Release 2.35.0

.github/CONTRIBUTING.md

@@ -30,9 +30,19 @@ To run markdownlint, use `node --run lint:markdown`.
 
 ## Testing
 
-We use [Jest](https://jestjs.io) for JavaScript testing.
+We use [Vitest](https://vitest.dev) for JavaScript testing.
 
 To run all tests, use `node --run test`.
 
-The specific test commands are defined in `package.json`.
-So you can also run the specific tests with other commands, e.g. `node --run test:unit` or `npx jest tests/e2e/env_spec.js`.
+The `package.json` scripts expose finer-grained test commands:
+
+- `test:unit` – run unit tests only
+- `test:e2e` – execute browser-driven end-to-end tests
+- `test:electron` – launch the Electron-based regression suite
+- `test:coverage` – collect coverage while running every suite
+- `test:watch` – keep Vitest in watch mode for fast local feedback
+- `test:ui` – open the Vitest UI dashboard (needs OS file-watch support enabled)
+- `test:calendar` – run the legacy calendar debug helper
+- `test:css`, `test:markdown`, `test:prettier`, `test:spelling`, `test:js` – lint-only scripts that enforce formatting, spelling, markdown style, and ESLint.
+
+You can invoke any script with `node --run <script>` (or `npm run <script>`). Individual files can still be targeted directly, e.g. `npx vitest run tests/e2e/env_spec.js`.

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,6 +1,6 @@
 Hello and thank you for wanting to contribute to the MagicMirror² project!
 
-**Please make sure that you have followed these 4 rules before submitting your Pull Request:**
+**Please make sure that you have followed these 3 rules before submitting your Pull Request:**
 
 > 1. Base your pull requests against the `develop` branch.
 > 2. Include these infos in the description:
@@ -12,8 +12,6 @@ Hello and thank you for wanting to contribute to the MagicMirror² project!
 >
 > 3. Please run `node --run lint:prettier` before submitting so that
 >    style issues are fixed.
-> 4. Don't forget to add an entry about your changes to
->    the CHANGELOG.md file.
 
 **Note**: Sometimes the development moves very fast. It is highly
 recommended that you update your branch of `develop` before creating a

.github/SECURITY.md

@@ -0,0 +1,31 @@
+# Security Policy
+
+## Scope and Deployment
+
+MagicMirror is primarily intended for trusted local/private network environments.
+Direct public exposure to the internet or other untrusted networks is not recommended.
+
+We take security seriously and encourage responsible disclosure of vulnerabilities to help us improve the software.
+
+## Reporting a Vulnerability
+
+**Please keep vulnerability details private** — do not post them in public GitHub issues.
+
+Instead, reach out privately via the MagicMirror forum to one of the core developers:
+
+- [rejas](https://forum.magicmirror.builders/user/rejas)
+- [karsten13](https://forum.magicmirror.builders/user/karsten13)
+- [sdetweil](https://forum.magicmirror.builders/user/sdetweil)
+- [Kristjan](https://forum.magicmirror.builders/user/kristjanesperanto)
+
+Please include, if possible:
+
+- Affected version(s)
+- Reproduction steps or proof-of-concept
+- What could an attacker do with this?
+- Any ideas how to fix it?
+
+## Coordinated Disclosure
+
+We will keep reported vulnerabilities private until a fix is available and coordinate the disclosure timeline with you.
+We aim to respond as quickly as possible.

.github/dependabot.yaml

@@ -6,7 +6,6 @@ updates:
       interval: "weekly"
     target-branch: "develop"
     labels:
-      - "Skip Changelog"
       - "dependencies"
 
   - package-ecosystem: "npm"
@@ -15,6 +14,5 @@ updates:
       interval: "monthly"
     target-branch: "develop"
     labels:
-      - "Skip Changelog"
       - "dependencies"
       - "javascript"

.github/workflows/automated-tests.yaml

@@ -12,15 +12,19 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   code-style-check:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     timeout-minutes: 15
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: "Use Node.js"
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v6
         with:
           node-version: lts/*
           cache: "npm"
@@ -38,31 +42,34 @@ jobs:
     timeout-minutes: 30
     strategy:
       matrix:
-        node-version: [22.18.0, 22.x, 24.x]
+        node-version: [22.x, 24.x, 25.x]
     steps:
       - name: Install electron dependencies and labwc
         run: |
           sudo apt-get update
           sudo apt-get install -y libnss3 libasound2t64 labwc
       - name: "Checkout code"
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: "Use Node.js ${{ matrix.node-version }}"
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node-version }}
           check-latest: true
           cache: "npm"
       - name: "Install MagicMirror²"
         run: |
           node --run install-mm:dev
+      - name: "Install Playwright browsers"
+        run: |
+          npx playwright install --with-deps chromium
       - name: "Prepare environment for tests"
         run: |
           # Fix chrome-sandbox permissions:
           sudo chown root:root ./node_modules/electron/dist/chrome-sandbox
           sudo chmod 4755 ./node_modules/electron/dist/chrome-sandbox
           # Start labwc
           WLR_BACKENDS=headless WLR_LIBINPUT_NO_DEVICES=1 WLR_RENDERER=pixman labwc &
-          touch css/custom.css
+          touch config/custom.css
       - name: "Run tests"
         run: |
           export WAYLAND_DISPLAY=wayland-0

.github/workflows/dep-review.yaml

@@ -10,9 +10,9 @@ permissions:
 
 jobs:
   dependency-review:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: "Dependency Review"
         uses: actions/dependency-review-action@v4

.github/workflows/electron-rebuild.yaml

@@ -5,28 +5,24 @@ on: [pull_request]
 jobs:
   rebuild:
     name: Run electron-rebuild
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     strategy:
       matrix:
-        node-version: [22.18.0, 22.x, 24.x]
+        node-version: [22.x, 24.x, 25.x]
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: "Use Node.js ${{ matrix.node-version }}"
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node-version }}
           check-latest: true
       - name: Install MagicMirror
         run: node --run install-mm
       - name: Install @electron/rebuild
         run: npm install @electron/rebuild
-      - name: Install node-libgpiod deps
-        run: |
-          sudo apt-get update
-          sudo apt-get install gpiod libgpiod2 libgpiod-dev
-      - name: Install test library (node-libgpiod) to be rebuilded
-        run: npm install node-libgpiod
+      - name: Install test library (serialport) to be rebuilt
+        run: npm install serialport
       - name: Run electron-rebuild
         run: npx electron-rebuild
         continue-on-error: false

.github/workflows/enforce-pullrequest-rules.yaml

@@ -1,28 +1,26 @@
-# This workflow enforces on every pull request:
-# - the update of our CHANGELOG.md file, see: https://github.com/dangoslen/changelog-enforcer
-# - that the PR is not based against master, taken from https://github.com/oppia/oppia-android/pull/2832/files
+# This workflow enforces on every pull request that the PR is not based against master,
+# taken from https://github.com/oppia/oppia-android/blob/develop/.github/workflows/static_checks.yml
 
 name: "Enforce Pull-Request Rules"
 
 on:
-  pull_request_target:
-    types: [opened, synchronize, reopened, ready_for_review, labeled, unlabeled]
+  pull_request:
+  push:
+    branches-ignore:
+      - develop
+      - master
 
 jobs:
   check:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
+    if: github.event_name == 'pull_request'
     timeout-minutes: 10
     steps:
-      - name: "Enforce changelog"
-        uses: dangoslen/changelog-enforcer@v3
-        with:
-          changeLogPath: "CHANGELOG.md"
-          skipLabels: "Skip Changelog"
-      - name: "Enforce develop branch"
-        if: ${{ github.event.pull_request.base.ref == 'master' && !contains(github.event.pull_request.labels.*.name, 'mastermerge') }}
+      - name: "Branch is not based on develop"
+        if: ${{ github.base_ref != 'develop' && !contains(github.event.pull_request.labels.*.name, 'mastermerge') }}
         run: |
-          echo "This PR is based against the master branch and not a release or hotfix."
-          echo "Please don't do this. Switch the branch to 'develop'."
+          echo "Current base branch: $BASE_BRANCH"
+          echo "Note: PRs should only ever be merged into develop so please rebase your branch on develop and try again."
           exit 1
         env:
-          BASE_BRANCH: ${{ github.event.pull_request.base.ref }}
+          BASE_BRANCH: ${{ github.base_ref }}

.github/workflows/release-notes.yaml

@@ -0,0 +1,33 @@
+# This workflow writes a draft release on GitHub named `unreleased` after every push on develop
+
+name: "Create Release Notes"
+
+on:
+  push:
+    branches: [develop]
+
+permissions:
+  contents: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  release-notes:
+    runs-on: ubuntu-slim
+    timeout-minutes: 15
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: "0"
+      - name: "Use Node.js"
+        uses: actions/setup-node@v6
+        with:
+          node-version: lts/*
+          cache: "npm"
+      - name: "Create Markdown content"
+        run: |
+          export GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}
+          node js/releasenotes.js

.github/workflows/spellcheck.yaml

@@ -12,14 +12,14 @@ permissions:
 
 jobs:
   spellcheck:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           ref: develop
       - name: Set up Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v6
         with:
           node-version: lts/*
           check-latest: true

.github/workflows/stale.yaml

@@ -10,7 +10,7 @@ permissions:
 
 jobs:
   stale:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     steps:
       - uses: actions/stale@v10
         with:

.gitignore

@@ -9,8 +9,7 @@ lib-cov
 coverage
 .lock-wscript
 build/Release
-/node_modules/**/*
-!/tests/node_modules/**/*
+node_modules
 jspm_modules
 .npm
 .node_repl_history
@@ -55,22 +54,13 @@ Temporary Items
 .directory
 .Trash-*
 
-# Ignore all modules except the default modules.
-/modules/**
-!/modules/default
-!/modules/default/**
-!/modules/README.md**
+# Ignore all modules
+/modules/*
 
-# Ignore changes to the custom css files but keep the sample and main.
-/css/*
-!/css/custom.css.sample
-!/css/main.css
-!/css/roboto.css
-!/css/font-awesome.css
-
-# Ignore users config file but keep the sample.
-/config/*
-!/config/config.js.sample
+# Ignore users config file but keep the samples.
+config
+!config/config.js.sample
+!config/custom.css.sample
 
 # Vim
 ## swap
@@ -88,3 +78,6 @@ js/positions.js
 # Ignore lock files other than package-lock.json
 pnpm-lock.yaml
 yarn.lock
+
+# Vitest temporary test files
+tests/**/.tmp/

CHANGELOG.md

@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ❤️ **Donate:** Enjoying MagicMirror²? [Please consider a donation!](https://magicmirror.builders/#donate) With your help we can continue to improve the MagicMirror².
 
+## Obsolete
+
+This file is no longer being updated. Release notes are now automatically generated via a GitHub action.
+
 ## [2.33.0] - 2025-10-01
 
 Thanks to: @Crazylegstoo, @dathbe, @m-idler, @plebcity, @khassel, @KristjanESPERANTO, @rejas and @sdetweil!
@@ -335,7 +339,7 @@ For more info, please read the following post: [A New Chapter for MagicMirror: T
 ### Fixed
 
 - [weather] Correct apiBase of weathergov weatherProvider to match documentation (#2926)
-- Worked around several issues in the RRULE library that were causing deleted calender events to still show, some
+- Worked around several issues in the RRULE library that were causing deleted calendar events to still show, some
   initial and recurring events to not show, and some event times to be off an hour. (#3291)
 - Skip changelog requirement when running tests for dependency updates (#3320)
 - Display precipitation probability when it is 0% instead of blank/empty (#3345)