Previous HTML stripping could allow malformed or unclosed tags to pass through, potentially leading to Cross-Site Scripting (XSS) vulnerabilities if completed by the browser.
This change updates the regex to aggressively remove all HTML tags, even incomplete ones. The `knockout-extensions.js` code also now universally escapes HTML, removing a potential bypass. New tests confirm this behavior.
Malformed RAR file metadata can raise exceptions other than `rarfile.Error` (e.g., `ValueError` on a bad seek). Catching these broader exceptions prevents the assembler from crashing during inspection.
The hachoir library is a large dependency (~5-10MB memory usage) that is exclusively used by the `get_media_duration` function. By moving its import statement inside this function, hachoir is only loaded when its functionality is actively needed, reducing the application's overall memory footprint.
On Windows, creating symbolic links requires either an elevated shell or Developer Mode. This introduces a runtime check to verify if symlinks can be created. Tests that rely on symlink creation are now skipped if this check fails, preventing unnecessary test failures in environments without the required permissions.
These tests rely on a specific behavior of '..' in paths involving symbolic links, which differs on Windows where '..' is collapsed before the filesystem resolves links.
Replaces `github.token` with `secrets.AUTOMATION_GITHUB_TOKEN` to provide consistent and appropriate permissions for automated tasks like creating pull requests.
* Guard the speed counters with their own lock so updates are not lost
* Update the speed counters without taking the Downloader lock
* Skip the downloader sleep once the loop rather than the connection is the limit
* Remove unused variable
Moves theme-specific styles into main CSS files for each interface,
leveraging `color-scheme` and `light-dark()` CSS functions. This
consolidates styling, reduces HTTP requests, and improves automatic
dark/light mode detection based on OS preferences.