v2.4.4 — Audit Hardening

Ten fixes from a full-codebase security and stability audit: two security holes closed, three crash classes eliminated, and the Overview dashboard is dramatically lighter on your Pi.

🛡️ Security

• Cross-site scripting fixed on the Insights page. The subview name from the URL was echoed back into the page unescaped; it's now validated against the list of real subviews.
• Service buttons work again — safely. The Stop/Restart/Enable/Disable buttons for the Live Audio Stream and the RAM drive in Settings silently did nothing (their commands never matched the security allowlist after input sanitizing). The comparison now happens on the decoded value, so the buttons work and the allowlist still guards every command.

🐛 Fixed

• Insights → Environmental no longer crashes on fresh installs. With weather synced but no detections yet in the last 30 days, the page died with a fatal error. Thanks to @FrostSaint for the report and fix (#18)!
• Notifications and weather sync no longer die silently on missing settings. Any config key absent from birdnet.conf (typical after restoring a backup made on an older version) crashed the Python side invisibly — weather updates stopped and every Apprise notification was dropped. Missing keys now fall back cleanly, and a missing notification title uses the default.
• The weather table is created at install time, not after the first successful fetch — so offline stations and fresh installs get a working database schema immediately instead of error states on the weather pages.
• Weather sync survives non-standard home directories. The hourly cron entry was written with a hardcoded /home/<user> path in one place and the real home in another; an update could silently kill weather sync on systems where those differ. Both now derive the real home directory.

⚡ Performance

• The Overview dashboard now refreshes only when a new detection actually arrives. Previously a broken guard made it re-run every chart, KPI, and recent-detections query every ~3 seconds for as long as the tab was open — a constant CPU and database load on the Pi. It still refreshes live during audio-backlog processing and when you return to the tab.
• Checking for a new detection is now nearly free. Each poll used to render a full detection card server-side — including Flickr/Wikipedia image lookups — just to be thrown away. The check now returns a one-line answer.
• Chart loads no longer stall on offline stations. When the weather API is unreachable, the on-demand sync retries at most every 10 minutes instead of blocking page requests for up to 20 seconds each.

Updating

cd ~/BirdNET-Pi
git fetch origin
git pull --ff-only origin main
sudo bash scripts/update_birdnet_snippets.sh

Then refresh your browser.

🤖 Generated with Claude Code