v1.5.8

A security release — please update.

Stored passwords and keys could be read without signing in

A display loads its view without signing in, and that answer carried each view's wallpaper settings in full: a NAS folder's user name and password, and a view's own Immich API key. Every display also kept a copy in its browser storage. On installs that once used the old mobile editor's Integrations dialog, the answer for view 1 also carried a Home Assistant access token.

The displays never needed any of it — Magic Frame fetches the pictures itself. 1.5.8 leaves all of it out for everyone except an admin signed in to the editor. Nothing is lost: saving a view keeps the stored passwords and keys, as long as the wallpaper's address stays the same.

If your Magic Frame was reachable by people you don't trust — from the internet, or on a network you share — change those NAS passwords and Immich keys after updating, and make a new Home Assistant token. On a home network only your household uses, the risk was small.

Also closed

• /api/settings gave the Home Assistant token and the global Immich key to any signed-in account, viewers included, and let them change both. It is admin-only now and never returns either: the Integrations page says a token is saved instead of showing it, an empty field keeps it, and a new address asks for it again.
• The layout export contained the same wallpaper passwords and keys, although it is meant to be safe to share. It carries none now, and importing it back into the same installation keeps the ones stored there. Exporting needs an admin, like importing.
• The calendar sign-in (Google, Microsoft) trusted an unsigned value on the way back. It is signed now and expires after 15 minutes — if you were in the middle of connecting a calendar during the update, start again.
• The MCP's get_view names stored credentials instead of showing them.

Fixed

• Agenda: Max events per day capped the whole agenda instead of each day, so one busy day used up the room for every day after it (#123, reported by @tomhnatt). The longer time ranges and higher limits asked for there come with the next bigger update.

Upgrade: curl -fsSL https://raw.githubusercontent.com/jeremiaa/magic-frame/main/deploy/install.sh | bash — add-on users: add-on store → Reload → Update.