fix: electron blank with "::"#4187
Closed
MikeBishop wants to merge 2 commits into
Closed
Conversation
MikeBishop
commented
Jun 19, 2026
MikeBishop
commented
Contributor
- electron.js: "::" was not remapped to "localhost" for the Electron loadURL call, causing it to try loading http://:::8080, resulting in a blank screen. 0.0.0.0 was special-cased, but not the IPv6 equivalent.
## Release Notes Thanks to: @cgillinger, @khassel, @KristjanESPERANTO, @sonnyb9 >⚠️ This release needs nodejs version >=22.21.1 <23 || >=24 (no change to previous release) [Compare to previous Release v2.35.0](MagicMirrorOrg/MagicMirror@v2.35.0...v2.36.0) This release falls outside the quarterly schedule. We opted for an early release due to: - Security fix for the internal cors proxy - API change of the weather provider smi - Several bug fixes ### Breaking Changes The cors proxy is now disabled by default. If required, it must be explicitly enabled in the `config.js` file. See the [documentation](https://docs.magicmirror.builders/configuration/cors.html). ###⚠️ Security You can find several publicly accessible MagicMirror² instances. This should never be done. Doing so makes your entire configuration, including secrets and API keys, publicly visible. Furthermore, it allows attackers to target the host; this is only prevented beginning with this release. Public MagicMirror² instances should always run behind a reverse proxy with authentication. ### [core] - Prepare Release 2.36.0 (MagicMirrorOrg#4126) - Allow HTTPFetcher to pass through 304 responses (MagicMirrorOrg#4120) - fix(http-fetcher): fall back to reloadInterval after retries exhausted (MagicMirrorOrg#4113) - config endpoint must handle functions in module configs (MagicMirrorOrg#4106) - fix replaceSecretPlaceholder (MagicMirrorOrg#4104) - restrict replaceSecretPlaceholder to cors with allowWhitelist (MagicMirrorOrg#4102) - fix: prevent crash when config is undefined in socket handler (MagicMirrorOrg#4096) - fix cors function for alpine linux (MagicMirrorOrg#4091) - fix(cors): prevent SSRF via DNS rebinding (MagicMirrorOrg#4090) - add option to disable or restrict cors endpoint (MagicMirrorOrg#4087) - fix: prevent SSRF via /cors endpoint by blocking private/reserved IPs (MagicMirrorOrg#4084) - chore: add permissions section to enforce pull-request rules workflow (MagicMirrorOrg#4079) - update version for develop ### [dependencies] - update dependencies (MagicMirrorOrg#4124) - chore: update dependencies (MagicMirrorOrg#4088) - refactor: enable ESLint rule "no-unused-vars" and handle related issues (MagicMirrorOrg#4080) ### [modules/newsfeed] - fix(newsfeed): prevent duplicate parse error callback when using pipeline (MagicMirrorOrg#4083) ### [modules/updatenotification] - fix(updatenotification): harden git command execution + simplify checkUpdates (MagicMirrorOrg#4115) - fix(tests): correct import path for git_helper module in updatenotification tests (MagicMirrorOrg#4078) ### [modules/weather] - fix(weather): use nearest openmeteo hourly data (MagicMirrorOrg#4123) - fix(weather): avoid loading state after reconnect (MagicMirrorOrg#4121) - weather: fix UV index display and add WeatherFlow precipitation (MagicMirrorOrg#4108) - fix(weather): restore OpenWeatherMap v2.5 support (MagicMirrorOrg#4101) - fix(weather): use stable instanceId to prevent duplicate fetchers (MagicMirrorOrg#4092) - SMHI: migrate to SNOW1gv1 API (replace deprecated PMP3gv2) (MagicMirrorOrg#4082) ### [testing] - ci(actions): set explicit token permissions (MagicMirrorOrg#4114) - fix(http_fetcher): use undici.fetch when dispatcher is present (MagicMirrorOrg#4097) - ci(codeql): also scan develop branch on push and PR (MagicMirrorOrg#4086) - refactor: replace implicit global config with explicit global.config (MagicMirrorOrg#4085) --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: sam detweiler <sdetweil@gmail.com> Co-authored-by: Kristjan ESPERANTO <35647502+KristjanESPERANTO@users.noreply.github.com> Co-authored-by: Veeck <github@veeck.de> Co-authored-by: veeck <gitkraken@veeck.de> Co-authored-by: Magnus <34011212+MagMar94@users.noreply.github.com> Co-authored-by: Ikko Eltociear Ashimine <eltociear@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: DevIncomin <56730075+Developer-Incoming@users.noreply.github.com> Co-authored-by: Nathan <n8nyoung@gmail.com> Co-authored-by: mixasgr <mixasgr@users.noreply.github.com> Co-authored-by: Savvas Adamtziloglou <savvas-gr@greeklug.gr> Co-authored-by: Konstantinos <geraki@gmail.com> Co-authored-by: OWL4C <124401812+OWL4C@users.noreply.github.com> Co-authored-by: BugHaver <43462320+bughaver@users.noreply.github.com> Co-authored-by: BugHaver <43462320+lsaadeh@users.noreply.github.com> Co-authored-by: Bugsounet - Cédric <github@bugsounet.fr> Co-authored-by: Koen Konst <koenspero@gmail.com> Co-authored-by: Koen Konst <c.h.konst@avisi.nl> Co-authored-by: dathbe <github@beffa.us> Co-authored-by: Marcel <m-idler@users.noreply.github.com> Co-authored-by: Kevin G. <crazylegstoo@gmail.com> Co-authored-by: Jboucly <33218155+jboucly@users.noreply.github.com> Co-authored-by: Jboucly <contact@jboucly.fr> Co-authored-by: Jarno <54169345+jarnoml@users.noreply.github.com> Co-authored-by: Jordan Welch <JordanHWelch@gmail.com> Co-authored-by: Blackspirits <blackspirits@gmail.com> Co-authored-by: Samed Ozdemir <samed@xsor.io> Co-authored-by: in-voker <58696565+in-voker@users.noreply.github.com> Co-authored-by: Andrés Vanegas Jiménez <142350+angeldeejay@users.noreply.github.com> Co-authored-by: cgillinger <christian.gillinger@gmail.com> Co-authored-by: Sonny B <43247590+sonnyb9@users.noreply.github.com> Co-authored-by: sonnyb9 <sonnyb9@users.noreply.github.com>
When config.address is set to "::" (listen on all interfaces), the Electron window tries to load http://:::8080 instead of http://localhost:8080, resulting in a blank local display. The remap that converts wildcard bind addresses to "localhost" for the Electron loadURL call already handled undefined, "", and "0.0.0.0", but was missing "::". Add it.
Contributor
Author
|
Closed in favor of #4188 . |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.