opensensor/lightNVR 0.46.0 on GitHub

🤖 AI-Generated Changelog

Show recording storage breakdown per tier (hot disk, cold bucket) in the System view
Live plan editor: multi-select cameras, FOV handles, plan locations, and direct manipulation with right-click context menus; single tap now exits fullscreen

Resolved deadlock on every stream PUT update caused by nested mutex lock in stream modify handler
Fixed privacy-mode streams being incorrectly included in go2rtc.yaml configuration
Fixed investigation search being unbounded by its configured time window
Fixed stream PUT handler regressions affecting enable/disable and privacy toggle behavior
Fixed worker lock leak and undefined backchannel_changed in stream PUT handler
Fixed double close and unchecked startup-pipe I/O in daemon initialization
Fixed shutdown coordinator lifecycle to keep sync objects alive after cleanup
Fixed NULL return from stream worker threads causing build warnings
Fixed plan editor pointer-cancel rollback; SVG markers are now keyboard-reachable
Re-resolve stream handle by name in DELETE worker to avoid stale references
Privacy toggle now reports go2rtc failures, covers sub-streams, and keeps disabled streams off
Drop unused shapeCenter import in LiveBuildingPlan component

Bumped SQLite to 3.54.1, libuv to 1.53.0, and llhttp to 9.4.3
Applied restream URL changes to go2rtc independently of a full stream restart
Shared one async-signal-safe stderr helper across daemon and signal handlers; removed dead socket close code
Dropped redundant memset after delivery plan clear in event router
Renamed startup cwd variable in daemon to avoid redefinition in init_daemon
go2rtc now declares and maintains g_last_stop_was_managed for cleaner process lifecycle tracking
Generation-tagged component IDs; privacy_mode is now owned by its own toggle component
Dropped always-true array null check for models_path in main
Upgraded all web frontend dependencies to latest versions

Hardened path construction in CMakeLists.txt flagged by CodeQL path-injection analysis
Bounded TZif transition count at allocation site to prevent over-allocation (CodeQL alerts #293, #329, #343, #344)
Applied Copilot Autofix hardening across daemon, event router, stream modify handler, go2rtc process, main, and shutdown coordinator
Added --wrap=write fault injection and tightened assertions in signal-safety unit tests
Asserted lock-free atomic bool usage; fixed stale signal-safety comments in daemon handler

🔗 Full Changelog: 0.45.3...0.46.0