Thanks to: @ago1776, @alkank, @Antra, @Blackspirits, @deBasMan21, @flightlesstux, @i-xul, @jamalkamaladdin, @khassel, @KristjanESPERANTO, @MannXo, @pascalpfammatter, @rejas

⚠️ This release needs nodejs version >=22.22.2 <23 || >=24

Compare to previous Release v2.37.0

[core]

• Prepare Release 2.38.0 (#4285)
• fix: let Electron select the Wayland display (#4268)
• fix(http): improve access error messages (#4281)
• fix: always redact client configuration (#4275)
• refactor: migrate browser scripts to ESM (#4272)
• refactor: convert animateCSS to ES module (#4266)
• use filter instead of find to get all allowed secrets when multiple instances of a module are active (#4265)
• refactor: convert notificationFx to ES module (#4263)
• refactor: enforce function expression style (#4262)
• fix: validate client IP behind trusted proxies (#4261)
• prefer arrow over function (#4252)
• refactor(utils): simplify configuration validation and error handling (#4240)
• fix(server): validate request origins (#4234)
• remove codeql warning (#4231)
• refactor(socket): use direct ESM import in main (#4225)
• refactor(socket): load Socket.IO client via ESM (#4224)
• style: simplify Electron startup checks (#4213)
• refactor: consolidate electron bootstrap into async function (#4210)
• refactor(module): simplify and fix configMerge (#4203)
• refactor: convert Translator to ES module (#4202)
• docs: add CodeQL review steps and restructure after-release checklist (#4200)
• refactor: centralize server port resolution (#4198)
• refactor: use const instead of let for variable declarations (#4196)
• refactor: replace Loader object with named exports (#4195)
• set next release dev number
• refactor(eslint): enforce prefer-arrow-callback rule (#4251)
• refactor(http_fetcher): make dynamic URL handling explicit (#4282)
• refactor: use explicit global config (#4233)
• expand logic of hideConfigSecrets, add more tests (#4229)
• refactor: make browser startup more explicit (#4214)

[dependencies]

• update dependencies (#4276)
• update dependencies incl. electron to v44 (#4250)
• chore: update eslint incl. plugins + review rules (#4236)
• Bump actions/stale from 10 to 11 (#4215)
• update dependencies (#4221)
• Bump actions/setup-node from 6 to 7 (#4204)
• chore: update dependencies (#4201)
• Bump electron from 42.5.2 to 43.0.0 (#4192)

[modules/alert]

• Move alert translations into common translations (#4284)

[modules/calendar]

• Fixes issue 4243: Ensure while loop in calendar module does not get stuck when no entries (#4244)
• fix(calendar): escape HTML in event title and location (#4260)
• calendar: allow custom events to override symbol class (#4257)
• Fix calendar crash when yearmatchgroup regex does not match (#4239)
• fix(calendar): keep yearly events in DTSTART’s month when BYMONTH is missing (#4222)
• fix(calendar): correct multi-day slice day counts (#4232)
• chore: update dependencies + adapt calendar tests (#4211)
• fix(calendar): sliced multi-day events start at 00:00, not 23:59 (#4208)

[modules/newsfeed]

• newsfeed: don’t use cors url in njk template (#4279)
• refactor(newsfeed): extract feed item normalization into feeditem.js (#4271)
• refactor(newsfeed): replace feedme lib with feedparser (#4269)
• newsfeed: fix allowedBasicHtmlTags (#4258)
• newsfeed: update checkArticleUrl (#4256)

[modules/updatenotification]

• feat(updatenotification): implement trusted module configuration for update commands (#4259)

[modules/weather]

• feat: add FMI weather provider (#4278)
• feat(weather): enable CSS ordering for forecast and hourly columns (#4118)
• fix(weather): respect initial load delay (#4254)
• fix(weather): restrict provider loading to the providers directory (#4235)
• refactor(weather): extract WeatherProvider base class (#4228)

[testing]

• ci: fail lint on warnings (#4230)
• add test if install works for minimal node version (#4197)

[translation]

• feat(i18n): add Azerbaijani translation (#4283)
• feat(i18n): complete Turkish translations (#4277)
• Improve Portuguese translations (#4274)