Release 2.36.0 (#4127)

## Release Notes
Thanks to: @cgillinger, @khassel, @KristjanESPERANTO, @sonnyb9
> ⚠️ This release needs nodejs version >=22.21.1 <23 || >=24 (no change
to previous release)

[Compare to previous Release
v2.35.0](https://github.com/MagicMirrorOrg/MagicMirror/compare/v2.35.0...v2.36.0)

This release falls outside the quarterly schedule. We opted for an early
release due to:
- Security fix for the internal cors proxy
- API change of the weather provider smi
- Several bug fixes

### Breaking Changes

The cors proxy is now disabled by default. If required, it must be
explicitly enabled in the `config.js` file. See the
[documentation](https://docs.magicmirror.builders/configuration/cors.html).

### ⚠️ Security

You can find several publicly accessible MagicMirror² instances.

This should never be done. Doing so makes your entire configuration,
including secrets and API keys, publicly visible. Furthermore, it allows
attackers to target the host; this is only prevented beginning with this
release.

Public MagicMirror² instances should always run behind a reverse proxy
with authentication.

### [core]
- Prepare Release 2.36.0 (#4126)
- Allow HTTPFetcher to pass through 304 responses (#4120)
- fix(http-fetcher): fall back to reloadInterval after retries exhausted
(#4113)
- config endpoint must handle functions in module configs (#4106)
- fix replaceSecretPlaceholder (#4104)
- restrict replaceSecretPlaceholder to cors with allowWhitelist (#4102)
- fix: prevent crash when config is undefined in socket handler (#4096)
- fix cors function for alpine linux (#4091)
- fix(cors): prevent SSRF via DNS rebinding (#4090)
- add option to disable or restrict cors endpoint (#4087)
- fix: prevent SSRF via /cors endpoint by blocking private/reserved IPs
(#4084)
- chore: add permissions section to enforce pull-request rules workflow
(#4079)
- update version for develop

### [dependencies]
- update dependencies (#4124)
- chore: update dependencies (#4088)
- refactor: enable ESLint rule "no-unused-vars" and handle related
issues (#4080)

### [modules/newsfeed]
- fix(newsfeed): prevent duplicate parse error callback when using
pipeline (#4083)

### [modules/updatenotification]
- fix(updatenotification): harden git command execution + simplify
checkUpdates (#4115)
- fix(tests): correct import path for git_helper module in
updatenotification tests (#4078)

### [modules/weather]
- fix(weather): use nearest openmeteo hourly data (#4123)
- fix(weather): avoid loading state after reconnect (#4121)
- weather: fix UV index display and add WeatherFlow precipitation
(#4108)
- fix(weather): restore OpenWeatherMap v2.5 support (#4101)
- fix(weather): use stable instanceId to prevent duplicate fetchers
(#4092)
- SMHI: migrate to SNOW1gv1 API (replace deprecated PMP3gv2) (#4082)

### [testing]
- ci(actions): set explicit token permissions (#4114)
- fix(http_fetcher): use undici.fetch when dispatcher is present (#4097)
- ci(codeql): also scan develop branch on push and PR (#4086)
- refactor: replace implicit global config with explicit global.config
(#4085)

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: sam detweiler <sdetweil@gmail.com>
Co-authored-by: Kristjan ESPERANTO <35647502+KristjanESPERANTO@users.noreply.github.com>
Co-authored-by: Veeck <github@veeck.de>
Co-authored-by: veeck <gitkraken@veeck.de>
Co-authored-by: Magnus <34011212+MagMar94@users.noreply.github.com>
Co-authored-by: Ikko Eltociear Ashimine <eltociear@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: DevIncomin <56730075+Developer-Incoming@users.noreply.github.com>
Co-authored-by: Nathan <n8nyoung@gmail.com>
Co-authored-by: mixasgr <mixasgr@users.noreply.github.com>
Co-authored-by: Savvas Adamtziloglou <savvas-gr@greeklug.gr>
Co-authored-by: Konstantinos <geraki@gmail.com>
Co-authored-by: OWL4C <124401812+OWL4C@users.noreply.github.com>
Co-authored-by: BugHaver <43462320+bughaver@users.noreply.github.com>
Co-authored-by: BugHaver <43462320+lsaadeh@users.noreply.github.com>
Co-authored-by: Bugsounet - Cédric <github@bugsounet.fr>
Co-authored-by: Koen Konst <koenspero@gmail.com>
Co-authored-by: Koen Konst <c.h.konst@avisi.nl>
Co-authored-by: dathbe <github@beffa.us>
Co-authored-by: Marcel <m-idler@users.noreply.github.com>
Co-authored-by: Kevin G. <crazylegstoo@gmail.com>
Co-authored-by: Jboucly <33218155+jboucly@users.noreply.github.com>
Co-authored-by: Jboucly <contact@jboucly.fr>
Co-authored-by: Jarno <54169345+jarnoml@users.noreply.github.com>
Co-authored-by: Jordan Welch <JordanHWelch@gmail.com>
Co-authored-by: Blackspirits <blackspirits@gmail.com>
Co-authored-by: Samed Ozdemir <samed@xsor.io>
Co-authored-by: in-voker <58696565+in-voker@users.noreply.github.com>
Co-authored-by: Andrés Vanegas Jiménez <142350+angeldeejay@users.noreply.github.com>
Co-authored-by: cgillinger <christian.gillinger@gmail.com>
Co-authored-by: Sonny B <43247590+sonnyb9@users.noreply.github.com>
Co-authored-by: sonnyb9 <sonnyb9@users.noreply.github.com>

defaultmodules/updatenotification/git_helper.js

@@ -1,5 +1,5 @@
 const util = require("node:util");
-const exec = util.promisify(require("node:child_process").exec);
+const execFile = util.promisify(require("node:child_process").execFile);
 const fs = require("node:fs");
 const path = require("node:path");
 const Log = require("logger");
@@ -14,14 +14,14 @@ class GitHelper {
 		return new RegExp(`s*([a-z,0-9]+[.][.][a-z,0-9]+)  ${branch}`, "g");
 	}
 
-	async execShell (command) {
-		const { stdout = "", stderr = "" } = await exec(command);
+	async execGit (moduleFolder, ...args) {
+		const { stdout = "", stderr = "" } = await execFile("git", args, { cwd: moduleFolder });
 
 		return { stdout, stderr };
 	}
 
 	async isGitRepo (moduleFolder) {
-		const { stderr } = await this.execShell(`cd ${moduleFolder} && git remote -v`);
+		const { stderr } = await this.execGit(moduleFolder, "remote", "-v");
 
 		if (stderr) {
 			Log.error(`Failed to fetch git data for ${moduleFolder}: ${stderr}`);
@@ -51,7 +51,7 @@ class GitHelper {
 				// Folder has .git and has at least one git remote, watch this folder
 				this.gitRepos.push({ module: moduleName, folder: moduleFolder });
 			}
-		} catch (err) {
+		} catch {
 			// Error when directory .git doesn't exist or doesn't have any remotes
 			// This module is not managed with git, skip
 		}
@@ -69,7 +69,7 @@ class GitHelper {
 
 		if (repo.module === "MagicMirror") {
 			// the hash is only needed for the mm repo
-			const { stderr, stdout } = await this.execShell(`cd ${repo.folder} && git rev-parse HEAD`);
+			const { stderr, stdout } = await this.execGit(repo.folder, "rev-parse", "HEAD");
 
 			if (stderr) {
 				Log.error(`Failed to get current commit hash for ${repo.module}: ${stderr}`);
@@ -78,7 +78,7 @@ class GitHelper {
 			gitInfo.hash = stdout;
 		}
 
-		const { stderr, stdout } = await this.execShell(`cd ${repo.folder} && git status -sb`);
+		const { stderr, stdout } = await this.execGit(repo.folder, "status", "-sb");
 
 		if (stderr) {
 			Log.error(`Failed to get git status for ${repo.module}: ${stderr}`);
@@ -123,7 +123,7 @@ class GitHelper {
 			return gitInfo;
 		}
 
-		const { stderr } = await this.execShell(`cd ${repo.folder} && git fetch -n --dry-run`);
+		const { stderr } = await this.execGit(repo.folder, "fetch", "-n", "--dry-run");
 
 		// example output:
 		// From https://github.com/MagicMirrorOrg/MagicMirror
@@ -140,7 +140,7 @@ class GitHelper {
 
 		// get behind with refs
 		try {
-			const { stdout } = await this.execShell(`cd ${repo.folder} && git rev-list --ancestry-path --count ${refDiff}`);
+			const { stdout } = await this.execGit(repo.folder, "rev-list", "--ancestry-path", "--count", refDiff);
 			gitInfo.behind = parseInt(stdout);
 
 			// for MagicMirror-Repo and "master" branch avoid getting notified when no tag is in refDiff
@@ -148,14 +148,14 @@ class GitHelper {
 			if (gitInfo.behind > 0 && gitInfo.module === "MagicMirror" && gitInfo.current === "master") {
 				let tagList = "";
 				try {
-					const { stdout } = await this.execShell(`cd ${repo.folder} && git ls-remote -q --tags --refs`);
+					const { stdout } = await this.execGit(repo.folder, "ls-remote", "-q", "--tags", "--refs");
 					tagList = stdout.trim();
 				} catch (err) {
 					Log.error(`Failed to get tag list for ${repo.module}: ${err}`);
 				}
 				// check if tag is between commits and only report behind > 0 if so
 				try {
-					const { stdout } = await this.execShell(`cd ${repo.folder} && git rev-list --ancestry-path ${refDiff}`);
+					const { stdout } = await this.execGit(repo.folder, "rev-list", "--ancestry-path", refDiff);
 					let cnt = 0;
 					for (const ref of stdout.trim().split("\n")) {
 						if (tagList.includes(ref)) cnt++; // tag found
@@ -193,19 +193,15 @@ class GitHelper {
 		return this.gitResultList;
 	}
 
-	async checkUpdates () {
-		var updates = [];
+	checkUpdates () {
+		const updates = [];
 
-		const allRepos = await this.gitResultList.map((module) => {
-			return new Promise((resolve) => {
-				if (module.behind > 0 && module.module !== "MagicMirror") {
-					Log.info(`Update found for module: ${module.module}`);
-					updates.push(module);
-				}
-				resolve(module);
-			});
-		});
-		await Promise.all(allRepos);
+		for (const moduleInfo of this.gitResultList) {
+			if (moduleInfo.behind > 0 && moduleInfo.module !== "MagicMirror") {
+				Log.info(`Update found for module: ${moduleInfo.module}`);
+				updates.push(moduleInfo);
+			}
+		}
 
 		return updates;
 	}

defaultmodules/updatenotification/update_helper.js

@@ -113,7 +113,7 @@ class Updater {
 		Log.info(`Updating ${module.name}...`);
 
 		return new Promise((resolve) => {
-			Exec(Command, { cwd: modulePath, timeout: this.timeout }, (error, stdout, stderr) => {
+			Exec(Command, { cwd: modulePath, timeout: this.timeout }, (error, stdout) => {
 				if (error) {
 					Log.error(`exec error: ${error}`);
 					Result.error = true;
@@ -143,7 +143,7 @@ class Updater {
 	pm2Restart () {
 		Log.info("[PM2] restarting MagicMirror...");
 		const pm2 = require("pm2");
-		pm2.restart(this.PM2Id, (err, proc) => {
+		pm2.restart(this.PM2Id, (err) => {
 			if (err) {
 				Log.error("[PM2] restart Error", err);
 			}