v0.5.0 — Security & Reliability Sweep

What's Changed

Security

• CORS restricted from wildcard * to http://127.0.0.1
• Mutex poisoning resilience via safe_lock() across all Rust code
• SystemTime::unwrap() → unwrap_or_default() for safety
• Action throttling (500ms) to prevent API request spam

Reliability

• ascii-art/ missing directory now raises clear ImportError
• track_changed() split into is_new_track() + mark_track_seen() (no more side effects)
• API server tries ports 18899→18901 instead of hard fail
• 13 bare except: pass replaced with stderr logging
• API retries exhausted now raises ConnectionError instead of silent None

Code Quality

• Version synced to 0.5.0 across Python / Cargo.toml / package.json
• Removed dead code, redundant imports, misleading comments
• logout() refactored to @staticmethod clear_tokens()
• requirements.txt completed with pywebview + pyobjc

Polish

• Frontend art cache capped at 20 entries (prevents memory leak)
• HTML entity escaping completed (added ')
• setup.sh warns when ascii-art/ directory is missing

Install

Download Spottt.dmg, open it, drag to Applications.
Set SPOTIFY_CLIENT_ID env var or add to ~/.config/spottt/config.json.

🤖 Generated with Claude Code