v0.3.0

Changelog

• 5a13635: feat: concurrent track matching, search cache, quiet mode (@just5ky)
• 835207b: refactor: simplify levenshtein function and remove unused code (@just5ky)

v0.2.0

What's Changed

🔒 Security

• crypto/rand for auth salt — replaced math/rand (not a CSPRNG) in Subsonic token generation
• HTTP response size cap — io.LimitReader at 10 MiB prevents OOM from malicious servers
• HTTP status check — 4xx/5xx responses now fail fast before JSON decode
• State file permissions — tightened from 0644 → 0600 (no longer world-readable)
• SPOTSONIC_PASSWORD env var — password no longer required on the command line (avoids ps aux exposure)

🔁 Reliability

• Retry with exponential backoff — transient network errors and HTTP 5xx retry up to 3× (1 s, 2 s); 4xx and API errors fail immediately
• Temp file cleanup — .tmp state file removed on failed os.Rename
• Report write errors surfaced — CSV write/flush failures in unmatched report are now logged instead of silently dropped
• State-save failure — logged at ERROR level instead of warning

✅ Correctness

• Fuzzy matcher rune-aware — similarity() now uses rune lengths (not byte lengths); fixes inflated scores for non-ASCII track names (CJK, Arabic, etc.)
• Case-insensitive CSV headers — column matching now tolerates track uri / TRACK URI etc.

📄 Docs

• Added AUDIT_REPORT.md (full security audit findings)

v0.1

Full Changelog: https://github.com/just5ky/SpotSonic/commits/v0.1