MagicMirror Smart Display

In this hands-on lab, students build and configure an interactive smart mirror dashboard using the open-source MagicMirror platform deployed on a single-board computer. Students set up and configure a Linux desktop environment on a Raspberry Pi, execute modular dashboard software within an Electron desktop wrapper or across a distributed Node.js client-server architecture, and interface flat-panel display hardware behind two-way reflective glass. Through hands-on configuration and debugging using Chromium Developer Tools, learners explore embedded web technologies, external REST and RSS data feed integrations, calendar synchronization, real-time WebSocket communication via Socket.io, and local network security controls such as IP whitelisting.

Raspberry Pi single-board computer SBC smart mirror smart display Internet of Things IoT embedded Linux Raspberry Pi OS Node.js Electron Express.js WebSockets Socket.io API integration JavaScript web dashboard

Uploaded by demo on 2026-09-03 · ready · Electronics · Original source ↗

Files: README.md · docs_installation.md · docs_requirements.md · package.json

Readiness checks

  • complete 2026-09-03 18:30 🛡 Cybersecurity: Review before networking · 9 findings 8 searches · 3 pages
    view · PDF

Latest report — 2026-09-03 18:30

Readiness: MagicMirror Smart Display

Verdict: Ready with caveats · 2026-09-03 · est. parts cost $130–$235, excluding the custom-cut two-way mirror Cybersecurity — software & network: Review before networking

Every part this lab needs is a current, in-stock consumer item available from several sellers today — there is nothing obsolete, back-ordered or single-sourced in the whole bill of materials, and no PCB to fabricate. Two things stop this being a clean "Ready". The two-way mirror, the one part specific to this build, is cut to order and the supplier publishes no prices, so that line has no cost on the record. And the lab specifies neither the display size nor the Raspberry Pi's RAM, so the two biggest cost drivers are left to the instructor and the total cannot be bounded from the BOM. This is the cold check for this lab: it establishes the baseline, and every price and stock position below is recorded so the next run can measure drift against it.

Action required

None — all checked parts are sourceable.

Cybersecurity — software & network

Review before networking — The network-facing WebSocket parser and web server carry fixable known flaws and the documented remote-access mode is unauthenticated, so the build is fine on a bench but should be patched and segmented before it goes on a shared network.

Component Version How known Support status
MagicMirror² 2.37.0 read from project (version field of fetched/01-package.json (tag v2.37.0); also pinned as magicmirror@2.37.0 in fetched/02-package-lock.json) —
Node.js 22.21.1 inferred (lower bound of the engines.node range '>=22.21.1 <23 || >=24' in fetched/01-package.json; the range is not a pin, so the installed version depends on what the instructor installs) supported until 2027-04-30
Raspberry Pi OS not determined unpinned (docs_requirements.md says 'latest full version with Desktop'; no numeric release or codename is stated anywhere in the lab materials) —
Electron 42.5.2 read from project (fetched/02-package-lock.json (root optionalDependency; package.json declares the range ^42.5.2)) —
express 5.2.1 read from project (fetched/02-package-lock.json (the HTTP server behind port 8080)) —
socket.io 4.8.3 read from project (fetched/02-package-lock.json (the WebSocket server on port 8080)) —
socket.io-parser 4.2.6 read from project (fetched/02-package-lock.json (transitive via socket.io 4.8.3, declared range ~4.2.4)) —
undici 8.5.0 read from project (fetched/02-package-lock.json at node_modules/undici (root dependency, declared ^8.5.0) - the HTTP client used for weather, news and calendar fetches) —
undici (build/test copy) 7.28.0 read from project (fetched/02-package-lock.json at node_modules/@electron/get/node_modules/undici and node_modules/jsdom/node_modules/undici) —
qs 6.15.3 read from project (fetched/02-package-lock.json (transitive via express 5.2.1 ^6.14.0 and body-parser 2.3.0 ^6.15.2)) —
deepmerge-ts 7.1.5 read from project (fetched/02-package-lock.json (transitive via html-to-text 10.0.0, declared range ^7.1.5)) —
brace-expansion 5.0.7 read from project (fetched/02-package-lock.json (transitive via minimatch 10.2.5, declared range ^5.0.5; lint and test tooling only)) —
helmet 8.2.0 read from project (fetched/02-package-lock.json (HTTP security headers middleware); checked against OSV with no advisories) —
express-basic-auth 1.2.1 read from project (fetched/02-package-lock.json (the optional HTTP authentication the snapshot describes); checked against OSV with no advisories) —
node-ical 0.26.1 read from project (fetched/02-package-lock.json (fetches remote iCalendar files); checked against OSV with no advisories) —
feedme 2.0.2 read from project (fetched/02-package-lock.json (parses remote RSS/Atom feeds); checked against OSV with no advisories) —
html-to-text 10.0.0 read from project (fetched/02-package-lock.json (renders remote feed HTML to text)) —
MagicMirrorOS (alternative image) not determined not determined (docs_installation.md names https://github.com/guysoft/MagicMirrorOS but states no version) —
MagicMirror Docker image (alternative) not determined not determined (docs_installation.md names https://gitlab.com/khassel/magicmirror but states no version or tag) —
MagicMirror Kubernetes Helm chart (alternative) not determined not determined (docs_installation.md names https://gitlab.com/khassel/magicmirror-helm but states no chart version) —
Component Finding Severity Fix available?
brace-expansion Two denial-of-service flaws in a file-matching helper used by the project's lint and test tooling; the running mirror does not reach this code. — GHSA-rgw5-rvv9-x895, GHSA-mh99-v99m-4gvg high Yes — update to 5.0.9
deepmerge-ts The helper that merges options for the HTML-to-text converter, which processes remote RSS and calendar content, can exhaust the stack on a deeply nested document and crash the mirror. — GHSA-ggr8-5vv4-36mx high No — project pins ^7.1.5 via html-to-text 10.0.0, and the fix is in 8.0.0
socket.io-parser The parser that reads WebSocket messages arriving on the mirror's port 8080 can be driven out of memory by a client sending specially shaped packets, which takes the display offline until it is restarted. — GHSA-2m8v-j782-fhvr high Yes — update to 4.2.7
undici The HTTP client the mirror uses to pull weather, news feeds and calendars mishandles caching and cookie headers, so a hostile or compromised feed server can crash the fetch or cause one response to be served in place of another. — GHSA-4cwx-7wf7-3272, GHSA-jr45-8vmc-qm54, GHSA-8xcm-r25x-g524, GHSA-v3r7-h72x-cjcm (+1 more) high Yes — update to 8.9.0
undici (build/test copy) A second, older copy of the same HTTP client is installed under the Electron downloader and the test browser, so it is reached only when building or testing the project, not by the running mirror. — GHSA-4cwx-7wf7-3272, GHSA-jr45-8vmc-qm54, GHSA-8xcm-r25x-g524, GHSA-v3r7-h72x-cjcm (+1 more) high Yes — update to 7.29.0
qs The query-string parser inside the mirror's web server can be made to consume excessive CPU, or to slip past its own array-size limit, by a crafted request to port 8080. — GHSA-4mjr-xmp4-gh2g, GHSA-x5fp-wj9c-mxmx moderate Yes — update to 6.16.0
MagicMirror² All 45 dependencies in the project's package.json are declared as caret ranges and the copy uploaded for this lab ships no lockfile, so two instructors installing on different days get different code; the versions checked above are upstream's package-lock.json for tag v2.37.0, not necessarily what will land on the mirror. posture Mitigation only — install with upstream's v2.37.0 package-lock.json using 'npm ci' rather than 'npm install', so the versions checked here are the versions deployed
MagicMirror² The application ships no username or password, and the documented way to reach it from another machine is to bind it to 0.0.0.0 and widen the ipWhitelist, at which point anything the whitelist admits can read the dashboard and open a WebSocket to it with no login. posture Mitigation only — keep the default localhost binding where possible; if remote access is needed, keep ipWhitelist to specific addresses and turn on the optional express-basic-auth
Raspberry Pi OS The lab installs whatever Raspberry Pi OS Desktop release is current rather than a recorded one, so the operating system underneath a network-facing service has no version anyone can check for patches or end-of-life. posture Mitigation only — record the Raspberry Pi OS release written to the card and run a full system update before the lab is used

What this means for your lab

Out of the box this mirror is fairly contained: it only listens on its own machine, so nobody else on the network can reach it, and it has no default password to leak. The risk starts the moment you follow the documentation's instructions for viewing the mirror from another computer, because that opens the dashboard to the network with no login at all - anyone the address filter lets through can read whatever the mirror displays, which usually means your calendar, your location's weather and any feeds you added. On top of that, the WebSocket parser and the web server's query handling both have known flaws that let a visitor on the network crash the display, and the component that fetches your calendars and news feeds can be tripped up by a hostile feed. Most of these have updates available; one, in the HTML-to-text converter, does not and cannot be fixed without the project moving to a newer version of that library. Two other things are simply unknown rather than safe: the lab installs whatever Raspberry Pi OS release is current instead of a recorded one, and it ships no lockfile, so the exact software you end up running is not the software checked here. Practically: keep the mirror on a staff or IoT network segment rather than the open campus network, do not enable remote viewing unless you also turn on the optional password protection, run a full system update before class, and let campus IT know it is there before you plug it in.

Not checked

  • Raspberry Pi OS: Installed as 'latest full version with Desktop'; no numeric release or codename is stated, so no end-of-life or advisory lookup was possible.
  • 173 transitive npm dependencies from package-lock.json: Beyond this run's 500-row automatic OSV check cap (676 pinned rows in the lockfile, 500 checked).
  • MagicMirrorOS (guysoft/MagicMirrorOS): Alternative install image; the lab's documentation states no version, so there was nothing to look up.
  • MagicMirror Docker image (khassel/magicmirror): Alternative install path; the lab's documentation states no image tag or version.
  • MagicMirror Kubernetes Helm chart (khassel/magicmirror-helm): Alternative install path; the lab's documentation states no chart version.
  • Third-party MagicMirror modules and community scripts (sdetweil/MagicMirror_scripts, Bee-Mar/mmpm): Named in the lab's external links but carry no version or check plan in the snapshot; whatever an instructor installs from them is unchecked code.
  • Electron 42.5.2: Checked against OSV with no advisories, but Electron bundles a Chromium build whose own patch level is not visible from the lockfile and was not checked separately.
  • 173 further dependencies in package-lock.json: beyond the 500-dependency automatic check cap (e.g. istanbul-lib-report, istanbul-reports, js-tokens, jsdoc-type-pratt-parser, jsonc-eslint-parser)

Parts

Part Spec/Package Status Stock Price Source
Host single-board computer Raspberry Pi 4 Model B, 85 × 56 mm, 5 V ≥3.0 A USB-C Readily available In stock, multiple sellers $35.00 – $165.00 by RAM CanaKit, PiShop USA, Mouser, eBay
Host power supply adapter 100–240 V AC in, 5.1 V DC out, 3.0 A (Pi 4) / 5.0 A (Pi 5), USB-C Readily available In stock, six sellers $8.00 (Pi 4) / $14.04 (27 W, 5.1 V 5 A) DigiKey, Adafruit
MicroSD flash storage card 32 GB, Class 10, UHS-I, microSDHC Readily available In stock $20.99 Walmart (First Choice Online)
HDMI video interconnect cable Micro-HDMI (type D) male to full-size HDMI male, 1 m Readily available In stock, four sellers $3.26 – $6.95 Computer Cable Store, PiShop USA
Computer monitor / flat-panel display Any HDMI-input panel; thin bezel preferred for mirror mounting Readily available In stock, seven sellers $69.19 – $119.99 Walmart (Gawfolk 22" bezel-less)
Two-way semi-transparent mirror 70% reflective / 30% transparent, glass or acrylic, cut to panel size Readily available (not priced) Ships immediately; 1-day cutting for sizes up to 63" × 96" Quote required — supplier publishes no prices twowaymirrors.com (Toledo, OH)
Computer keyboard Standard USB keyboard, 5 V bus powered Readily available In stock, seven sellers $11.99 – $14.99 Best Buy, Dell

Three wrong-variant listings to avoid. All three sit inside otherwise healthy search results for the parts above:

  • The Micro Center "Raspberry Pi White Mini HDMI to HDMI" at $3.99 is mini HDMI (type C), not micro HDMI (type D). It will not mate with a Pi 4 or Pi 5.
  • The eBay "SanDisk Ultra SDHC SDSDUNC-032G-AN6IN" at $20.00 is a full-size SD card, not microSD.
  • The 32 GB microSD listings at $53.99, $54.99 and $68.79 are phone-accessory bundles — the same class of card at 2.5–3.3× the $20.99 price.

Substitutes

None needed.

Other dependencies

Watch list

  • The two-way mirror is the only unpriced line and the only made-to-order part. Get a written quote for your chosen panel size before committing a budget — it is the largest unknown in the build and cannot be substituted from a shelf.
  • Raspberry Pi pricing swings with RAM and channel. The same board ranged from $35.00 to $165.00 this run, and the distributor listing was roughly 1.8× the marketplace price for 8 GB. Decide the RAM you actually need before ordering; the lab does not specify one.
  • Pi generation drives two other lines. A Pi 2 or 3 needs a full-size HDMI cable and a micro-USB supply rather than the micro-HDMI cable and USB-C supply priced here; only the Pi 4 path was checked.
  • Monitor availability is by model, not by category. The specific panels priced here are consumer stock that rotates; the category will stay cheap and plentiful, but expect these exact models to be gone by the next check.
  • The $8.00 official Pi 4 power supply is the cheapest correct part but its amperage is not stated in the listing. Confirm it is the 15 W / 3 A official unit before buying for a Pi 4, and note a Pi 5 needs the 27 W / 5 A version instead.
Snapshot What the lab depended on when it was uploaded — the baseline the readiness checks research against.

The MagicMirror Smart Display lab builds an open-source modular smart mirror dashboard (MagicMirror²) deployed on a single-board computer, wrapped inside an Electron desktop application or executed as a distributed Node.js client-server application. The platform is designed specifically for Raspberry Pi single-board computers (officially Raspberry Pi 2, 3, 4, or 5) interfaced with a display panel mounted behind semi-transparent two-way mirror glass. The system's primary computational hardware operates on a standard 5 V DC power rail provided via micro-USB or USB-C (depending on the Raspberry Pi generation), while auxiliary monitors and backlights operate from separate AC mains or 12 V DC power adapters. No custom electronic schematics, PCB layouts, frame fabrication designs, or specific display panel part numbers were provided in the source repository.

Bill of Materials

  • Host Single-Board Computer (Host Platform)

    • Identity: Raspberry Pi single-board computer, targeting Raspberry Pi 2, Raspberry Pi 3, Raspberry Pi 4, or Raspberry Pi 5. (Raspberry Pi 0 and Raspberry Pi 1 are explicitly not supported for the standard desktop Electron application wrapper; running on Pi 0/1 requires a custom headless server-only configuration with an external browser).
    • Quantity: 1
    • Footprint/package: Standard Raspberry Pi single-board computer form factor (approx. 85 mm x 56 mm).
    • Electrical constraints: 5 V DC logic and system rail. Current requirements vary by board: 5 V at ≥ 2.5 A via micro-USB (Pi 2/3), 5 V at ≥ 3.0 A via USB-C (Pi 4), or 5 V at ≥ 5.0 A via USB-C (Pi 5).
    • Substitution latitude: Must be an ARMv7 or ARMv8/AArch64 Raspberry Pi (Pi 2, 3, 4, or 5) to run the official Electron desktop package. Other Linux single-board computers can run the application in server-only mode, but upstream software updates and automated tests target Raspberry Pi hardware exclusively.
    • Operated control: No.
    • Sourcing plan: retail shopping search: Raspberry Pi 4 Model B single board computer

  • Host Power Supply Adapter

    • Identity: Described only implicitly as the power source required to operate the host Raspberry Pi.
    • Quantity: 1
    • Footprint/package: AC wall adapter with captive micro-USB or USB-C connector.
    • Electrical constraints: Input 100–240 V AC, 50/60 Hz; output regulated 5.1 V DC at 2.5 A to 5.0 A depending on the specific host SBC selected.
    • Substitution latitude: Any regulated 5 V power supply with sufficient amperage rating and matching connector.
    • Operated control: No.
    • Sourcing plan: retail shopping search: Raspberry Pi official power supply 5.1V USB-C

  • MicroSD Flash Storage Card

    • Identity: Described only as the storage media required to host the Raspberry Pi operating system and application files.
    • Quantity: 1
    • Footprint/package: MicroSD / TransFlash card.
    • Electrical constraints: 3.3 V interface; capacity ≥ 16 GB required to accommodate full Raspberry Pi OS Desktop and Node.js environment.
    • Substitution latitude: Any standard Class 10, A1, or UHS-1 MicroSD card.
    • Operated control: No.
    • Sourcing plan: retail shopping search: 32GB Class 10 microSD card

  • HDMI Video Interconnect Cable

    • Identity: Described only as the video interconnect linking the host Raspberry Pi to the display monitor.
    • Quantity: 1
    • Footprint/package: Full-size HDMI male to full-size HDMI male (for Raspberry Pi 2/3), or Micro-HDMI male to full-size HDMI male (for Raspberry Pi 4/5).
    • Electrical constraints: Standard HDMI digital video signaling.
    • Substitution latitude: Any functional HDMI/micro-HDMI cable matching the board and display ports.
    • Operated control: No.
    • Sourcing plan: retail shopping search: micro HDMI to HDMI cable 1 meter

  • Computer Monitor / Flat-Panel Display Module

    • Identity: Described only conceptually as the display monitor placed behind the mirror glass to present the UI. No manufacturer, part number, diagonal dimensions, aspect ratio, or resolution are specified in the sources.
    • Quantity: 1
    • Footprint/package: Flat-panel LCD/OLED monitor chassis or bare panel with HDMI controller board.
    • Electrical constraints: Standard HDMI video input; power rail defined by monitor (typically 100–240 V AC or 12 V DC external adapter).
    • Substitution latitude: Any display monitor with HDMI video input compatible with the Raspberry Pi resolution output.
    • Operated control: No.
    • Sourcing plan: retail shopping search: computer monitor HDMI thin bezel

  • Two-Way Semi-Transparent Mirror

    • Identity: Described only conceptually as mirror glass used to convert a display into a smart mirror. No glass thickness, transmission/reflection ratio (e.g., 70/30 or 60/40), dimensions, or coating specifications are provided.
    • Quantity: 1
    • Footprint/package: Flat sheet glass or acrylic cut to fit display panel and chassis.
    • Electrical constraints: None (optical component).
    • Substitution latitude: Any two-way semi-transparent mirror glass or mirrored acrylic sheet.
    • Operated control: No.
    • Sourcing plan: general web research: two way semi transparent mirror acrylic sheet smart mirror

  • Computer Keyboard

    • Identity: USB keyboard for manual configuration and runtime interaction. Documentation specifically requires keyboard input for system operations: pressing the Alt key toggles the menu toolbar, and pressing Ctrl+Shift+I toggles the Chromium Developer Tools.
    • Quantity: 1
    • Footprint/package: Standard USB keyboard.
    • Electrical constraints: 5 V bus powered via USB.
    • Substitution latitude: Any standard USB keyboard.
    • Operated control: Yes (students/users operate keystrokes Alt and Ctrl+Shift+I during setup, debugging, and menu navigation).
    • Sourcing plan: retail shopping search: standard USB keyboard

Software and network dependencies

  • Operating System: Raspberry Pi OS

    • Repository / Download: https://www.raspberrypi.com/software/
    • Version: "latest full version" (specific numeric release not stated; documentation in docs_requirements.md explicitly specifies "Full version with Desktop environment", states that "Lite Version of Raspberry Pi OS will not work", and notes that "versions based on Debian 'Buster' are also no longer supported").
    • Where version came from: stated in documentation.
    • Version pinned: No (unpinned floating latest desktop release).
    • Manifest location: docs_requirements.md
    • Check plan: support-status lookup: Raspberry Pi OS latest

  • Alternative Distribution Image: MagicMirrorOS

    • Repository / Download: https://github.com/guysoft/MagicMirrorOS
    • Version: not stated.
    • Where version came from: not stated.
    • Version pinned: No.
    • Manifest location: docs_installation.md
    • Check plan: not checkable: version not stated

  • Alternative Container Image: MagicMirror Docker Image

    • Repository / Download: https://gitlab.com/khassel/magicmirror
    • Version: not stated.
    • Where version came from: not stated.
    • Version pinned: No.
    • Manifest location: docs_installation.md
    • Check plan: not checkable: version not stated

  • Alternative Deployment Chart: MagicMirror Kubernetes Helm Chart

    • Repository / Download: https://gitlab.com/khassel/magicmirror-helm
    • Version: not stated.
    • Where version came from: not stated.
    • Version pinned: No.
    • Manifest location: docs_installation.md
    • Check plan: not checkable: version not stated

  • Runtime Engine: Node.js

  • Core Application Platform: MagicMirror²

    • Repository / Download: https://github.com/MagicMirrorOrg/MagicMirror
    • Version: 2.37.0
    • Where version came from: pinned in package.json (field version).
    • Version pinned: Yes.
    • Manifest location: package.json
    • Check plan: vulnerability lookup: magicmirror / npm / 2.37.0

  • Optional Desktop Wrapper Dependency (optionalDependencies in package.json):

    • electron: version ^42.5.2; where version came from: pinned in package.json; version pinned: caret range without lockfile; manifest location: package.json; check plan: vulnerability lookup: electron / npm / 42.5.2

  • Production Runtime Dependencies (dependencies in package.json, installed via command "node --run install-mm" / "npm install --only=prod"):

    • @fontsource/roboto: version ^5.2.10; where version came from: pinned in package.json; version pinned: caret range without lockfile; manifest location: package.json; check plan: vulnerability lookup: @fontsource/roboto / npm / 5.2.10
    • @fontsource/roboto-condensed: version ^5.2.8; where version came from: pinned in package.json; version pinned: caret range without lockfile; manifest location: package.json; check plan: vulnerability lookup: @fontsource/roboto-condensed / npm / 5.2.8
    • @fortawesome/fontawesome-free: version ^7.3.0; where version came from: pinned in package.json; version pinned: caret range without lockfile; manifest location: package.json; check plan: vulnerability lookup: @fortawesome/fontawesome-free / npm / 7.3.0
    • animate.css: version ^4.1.1; where version came from: pinned in package.json; version pinned: caret range without lockfile; manifest location: package.json; check plan: vulnerability lookup: animate.css / npm / 4.1.1
    • croner: version ^10.0.1; where version came from: pinned in package.json; version pinned: caret range without lockfile; manifest location: package.json; check plan: vulnerability lookup: croner / npm / 10.0.1
    • eslint: version ^10.6.0; where version came from: pinned in package.json; version pinned: caret range without lockfile; manifest location: package.json; check plan: vulnerability lookup: eslint / npm / 10.6.0
    • express: version ^5.2.1; where version came from: pinned in package.json; version pinned: caret range without lockfile; manifest location: package.json; check plan: vulnerability lookup: express / npm / 5.2.1
    • feedme: version ^2.0.2; where version came from: pinned in package.json; version pinned: caret range without lockfile; manifest location: package.json; check plan: vulnerability lookup: feedme / npm / 2.0.2
    • globals: version ^17.7.0; where version came from: pinned in package.json; version pinned: caret range without lockfile; manifest location: package.json; check plan: vulnerability lookup: globals / npm / 17.7.0
    • helmet: version ^8.2.0; where version came from: pinned in package.json; version pinned: caret range without lockfile; manifest location: package.json; check plan: vulnerability lookup: helmet / npm / 8.2.0
    • html-to-text: version ^10.0.0; where version came from: pinned in package.json; version pinned: caret range without lockfile; manifest location: package.json; check plan: vulnerability lookup: html-to-text / npm / 10.0.0
    • iconv-lite: version ^0.7.2; where version came from: pinned in package.json; version pinned: caret range without lockfile; manifest location: package.json; check plan: vulnerability lookup: iconv-lite / npm / 0.7.2
    • ics-filter: version ^1.0.3; where version came from: pinned in package.json; version pinned: caret range without lockfile; manifest location: package.json; check plan: vulnerability lookup: ics-filter / npm / 1.0.3
    • ipaddr.js: version ^2.4.0; where version came from: pinned in package.json; version pinned: caret range without lockfile; manifest location: package.json; check plan: vulnerability lookup: ipaddr.js / npm / 2.4.0
    • moment: version ^2.30.1; where version came from: pinned in package.json; version pinned: caret range without lockfile; manifest location: package.json; check plan: vulnerability lookup: moment / npm / 2.30.1
    • moment-timezone: version ^0.6.2; where version came from: pinned in package.json; version pinned: caret range without lockfile; manifest location: package.json; check plan: vulnerability lookup: moment-timezone / npm / 0.6.2
    • node-ical: version ^0.26.1; where version came from: pinned in package.json; version pinned: caret range without lockfile; manifest location: package.json; check plan: vulnerability lookup: node-ical / npm / 0.26.1
    • nunjucks: version ^3.2.4; where version came from: pinned in package.json; version pinned: caret range without lockfile; manifest location: package.json; check plan: vulnerability lookup: nunjucks / npm / 3.2.4
    • socket.io: version ^4.8.3; where version came from: pinned in package.json; version pinned: caret range without lockfile; manifest location: package.json; check plan: vulnerability lookup: socket.io / npm / 4.8.3
    • suncalc: version ^2.0.0; where version came from: pinned in package.json; version pinned: caret range without lockfile; manifest location: package.json; check plan: vulnerability lookup: suncalc / npm / 2.0.0
    • systeminformation: version ^5.31.11; where version came from: pinned in package.json; version pinned: caret range without lockfile; manifest location: package.json; check plan: vulnerability lookup: systeminformation / npm / 5.31.11
    • undici: version ^8.5.0; where version came from: pinned in package.json; version pinned: caret range without lockfile; manifest location: package.json; check plan: vulnerability lookup: undici / npm / 8.5.0
    • weathericons: version ^2.1.0; where version came from: pinned in package.json; version pinned: caret range without lockfile; manifest location: package.json; check plan: vulnerability lookup: weathericons / npm / 2.1.0

  • Development Dependencies (devDependencies in package.json):

    • @eslint/css: version ^1.3.0; where version came from: pinned in package.json; check plan: vulnerability lookup: @eslint/css / npm / 1.3.0
    • @eslint/js: version ^10.0.1; where version came from: pinned in package.json; check plan: vulnerability lookup: @eslint/js / npm / 10.0.1
    • @eslint/markdown: version ^8.0.2; where version came from: pinned in package.json; check plan: vulnerability lookup: @eslint/markdown / npm / 8.0.2
    • @stylistic/eslint-plugin: version ^5.10.0; where version came from: pinned in package.json; check plan: vulnerability lookup: @stylistic/eslint-plugin / npm / 5.10.0
    • @vitest/coverage-v8: version ^4.1.9; where version came from: pinned in package.json; check plan: vulnerability lookup: @vitest/coverage-v8 / npm / 4.1.9
    • @vitest/eslint-plugin: version ^1.6.20; where version came from: pinned in package.json; check plan: vulnerability lookup: @vitest/eslint-plugin / npm / 1.6.20
    • @vitest/ui: version ^4.1.9; where version came from: pinned in package.json; check plan: vulnerability lookup: @vitest/ui / npm / 4.1.9
    • cspell: version ^10.0.1; where version came from: pinned in package.json; check plan: vulnerability lookup: cspell / npm / 10.0.1
    • eslint-plugin-import-x: version ^4.17.1; where version came from: pinned in package.json; check plan: vulnerability lookup: eslint-plugin-import-x / npm / 4.17.1
    • eslint-plugin-jsdoc: version ^63.0.10; where version came from: pinned in package.json; check plan: vulnerability lookup: eslint-plugin-jsdoc / npm / 63.0.10
    • eslint-plugin-package-json: version ^1.5.0; where version came from: pinned in package.json; check plan: vulnerability lookup: eslint-plugin-package-json / npm / 1.5.0
    • eslint-plugin-playwright: version ^2.10.4; where version came from: pinned in package.json; check plan: vulnerability lookup: eslint-plugin-playwright / npm / 2.10.4
    • express-basic-auth: version ^1.2.1; where version came from: pinned in package.json; check plan: vulnerability lookup: express-basic-auth / npm / 1.2.1
    • husky: version ^9.1.7; where version came from: pinned in package.json; check plan: vulnerability lookup: husky / npm / 9.1.7
    • jsdom: version ^29.1.1; where version came from: pinned in package.json; check plan: vulnerability lookup: jsdom / npm / 29.1.1
    • lint-staged: version ^17.0.8; where version came from: pinned in package.json; check plan: vulnerability lookup: lint-staged / npm / 17.0.8
    • msw: version ^2.14.6; where version came from: pinned in package.json; check plan: vulnerability lookup: msw / npm / 2.14.6
    • playwright: version ^1.61.1; where version came from: pinned in package.json; check plan: vulnerability lookup: playwright / npm / 1.61.1
    • prettier: version ^3.9.4; where version came from: pinned in package.json; check plan: vulnerability lookup: prettier / npm / 3.9.4
    • prettier-plugin-jinja-template: version ^2.2.0; where version came from: pinned in package.json; check plan: vulnerability lookup: prettier-plugin-jinja-template / npm / 2.2.0
    • vitest: version ^4.1.9; where version came from: pinned in package.json; check plan: vulnerability lookup: vitest / npm / 4.1.9

  • Note on dependency version pinning: No lockfile (such as package-lock.json or npm-shrinkwrap.json) was included in the source distribution. All NPM dependencies are declared with caret ranges (^), which permits npm to install newer minor and patch versions at installation time.

  • Network Exposure:

    • Network Interfaces: The device connects via standard local area network (Ethernet or Wi-Fi on the Raspberry Pi).
    • Inbound Listening Services: Runs an Express HTTP web server and a Socket.io WebSocket server.
    • Ports: Listens by default on TCP port 8080 (configured via "port: 8080" in default configuration files and documented in docs_installation.md).
    • Listening Address & Whitelist: By default, the application binds to "localhost" (127.0.0.1) and rejects external connections. To accept remote network connections in server mode, docs_installation.md directs users to set "address: '0.0.0.0'" and update the "ipWhitelist" configuration array (default whitelist: ["127.0.0.1", "::ffff:127.0.0.1", "::1", "::ffff:172.17.0.1"]).
    • Client-Only Remote Mode: In client mode, remote display devices connect inbound to the server via TCP port 8080 using the command: node clientonly --address --port .
    • Outbound Network Traffic: The runtime actively makes outbound HTTP/HTTPS requests to download RSS/Atom feeds (via feedme), fetch remote iCalendar files (via node-ical and ics-filter), query weather data APIs, and poll external web services (via undici).
    • Default Credentials: No default usernames or passwords exist in the application code. Optional basic HTTP authentication is supported via express-basic-auth.
    • SSH / System Access: Not stated in the sources (standard Raspberry Pi OS SSH may be enabled at user discretion, but the documentation does not instruct configuring SSH).

Downloads, External URLs, and Fabrication