changes may be required. It is always recommended to back up your current config and database before upgrading:

1. Simply copy your current config file to a new location
2. Stop Frigate and make a copy of the frigate.db file

• GenAI now supports multiple providers. As a result, the global genai config is now a mapping of keys to GenAI provider setups, and a new roles field defines what tasks each provider will be used for (object descriptions, review summaries, embeddings, chat, etc.). Existing configs will be automatically migrated. Documentation
• Frigate no longer saves annotated JPEG snapshots (.jpg) to disk. Only a clean, unannotated WebP snapshot (<camera>-<id>-clean.webp) is now stored in /media/frigate/clips/. The clean_copy configuration option has been removed — clean snapshots are always saved when snapshots are enabled. The snapshots.quality default has changed from 70 to 60, reflecting the switch from JPEG to WebP encoding. Users who previously relied on the annotated .jpg files on disk should instead use the /api/events/<id>/snapshot.jpg endpoint, which now honors timestamp, bounding_box, crop, height, and quality query parameters for both in-progress and completed tracked objects. When query parameters are omitted, the camera's snapshots config values are used as defaults. Existing configs containing clean_copy will be automatically migrated. Documentation
• The config format for zones and masks has changed to add enabled and friendly_name fields. A config migrator will make the necessary changes, but if migration fails you may need to edit your masks and zones manually.
• Intel GPU stats reporting has changed to no longer require intel_gpu_top and now reads directly from the kernel's per-client DRM usage counters. This removes the need for CAP_PERFMON, privileged mode, or perf_event_paranoid tuning, and adds support for newer Intel GPUs (including Battlemage). Reported usage values may differ from previous versions because the measurement method has changed; the underlying GPU workload is unchanged for the same configuration.
  • Note that this change will require a Linux kernel version of 6.5 or newer on your host. Kernels older than 6.5 do not expose per-engine counters for GPUs using GuC submission.
• FFmpeg has been updated to version 8 (excluding the -rk image), and introduces a known issue with

This is a maintenance release for Frigate 0.17 that includes fixes and minor changes.

Images

• ghcr.io/blakeblackshear/frigate:0.17.2
• ghcr.io/blakeblackshear/frigate:0.17.2-standard-arm64
• ghcr.io/blakeblackshear/frigate:0.17.2-tensorrt
• ghcr.io/blakeblackshear/frigate:0.17.2-rk
• ghcr.io/blakeblackshear/frigate:0.17.2-rocm
• ghcr.io/blakeblackshear/frigate:0.17.2-tensorrt-jp6
• ghcr.io/blakeblackshear/frigate:0.17.2-synaptics

What's Changed

Security Advisories

These advisories impact users with publicly exposed instances with no authentication and users with viewer roles where it is important to restrict access to some cameras.

Addressed in this release:

• go2rtc WebSocket live stream camera access bypass (role-restricted users)
• Incomplete patch of CVE-2025-62382: image_path backslash-separator bypass of pathvalidate.sanitize_filepath + startswith(CLIPS_DIR) reaches shutil.copy arbitrary host-file read
• Incomplete patch of CVE-2026-25643: go2rtc exec:/echo:/expr: prefix block is bypassed when a stream value is a YAML mapping with a url key (RCE + container escape)
• RTSP credentials leak to viewer role via nginx proxy_cache
• Authenticated Admin Can Achieve RCE via go2rtc Stream API — exec: Filter Not Enforced at API Layer
• WebSocket Missing Authorization — Viewer Can Execute Admin-Only Operations

To be addressed in future versions:

• Authenticated viewer can read /api/logs/frigate and /api/logs/nginx, exposing the auto-generated admin password and camera RTSP/ONVIF credentials (viewer-to-admin privilege escalation)
• Viewer-Role User Can Access go2rtc Internal API to obtain sensitive information
• Camera ACL bypass via Nginx static locations allows authenticated users to access recordings from unauthorized cameras

Notable Changes

• Exports can optionally include recording segment information as chapters in mp4 metadata
• Performance improvements when displaying previews in the live page

All Commits

• Update docs for DEIMv2 support by @NickM-27 in https://github.com/blakeblackshear/frigate/pull/22598
• Add role-based auth to websocket message handler by @hawkeye217 in https://github.com/blakeblackshear/frigate/pull/22710
• Update MemryX section documentation by @abinila4 in https://github.com/blakeblackshear/frigate/pull/22712
• Memryx docs update by @abinila4 in https://github.com/blakeblackshear/frigate/pull/22746
• Docs update by @hawkeye217 in https://github.com/blakeblackshear/frigate/pull/22864
• Up

This is a maintenance release for Frigate 0.17 that includes bugfixes and minor changes.

Images

• ghcr.io/blakeblackshear/frigate:0.17.1
• ghcr.io/blakeblackshear/frigate:0.17.1-standard-arm64
• ghcr.io/blakeblackshear/frigate:0.17.1-tensorrt
• ghcr.io/blakeblackshear/frigate:0.17.1-rk
• ghcr.io/blakeblackshear/frigate:0.17.1-rocm
• ghcr.io/blakeblackshear/frigate:0.17.1-tensorrt-jp6
• ghcr.io/blakeblackshear/frigate:0.17.1-synaptics

What's Changed

Security Fixes

• Restrict raw config endpoint to admin role by @hawkeye217 in https://github.com/blakeblackshear/frigate/pull/22523
• Fix cross-camera auth in timeline and media endpoints by @hawkeye217 in https://github.com/blakeblackshear/frigate/pull/22522

Notable Changes

• Fix/rknn arcface input format master by @begetan in https://github.com/blakeblackshear/frigate/pull/22319
• Don't try to run storage cleanup if frigate is in safe mode by @hawkeye217 in https://github.com/blakeblackshear/frigate/pull/22492

Other Changes

• docs: fix image address by @ZhaiSoul in https://github.com/blakeblackshear/frigate/pull/22067
• docs: fix hailo setup numbering error by @ZhaiSoul in https://github.com/blakeblackshear/frigate/pull/22066
• Fix script for downloading RF-DETR by @f0ff886f in https://github.com/blakeblackshear/frigate/pull/22083
• docs: Add frame selection and clean copy details to snapshots docs by @webmasterkai in https://github.com/blakeblackshear/frigate/pull/21946
• Update line breaks in video_pipeline.md diagram by @GrumpyMeow in https://github.com/blakeblackshear/frigate/pull/21919
• docs: Add detail to face recognition MQTT update docs by @webmasterkai in https://github.com/blakeblackshear/frigate/pull/21942
• Update HA docs with MQTT example by @hawkeye217 in https://github.com/blakeblackshear/frigate/pull/22098
• Docs: fix YOLOv9 onnx export by @tremby in https://github.com/blakeblackshear/frigate/pull/22107
• Docs updates by @hawkeye217 in https://github.com/blakeblackshear/frigate/pull/22131
• updates for yolov9 coral support by @blakeblackshear in https://github.com/blakeblackshear/frigate/pull/22136
• 0.17 Release by @blakeblackshear in https://github.com/blakeblackshear/frigate/pull/19787
• Fix link to Coral YOLOv9 Frigate+ models by @hawkeye217 in https://github.com/blakeblackshear/frigate/pull/22164
• Fix go2rtc stream alias auth by @hawkeye217 in https://github.com/blakeblackshear/frigate/pull/22097
• Birdseye fixes by @hawkeye217 in https://github.com/blakeblackshear/frigate/pull/22166
• Fix genai by @NickM-27 in https://github.com/blakeblackshear/frigate/pull/22203
• Docs updates by @hawkeye217 in https://github.com/blakeblackshear/frigate/pull/22222
• Fix menu display conditions by @hawkeye217 in https://github.com/blakeblackshear/frigate/pull/22237
• docs: updated the guides detectors section by @ZhaiSoul in https://github.com/blakeblackshear/frigate/pull/22241
• Docs update by @hawkeye217 in https://github.com/blakeblackshear/frigate/pull/22251
• Update docs for new HA language by @hawkeye217 in https://github.com/blakeblackshear/frigate/pull/22258
• Update docs for AVX2 CPU requirement by @hawkeye217 in https://github.com/blakeblackshear/frigate/pull/22305
• Improve playback of videos in Tracking Details by @hawkeye21