Fix CodeRabbit findings on cricket-scoreboard plugin (PR #181)

[ChuckBuilds]

Summary

Addresses all 7 CodeRabbit findings from #181:

• Schema: favorite_teams now requires non-empty strings (minLength: 1) — an empty entry previously matched every international series via substring matching in cricket_data_fetcher.py.
• overs_to_balls: now rejects negative overs (returns 0), matching the existing guard in overs_to_decimal.
• _get_json: validates the parsed response is a dict before returning it, logging a warning and returning None otherwise, so callers can safely use .get(...).
• Series discovery cache: cache key is now scoped by the normalized favorite_teams/favorite_competitions filters, so a config change can no longer serve up to 24h of stale series from the previous configuration.
• Module collision: renamed logo_downloader.py → cricket_logo_downloader.py (plugin-unique name per the repo's module-naming rule for deferred imports) and updated the import in manager.py.
• SSRF / path traversal: download_missing_logo now rejects non-HTTPS logo_urls, and both manager.py (where logo_path is built) and cricket_logo_downloader.py sanitize the team abbreviation to alphanumeric/&/_ before it's used in a filename.
• on_config_change: preserves self._lock across the self.__init__() re-run instead of replacing it, so a thread already holding the old lock inside update()/display() doesn't lose mutual exclusion with callers of the new lock.

Bumped manifest.json version to 1.0.1.

Test plan

• python3 -m py_compile plugins/cricket-scoreboard/*.py
• python3 test_cricket_plugin.py — 21/21 pass
• python scripts/check_module_collisions.py — OK
• Pre-commit hook synced plugins.json for the version bump

Note on PR #182 / #183

Checked whether these same findings apply to the NRL and AFL scoreboard plugins (also opened around the same time, forked from soccer-scoreboard). They don't — different architecture:

• Team filtering there is list-membership equality (abbr in self.favorite_teams), not substring matching, so an empty string can't accidentally match everything the way it could in cricket's series-name matching.
• No overs math, no series-discovery cache (single stable ESPN league id, unlike cricket's per-season series ids).
• Logo downloading goes through the core src.logo_downloader module, not a plugin-local file, so there's no cross-plugin module-collision risk to rename away.
• Both on_config_change implementations already update state in-place under self._config_lock (draining in-flight update threads) rather than calling self.__init__(), so the lock-replacement bug doesn't exist there.

No changes needed on #182/#183 for these specific findings.

---

Generated by Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 60e19c4e-81ae-4a18-88fd-8c89e94353c1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/code-rabbit-pr-issues-99a3r1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 30 complexity

Metric	Results
Complexity	30

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}