Phoenix introduces new features and many bug fixes. Additionally it paves the way for Dashboard v4!

Shinobi is truly reborn with these changes! See them here in this log :

https://gitlab.com/Shinobi.../Shinobi/-/merge_requests/556

Plugin System

• Docker-based plugin launching — plugins can now be started directly via Docker
• Connect a plugin without restarting Shinobi (hot-loading)
• Enable/Disable button for hotloading plugins, with UI fix
• Connected Plugin list added to Superuser panel
• Plugin connection-failure notices in plugins.js
• Plugin size check + forced-disconnect notice on key mismatch (security hardening)
• Cleaner Plugin Manager UI, always shows Docker status
• Face Manager–specific Docker install rule

Dashboard

• New "System Control" tab (with Activation status field)
• Easy Remote Access moved into Dashboard, gated by a new permission-group toggle
• GPU usage indicator
• Monitor Map: clicking a pin now shows related Events (like the Events table)

Events / Detection

• New "Events" tab for quickly searching detection logs
• Quick Range dropdown added to Events Table
• Events Table search and visuals updated

Video / Calendar / Timelapse

• Better Timelapse Viewer
• Calendar + FileBin layout improvements; Calendar range search now auto-matches display
• Cap added to Calendar video GET requests (prevents UI slowdowns)
• Cleaner/rebuilt video player, preview button opens the video player directly
• videosTable layout updated with Quick Range(+)

Notifications

• Firebase Cloud Messaging (push notifications)
• Discord notifications targetable to specific user IDs

Access Control

• Separate PTZ control permission (independent of general monitor permissions)
• Configurable SSRF filtering via new disableSSRFSelfTargetFilter option

ONVIF

• Hardened PTZ detection on ONVIF Scanner
• Enhanced ONVIF event parsing; ONVIF events now correctly trigger recording

Config / Admin

• config.debugLogSql option for SQL debug logging
• Debug heap info restricted to Superuser only
• Scanner capped at 4096 addresses (prevents OOM)
• Subscription ID/License Key redacted from logs
• Expanded documentation for conf.json options
• Rebuilt Superuser panel

Platform / Installers

• Modernized macOS installer (Docker-based, Apple Silicon support)
• New/updated installers: FreeBSD, OpenBSD, openSUSE, FreeNAS, and new Arch Linux support

Localization

• Icelandic translation added
• Russian translation completed

Major Fixes Bundled In (not new features, but notable)

• 10-vulnerability coordinated security disclosure (#565): unauthenticated DB writes, RCE via detector filtering, cross-tenant IDORs, command/XSS/SSRF injection, session-token leak via users_online socket broadcast
• Timelapse file-descriptor leak causing CPU buildup after days of uptime
• Motion detection "dead until restart" bug — stuck motion_lock now cleared
• Global webhook "dead until restart until Account Settings re-saved" bug
• Video merge/codec issues (including RTSPS URL handling)
• Cloud storage counters corrupting and showing NaN
• Child node process startup failures on distributed setups
• Scheduler time-wrapping bug, startup Orphan Check fix, XAmzContentSHA256Mismatch fix