2 Commits

Author	SHA1	Message	Date
Karsten Hassel	fb41d24ef5	Release 2.36.0 (#4127) ... ## Release Notes Thanks to: @cgillinger, @khassel, @KristjanESPERANTO, @sonnyb9 > ⚠️ This release needs nodejs version >=22.21.1 <23 || >=24 (no change to previous release) [Compare to previous Release v2.35.0](https://github.com/MagicMirrorOrg/MagicMirror/compare/v2.35.0...v2.36.0) This release falls outside the quarterly schedule. We opted for an early release due to: - Security fix for the internal cors proxy - API change of the weather provider smi - Several bug fixes ### Breaking Changes The cors proxy is now disabled by default. If required, it must be explicitly enabled in the `config.js` file. See the [documentation](https://docs.magicmirror.builders/configuration/cors.html). ### ⚠️ Security You can find several publicly accessible MagicMirror² instances. This should never be done. Doing so makes your entire configuration, including secrets and API keys, publicly visible. Furthermore, it allows attackers to target the host; this is only prevented beginning with this release. Public MagicMirror² instances should always run behind a reverse proxy with authentication. ### [core] - Prepare Release 2.36.0 (#4126) - Allow HTTPFetcher to pass through 304 responses (#4120) - fix(http-fetcher): fall back to reloadInterval after retries exhausted (#4113) - config endpoint must handle functions in module configs (#4106) - fix replaceSecretPlaceholder (#4104) - restrict replaceSecretPlaceholder to cors with allowWhitelist (#4102) - fix: prevent crash when config is undefined in socket handler (#4096) - fix cors function for alpine linux (#4091) - fix(cors): prevent SSRF via DNS rebinding (#4090) - add option to disable or restrict cors endpoint (#4087) - fix: prevent SSRF via /cors endpoint by blocking private/reserved IPs (#4084) - chore: add permissions section to enforce pull-request rules workflow (#4079) - update version for develop ### [dependencies] - update dependencies (#4124) - chore: update dependencies (#4088) - refactor: enable ESLint rule "no-unused-vars" and handle related issues (#4080) ### [modules/newsfeed] - fix(newsfeed): prevent duplicate parse error callback when using pipeline (#4083) ### [modules/updatenotification] - fix(updatenotification): harden git command execution + simplify checkUpdates (#4115) - fix(tests): correct import path for git_helper module in updatenotification tests (#4078) ### [modules/weather] - fix(weather): use nearest openmeteo hourly data (#4123) - fix(weather): avoid loading state after reconnect (#4121) - weather: fix UV index display and add WeatherFlow precipitation (#4108) - fix(weather): restore OpenWeatherMap v2.5 support (#4101) - fix(weather): use stable instanceId to prevent duplicate fetchers (#4092) - SMHI: migrate to SNOW1gv1 API (replace deprecated PMP3gv2) (#4082) ### [testing] - ci(actions): set explicit token permissions (#4114) - fix(http_fetcher): use undici.fetch when dispatcher is present (#4097) - ci(codeql): also scan develop branch on push and PR (#4086) - refactor: replace implicit global config with explicit global.config (#4085) --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: sam detweiler <sdetweil@gmail.com> Co-authored-by: Kristjan ESPERANTO <35647502+KristjanESPERANTO@users.noreply.github.com> Co-authored-by: Veeck <github@veeck.de> Co-authored-by: veeck <gitkraken@veeck.de> Co-authored-by: Magnus <34011212+MagMar94@users.noreply.github.com> Co-authored-by: Ikko Eltociear Ashimine <eltociear@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: DevIncomin <56730075+Developer-Incoming@users.noreply.github.com> Co-authored-by: Nathan <n8nyoung@gmail.com> Co-authored-by: mixasgr <mixasgr@users.noreply.github.com> Co-authored-by: Savvas Adamtziloglou <savvas-gr@greeklug.gr> Co-authored-by: Konstantinos <geraki@gmail.com> Co-authored-by: OWL4C <124401812+OWL4C@users.noreply.github.com> Co-authored-by: BugHaver <43462320+bughaver@users.noreply.github.com> Co-authored-by: BugHaver <43462320+lsaadeh@users.noreply.github.com> Co-authored-by: Bugsounet - Cédric <github@bugsounet.fr> Co-authored-by: Koen Konst <koenspero@gmail.com> Co-authored-by: Koen Konst <c.h.konst@avisi.nl> Co-authored-by: dathbe <github@beffa.us> Co-authored-by: Marcel <m-idler@users.noreply.github.com> Co-authored-by: Kevin G. <crazylegstoo@gmail.com> Co-authored-by: Jboucly <33218155+jboucly@users.noreply.github.com> Co-authored-by: Jboucly <contact@jboucly.fr> Co-authored-by: Jarno <54169345+jarnoml@users.noreply.github.com> Co-authored-by: Jordan Welch <JordanHWelch@gmail.com> Co-authored-by: Blackspirits <blackspirits@gmail.com> Co-authored-by: Samed Ozdemir <samed@xsor.io> Co-authored-by: in-voker <58696565+in-voker@users.noreply.github.com> Co-authored-by: Andrés Vanegas Jiménez <142350+angeldeejay@users.noreply.github.com> Co-authored-by: cgillinger <christian.gillinger@gmail.com> Co-authored-by: Sonny B <43247590+sonnyb9@users.noreply.github.com> Co-authored-by: sonnyb9 <sonnyb9@users.noreply.github.com>	2026-04-30 22:49:25 +02:00
sam detweiler	b742e839be	Release 2.34.0 (#3999) ... Thanks to: @Blackspirits, @Crazylegstoo, @jarnoml, @jboucly, @JHWelch, @khassel, @KristjanESPERANTO, @rejas, @sdetweil, @xsorifc28 ⚠️ This release needs nodejs version >=22.21.1 <23 || >=24 [Compare to previous Release v2.33.0](https://github.com/MagicMirrorOrg/MagicMirror/compare/v2.33.0...develop) [core] Prepare Release 2.34.0 (https://github.com/MagicMirrorOrg/MagicMirror/pull/3998) dependency update + adjust Playwright setup + fix linter issue (https://github.com/MagicMirrorOrg/MagicMirror/pull/3994) demo with gif (https://github.com/MagicMirrorOrg/MagicMirror/pull/3995) [core] fix: allow browser globals in config files (https://github.com/MagicMirrorOrg/MagicMirror/pull/3992) [core] fix: restore --ozone-platform=wayland flag for reliable Wayland support (https://github.com/MagicMirrorOrg/MagicMirror/pull/3989) [core] auto create release notes with every push on develop (https://github.com/MagicMirrorOrg/MagicMirror/pull/3985) [core] chore: simplify Wayland start script (https://github.com/MagicMirrorOrg/MagicMirror/pull/3974) [gitignore] restore the old Git behavior for the default modules (https://github.com/MagicMirrorOrg/MagicMirror/pull/3968) [core] configure cspell to check default modules only and fix typos (https://github.com/MagicMirrorOrg/MagicMirror/pull/3955) [gitignore] restoring the old Git behavior for the CSS directory (https://github.com/MagicMirrorOrg/MagicMirror/pull/3954) feat(core): add server:watch script with automatic restart on file changes (https://github.com/MagicMirrorOrg/MagicMirror/pull/3920) [check_config] refactor: improve error handling (https://github.com/MagicMirrorOrg/MagicMirror/pull/3927) refactor: replace express-ipfilter with lightweight custom middleware (https://github.com/MagicMirrorOrg/MagicMirror/pull/3917) refactor: replace module-alias dependency with internal alias resolver (https://github.com/MagicMirrorOrg/MagicMirror/pull/3893) [dependencies] [chore] update dependencies and min. node version (https://github.com/MagicMirrorOrg/MagicMirror/pull/3986) [core] bump dependencies into december (https://github.com/MagicMirrorOrg/MagicMirror/pull/3982) Bump actions/checkout from 5 to 6 (https://github.com/MagicMirrorOrg/MagicMirror/pull/3972) Update deps, unpin parse5 (https://github.com/MagicMirrorOrg/MagicMirror/pull/3934) [core] Update deps and pin jsdom to v27.0.0 (https://github.com/MagicMirrorOrg/MagicMirror/pull/3925) chore: update dependencies (https://github.com/MagicMirrorOrg/MagicMirror/pull/3921) update deps, exclude node v23 (https://github.com/MagicMirrorOrg/MagicMirror/pull/3916) remove eslint warnings, add npm publish process to Collaboration.md (https://github.com/MagicMirrorOrg/MagicMirror/pull/3913) feat: add ESlint rule no-sparse-arrays for config check (https://github.com/MagicMirrorOrg/MagicMirror/pull/3911) chore: bump dependencies into october (https://github.com/MagicMirrorOrg/MagicMirror/pull/3909) [logging] logger: add calling filename as prefix on server side (https://github.com/MagicMirrorOrg/MagicMirror/pull/3926) [logger] Add prefixes to most Log messages (https://github.com/MagicMirrorOrg/MagicMirror/pull/3923) [modules/alert] Add new pt and pt-BR translations for Alert module and update global PT strings (https://github.com/MagicMirrorOrg/MagicMirror/pull/3965) [modules/calendar] add checksum to test whether calendar event list changed (https://github.com/MagicMirrorOrg/MagicMirror/pull/3988) [calendar] fix: prevent excessive fetching on client reload and refactor calendarfetcherutils.js (https://github.com/MagicMirrorOrg/MagicMirror/pull/3976) [calendar] refactor: migrate CalendarFetcher to ES6 class and improve error handling (https://github.com/MagicMirrorOrg/MagicMirror/pull/3959) [calendar] Show repeatingCountTitle only if yearDiff > 0 (https://github.com/MagicMirrorOrg/MagicMirror/pull/3949) [tests] suppress debug logs in CI environment + improve calendar symbol test stability (https://github.com/MagicMirrorOrg/MagicMirror/pull/3941) [calendar] chore: remove requiresVersion: "2.1.0" (https://github.com/MagicMirrorOrg/MagicMirror/pull/3932) [calendar] test: remove "Recurring event per timezone" test (https://github.com/MagicMirrorOrg/MagicMirror/pull/3929) [modules/compliments] [compliments] refactor: optimize loadComplimentFile method and add unit tests (https://github.com/MagicMirrorOrg/MagicMirror/pull/3969) fix: set compliments remote file minimum delay to 15 minutes (https://github.com/MagicMirrorOrg/MagicMirror/pull/3970) [compliments] fix: duplicate query param "?" in compliments module refresh url (https://github.com/MagicMirrorOrg/MagicMirror/pull/3967) [modules/newsfeed] [newsfeed] fix header layout issue (https://github.com/MagicMirrorOrg/MagicMirror/pull/3946) [modules/weather] [weatherprovider] update subclass language use override (https://github.com/MagicMirrorOrg/MagicMirror/pull/3914) [weather] fix wind-icon not showing in pirateweather (https://github.com/MagicMirrorOrg/MagicMirror/pull/3957) [weather] add error handling to weather fetch functions, including cors (https://github.com/MagicMirrorOrg/MagicMirror/pull/3791) remove deprecated ukmetoffice datapoint provider, cleanup .gitignore (https://github.com/MagicMirrorOrg/MagicMirror/pull/3952) fixes problems with daylight-saving-time in weather provider openmeteo (https://github.com/MagicMirrorOrg/MagicMirror/pull/3931) Fix for envcanada Provider to use updated Env Canada URL (https://github.com/MagicMirrorOrg/MagicMirror/pull/3919) [weather] feat: add configurable forecast date format option (https://github.com/MagicMirrorOrg/MagicMirror/pull/3918) [testing] testing: update "Enforce Pull-Request Rules" workflow (https://github.com/MagicMirrorOrg/MagicMirror/pull/3987) [core] refactor: replace XMLHttpRequest with fetch and migrate e2e tests to Playwright (https://github.com/MagicMirrorOrg/MagicMirror/pull/3950) [test] replace node-libgpiod with serialport in electron-rebuild workflow (https://github.com/MagicMirrorOrg/MagicMirror/pull/3945) [ci] Add concurrency to automated tests workflow to cancel outdated runs (https://github.com/MagicMirrorOrg/MagicMirror/pull/3943) [tests] migrate from jest to vitest (https://github.com/MagicMirrorOrg/MagicMirror/pull/3940) --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Karsten Hassel <hassel@gmx.de> Co-authored-by: Kristjan ESPERANTO <35647502+KristjanESPERANTO@users.noreply.github.com> Co-authored-by: Ryan Williams <65094007+ryan-d-williams@users.noreply.github.com> Co-authored-by: Veeck <github@veeck.de> Co-authored-by: Bugsounet - Cédric <github@bugsounet.fr> Co-authored-by: Marc Landis <dirk.rettschlag@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: HeikoGr <20295490+HeikoGr@users.noreply.github.com> Co-authored-by: Pedro Lamas <pedrolamas@gmail.com> Co-authored-by: veeck <gitkraken@veeck.de> Co-authored-by: Magnus <34011212+MagMar94@users.noreply.github.com> Co-authored-by: Ikko Eltociear Ashimine <eltociear@gmail.com> Co-authored-by: DevIncomin <56730075+Developer-Incoming@users.noreply.github.com> Co-authored-by: Nathan <n8nyoung@gmail.com> Co-authored-by: mixasgr <mixasgr@users.noreply.github.com> Co-authored-by: Savvas Adamtziloglou <savvas-gr@greeklug.gr> Co-authored-by: Konstantinos <geraki@gmail.com> Co-authored-by: OWL4C <124401812+OWL4C@users.noreply.github.com> Co-authored-by: BugHaver <43462320+bughaver@users.noreply.github.com> Co-authored-by: BugHaver <43462320+lsaadeh@users.noreply.github.com> Co-authored-by: Koen Konst <koenspero@gmail.com> Co-authored-by: Koen Konst <c.h.konst@avisi.nl> Co-authored-by: dathbe <github@beffa.us> Co-authored-by: Marcel <m-idler@users.noreply.github.com> Co-authored-by: Kevin G. <crazylegstoo@gmail.com> Co-authored-by: Jboucly <33218155+jboucly@users.noreply.github.com> Co-authored-by: Jboucly <contact@jboucly.fr> Co-authored-by: Jarno <54169345+jarnoml@users.noreply.github.com> Co-authored-by: Jordan Welch <JordanHWelch@gmail.com> Co-authored-by: Blackspirits <blackspirits@gmail.com> Co-authored-by: Samed Ozdemir <samed@xsor.io>	2026-01-01 08:45:36 -06:00