7/12/26 - v1.2.3

Security

• Fixed CSS injection vulnerability in custom font fields and imported themes. Color and font values are now validated to reject CSS breaking payloads. This affects custom fonts, marketplace themes, and imported JSON configs.

Fixes

Text & Color

• Preview gradient no longer falsely renders on sung or unsung sample lines. Only the active line uses the gradient, matching actual output.
• Font weight dropdown now correctly displays custom weights (such as "Custom (760)") instead of silently showing a mismatched option.
• Color picker now displays and edits rgba() colors correctly instead of defaulting to white.

Glow & Effects

• Active line scale no longer double scales words. Words now scale once with the line instead of compounding to scaleActive², eliminating overflow and jank with Pop/Wave animations.
• Flat color mode default changed from near invisible rgba(255,255,255,0.2) to opaque #ffffff. The mode is now usable out of the box.
• Removed dead refreshPreview() calls that had no effect.

Translation

• Translation opacity slider now works correctly. It was previously ineffective due to a specificity override. Translations now properly blend state based fades (bright active to dimmer sung or unsung) with the translation opacity setting.

Player & Media

• Added descriptive helper text under the section heading to clarify these settings affect the Now Playing bar and the main Spicy Lyrics window.

Full Changelog: v1.2.2...v1.2.3