[hawkeye217]

Please read the contributing guidelines and the AI policy before submitting a PR. Every PR must be read and submitted by a person, and PRs that appear to be unreviewed AI output will be closed without review.

Proposed change

• Keep the HA ingress path in recording share links
• Reject scale below 1 on /recordings/unavailable. Zero hung the event loop
• Reject negative padding on /vod/event and clamp preview gif/mp4 offsets to the start of the preview
• Don't delete an export that is still in progress
• Hash a dummy password when the login username doesn't exist, so response time doesn't reveal valid usernames
• Include the start hour in the Explore time-of-day filter
• Show an error and clean up the service worker when the push subscription fails
• Don't wipe an unnamed entry when adding another known plate
• Fix the export "last N hours" range across DST changes
• Load live dashboard audio and volume from the current camera group only, and reset them when the group changes
• Don't clear a trigger's highlight when another trigger fires within 3 seconds
• Fix two-way talk shortcut
• Fix detail stream active item after camera switch
• Show already running message when a media sync is in progress
• Pick the earliest overlapping preview for preview gif and mp4
• Remove password strength meter and fix confirm password feedback
• Add tests

Deps for dependabot:

• Hold pandas 3.1 until numpy 2

Type of change

• Dependency upgrade
• Bugfix (non-breaking change which fixes an issue)
• New feature
• Breaking change (fix/feature causing existing functionality to break)
• Code quality improvements to existing code
• Documentation Update

Additional information

• This PR fixes or closes issue: fixes #
• This PR is related to issue:
• Link to discussion with maintainers (required for any large or "planned" features):

For new features

• There is an existing feature request or discussion with community interest for this change.
  • Link:

AI disclosure

• No AI tools were used in this PR.
• AI tools were used in this PR. Details below:

AI tool(s) used (e.g., Claude, Copilot, ChatGPT, Cursor):

How AI was used (e.g., code generation, code review, debugging, documentation):

Extent of AI involvement (e.g., generated entire implementation, assisted with specific functions, suggested fixes):

Human oversight: Describe what manual review, testing, and validation you performed on the AI-generated portions.

Checklist

• The code change is tested and works locally.
• Local tests pass. Your PR cannot be merged unless tests pass
• There is no commented out code in this PR.
• I can explain every line of code in this PR if asked.
• UI changes including text have used i18n keys and have been added to the en locale.
• The code has been formatted using Ruff (ruff format frigate)

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no new actionable issue remains.

Summary

This PR fixes recording links, media bounds, export cleanup, live audio settings, and several settings-page behaviors. The latest changes remove the password strength meter and refresh confirmation checks when the password changes.

• Login checks unknown usernames with the same password-hashing work.
• Recording and event requests reject values outside their allowed ranges.
• Exports stay intact while running and failed exports lose their partial files.
• Preview GIFs and MP4s start at the earliest matching preview.
• Time-of-day filters include events at the start of the selected range.
• Review results are ordered by their start time.
• Export time presets keep the same duration across daylight-saving changes.
• Recording share links keep the app's existing path prefix.
• Live audio and volume follow the selected camera group.
• The detail stream selects a review item after a camera switch.
• The live camera's T shortcut turns two-way talk on and off.
• Failed push registrations show an error and clean up the worker.
• Adding a known plate leaves an existing unnamed entry alone.
• Password dialogs show when the two entered passwords do not match.
• The media sync screen shows the already-running message for a running sync.
• A trigger stays highlighted for three seconds after its latest alert.
• Dependabot holds pandas updates at version 3.1 and above.

_{Reviews (6) · Last reviewed commit: "remove password strength meter and fix c..." · Reviewed by Greptile}