mirror of
https://github.com/MichMich/MagicMirror.git
synced 2026-07-21 02:06:50 -07:00
develop
5412 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Kristjan ESPERANTO
|
469f3bf0cd |
chore: update dependencies + adapt calendar tests (#4211)
I updated dependencies (including `node-ical` to 0.27.0), which broke 2 tests. It's not a bug in `node-ical`, our code, or the tests - `node-ical` just switched its CJS build to non-configurable getters, so `vi.spyOn` on the module could no longer redefine them. I adjusted the two affected tests to use real invalid input instead of mocking, keeping the original test intention. No production code changes. Full suite passes again. |
||
|
Kristjan ESPERANTO
|
f246b0facd |
refactor: consolidate electron bootstrap into async function (#4210)
Mainly I wanted to replace the two not-so-pretty nested `.then()` promise chains at the bottom of `js/electron.js` with a proper `async` function. While I was at that file, optimized two JSdocs and did a small style optimization. No functional changes intended. |
||
 ago1776
|
e368fd6c8c | fix(calendar): sliced multi-day events start at 00:00, not 23:59 (#4208) | ||
 dependabot[bot]
|
f5ef002905 |
Bump actions/setup-node from 6 to 7 (#4204)
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6 to 7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/setup-node/releases">actions/setup-node's releases</a>.</em></p> <blockquote> <h2>v7.0.0</h2> <h2>What's Changed</h2> <h3>Enhancements:</h3> <ul> <li>Add cache-primary-key and cache-matched-key as outputs by <a href="https://github.com/gowridurgad"><code>@gowridurgad</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1577">actions/setup-node#1577</a></li> <li>Migrate to ESM and upgrade dependencies by <a href="https://github.com/gowridurgad"><code>@gowridurgad</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1574">actions/setup-node#1574</a></li> </ul> <h3>Bug fixes:</h3> <ul> <li>Remove dummy NODE_AUTH_TOKEN export by <a href="https://github.com/gowridurgad"><code>@gowridurgad</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1558">actions/setup-node#1558</a></li> <li>Only use <code>mirrorToken</code> in <code>getManifest</code> if it's provided by <a href="https://github.com/deiga"><code>@deiga</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1548">actions/setup-node#1548</a></li> </ul> <h3>Documentation updates:</h3> <ul> <li>Add documentation for publishing to npm with Trusted Publisher (OIDC) by <a href="https://github.com/chiranjib-swain"><code>@chiranjib-swain</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1536">actions/setup-node#1536</a></li> <li>docs: Update restore-only cache documentation by <a href="https://github.com/priya-kinthali"><code>@priya-kinthali</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1550">actions/setup-node#1550</a></li> <li>docs: Update caching recommendations to mitigate cache poisoning risks by <a href="https://github.com/chiranjib-swain"><code>@chiranjib-swain</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1567">actions/setup-node#1567</a></li> </ul> <h3>Dependency update:</h3> <ul> <li>Upgrade <code>@actions/cache</code> to 5.1.0, log cache write denied by <a href="https://github.com/jasongin"><code>@jasongin</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1569">actions/setup-node#1569</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/chiranjib-swain"><code>@chiranjib-swain</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-node/pull/1536">actions/setup-node#1536</a></li> <li><a href="https://github.com/deiga"><code>@deiga</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-node/pull/1548">actions/setup-node#1548</a></li> <li><a href="https://github.com/jasongin"><code>@jasongin</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-node/pull/1569">actions/setup-node#1569</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-node/compare/v6...v7.0.0">https://github.com/actions/setup-node/compare/v6...v7.0.0</a></p> <h2>v6.5.0</h2> <h2>What's Changed</h2> <ul> <li>Update <code>@actions/cache</code> to 5.1.0 and add security overrides for undici and fast-xml-parser by <a href="https://github.com/HarithaVattikuti"><code>@HarithaVattikuti</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1579">actions/setup-node#1579</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-node/compare/v6.4.0...v6.5.0">https://github.com/actions/setup-node/compare/v6.4.0...v6.5.0</a></p> <h2>v6.4.0</h2> <h2>What's Changed</h2> <h3>Dependency updates:</h3> <ul> <li>Upgrade <a href="https://github.com/actions"><code>@actions</code></a> dependencies by <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1525">actions/setup-node#1525</a></li> <li>Update Node.js versions in versions.yml and bump package to v6.4.0 by <a href="https://github.com/priya-kinthali"><code>@priya-kinthali</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1533">actions/setup-node#1533</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Copilot"><code>@Copilot</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-node/pull/1525">actions/setup-node#1525</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-node/compare/v6...v6.4.0">https://github.com/actions/setup-node/compare/v6...v6.4.0</a></p> <h2>v6.3.0</h2> <h2>What's Changed</h2> <h3>Enhancements:</h3> <ul> <li>Support parsing <code>devEngines</code> field by <a href="https://github.com/susnux"><code>@susnux</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1283">actions/setup-node#1283</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/setup-node/commit/820762786026740c76f36085b0efc47a31fe5020"><code>8207627</code></a> Migrate to ESM and upgrade dependencies (<a href="https://redirect.github.com/actions/setup-node/issues/1574">#1574</a>)</li> <li><a href="https://github.com/actions/setup-node/commit/04be95cf3511ea51ebf9f224ddfb99cc7ab87cd4"><code>04be95c</code></a> Add cache-primary-key and cache-matched-key as outputs (<a href="https://redirect.github.com/actions/setup-node/issues/1577">#1577</a>)</li> <li><a href="https://github.com/actions/setup-node/commit/7c2c68d20d402ed6a201ada70a81341941093140"><code>7c2c68d</code></a> docs: Update caching recommendations to mitigate cache poisoning risks (<a href="https://redirect.github.com/actions/setup-node/issues/1567">#1567</a>)</li> <li><a href="https://github.com/actions/setup-node/commit/6a61c0375d66246de94630495909f12cf8dac84d"><code>6a61c03</code></a> Merge pull request <a href="https://redirect.github.com/actions/setup-node/issues/1569">#1569</a> from jasongin/update-actions-cache-5.1.0</li> <li><a href="https://github.com/actions/setup-node/commit/30eb73b41ded577900c1ebf968ef95cdf8f7434f"><code>30eb73b</code></a> Resolve high-severity audit issues</li> <li><a href="https://github.com/actions/setup-node/commit/4e1a87a501d0302f99e30e2748568adcb388d09f"><code>4e1a87a</code></a> Update dist</li> <li><a href="https://github.com/actions/setup-node/commit/360237f0c01778d0c17291f75c56d6feae4f7574"><code>360237f</code></a> Strict equality</li> <li><a href="https://github.com/actions/setup-node/commit/4f8aac5beb2f0854bc79651567a18c67eb0b9de3"><code>4f8aac5</code></a> Bump <code>@actions/cache</code> to 5.1.0, log cache write denied</li> <li><a href="https://github.com/actions/setup-node/commit/f4a67bbeca970f103397d3d2b9462cf787cd2980"><code>f4a67bb</code></a> Only use <code>mirrorToken</code> in <code>getManifest</code> if it's provided (<a href="https://redirect.github.com/actions/setup-node/issues/1548">#1548</a>)</li> <li><a href="https://github.com/actions/setup-node/commit/0355742c943ddb13ca8a6b700f824231caa91e75"><code>0355742</code></a> Remove dummy NODE_AUTH_TOKEN export (<a href="https://redirect.github.com/actions/setup-node/issues/1558">#1558</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/setup-node/compare/v6...v7">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Kristjan ESPERANTO
|
4a8c1194f9 |
refactor(module): simplify and fix configMerge (#4203)
I had a hard time understanding `configMerge` - the old `arguments`
slicing and nested loops took me a while. The jsdoc didn't help much.
After it finally clicked, I rewrote it to be readable: rest param + a
simple `for...of` instead of the `while`-stack.
And there's one real behavior fix. With this default and user config:
```js
defaults: { foo: { a: 1 } }
config: { foo: [10, 20] }
```
the old code merged them into `{ foo: { 0: 10, 1: 20, a: 1 } }`. Now the
array just replaces the object -> `{ foo: [10, 20] }`.
I added a small test for that case.
Only affects modules using `configDeepMerge: true` that override an
object default with an array, so the impact is tiny.
|
||
|
Kristjan ESPERANTO
|
ed95826d19 |
refactor: convert Translator to ES module (#4202)
Another step towards ES modules: this converts `Translator` to a proper module and imports it where needed, instead of relying on it being globally available. The goal is to gradually get rid of the old global-script style in the core. It makes dependencies explicit, reduces hidden coupling and keeps the codebase easier to maintain going forward. The code change is tiny - the bigger and harder part was adapting the tests to the new loading behavior. |
||
|
Kristjan ESPERANTO
|
a489d930e1 |
chore: update dependencies (#4201)
The update of electron should fix #4199. |
||
|
Kristjan ESPERANTO
|
eab31fdbab |
docs: add CodeQL review steps and restructure after-release checklist (#4200)
After the last release, @rejas left some notes in the collaboration chat. This PR tries to address them. Additionally I went through the whole file and fixed some typos and formatting. |
||
|
Kristjan ESPERANTO
|
df6170c596 |
refactor: centralize server port resolution (#4198)
I took a look at the last remaining FIXME comment in the code - the one in `js/app.js` pointing to PR #673. It's from 2017 and was already flagged as a hotfix back then. The problem: `MM_PORT` got written into a global `global.mmPort` that was then read inconsistently across the code - sometimes via the global, sometimes straight from `process.env`, plus separate logic in `defaults.js`. Three ways to get the same port. I pulled this into a single `getServerPort()` helper (`MM_PORT` -> `config.port` -> `8080`) and switched `app.js`, `defaults.js`, `server.js`, `electron.js` and both serveronly files over to it. The global is gone now. Basically the behavior should be unchanged. |
||
 Karsten Hassel
|
0bb9b5ff42 |
add test if install works for minimal node version (#4197)
and update minimal node version to `v22.22.2` Background: The latest release requires node `v22.22.2` because this version is required by a dev dependency, see https://forum.magicmirror.builders/post/131522 I added a new test for this (I didn't want to add another version to the test matrix ...) so that we see needed minimum node version upgrades earlier on develop (and not after release). |
||
|
Kristjan ESPERANTO
|
cdab7a7ea3 |
refactor: use const instead of let for variable declarations (#4196)
This replaces `let` with `const` for variable declarations where it was possible. Using `const` [is considered best practice](https://www.xjavascript.com/blog/in-javascript-why-should-i-usually-prefer-const-to-let/#5-best-practices-const-first-let-second). I have enabled the corresponding ESLint rule and let the ESLint auto-fix the "wrong" usages of `let`. |
||
|
Kristjan ESPERANTO
|
3e223b7fad |
refactor: replace Loader object with named exports (#4195)
This PR removes the Loader wrapper object and switches to direct named exports (`loadModules`, `loadFileForModule`). It keeps behavior the same, but makes the API simpler and more idiomatic for ESM. This was reported in a PR comment by **github-code-quality** here https://github.com/MagicMirrorOrg/MagicMirror/pull/4194#pullrequestreview-4612392191. |
||
|
dependabot[bot]
|
503c171371 |
Bump electron from 42.5.2 to 43.0.0 (#4192)
Bumps [electron](https://github.com/electron/electron) from 42.5.2 to 43.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/electron/electron/releases">electron's releases</a>.</em></p> <blockquote> <h2>electron v43.0.0</h2> <h1>Release Notes for v43.0.0</h1> <h2>Stack Upgrades</h2> <ul> <li>Chromium <code>150.0.7871.46</code> <ul> <li><a href="https://developer.chrome.com/blog/new-in-chrome-146/">New in 150</a></li> <li><a href="https://developer.chrome.com/blog/new-in-chrome-145/">New in 149</a></li> </ul> </li> <li>Node <code>v24.147.0</code> <ul> <li><a href="https://nodejs.org/en/blog/release/v24.17.0/">Node 24.17.0 blog post</a></li> </ul> </li> <li>V8 <code>15.0</code></li> </ul> <h2>Breaking Changes</h2> <ul> <li>File downloads will open by default in the user's Downloads folder (or Home directory if Downloads doesn't exist). <a href="https://redirect.github.com/electron/electron/pull/49868">#49868</a></li> <li>Fix: If a <code>nativeImage</code> was passed an image with a color profile, its pixel values will now be normalized to SRGB. This ensures that two visually identical images after color space application will receive similar pixel values when converted to a <code>nativeImage</code>. <a href="https://redirect.github.com/electron/electron/pull/51565">#51565</a></li> <li>On Linux, frameless windows now have rounded corners by default, just like on macOS and Windows. Rounded corners can be disabled on all platforms by setting <code>roundedCorners: false</code> on the window. <a href="https://redirect.github.com/electron/electron/pull/52111">#52111</a></li> <li>Removed <code>showHiddenFiles</code> support from the <code>dialog</code> API on Linux. <a href="https://redirect.github.com/electron/electron/pull/51880">#51880</a></li> </ul> <h2>Features</h2> <h3>Additions</h3> <ul> <li>Added Clone method to WebContents. <a href="https://redirect.github.com/electron/electron/pull/49959">#49959</a></li> <li>Added JS stack trace to crash reports on renderer OOM. <a href="https://redirect.github.com/electron/electron/pull/50043">#50043</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/50911">42</a>)<!-- raw HTML omitted --></li> <li>Added Linux support for <code>app.getApplicationInfoForProtocol()</code>. <a href="https://redirect.github.com/electron/electron/pull/51297">#51297</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/51680">42</a>)<!-- raw HTML omitted --></li> <li>Added Notification.remove(), removeAll(), and removeGroup() static methods for macOS. <a href="https://redirect.github.com/electron/electron/pull/51690">#51690</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/51691">42</a>)<!-- raw HTML omitted --></li> <li>Added <code>Notification.getHistory()</code> for macOS, allowing developers to restore all delivered notifications still present in Notification Center. <a href="https://redirect.github.com/electron/electron/pull/50325">#50325</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/51123">42</a>)<!-- raw HTML omitted --></li> <li>Added <code>accessibilityLabel</code> property to <code>MenuItem</code> constructor options and properties for defining screen-reader-friendly labels. <a href="https://redirect.github.com/electron/electron/pull/50240">#50240</a></li> <li>Added <code>allowExtensions</code> privilege to <code>protocol.registerSchemesAsPrivileged()</code> to enable Chrome extensions on custom protocols. <a href="https://redirect.github.com/electron/electron/pull/49951">#49951</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/50588">40</a>, <a href="https://redirect.github.com/electron/electron/pull/50529">41</a>, <a href="https://redirect.github.com/electron/electron/pull/50530">42</a>)<!-- raw HTML omitted --></li> <li>Added <code>app.configureWebAuthn()</code> to enable the Touch ID platform authenticator for WebAuthn on macOS, and a <code>select-webauthn-account</code> session event for choosing between multiple discoverable credentials. <a href="https://redirect.github.com/electron/electron/pull/51255">#51255</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/51412">41</a>, <a href="https://redirect.github.com/electron/electron/pull/51411">42</a>)<!-- raw HTML omitted --></li> <li>Added <code>globalShortcut.setSuspended()</code> and <code>globalShortcut.isSuspended()</code> methods to temporarily suspend and resume global shortcut handling. <a href="https://redirect.github.com/electron/electron/pull/50425">#50425</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/50777">42</a>)<!-- raw HTML omitted --></li> <li>Added <code>id</code> and <code>groupId</code> options to the Notification constructor on macOS. <code>id</code> allows custom identifiers for notifications, and <code>groupId</code> visually groups notifications together in Notification Center. <a href="https://redirect.github.com/electron/electron/pull/50097">#50097</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/50304">42</a>)<!-- raw HTML omitted --></li> <li>Added <code>nv12</code> OSR pixel format support for professional use. <a href="https://redirect.github.com/electron/electron/pull/49799">#49799</a></li> <li>Added <code>view.setBackgroundBlur</code>. <a href="https://redirect.github.com/electron/electron/pull/51076">#51076</a></li> <li>Added <code>webContents.copyVideoFrameAt(x, y)</code> and <code>webContents.saveVideoFrameAs(x, y)</code> methods. <a href="https://redirect.github.com/electron/electron/pull/48149">#48149</a></li> <li>Added id, groupId, and groupTitle support for Windows notifications. <a href="https://redirect.github.com/electron/electron/pull/50328">#50328</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/50895">42</a>)<!-- raw HTML omitted --></li> <li>Added nativeTheme.shouldDifferentiateWithoutColor on macOS. <a href="https://redirect.github.com/electron/electron/pull/49912">#49912</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/50408">41</a>, <a href="https://redirect.github.com/electron/electron/pull/50409">42</a>)<!-- raw HTML omitted --></li> <li>Added session support to net module requests from utility process. <a href="https://redirect.github.com/electron/electron/pull/51279">#51279</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/51698">42</a>)<!-- raw HTML omitted --></li> <li>Added support for heap profiling via <code>contentTracing.enableHeapProfiling()</code>. <a href="https://redirect.github.com/electron/electron/pull/50826">#50826</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/51178">41</a>, <a href="https://redirect.github.com/electron/electron/pull/51162">42</a>)<!-- raw HTML omitted --></li> <li>Added support for importing shared textures using the nv16 pixel format. <a href="https://redirect.github.com/electron/electron/pull/50728">#50728</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/51187">42</a>)<!-- raw HTML omitted --></li> <li>Added support for the <code>urgency</code> option in Notifications on Windows. <a href="https://redirect.github.com/electron/electron/pull/50225">#50225</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/50382">41</a>, <a href="https://redirect.github.com/electron/electron/pull/50383">42</a>)<!-- raw HTML omitted --></li> <li>Added support for using a proxy during yarn install. <a href="https://redirect.github.com/electron/electron/pull/50322">#50322</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/50349">39</a>, <a href="https://redirect.github.com/electron/electron/pull/50352">40</a>, <a href="https://redirect.github.com/electron/electron/pull/50350">41</a>, <a href="https://redirect.github.com/electron/electron/pull/50351">42</a>)<!-- raw HTML omitted --></li> <li>Allowed the <code>--experimental-inspector-network-resource</code> Node.js flag to be passed through Electron. <a href="https://redirect.github.com/electron/electron/pull/49689">#49689</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/51377">41</a>, <a href="https://redirect.github.com/electron/electron/pull/51378">42</a>)<!-- raw HTML omitted --></li> <li>Enabled ThinLTO on macOS builds. <a href="https://redirect.github.com/electron/electron/pull/51819">#51819</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/51823">42</a>)<!-- raw HTML omitted --></li> <li>Enabled profile-guided optimization for V8 builtins in release builds, improving JavaScript builtin performance (Array, String, RegExp, etc.). <a href="https://redirect.github.com/electron/electron/pull/50416">#50416</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/50575">40</a>, <a href="https://redirect.github.com/electron/electron/pull/50574">41</a>, <a href="https://redirect.github.com/electron/electron/pull/50573">42</a>)<!-- raw HTML omitted --></li> <li>Feat: SF Symbol customisation. <a href="https://redirect.github.com/electron/electron/pull/48911">#48911</a></li> <li>Fixed contentTracing module to capture Node.js trace categories. <a href="https://redirect.github.com/electron/electron/pull/50591">#50591</a></li> </ul> <h3>Improvements</h3> <ul> <li>Improved app startup performance — the main process now boots from an embedded Node.js startup snapshot, framework bundles and preload scripts are cached as compiled V8 bytecode, and sandboxed renderer startup data is pushed ahead of navigation instead of fetched via blocking IPC. Preload stack traces now show the correct file path and line number. <a href="https://redirect.github.com/electron/electron/pull/51792">#51792</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/51831">42</a>)<!-- raw HTML omitted --></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/electron/electron/commit/5147ac2d278f105ec0801c1ef021709979f6d428"><code>5147ac2</code></a> test: fix lost-event race in custom-protocol-panel devtools fixture (<a href="https://redirect.github.com/electron/electron/issues/52194">#52194</a>)</li> <li><a href="https://github.com/electron/electron/commit/765def358e8ee1ea62732e491467fe73f6f7f230"><code>765def3</code></a> ci: improve lint job code reuse (<a href="https://redirect.github.com/electron/electron/issues/52180">#52180</a>)</li> <li><a href="https://github.com/electron/electron/commit/07f97572b971a73bd1bf12430e658671c8147ed5"><code>07f9757</code></a> fix: remove 1px frame background color from the top of frameless windows on L...</li> <li><a href="https://github.com/electron/electron/commit/2e29d7f2a6c6bf117a5907b0049cda60a008a767"><code>2e29d7f</code></a> build: register Electron.app with LaunchServices before macOS tests (<a href="https://redirect.github.com/electron/electron/issues/52186">#52186</a>)</li> <li><a href="https://github.com/electron/electron/commit/3a77e4a0504f1dad462a2861cb73831a63d6cea3"><code>3a77e4a</code></a> fix: inherit iframe sandbox flags in windows opened on the OpenURL navigation...</li> <li><a href="https://github.com/electron/electron/commit/38467280183db4cfa9aa039ec047f7275b85be59"><code>3846728</code></a> chore: bump chromium to 150.0.7871.46 (43-x-y) (<a href="https://redirect.github.com/electron/electron/issues/52123">#52123</a>)</li> <li><a href="https://github.com/electron/electron/commit/c0d5334217a144264bf49633e050be17b9fa789d"><code>c0d5334</code></a> ci: calculate rerun apply patches date from first run attempt (<a href="https://redirect.github.com/electron/electron/issues/52075">#52075</a>)</li> <li><a href="https://github.com/electron/electron/commit/4a2ff4b955380b83fd15f682b382ce51fc0b1f46"><code>4a2ff4b</code></a> build: only run gn-typescript-definitions for default toolchain (<a href="https://redirect.github.com/electron/electron/issues/52165">#52165</a>)</li> <li><a href="https://github.com/electron/electron/commit/c3d3305347651ddd1d555ea2567b9e0a6a33003f"><code>c3d3305</code></a> chore: cherry-pick 1 changes from chromium (<a href="https://redirect.github.com/electron/electron/issues/52168">#52168</a>)</li> <li><a href="https://github.com/electron/electron/commit/dad4f734e82c03a268e48b4e2a8bc61910e1e8d8"><code>dad4f73</code></a> fix: use the registering session for ProtocolResponse.url requests (<a href="https://redirect.github.com/electron/electron/issues/52131">#52131</a>)</li> <li>Additional commits viewable in <a href="https://github.com/electron/electron/compare/v42.5.2...v43.0.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
 veeck
|
975f5e7914 | set next release dev number | ||
|
veeck
|
eed59d7ef2 | Merge branch 'mm_master' into mm_develop | ||
 Veeck
|
f94ba6489d |
Prepare Release 2.37.0 (#4193)
Co-authored-by: veeck <gitkraken@veeck.de> |
||
|
Karsten Hassel
|
ad0d2eed7d | update dependencies (#4191) | ||
|
dependabot[bot]
|
caccd41854 |
Bump actions/checkout from 6 to 7 (#4190)
Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v7.0.0</h2> <h2>What's Changed</h2> <ul> <li>block checking out fork pr for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li> <li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li> <li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li> <li>Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li> <li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li> <li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li> <li>getting ready for checkout v7 release by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2464">actions/checkout#2464</a></li> <li>update error wording by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2467">actions/checkout#2467</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.3...v7.0.0">https://github.com/actions/checkout/compare/v6.0.3...v7.0.0</a></p> <h2>v6.0.3</h2> <h2>What's Changed</h2> <ul> <li>Update changelog by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2357">actions/checkout#2357</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>Update changelog for v6.0.3 by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2446">actions/checkout#2446</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/yaananth"><code>@yaananth</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.3">https://github.com/actions/checkout/compare/v6...v6.0.3</a></p> <h2>v6.0.2</h2> <h2>What's Changed</h2> <ul> <li>Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2355">actions/checkout#2355</a></li> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.1...v6.0.2">https://github.com/actions/checkout/compare/v6.0.1...v6.0.2</a></p> <h2>v6.0.1</h2> <h2>What's Changed</h2> <ul> <li>Update all references from v5 and v4 to v6 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2314">actions/checkout#2314</a></li> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> <li>Clarify v6 README by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2328">actions/checkout#2328</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.1">https://github.com/actions/checkout/compare/v6...v6.0.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v7.0.0</h2> <ul> <li>Block checking out fork PR for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li> <li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li> <li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li> <li>Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li> <li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li> <li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li> </ul> <h2>v6.0.3</h2> <ul> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <h2>v6.0.2</h2> <ul> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <h2>v6.0.1</h2> <ul> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> </ul> <h2>v6.0.0</h2> <ul> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> </ul> <h2>v5.0.1</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <h2>v5.0.0</h2> <ul> <li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li> </ul> <h2>v4.3.1</h2> <ul> <li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li> </ul> <h2>v4.3.0</h2> <ul> <li>docs: update README.md by <a href="https://github.com/motss"><code>@motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li> <li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li> <li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li> <li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li> <li>Update README.md by <a href="https://github.com/nebuk89"><code>@nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li> <li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li> <li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li> </ul> <h2>v4.2.2</h2> <ul> <li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li> <li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li> </ul> <h2>v4.2.1</h2> <ul> <li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/checkout/commit/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"><code>9c091bb</code></a> update error wording (<a href="https://redirect.github.com/actions/checkout/issues/2467">#2467</a>)</li> <li><a href="https://github.com/actions/checkout/commit/1044a6dea927916f2c38ba5aeffbc0a847b1221a"><code>1044a6d</code></a> getting ready for checkout v7 release (<a href="https://redirect.github.com/actions/checkout/issues/2464">#2464</a>)</li> <li><a href="https://github.com/actions/checkout/commit/f0282184c7ce73ab54c7e4ab5a617122602e575f"><code>f028218</code></a> Bump the minor-npm-dependencies group across 1 directory with 3 updates (<a href="https://redirect.github.com/actions/checkout/issues/2462">#2462</a>)</li> <li><a href="https://github.com/actions/checkout/commit/d914b262ffc244530a203ab40decab34c3abf34d"><code>d914b26</code></a> upgrade module to esm and update dependencies (<a href="https://redirect.github.com/actions/checkout/issues/2463">#2463</a>)</li> <li><a href="https://github.com/actions/checkout/commit/537c7ef99cef6e5ddb5e7ff5d16d14510503801d"><code>537c7ef</code></a> Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid (<a href="https://redirect.github.com/actions/checkout/issues/2459">#2459</a>)</li> <li><a href="https://github.com/actions/checkout/commit/130a169078a413d3a5246a393625e8e742f387f6"><code>130a169</code></a> Bump js-yaml from 4.1.0 to 4.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2461">#2461</a>)</li> <li><a href="https://github.com/actions/checkout/commit/7d09575332117a40b46e5e020664df234cd416f3"><code>7d09575</code></a> Bump flatted from 3.3.1 to 3.4.2 (<a href="https://redirect.github.com/actions/checkout/issues/2460">#2460</a>)</li> <li><a href="https://github.com/actions/checkout/commit/0f9f3aa320cb53abeb534aeb54048075d9697a0e"><code>0f9f3aa</code></a> Bump actions/publish-immutable-action (<a href="https://redirect.github.com/actions/checkout/issues/2458">#2458</a>)</li> <li><a href="https://github.com/actions/checkout/commit/f9e715a95fcd1f9253f77dd28f11e88d2d6460c7"><code>f9e715a</code></a> block checking out fork pr for pull_request_target and workflow_run (<a href="https://redirect.github.com/actions/checkout/issues/2454">#2454</a>)</li> <li>See full diff in <a href="https://github.com/actions/checkout/compare/v6...v7">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Kristjan ESPERANTO
|
dbc7a574eb |
chore: update dependencies and adjust import path for SunCalc (#4189)
With SunCalc v2 we have to point the browser vendor mapping to the new CJS bundle. |
||
 Mike Bishop
|
7c966236a3 | fix(electron): map IPv6 :: wildcard to localhost (#4188) | ||
|
Kristjan ESPERANTO
|
9d315e1149 |
refactor(main): modernize DOM update flow with async/await (#4186)
Follow-up to #4185. This PR replaces `.then()`/`.catch()` chains in the DOM update flow with `async/await`, making the code easier to read and reason about. **What changed:** - `createDomObjects` and `MM.updateDom` are now `async`, the nested `.then()` callbacks are gone - Extracted a small `createModuleDom()` helper to keep the loop in `createDomObjects` readable - Errors in `createDomObjects` are caught in a single `try/catch` - before, a failing module could cause an unhandled Promise rejection - `updateDomWithContent` now properly awaits the full show animation before resolving. The old code called `resolve()` while the animation was still running, which was technically wrong - Fixed `@param {Promise} callback` in JSDoc - it's not a Promise, it's a plain `() => void` function |
||
|
Kristjan ESPERANTO
|
ef2c7dbb55 |
perf(calendar): pre-filter ICS data before parsing (#4168)
This adds a pre-filter that drops out-of-window non-recurring events from the raw ICS data before `node-ical` parses it. Recurring events and anything we cannot classify cheaply are kept - the existing logic handles those as before. Some calendars accumulate years of old events. Pre-filtering them reduces the amount of work `node-ical` has to do and keeps event loop lag lower. My benchmarks on a fast machine showed a small but measurable speedup (roughly 10-20% with generated test data); on a Raspberry Pi it should be significantly more noticeable. For the implementation I ended up using [`ics-filter`](https://github.com/runely/ics-filter), suggested by @rejas. I had a custom version first, but ICS date string parsing has enough complexity that it makes sense to delegate it to a package built specifically for this. I also contributed a couple of fixes to `ics-filter` along the way, and the maintainer was responsive and open to improvements, so it seems like a good fit. Solves #4103. |
||
|
Kristjan ESPERANTO
|
b9be026df6 |
refactor(main): simplify _updateDom with async/await (#4185)
`_updateDom` was wrapping its entire body in a `new Promise(resolve =>
{...})` constructor just to chain `getDom()` and
`updateDomWithContent()` together. Since `updateDomWithContent` was
already converted to async in #4182, we can now just `await` it directly
- the manual wrapper, the explicit `Promise.resolve()` normalization,
and the nested `.then().catch()` chain all become unnecessary, making
the control flow easier to follow.
Also added `.catch(Log.error)` at both call sites, since async functions
reject on error instead of swallowing it silently.
|
||
|
Kristjan ESPERANTO
|
ca7b752025 |
fix(security): prevent unauthorized secret expansion in socket payloads (#4184)
This PR attempts to fix the unauthorized secret expansion vulnerability reported in [GHSA-q4gh-4ffp-5cg8](https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-q4gh-4ffp-5cg8). Previously, if a module sent a payload through the socket containing any `**SECRET_FOO**` placeholder, the server would unconditionally expand it with the real environment variable. This meant a manipulated module could theoretically extract secrets that belonged to other modules. To prevent this, the expansion logic is now much stricter and scoped to the individual module: * In `app.js`, we now store a copy of the redacted config (`global.configRedacted`) to keep track of which module uses which secrets. * In `node_helper.js`, before handling a socket notification, we build a specific "allow-list" (`Set`) of secrets that are actually present in the calling module's config. * `replaceSecretPlaceholder` in `server_functions.js` was updated to accept this `Set` and will now only expand placeholders that the module is explicitly authorized to know. Unlisted placeholders are safely ignored. I also updated the unit tests to cover the new allow-list behavior. Since this security stuff is tricky and gives me headaches all the time, I've added more comments than usual. I've tried several ways to make it a little simpler, but unfortunately, I couldn't come up with anything easier than that. I'd appreciate it if someone could take a critical look at the logic to make sure I didn't miss anything! |
||
 Morgan McBee
|
6ab8104dda |
[newsfeed] add allowBasicHtmlTags option for basic emphasis (#4176)
**Please make sure that you have followed these 3 rules before submitting your Pull Request:** > 1. Base your pull requests against the `develop` branch. Done. > 2. Include these infos in the description: > > - Does the pull request solve a **related** issue? No > - If so, can you reference the issue like this `Fixes #<issue_number>`? > - What does the pull request accomplish? Use a list if needed. > - If it includes major visual changes please add screenshots. > Render a strict allowlist of basic formatting tags (b, strong, i, em, u) in news titles and descriptions, while neutralizing all other HTML. Feeds such as The Atlantic encode emphasis as entities (<em>), which html-to-text decoded to a literal <em> string that the template then auto-escaped, so the raw tag was shown on screen. The new opt-in allowBasicHtmlTags option (default false) sanitizes both fields by escaping everything and restoring only the exact, attribute-free allowlisted tags, so the result is safe to render and arbitrary HTML/script injection is impossible. Adds unit tests for the sanitizer and an e2e test covering rendering and an injection attempt. Before screenshot: <img width="980" height="2726" alt="before" src="https://github.com/user-attachments/assets/d1c871e1-21c5-44f9-ae40-da65c2c56f68" /> After screenshot: <img width="980" height="2726" alt="after" src="https://github.com/user-attachments/assets/22d9e86b-221c-408e-a29b-718b0e98f236" /> > 3. Please run `node --run lint:prettier` before submitting so that > style issues are fixed. Done **Note**: Sometimes the development moves very fast. It is highly recommended that you update your branch of `develop` before creating a pull request to send us your changes. This makes everyone's lives easier (including yours) and helps us out on the development team. Thanks again and have a nice day! --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> |
||
|
Karsten Hassel
|
4377071347 |
update dependencies incl. electron and revert yauzl-electron-install-fix (#4183)
Fixes electron problem from #4150 for electron v42. |
||
|
Kristjan ESPERANTO
|
e747db16d4 |
refactor(main): simplify updateDomWithContent async flow (#4182)
This keeps the same behavior, but makes the function easier to read. - moved to async/await with early returns - kept only one small Promise wrapper around the _hideModule callback - removed a duplicate speed check - cleaned up JSDoc so timing/return details are clearer No runtime change intended; hide/show sequencing stays the same. |
||
|
Kristjan ESPERANTO
|
5d11b5d73b |
fix: modules losing data after HTTP 304 responses (#4180)
When a server responds with 304 (nothing changed since last fetch), the response has no body. Several modules were trying to parse that empty body anyway - which either cleared their cached data or threw an exception. The result: a blank calendar, empty newsfeed, or missing weather data after the next refresh cycle. This was reported in the forum: https://forum.magicmirror.builders/topic/20250/calendar-events-broadcasting-nothing-showing The bug was "introduced" by #4120, which correctly started forwarding 304s to consumers - but not all were ready for it. ### Fix Skip parsing on 304 and keep the existing data as-is: - **calendar** - re-broadcasts cached events - **newsfeed** - re-broadcasts cached items - **buienradar, openmeteo, weatherflow, weathergov** - return early before calling `response.json()` |
||
|
Kristjan ESPERANTO
|
3fd1591953 |
chore: add missing core defaults (#4181)
Add defaults for config options that are already supported in core, so behavior is easier to understand and config stays consistent. This does not change runtime behavior. Refs #4159 |
||
|
Karsten Hassel
|
4492a83fe9 |
update dependencies, add electron fix in package.json (#4175)
The electron install problem is still not fixed upstream so I added
```json
"overrides": {
"yauzl": "^3.3.1"
},
```
to `package.json`. This should be reverted when fixed upstream.
|
||
|
Kristjan ESPERANTO
|
58c2a5e675 |
fix(server): enforce ipWhitelist for Socket.IO too (#4169)
ipWhitelist was only applied to HTTP routes, so Socket.IO module namespaces could still be reached from disallowed clients. This adds the same whitelist check to Socket.IO handshakes (allowRequest), and reuses the same client IP resolution for both HTTP and Socket.IO (forwarded IP is only trusted for loopback peers). Also adds tests for handshake allow/deny and forwarded-header behavior. Fixes: GHSA-w26r-fwg8-rcp3 |
||
|
Kristjan ESPERANTO
|
d203fefed1 |
feat(systeminfo): include Git hash and branch in system information log (#4167)
I suggest to add the commit hash and branch to the system information. This should help trouble shooting issues from developers. Like in #4165. ### before ``` #### System Information #### - SYSTEM: manufacturer: Micro-Star International Co., Ltd.; model: MS-7D75; virtual: false; MM: v2.37.0-develop - OS: ... ... ``` ### after ``` #### System Information #### - MM: version: v2.37.0-develop; git: 03e4eef3d; branch: develop - SYSTEM: manufacturer: Micro-Star International Co., Ltd.; model: MS-7D75; virtual: false - OS: ... ... ``` |
||
|
Kristjan ESPERANTO
|
03e4eef3d1 |
fix(updatenotification): don't spawn a child process when running under PM2 (#4166)
Previously, `nodeRestart()` would spawn a detached child and exit. Under PM2 that's a problem: PM2 also respawns on exit, so both race to bind the same port. The fix: When `process.env.pm_id` is set, just exit and let PM2 handle the restart. The spawn logic is moved into its own method so it can be tested cleanly. Partially fixes #4165 |
||
|
Kristjan ESPERANTO
|
e55b11be5d |
feat(electron): support object-based electronSwitches (#4161)
Previously, `electronSwitches` only accepted strings. This PR adds
support for object entries, allowing switches with values:
```js
electronSwitches: [
"no-sandbox",
{ "js-flags": "--max-old-space-size=8192" }
]
```
I decided to put the logic into a helper file so it can be unit-tested
independently, since electron.js itself requires a live Electron
environment and cannot be tested in isolation.
Fixes #4159
|
||
|
Kristjan ESPERANTO
|
fd687bf5fe |
feat(weather): add Buienradar provider (#4164)
This adds the weather provider Buienradar for the Netherlands and Belgium without requiring an API key. In MagicMirrorOrg/MagicMirror-Documentation#380 @plebcity shared his implementation for the old browser-side architecture. I used it as a reference to build this server-side implementation. ### Example screenshot <img width="969" height="578" alt="Ekrankopio de 2026-05-20 20-38-36" src="https://github.com/user-attachments/assets/56623ad8-7439-4047-abad-452ba2ebdcb2" /> ### Example config ```js { module: "weather", position: "top_left", header: "Buienradar - Current", config: { weatherProvider: "buienradar", type: "current", locationId: 2747891 } }, { module: "weather", position: "top_right", header: "Buienradar - Forecast", config: { weatherProvider: "buienradar", type: "forecast", locationId: 2747891 } }, { module: "weather", position: "bottom_left", header: "Buienradar - Hourly", config: { weatherProvider: "buienradar", type: "hourly", locationId: 2747891 } }, ``` ---- When this is accepted and merged I'll update the weather docs. |
||
|
Kristjan ESPERANTO
|
9a3538de01 |
chore: update dependencies (#4162)
This updates the dependencies and implements a workaround for the failing ci tests on node 26.1.0 (#4150). I'm not sure myself whether we should go with this workaround or wait for an upstream fix. |
||
|
Kristjan ESPERANTO
|
1b540aeba1 |
fix(updatenotification): use process.argv[0] as restart binary (#4163)
The restart approach I introduced in #4156 still crashes under Electron: ``` TypeError: Cannot read properties of undefined (reading 'disableHardwareAcceleration') at electron.js:18 ``` `nodeRestart()` hardcodes `node` as the interpreter, but under Electron `process.argv[0]` is the Electron binary. Spawning `node js/electron.js` causes `require("electron")` to return a string instead of the API, so `electron.app` is `undefined`. This uses `process.argv[0]` as the binary directly, which works for both Electron and plain Node. I introduced more variables for more clarity. Fixes #4154. |
||
|
Karsten Hassel
|
7abbe62cb0 | systeminformation thread not ending: move error handling from utils to app (#4160) | ||
|
Karsten Hassel
|
3c514dff3a |
fix systeminformation thread not ending (#4155)
This was introduced when running systeminformation in an own thread. If the main thread ends before (e.g. when config has errors) the systeminformation thread never ends. As this can have side effects under pm2 or docker (because the app never exits) this PR restores the old behavior. |
||
|
Kristjan ESPERANTO
|
d4a5ebe273 |
refactor: use ES module imports in browser core (#4158)
With these changes a few browser-side core files now use native ES modules. `Loader`, `MMSocket`, `Module` and `MM` can be imported directly instead of being read off `window`. `main.js` and `loader.js` are no longer wrapped in IIFEs - they're just normal modules now. `Module`, `MM` and `MMSocket` are still exposed as globals, so third-party modules that use the old API keep working. The changes are mostly structural, behavior should stay the same. A few internal helpers in `main.js` got an underscore prefix because their names clashed with public `MM` methods. ## Why The old setup relied a lot on script order: a file could use `Loader` or `MMSocket` only because another script happened to put it on `window` first. Imports make that explicit. The bigger goal is to move away from the legacy script-loading patterns - making it easier to understand and easier to test - in other words: easier to maintain. More of the core could be "cleaned up" the same way, but that would blow up this PR. For reviewing, I recommend to hide the whitespace changes. |
||
|
Kristjan ESPERANTO
|
4425f52bda |
fix(updatenotification): preserve start mode on restart (#4156)
Use current process arguments when spawning the restart command so auto-restart keeps the active runtime mode (for example `start:x11`) instead of always defaulting to `start`. This should fix #4154. |
||
|
Kristjan ESPERANTO
|
41eb17c0e3 |
refactor(core): remove old Object.assign polyfill (#4157)
Object.assign has been standard since ES2015, and all runtimes we support already provide it. Removing this keeps the client code a little cleaner. |
||
|
Kristjan ESPERANTO
|
13d51cfce9 |
CodeQL cleanup for alerts #18, #19, #20 (#4153)
Small cleanup PR to close three CodeQL alerts, without changing app behavior. - [#18](https://github.com/MagicMirrorOrg/MagicMirror/security/code-scanning/18) in `js/loader.js` - [#19](https://github.com/MagicMirrorOrg/MagicMirror/security/code-scanning/19) in `js/socketclient.js` - [#20](https://github.com/MagicMirrorOrg/MagicMirror/security/code-scanning/20) in `tests/electron/modules/calendar_spec.js` For `Loader` and `MMSocket`, make the global export explicit via `globalThis` (instead of suppressing `no-unused-vars`). For calendar tests, remove the unused debug helper `logAllText`. Also includes a tiny e2e cleanup: `MM_PORT` is cleared in `afterAll`. Outcome: Three open CodeQL alerts are addressed with small, low-risk changes. The global intent for `Loader` and `MMSocket` is explicit, dead test helper code is removed, and e2e test state is cleaned up more reliably between runs. With this, all current [code scanning issues](https://github.com/MagicMirrorOrg/MagicMirror/security/code-scanning) should be resolved in the develop branch 🎈 |
||
|
Kristjan ESPERANTO
|
79ea2633a7 |
refactor: rewrite Module as an ES6 class (#4151)
This PR rewrites `module.js` to use a native ES6 `class` instead of `Class.extend()` - the same old inheritance helper that was removed from `node_helper.js` in #4147. The normal module API stays the same: modules still use `Module.register({...})`. Internally, `Module.create()` now creates a named subclass for each module, copies over a cloned definition, and only calls `init()` when it is actually a function. Outcome: one less file in the browser bundle, no more magic `_super()` wiring, better stack traces, and tests for the module creation path that did not exist before. `module.js` is also now a plain class with no external dependencies - an intentional step towards `export default Module` when browser scripts eventually move to native ES modules. Since these changes touch the core of how modules are created, I'd appreciate a close review and any feedback on edge cases I may have missed. |
||
|
dependabot[bot]
|
b38c7b7aa2 |
Bump actions/dependency-review-action from 4 to 5 (#4152)
Bumps [actions/dependency-review-action](https://github.com/actions/dependency-review-action) from 4 to 5. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/dependency-review-action/releases">actions/dependency-review-action's releases</a>.</em></p> <blockquote> <h2>5.0.0</h2> <p>This is a new major version of the Dependency Review Action which updates the runtime to node24. This requires a minimum Actions Runner version <a href="https://github.com/actions/runner/releases/tag/v2.327.1">v2.327.1</a> to run.</p> <h2>What's Changed</h2> <ul> <li>Add .github/copilot-instructions.md for Copilot coding agent by <a href="https://github.com/ahpook"><code>@ahpook</code></a> in <a href="https://redirect.github.com/actions/dependency-review-action/pull/1067">actions/dependency-review-action#1067</a></li> <li>Update Node.js runtime from 20 to 24 by <a href="https://github.com/scottschreckengaust"><code>@scottschreckengaust</code></a> in <a href="https://redirect.github.com/actions/dependency-review-action/pull/1084">actions/dependency-review-action#1084</a></li> <li>Bump spdx-license-ids from 3.0.20 to 3.0.23 by <a href="https://github.com/mongolyy"><code>@mongolyy</code></a> in <a href="https://redirect.github.com/actions/dependency-review-action/pull/1091">actions/dependency-review-action#1091</a></li> <li>docs: bump actions/checkout from v4 to v6 in workflow examples by <a href="https://github.com/Marukome0743"><code>@Marukome0743</code></a> in <a href="https://redirect.github.com/actions/dependency-review-action/pull/1077">actions/dependency-review-action#1077</a></li> <li>fix: patched version display for advisories with non-strict semver ranges (e.g. Maven beta versions) by <a href="https://github.com/tspascoal"><code>@tspascoal</code></a> in <a href="https://redirect.github.com/actions/dependency-review-action/pull/1076">actions/dependency-review-action#1076</a></li> <li>Resolve security findings by <a href="https://github.com/AshelyTC"><code>@AshelyTC</code></a> in <a href="https://redirect.github.com/actions/dependency-review-action/pull/1094">actions/dependency-review-action#1094</a></li> <li>v5.0.0 release branch by <a href="https://github.com/ahpook"><code>@ahpook</code></a> in <a href="https://redirect.github.com/actions/dependency-review-action/pull/1098">actions/dependency-review-action#1098</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/scottschreckengaust"><code>@scottschreckengaust</code></a> made their first contribution in <a href="https://redirect.github.com/actions/dependency-review-action/pull/1084">actions/dependency-review-action#1084</a></li> <li><a href="https://github.com/mongolyy"><code>@mongolyy</code></a> made their first contribution in <a href="https://redirect.github.com/actions/dependency-review-action/pull/1091">actions/dependency-review-action#1091</a></li> <li><a href="https://github.com/Marukome0743"><code>@Marukome0743</code></a> made their first contribution in <a href="https://redirect.github.com/actions/dependency-review-action/pull/1077">actions/dependency-review-action#1077</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/dependency-review-action/compare/v4.9.0...v5.0.0">https://github.com/actions/dependency-review-action/compare/v4.9.0...v5.0.0</a></p> <h2>Dependency Review Action 4.9.0</h2> <p>This feature release contains a couple of notable changes:</p> <ul> <li>There is a new configuration option <code>show_patched_versions</code> which will add a column to the output, showing the fix version of each vulnerable dependency. Thanks <a href="https://github.com/felickz"><code>@felickz</code></a>!</li> <li>Runs which do not display OpenSSF scorecards no longer fetch scorecard information; previously it was fetched regardless of whether or not it was displayed, causing unneccessary slowness. Great catch <a href="https://github.com/jantiebot"><code>@jantiebot</code></a>!</li> <li>There are a couple of fixes to purl parsing which should improve match accuracy for <code>allow-package-dependency</code> lists, including case (in)sensitivity and url-encoded namespaces Thanks <a href="https://github.com/juxtin"><code>@juxtin</code></a>!</li> </ul> <h2>What's Changed</h2> <ul> <li>Compare normalized purls to account for encoding quirks by <a href="https://github.com/juxtin"><code>@juxtin</code></a> in <a href="https://redirect.github.com/actions/dependency-review-action/pull/1056">actions/dependency-review-action#1056</a></li> <li>Make purl comparisons case insensitive by <a href="https://github.com/juxtin"><code>@juxtin</code></a> in <a href="https://redirect.github.com/actions/dependency-review-action/pull/1057">actions/dependency-review-action#1057</a></li> <li>Feat: Add <code>Patched Version</code> to <code>Vulnerabilities</code> summary by <a href="https://github.com/felickz"><code>@felickz</code></a> in <a href="https://redirect.github.com/actions/dependency-review-action/pull/1045">actions/dependency-review-action#1045</a></li> <li>fix: only get scorecard levels if user wants to see the OpenSSF scorecard by <a href="https://github.com/jantiebot"><code>@jantiebot</code></a> in <a href="https://redirect.github.com/actions/dependency-review-action/pull/1060">actions/dependency-review-action#1060</a></li> <li>Bump actions/stale from 10.1.0 to 10.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/dependency-review-action/pull/1058">actions/dependency-review-action#1058</a></li> <li>Bump actions/checkout from 4 to 6 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/dependency-review-action/pull/1021">actions/dependency-review-action#1021</a></li> <li>Updates for release 4.9.0 by <a href="https://github.com/ahpook"><code>@ahpook</code></a> in <a href="https://redirect.github.com/actions/dependency-review-action/pull/1064">actions/dependency-review-action#1064</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/jantiebot"><code>@jantiebot</code></a> made their first contribution in <a href="https://redirect.github.com/actions/dependency-review-action/pull/1060">actions/dependency-review-action#1060</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/dependency-review-action/compare/v4.8.3...v4.9.0">https://github.com/actions/dependency-review-action/compare/v4.8.3...v4.9.0</a></p> <h2>4.8.3</h2> <h2>Dependency Review Action v4.8.3</h2> <p>This is a bugfix release that updates a number of upstream dependencies and includes a fix for the earlier feature that detected oversized summaries and upload them as artifacts, which could occasionally crash the action.</p> <p>We have also updated the release process to use a long-lived <code>v4</code> <strong>branch</strong> for the action, instead of a force-pushed tag, which aligns better with git branching strategies; the change should be transparent to end users.</p> <h2>What's Changed</h2> <ul> <li>GitHub Actions can't push to our protected main by <a href="https://github.com/dangoor"><code>@dangoor</code></a> in <a href="https://redirect.github.com/actions/dependency-review-action/pull/1017">actions/dependency-review-action#1017</a></li> <li>Bump actions/stale from 9.1.0 to 10.1.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/dependency-review-action/pull/995">actions/dependency-review-action#995</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/dependency-review-action/commit/a1d282b36b6f3519aa1f3fc636f609c47dddb294"><code>a1d282b</code></a> Merge pull request <a href="https://redirect.github.com/actions/dependency-review-action/issues/1098">#1098</a> from actions/ahpook/v5-release</li> <li><a href="https://github.com/actions/dependency-review-action/commit/eb6c199c5a85c7387f1f0b02b3ba5c6364740695"><code>eb6c199</code></a> update examples to show <a href="https://github.com/v5"><code>@v5</code></a></li> <li><a href="https://github.com/actions/dependency-review-action/commit/3943c2c5beaaaf1806eb3758273c203dabcbf89c"><code>3943c2c</code></a> v5.0.0 release branch</li> <li><a href="https://github.com/actions/dependency-review-action/commit/454943c880b147adbfe7de0cdd3ece1c00882033"><code>454943c</code></a> Merge pull request <a href="https://redirect.github.com/actions/dependency-review-action/issues/1094">#1094</a> from actions/ashelytc/security-findings</li> <li><a href="https://github.com/actions/dependency-review-action/commit/6d92a1228e9e9db334f02c09f84fe9217d2b4463"><code>6d92a12</code></a> revert <code>@typescript-eslint/parser</code> update</li> <li><a href="https://github.com/actions/dependency-review-action/commit/a8e5a7e93695b41abf6d1083cd220bee39a720f0"><code>a8e5a7e</code></a> Merge pull request <a href="https://redirect.github.com/actions/dependency-review-action/issues/1076">#1076</a> from tspascoal/fix-version-matching-for-non-string-s...</li> <li><a href="https://github.com/actions/dependency-review-action/commit/b6b7079031ef4ed61656c221988f1f3bcbf35101"><code>b6b7079</code></a> update <code>@typescript-eslint/parser</code> to 8.40.0</li> <li><a href="https://github.com/actions/dependency-review-action/commit/821a21dd691f162c4c5c2e9754a344accde9a208"><code>821a21d</code></a> update more dependencies</li> <li><a href="https://github.com/actions/dependency-review-action/commit/05aaaae45cf4c420de012addf2a72e3435ddaa63"><code>05aaaae</code></a> run npm audit fix</li> <li><a href="https://github.com/actions/dependency-review-action/commit/55d3e754501fc13c84b95637ce51f135012d41ea"><code>55d3e75</code></a> Merge pull request <a href="https://redirect.github.com/actions/dependency-review-action/issues/1077">#1077</a> from Marukome0743/docs/checkout</li> <li>Additional commits viewable in <a href="https://github.com/actions/dependency-review-action/compare/v4...v5">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Karsten Hassel
|
170c4a9883 |
remove warning in unit tests (for nodejs >= v25) (#4149)
The unit tests were full of warnings `ExperimentalWarning: localStorage is not available because --localstorage-file was not provided.` for node versions >=25. Additionally this PR nails node to `v26.0.0` in the automated-tests workflow until the [playwright issue](https://github.com/microsoft/playwright/issues/40724) is fixed. Will revert this after fixed playwright version is available. |
||
|
Kristjan ESPERANTO
|
2850e14172 |
Unify linting: replace Stylelint and markdownlint with ESLint (#4148)
We were running three separate lint tools (ESLint, Stylelint, markdownlint-cli2) and a separate Prettier step. This PR consolidates everything: `@eslint/css` and `@eslint/markdown` bring CSS and Markdown linting into ESLint, so one tool now covers JS, CSS, and Markdown. The Prettier step got merged into the lint scripts too, so there's now just `test:lint` to check things and `lint:fix` to fix them. Outcome: fewer tools to maintain, simpler/fewer scripts, fewer config files. As a side effect, the dependabot alerts https://github.com/MagicMirrorOrg/MagicMirror/security/dependabot/140 and https://github.com/MagicMirrorOrg/MagicMirror/security/dependabot/141 are resolved, as we no longer use the vulnerable `fast-uri` package (which was a dependency of `stylelint`). |
||
|
Kristjan ESPERANTO
|
67db41cfcb |
refactor: rewrite NodeHelper as an ES6 class (#4147)
This PR rewrites `node_helper.js` to use a native ES6 `class` instead of
`Class.extend()` - a manual inheritance helper from 2008, written back
when `class` syntax didn't exist yet. Node.js has supported native
classes since v6, so there's no reason to keep the workaround around.
The public API is unchanged - module authors still write the same
`NodeHelper.create({...})` they always have.
Outcome: same behavior, normal modern JavaScript, better stack traces,
and `node_helper.js` no longer pulls in `class.js` on the server side.
Removing `class.js` altogether is a follow-up (it's still used on
browser side).
|
||
|
Kristjan ESPERANTO
|
9386c44928 |
fix: resolve CodeQL alerts #24 and #26 (#4145)
**[#24](https://github.com/MagicMirrorOrg/MagicMirror/security/code-scanning/24) – `js/class.js`** `fnTest` works by serialising a function to a string and checking if `"xyz"` appears in it - the function is never actually called. The bare `xyz;` is never executed, so CodeQL is right to flag it. `return xyz;` makes the intent clear. So this is purely a cosmetic change. **[#26](https://github.com/MagicMirrorOrg/MagicMirror/security/code-scanning/26) – `tests/e2e/helpers/global-setup.js`** CodeQL flagged `if (exec) exec;` as a useless expression - and it was right. But the real find was one level deeper. `startApplication` hardcoded `const port = 8080`, so `MM_PORT` was always overwritten before the app started. The test named "Set port 8100 on environment variable MM_PORT" was actually testing port 8080 the whole time - it just happened to pass anyway. Removed the dead `exec` parameter, made `startApplication` read `MM_PORT` from the environment, and fixed the test so it actually checks what it says it checks. |
||
|
Kristjan ESPERANTO
|
7da9e5af02 |
perf(calendar): use async ICS parsing to avoid blocking event loop (#4143)
This switches the calendar fetcher from synchronous to asynchronous ICS parsing. It does not necessarily make parsing faster overall, but it avoids long event-loop stalls with large calendar files (especially on slower devices and with multiple feeds). So this does not fully solve #4103 on its own, but it clearly mitigates it. It should also combine well with a future pre-filter approach discussed in the issue: - with pre-filter = less data to parse (future PR) - with async parsing = less blocking while parsing (this PR) Together, that is likely the strongest path to fully address #4103. |