chore(license): standardize flights + stocks to GPL-3.0#177
Merged
Conversation
Completes the repo-wide MIT -> GPL-3.0 pass for the plugins not covered by the other audit PRs. All first-party: - ledmatrix-flights (1.10.0 -> 1.10.1): manifest "license" + README MIT -> GPL-3.0 (its LICENSE file was already GPL). - ledmatrix-music (1.0.6 -> 1.0.7): LICENSE file + manifest "license" + README MIT -> GPL-3.0. - ledmatrix-stocks (2.3.0 -> 2.3.1): manifest "license" MIT -> GPL-3.0 (its LICENSE file was already GPL). No code changes. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F9Saiat9CQmNi3DeDdvacB
Contributor
|
Warning Review limit reached
Next review available in: 6 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughChangesPlugin release updates
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Complexity | 0 |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
…patibility The plugin-safety harness renders each changed plugin, and its BoundsCheckingDisplayManager does not implement process_deferred_updates(), so stocks crashed at every size once the license bump made it a "changed" plugin. Guard the call with hasattr — production DisplayManager still runs it; harness/other managers that lack it are skipped. No production behavior change. Note: leaderboard, odds-ticker, news, and stock-news call the same method and would hit this too when next touched — the core harness double is missing it. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F9Saiat9CQmNi3DeDdvacB
Relicensing made music a "changed" plugin, so the safety harness rendered it and caught a PRE-EXISTING overflow on the 64px-wide panels ([FAIL] 64x32 / 64x64 now_playing overflow bbox=(64,...)) — album-art + text don't fit a 64px width. That's a narrow-panel layout bug, not a licensing issue, and needs a real rendering fix (best verified against the core harness). Revert music to its current state so this PR (flights + stocks -> GPL-3.0) can land; music's relicense will follow once the overflow is fixed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F9Saiat9CQmNi3DeDdvacB
ChuckBuilds
changed the title
2 tasks
Resolves conflicts after #173 (phase-1 LICENSE) and #176 (flights airport-weather) landed on main: - ledmatrix-flights/manifest.json: main advanced to 1.12.2 (still MIT). Re-applied the GPL-3.0 license flip on top and bumped to 1.12.3, preserving the weather-feature version history. - plugins.json: regenerated from manifests (deterministic). flights -> 1.12.3, stocks -> 2.3.1 (both GPL-3.0). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F9Saiat9CQmNi3DeDdvacB
Follows the maintainer's correction on #175: the core's manifest validator flags `ledmatrix_min` as deprecated and expects `ledmatrix_min_version`. Normalize every versions[] entry in the flights and stocks manifests to `ledmatrix_min_version` so device installs don't log deprecated-field warnings. (Latest main, incl. #174/#175, was merged in the preceding commit.) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F9Saiat9CQmNi3DeDdvacB
ChuckBuilds
added a commit
that referenced
this pull request
Jul 10, 2026
CI's version-bump enforcement failed because this PR's code changes to display_renderer.py and manager.py weren't matched by manifest version bumps. Branch was 5 commits behind main (missing #177's GPL/hasattr-guard work, which had already taken ledmatrix-stocks to 2.3.1) — merged main in first so this bumps from the real current version instead of colliding with an already-published one. - ledmatrix-stocks: 2.3.1 -> 2.3.2 (logo_x/logo_gap spacing fix) - odds-ticker: 1.1.4 -> 1.1.5 (baseball odds-column sizing fix), and dropped its dependencies.managers object — same schema shape as the bug fixed in stock-news (PR #174): manifest_schema.json types `dependencies` as a flat array of pip package names, and nothing in core reads a `managers` key. It was never touched before because CI only validates changed plugins, but editing this manifest for the version bump means the schema check now runs against it for real. New versions[] entries use ledmatrix_min_version (not the deprecated ledmatrix_min flagged by core's store_manager.py validator). plugins.json synced via update_registry.py.
ChuckBuilds
added a commit
that referenced
this pull request
Jul 10, 2026
* Fix odds-ticker baseball gap and stock-ticker logo spacing
odds-ticker: for live baseball games, odds_width was sized from the
away/home odds text ("Bases: 1B2B3B", "Count: 3-2" - up to 104px at
8px font) even though that text is never drawn; a 24px bases-diamond
graphic is drawn instead, left-aligned in that column. The next
column (inning info) started after the full odds_width, leaving up
to ~80px of dead space between the bases graphic and the inning
text. Detect the live-baseball case before sizing the column and use
the actual 24px graphic width instead of maxing against the unused
placeholder text.
ledmatrix-stocks: logo_x (2px) and logo_gap (4px, between the logo's
right edge and the symbol/price text) were too tight for a ~26px-tall
logo on a 32px-tall display. Bumped to 4px and 8px.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* chore(plugins): bump versions for ledmatrix-stocks and odds-ticker
CI's version-bump enforcement failed because this PR's code changes to
display_renderer.py and manager.py weren't matched by manifest version
bumps. Branch was 5 commits behind main (missing #177's GPL/hasattr-guard
work, which had already taken ledmatrix-stocks to 2.3.1) — merged main
in first so this bumps from the real current version instead of colliding
with an already-published one.
- ledmatrix-stocks: 2.3.1 -> 2.3.2 (logo_x/logo_gap spacing fix)
- odds-ticker: 1.1.4 -> 1.1.5 (baseball odds-column sizing fix), and
dropped its dependencies.managers object — same schema shape as the
bug fixed in stock-news (PR #174): manifest_schema.json types
`dependencies` as a flat array of pip package names, and nothing in
core reads a `managers` key. It was never touched before because CI
only validates changed plugins, but editing this manifest for the
version bump means the schema check now runs against it for real.
New versions[] entries use ledmatrix_min_version (not the deprecated
ledmatrix_min flagged by core's store_manager.py validator).
plugins.json synced via update_registry.py.
---------
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
ChuckBuilds
added a commit
that referenced
this pull request
Jul 10, 2026
Same recurring issue as PRs #175/#177/#178: the core's store_manager.py validator flags ledmatrix_min as deprecated and expects ledmatrix_min_version. This PR's new 1.19.0 changelog entry used the deprecated name; corrected to match the non-deprecated field (older entries below 1.6.2 already have this same pre-existing issue but are untouched by this PR, so left as-is -- out of scope here).
ChuckBuilds
added a commit
that referenced
this pull request
Jul 10, 2026
…ayer card (v1.19.0) (#180) * feat(baseball-scoreboard): team-color grid, clearer at-bat labels, player card (v1.19.0) Three enhancements to the baseball plugin: 1. Traditional scoreboard: subtle team-color row tint (~12% brightness wash) plus a solid left-edge accent strip per team, reusing the already-fetched away/home ESPN colors. Gated by a new show_team_color_backgrounds toggle (default on; requires use_team_colors). Text stays legible via its black outline. 2. Pitcher/Batter screen: labels spelled out ("Pitcher:" / "Batter:") so "B" is no longer ambiguous with the grid's Balls indicator. 3. New Player Card screen (show_player_card, MLB & NCAA): rotates in a masters-style card for the current batter/pitcher with headshot, jersey number, position, bat/throw, and season stats (AVG/HR/RBI for hitters, ERA/W-L/K for pitchers). Bio + headshot fetched from ESPN's athlete API and cached (memory + disk); the headshot hides on tiny panels and the card degrades to text-only when unavailable. Skipped for MiLB (no ESPN player data). All new code lives in existing files (no new bare-name modules, per the cross-plugin collision rule). Adds config schema (grid toggle, per-league show_player_card, player_card customization block), manager plumbing, docs, and tests (test_player_card.py + grid-tint tests). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01R1z28MrGx56x6eiJvibDg9 * fix(baseball-scoreboard): harden headshot cache path + download URL Address a Codacy medium security finding on the new player-card headshot loader: - Sanitize the ESPN-provided player_id and league before using them as filesystem path segments (_safe_filename strips to [A-Za-z0-9_-]) so an unexpected id can't escape the headshot cache directory via '..' or path separators. - Only fetch headshots over http(s), refusing file://, ftp://, etc. Adds a unit test for the filename sanitization. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01R1z28MrGx56x6eiJvibDg9 * fix(baseball-scoreboard): log player-bio cache errors instead of silent pass Resolve the Codacy/Bandit B110 (try/except/pass) medium finding in _fetch_player_bio: the two cache_manager get/set guards swallowed exceptions with a bare `pass`. Log them at debug level instead so cache issues are diagnosable, matching how the rest of the plugin handles non-fatal cache errors. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01R1z28MrGx56x6eiJvibDg9 * fix(baseball-scoreboard): harden + de-block headshot fetch (CodeRabbit review) Address two CodeRabbit review findings on the player-card headshot loader: 1. SSRF + unbounded response (security): the ESPN-supplied headshot URL was fetched with only a scheme check. Now restrict the host to ESPN domains (*.espncdn.com / *.espn.com) via an allowlist, and stream the download with a hard 5 MB size cap (Content-Length check + bounded iter_content) to prevent memory exhaustion. 2. Render-path blocking (stability): load_headshot() previously did a synchronous requests.get on a cache miss straight from _draw_player_card_screen, freezing the display up to 5s when a new batter/pitcher rotated in. The render path is now cache-only (allow_download=False); BaseballLive.update() prefetches headshot bytes off-thread (daemon thread, throttled) to warm the disk cache, mirroring the existing _fetch_player_bio pattern. A cold cache degrades to a text-only card until the prefetch completes. Adds tests for the host allowlist (incl. metadata-IP and look-alike-host rejection) and for the render path never downloading. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01R1z28MrGx56x6eiJvibDg9 * fix(baseball-scoreboard): use ledmatrix_min_version in new 1.19.0 entry Same recurring issue as PRs #175/#177/#178: the core's store_manager.py validator flags ledmatrix_min as deprecated and expects ledmatrix_min_version. This PR's new 1.19.0 changelog entry used the deprecated name; corrected to match the non-deprecated field (older entries below 1.6.2 already have this same pre-existing issue but are untouched by this PR, so left as-is -- out of scope here). --------- Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Flips
ledmatrix-flightsandledmatrix-stocksfrom MIT to GPL-3.0 (part of the repo-wide "no MIT" pass). Both first-party; MIT is GPL-compatible.Plugin(s) affected
ledmatrix-flights(1.10.0→1.10.1),ledmatrix-stocks(2.3.0→2.3.1)What changed
license+ README MIT → GPL-3.0 (LICENSE file was already GPL).licenseMIT → GPL-3.0 (LICENSE already GPL) + guardeddisplay_manager.process_deferred_updates()withhasattrso it renders under the safety harness's display-manager double (which doesn't implement that method). Production behavior unchanged.Deferred —
ledmatrix-musicIts relicense was dropped from this PR: making it a "changed" plugin caused the harness to render it and catch a pre-existing overflow on the 64px-wide panels (
now_playing overflow bbox=(64,…)at 64×32 / 64×64) — album-art + text don't fit 64px width. That's a narrow-panel layout bug needing a real render fix (best done against the core harness), not a licensing change. Music stays MIT until that's fixed.Heads-up for the maintainer (core harness gap)
The safety harness's
BoundsCheckingDisplayManagerdoesn't implementprocess_deferred_updates(), which 5 plugins call (leaderboard, odds-ticker, news, stock-news, and stocks). Any of them fails the harness the moment it's touched. I guarded stocks here, but the clean fix is to add that method (a no-op is fine) to the harness double in the core repo.Test plan
update_registry.py(flights + stocks bumps; music back to 1.0.6),check_module_collisions.py(clean), JSON validity.🤖 Generated with Claude Code
https://claude.ai/code/session_01F9Saiat9CQmNi3DeDdvacB
Summary by CodeRabbit
New Releases
Bug Fixes
Documentation