Starstruk Logo MarkStarstruk

v2.36.0

longbridge/gpui-kitv2.36.0Apr 30, 2026by github-actions[bot]

AI Summary

An early release addressing security vulnerabilities and API changes in the weather provider. It includes significant updates to the CORS handling, HTTP fetcher, and various weather module fixes.

Key Highlights

  • Security fix for the internal CORS proxy
  • API change of the weather provider SMI
  • Fix SSRF via CORS endpoint by blocking private IPs
  • Fix weather module (UV index, OpenWeatherMap v2.5 support)
  • Restrict CORS endpoint to prevent SSRF attacks

Breaking Changes

  • The CORS proxy is now disabled by default and must be explicitly enabled in config.js

New Features

  • HTTPFetcher to pass through 304 responses
  • Fix CORS function for Alpine Linux
  • WeatherFlow precipitation support
  • SMHI migration to SNOW1gv1 API

Full Release Notes

## Release Notes
Thanks to: @cgillinger, @khassel, @KristjanESPERANTO, @sonnyb9
> ⚠️ This release needs nodejs version >=22.21.1 <23 || >=24 (no change to previous release)

[Compare to previous Release v2.35.0](https://github.com/MagicMirrorOrg/MagicMirror/compare/v2.35.0...v2.36.0)

This release falls outside the quarterly schedule. We opted for an early release due to:
- Security fix for the internal cors proxy
- API change of the weather provider smi
- Several bug fixes

### Breaking Changes

The cors proxy is now disabled by default. If required, it must be explicitly enabled in the `config.js` file. See the [documentation](https://docs.magicmirror.builders/configuration/cors.html).

### ⚠️ Security

You can find several publicly accessible MagicMirror² instances.

This should never be done. Doing so makes your entire configuration, including secrets and API keys, publicly visible. Furthermore, it allows attackers to target the host; this is only prevented beginning with this release.

Public MagicMirror² instances should always run behind a reverse proxy with authentication.

### [core]
- Prepare Release 2.36.0 (#4126)
- Allow HTTPFetcher to pass through 304 responses (#4120)
- fix(http-fetcher): fall back to reloadInterval after retries exhausted (#4113)
- config endpoint must handle functions in module configs (#4106)
- fix replaceSecretPlaceholder (#4104)
- restrict replaceSecretPlaceholder to cors with allowWhitelist (#4102)
- fix: prevent crash when config is undefined in socket handler (#4096)
- fix cors function for alpine linux (#4091)
- fix(cors): prevent SSRF via DNS rebinding (#4090)
- add option to disable or restrict cors endpoint (#4087)
- fix: prevent SSRF via /cors endpoint by blocking private/reserved IPs (#4084)
- chore: add permissions section to enforce pull-request rules workflow (#4079)
- update version for develop

### [dependencies]
- update dependencies (#4124)
- chore: update dependencies (#4088)
- refactor: enable ESLint rule "no-unused-vars" and handle related issues (#4080)

### [modules/newsfeed]
- fix(newsfeed): prevent duplicate parse error callback when using pipeline (#4083)

### [modules/updatenotification]
- fix(updatenotification): harden git command execution + simplify checkUpdates (#4115)
- fix(tests): correct import path for git_helper module in updatenotification tests (#4078)

### [modules/weather]
- fix(weather): use nearest openmeteo hourly data (#4123)
- fix(weather): avoid loading state after reconnect (#4121)
- weather: fix UV index display and add WeatherFlow precipitation (#4108)
- fix(weather): restore OpenWeatherMap v2.5 support (#4101)
- fix(weather): use stable instanceId to prevent duplicate fetchers (#4092)
- SMHI: migrate to SNOW1gv1 API (replace deprecated PMP3gv2) (#4082)

### [testing]
- ci(actions): set explicit token permissions (#4114)
- fix(http_fetcher): use undici.fetch when dispatcher is present (#4097)
- ci(codeql): also scan develop branch on push and PR (#4086)
- refactor: replace implicit global config with explicit global.config (#4085)