8.5.36

Improvements

• OS-14731: Upgraded to latest packages per OpenSSL security advisory.

Bug Fixes

• OS-13160: Fixed an issue where DHCP IP in IPv6 was bound to the DUID and not the MAC Address.

• BCN-13310: Fixed support for remote directory creation.

8.5.33

Improvements

• OS-13924: Forced redraw if HTML widget is moved

• OS-14000: HTML widget storage quota can now be made large

...

• OS-14166: Fixed non-HWZ video on 4K242, 4K1042, and 4K1142 models

• OS-14238: Fixed simultaneous video playback from multiple HTML widgets

9.0.15

New Features

• Added support for the XC5

• Chromium security fixes merged from 8.5

• Updated FFmpeg from 4.4.1 to 4.4.2

Improvements

• OS-12964: Added an interface that allows the background color to be dynamically set

• OS-13076: Disabled low end device mode in Chromium to avoid rendering errors

• OS-13347: (XC5) Support video opacity on the XC5

• OS-13467: Added audio support in roHtmlWidget for built-in Chromium media playback (Chromium audio will go to HDMI-1 and analog by default)

• OS-13483: Added audio output hints for selection when using built-in Chromium media playback

• Added an output port name to roHdmiEdidChanged events in roVideoMode

• Allowed "HDMI:1" as well as "HDMI-1" for video port naming in videooutput

• OS-13616: Extended the videooutput API to allow PowerSaveMode to be specified on individual ports

• OS-13705: Made startCalibration arguments optional in js_ipcpointercalibration

• OS-13781: Enabling the web inspector now requires a registry entry

• OS-13654: Implemented safe x509 GeneralName format (CVE-2021-44532)

• OS-13379: For multi-output players, the informational splash screen displays on all outputs

Bug Fixes

• OS-13363: Ensured that removing last item invalidates the index in roList

• OS-13444: Trigger the busy LED to flash on NVMe SSD activity on XD4/XT4 players

• OS-13521: Fixed crash of roVideoPlayer during fade out

• OS-13638: Fixed screenshot timeout and other problems when power save mode is enabled on any screen

• OS-13871: Discarded any invalid transform strings in VideoMode

• OS-13917: Rounded cumulative video mode frame rates to display integers only

• OS-4745: Deprecated obsolete WEP and TKIP WiFi modes on Series 5+

8.5.31

Notable Changes

• OS-12400: Node upgraded to version 14.17.6

• OS-12444: Chromium upgraded to version 87.0.4280.144

  • OS-13121, OS-13172: Applied numerous CVE fixes (Merged all Chromium CVE fixes up to Chromium99): CVE-2021-0129, CVE-2021-45960, CVE-2021-46143, CVE-2022-22822-27, CVE-2022-23852, CVE-2022-23990, CVE-2022-25235, CVE-2022-25236, CVE-2022-25313-5, CVE-2021-42374, CVE-42376, CVE-2020-36254, CVE-2021-27218, CVE-2021-27219, CVE-2021-28153, CVE-2021-3995, CVE-2021-3996, CVE-2021-45078, CVE-202-23903, CVE-2020-10531, CVE-2021-33560, CVE-2021-40528, CVE-2021-36976, CVE-2021-3658, CVE-2022-23308, CVE-2022-1271, CVE-2022-0204, CVE-2022-0563, CVE-2021-3541, CVE-2021-3517, CVE-2021-30553, CVE-2021-30569, 1204814 and 1197786, CVE-2021-30560, CVE-2021-30627, CVE-2021-30618, CVE-2021-30603, CVE-2021-30585, CVE-2021-30559, CVE-2021-30547, CVE-2021-30522, CVE-2021-21227, CVE-2021-30513, CVE-2021-21231, CVE-2021-30513, CVE-2021-30518, CVE-2021-30513, CVE-2021-30515, CVE-2021-21231, CVE-2021-21207, CVE-2021-21230, CVE-2021-21227, CVE-2021-21223, CVE-2021-21203, CVE-2021-21204, CVE-2021-21202, CVE-2021-21214, CVE-2021-21221, CVE-2021-21206, CVE-2021-21220, CVE-2021-21160, CVE-2021-21156, CVE-2021-21188, CVE-2021-21195, CVE-2021-21198, CVE-2021-21175, CVE-2021-21193, CVE-2021-21190, CVE-2021-21160, CVE-2021-21165, CVE-2021-21157, CVE-2021-21148, CVE-2021-21137, CVE-2021-21153, CVE-2021-21138, CVE-2021-21119, CVE-2021-21140, CVE-2021-21140, CVE-2021-21120, CVE-2020-16044, CVE-2020-16044, CVE-2020-16044, CVE-2021-21146, CVE-2021-21114, CVE-2020-16042, CVE-2020-16030, CVE-2020-16027, CVE-2020-16016, CVE-2020-16040, CVE-2020-16034, CVE-2020-16028, CVE-2020-16024, CVE-2020-16022, CVE-2020-16014, CVE-2020-16011, CVE-2020-16008


  • Fixed CVE-2021-44532 in TLS/node

• The Chromium remote inspector is disabled by default on 8.5 release, even when it is enabled by roHtmlWidget enable_inspector flag, or roHtmlWidget.StartInspectorServer. An extra registry value has been added (”enable-web-inspector” in the “html” registry section) to enable the inspector. This ensures that users do not unintentionally enable the remote inspector on production software, which is not secure and may increase memory usage.

• Chromium has dropped support for desktop style scrollbars. BrightSign OS 8.5 is shipped with overlay scrollbars. Overlay scrollbars overlay on graphics and are only displayed when a page is scrolled. They disappear when the page is still.

• Chromium87 uses separate JavaScript contexts for data URLs. It is no longer possible to inject JavaScript from the data URL and access window context.

• Data URLs no longer share the same URL domain with the origin domain. It is no longer possible to access cross site data from data URLs.

• Chromium has added support to view remote device screen through inspector view. This is not supported on BrightSign devices due to architectural differences between desktop Chromium and BrightSign.

• Chromium has added more stringent security policies around cross site requests. Some of these security options can be disabled if needed. But, unlike our security_params (roHtmlWidget | roHtmlWidget-[roAssociativeArray]security_params), these security options cannot be disabled per instance. We have added an “html” → “disable-web-security” registry option to disable these security checks. This change takes effect after a reboot.

...