v0.4.1 — sanitise Aladhan timings, escape Pango, harden the schedule run

Security and robustness fixes following a review of v0.4.0. No user-facing behaviour changes if your city has no & in it.

Sanitised: prayer times from the Aladhan API

hijri from that response was already treated as untrusted; the timings from the same response were not. Extraction kept anything without whitespace — which an OSC 52 terminal escape satisfies — and it reached the TUI, omarchy-prayer today, and the waybar tooltip unfiltered.

Validated at ingress now, and cleaned again in Today — ingress alone was not enough, because the month cache and today.json are re-read verbatim and the cache is preferred over the API, so a payload written by an older version would have kept being served all month.

Fixed: an & in your city name blanked the whole bar

waybar renders these labels through Pango markup unconditionally, and an unescaped & fails parsing outright, leaving the label unset. Any legitimate place name with an ampersand has quietly broken the module all along. Now escaped.

Corrected: markup: true never did anything

v0.4.0's notes said this key gated Pango parsing. It does not exist in waybar's custom-module contract (text, tooltip, class, percentage) and markup was always parsed. The key is removed and the comment in the source corrected, so nobody relaxes the sanitiser believing markup is opt-in.

Hardened: a failed schedule no longer takes the CLI down

omarchy-prayer-schedule runs as a systemd unit and every command shells out to it. Above roughly 60° latitude the offline calculator cannot compute a sunrise and raised, producing a backtrace and no prayer times at all. It now reports the failure and exits cleanly, leaving the previous schedule in place.

Two matching guards on the same theme: only the five displayed prayers can reject a month of API times — an unexpected field in Aladhan's response no longer costs every user their times — and a missing prayer time stays missing instead of becoming a 00:00 adhan.

---

316 tests, green under both the bundled and bundler-less invocations. Every guard here is mutation-tested: reverting any one of them fails the suite.

The widget is unchanged in this release; the plugin stays at 0.4.0.