v1.1.2

What's new

Pillow security update. Bumped the pinned Pillow version from >=10,<12 to >=12,<13, picking up upstream fixes for a batch of image-decoding vulnerabilities (denial-of-service and out-of-bounds read/write bugs). Cover art fetched from the firmware catalog is decoded through Pillow, so this closes off a real route for attacker-influenced image bytes to reach those bugs.

This is a small maintenance release with no user-facing feature changes.

Installing

• Windows: download and unzip m5uploader-windows.zip, run the .exe inside.
• Linux: download m5uploader-linux.AppImage, chmod +x it, run it.
• macOS: download and unzip m5uploader-macos.zip, run the .app.

v0.1.1

What's new

On-device flashing. A new Flash Firmware tab flashes M5Stack devices directly - pick a serial port (likely ports are auto-detected by USB vendor/product ID), pick a .bin, optionally erase first, and go. Flashing runs through esptool, kept in its own subprocess so its GPL license never touches this app's own Apache-2.0 code (see THIRD_PARTY_LICENSES.md).

Local caching. The firmware catalog, cover images, and firmware downloaded via the catalog are now cached on disk, so Browse Firmware loads faster on repeat visits. Each catalog entry also has a Flash button that downloads (or reuses the cache) and jumps straight to the Flash tab with the file loaded.

OS keychain for the session token. The token is now stored in your system keychain when one is actually available and working, with an automatic fallback to the existing plain-file storage otherwise - login never breaks because of a missing or locked keychain.

Passive update notice. m5uploader checks GitHub Releases and shows a dismissible banner when a newer version is out. No auto-updater - it just links to the release page.

Cover image metadata stripped. EXIF, ICC profile, and other metadata are removed from cover images before upload, so things like GPS coordinates in a phone photo don't get published by accident.

Opt-in download counting. A "Count my downloads" toggle in Browse Firmware (off by default) lets your downloads count toward the public download total shown in the catalog.

Theme now persists. Dark/light mode is remembered across restarts.

Installing

• Windows: download and unzip m5uploader-windows.zip, run the .exe inside.
• Linux: download m5uploader-linux.AppImage, chmod +x it, run it.
• macOS: download and unzip m5uploader-macos.zip, run the .app.

v0.1.0

v1.0.0 - Initial Release

Welcome to the first release of m5uploader, a minimal and security-conscious replacement for M5Burner's account and firmware features.

What's Included

• Account Management - Log in with your M5Stack account; session tokens are securely persisted
• Browse Firmware - Full public firmware catalog with search, filtering, descriptions, and cover art
• My Firmware - Publish, edit, and manage your own firmware versions with visibility controls
• Cross-Platform - Native GUI built with ttkbootstrap, works identically on Linux, Windows, and macOS

Security First

• HTTPS-only communication with TLS verification
• No embedded browser (no Chromium, Electron, or Node dependencies)
• Secure token storage with proper file permissions
• No automatic telemetry

Download

Prebuilt binaries for Linux, Windows, and macOS are available below.

Known Limitations

Flashing functionality is planned for a future release.