LoginSign Up
← Back to all sparks
Z

ZoneMinder

INFRA · APIS
Velocity0.0

Video surveillance and CCTV management system

zoneminder.com ↗

ZoneMinder 1.38 finally split capturing from analysing — and added roles to a system that had none.

video surveillancerbaconvifwebrtclegacy branchconsolidation
◆Current state
ZoneMinder runs two lines in parallel. The 1.38 series, opened in February, brought role-based access control, WebRTC, Go2RTC and RTSP2Web streaming with hardware acceleration, a redesigned monitor model splitting Capturing, Analysing and Recording into separate settings, ONVIF events, MQTT and event tagging. The legacy 1.36 branch is still receiving fixes, including a stored SQL injection through event name and cause fields. The 1.38.1 release replaced four vendor-specific ONVIF implementations with a single control module.
◆Where it's heading
The project is consolidating a decade of accumulated special cases: four ONVIF implementations become one, monitor function modes become independent toggles, and streaming moves onto standard components rather than bespoke paths. Meanwhile 1.36 keeps being patched for security and build compatibility, which means a substantial install base has not moved. Release engineering itself is visibly strained — 1.38.2 was abandoned mid-flight over a Debian packaging conflict.
◆Prediction
Expect 1.38 patch releases to keep folding in security and memory-safety fixes while the 1.36 branch receives only vulnerability backports until it is retired. Whether the new streaming stack becomes the default rather than an option is not settled by these entries.

◆Recent moves

  1. 1mo ago

    1.38.3 supersedes an abandoned 1.38.2 build

    A maintenance release carrying security, crash and memory-safety fixes, notable mostly for what it replaces: 1.38.2 was tagged but its Debian builds collapsed over non-deterministic upstream tarballs across distributions. Release plumbing failures like this are a real tax on a project shipping to many distributions.

    View source ↗
  2. 5mo ago

    Stored SQL injection patched on the 1.36 branch

    The legacy line receives a fix for SQL injection via stored event name and cause fields, along with 64-bit formatter and timezone handling corrections. That an advisory-grade fix still lands on 1.36 shows how much of the install base has not moved to 1.38.

    View source ↗
  3. 5mo ago

    One ONVIF module replaces four vendor implementations

    Four separate vendor-specific ONVIF control implementations collapse into a single module, with automatic SSL verification fallback for self-signed camera certificates and configurable clock drift handling. This is the consolidation work the 1.38 redesign made possible, arriving two weeks after the release itself.

    View source ↗
  4. 6mo ago

    1.38 adds RBAC, WebRTC, and splits monitor functions

    ⚡ SPARK

    The release that defines the current line and everything patched since. Its monitor redesign is what makes the later ONVIF consolidation coherent, and its access control changes are what a multi-user deployment was previously missing entirely.

    View source ↗
  5. 7mo ago

    FFmpeg 8.0 build fixes on the legacy branch

    Build compatibility work on 1.36: FFmpeg 8.0 support, libpcre3 replaced with libpcre2, and foreign keys dropped around the events table to let the recovery script function. Keeping an old branch compilable against current system libraries, nothing more.

    View source ↗
  6. 10mo ago

    Path handling and Debian trixie build support

    Assorted fixes to path deletion, storage path trailing slashes and the events API result limit, plus build support for a newer Debian. Ordinary legacy branch upkeep.

    View source ↗