if-let on a temporary lock guard without a trailing semicolon extends
the guard's drop scope past the enclosing block, so the State it
borrowed from gets dropped first -- E0597 on macOS/Windows.
- OAuth: generate and validate a state param across the Trakt/MAL/Simkl
deep-link flow to close a login-CSRF gap (code was exchanged with no
check that it came from a flow this app actually started).
- Add net_guard: resolves the host of any addon-supplied URL and refuses
to fetch loopback/private/link-local/CGNAT addresses, applied to
http_fetch_text, artwork prefetch, and offline downloads. Drop the
now-unused localhost/ws CSP allowances.
- Encrypt storage_read/storage_write at rest (AES-256-GCM, key in a
0600-permissioned file) instead of plaintext JSON, with transparent
fallback for existing unencrypted files so upgrading doesn't lose data.
- Replace get_nuvio_config (handed the Supabase anon key straight to JS)
with a nuvio_request proxy command -- Rust attaches the key and makes
the call itself, so it never exists in webview-reachable memory.
- Render backend now sources prebuilt libmpv from KhooLy/mpv (gpu-next),
fetched via src-tauri/fetch-libmpv.sh; video-sync switched to
display-resample with vsync-paced render loops on all platforms.
- CI (build.yml) updated to fetch the fork instead of building/bundling
mpv per-platform.
- Fix: next-episode auto-skip countdown kept ticking while paused.
- Fix: addon HTTP fetches had no timeout, so a hung (not just refused)
connection could block the home feed load forever, leaving a blank
screen with no error.
- Fix: Nuvio offline banner overlapped the player's top bar instead of
pushing it down.
- Add F11 as a fullscreen toggle in the player, alongside F.
- Restyle Skip Intro/Outro button: flat surface instead of native
button chrome bleeding through, icon, hover/focus state, progress bar.
