tphakala/birdnet-go nightly-20260429-405

Nightly Build nightly-20260429-405

on GitHub

Hotfix release for nightly-20260429. The earlier build shipped with a settings validation regression that broke Docker deployments using absolute audio export paths, a wizard that could reappear after dismissal, and several stale-pointer reads that prevented UI settings changes from taking effect at runtime. This build also adds a --silent flag to install.sh for scripted deployments.

New Features

Silent Installation Mode

install.sh now accepts a --silent flag that skips all interactive prompts and reads configuration from environment variables (BIRDNET_RTSP_URL, BIRDNET_LATITUDE, BIRDNET_LONGITUDE, BIRDNET_LOCALE, BIRDNET_PASSWORD, BIRDNET_TELEMETRY, BIRDNET_WEB_PORT). When run against an existing installation, it attempts an upgrade first and falls back to a fresh install. Cockpit installation is skipped in silent mode.

Security

• OAuth2 server used stale settings on every request - all 8 settings read sites in the OAuth2 server now use fresh atomic snapshots, preventing stale redirect URIs, client secrets, and provider configuration from persisting after UI changes (#2900).

Bug Fixes

• Audio export path validation rejected absolute paths - the validation hardening in nightly-20260429 rejected filepath.IsAbs() paths, breaking all Docker deployments where install.sh sets the export path to /data/clips/. Absolute paths are now allowed; only path traversal (..) is rejected (#2893).
• Wizard reappearing after dismissal - the dismiss endpoint is now always public (works pre-auth), existing installs auto-seed last_seen_version using 5 detection signals, and both frontend and backend enforce the skip via a 6-layer defense (#2895).
• Range filter using stale startup settings - GetProbableSpecies and predictFilter now read from the current published snapshot, so UI changes to coordinates, threshold, and location toggle take effect immediately (#2897).
• Stale settings pointers across 8 files - currentSettings() helpers added to BirdNET, Controller, and OAuth2Server structs. All runtime reads in classifier, API v2, processor, and analysis packages now use fresh atomic snapshots instead of startup-time pointers (#2899, #2900).
• Species cache key mismatch on concurrent settings change - getCachedSpeciesScores now uses the same settings snapshot for both cache key computation and score lookup, preventing a theoretical cache miss race.