Skip to content

The password form could not be typed into, and nothing noticed

Three boxes that looked normal, focused normally, and refused every character — including on the page a board shows before it will do anything else, so a board on its factory password could not be taken off it from a browser at all. Reported by a user who worked it out and used SSH instead. The release also carries the gate that would have caught it: the interface's CI now types into every box of every tab.

Firmware v2.37.0, 22 September 2026 — the first image to carry BMC-UI 3.36.0. Every item below is the repository's own changelog entry, taken apart; the whole entry is a click away under each one.

New

A gate that types

BMC-UI 3.36.0

npm run type-test drives the demo build over the DevTools protocol, types into every visible text box on every tab, and reads the value back; CI fails on a box that does not keep what was typed.

The whole entry

Nothing existing could have caught this — it builds, it lints, it renders, and the screens gate measures height. Run against the unfixed component it reports the three password boxes and nothing else; the probe types a value each field can actually hold, because a number box refusing a word is not a fault and a gate that cries wolf gets switched off.

Fixed

  • The password form would not accept typing, in any of its three boxes. The interface's shared text field dropped the change handler for password inputs, and a React field that holds its value but cannot report a change is read-only: every keystroke was reverted, silently, with markup that looks perfect.

    The whole entry

    It hit the password card on Access and the page a board still on its shipped password shows instead of everything else — so such a board could not be taken off that password from a browser at all, only over SSH. Logging in was unaffected, which is why it went unnoticed: that form reads the page on submit rather than holding state.

    Reported as #48 by a user on v2.34.0, and present since long before this fork. The release also adds the gate that would have caught it: the interface's CI now types into every visible box of every tab and fails on one that does not keep what was typed. Nothing that existed could see it — it builds, it lints, it renders, and the page-length gate measures height.

Every release of the firmware · the roadmap · follow by feed