Summary

Addresses all 7 CodeRabbit findings from #181:

• Schema: favorite_teams now requires non-empty strings (minLength: 1) — an empty entry previously matched every international series via substring matching in cricket_data_fetcher.py.
• overs_to_balls: now rejects negative overs (returns 0), matching the existing guard in overs_to_decimal.
• _get_json: validates the parsed response is a dict before returning it, logging a warning and returning None otherwise, so callers can safely use .get(...).
• Series discovery cache: cache key is now scoped by the normalized favorite_teams/favorite_competitions filters, so a config change can no longer serve up to 24h of stale series from the previous configuration.
• Module collision: renamed logo_downloader.py → cricket_logo_downloader.py (plugin-unique name per the repo's module-naming rule for deferred imports) and updated the import in manager.py.
• SSRF / path traversal: download_missing_logo now rejects non-HTTPS logo_urls, and both manager.py (where logo_path is built) and cricket_logo_downloader.py sanitize the team abbreviation to alphanumeric/&/_ before it's used in a filename.
• on_config_change: preserves self._lock across the self.__init__() re-run instead of replacing it, so a thread already holding the old lock inside update()/display() doesn't lose mutual exclusion with callers of the new lock.

Bumped manifest.json version to 1.0.1.

Test plan

• python3 -m py_compile plugins/cricket-scoreboard/*.py
• python3 test_cricket_plugin.py — 21/21 pass
• python scripts/check_module_collisions.py — OK
• Pre-commit hook synced plugins.json for the version bump

Note on PR #182 / #183

Checked whether these same findings apply to the NRL and AFL scoreboard plugins (also opened around the same time, forked from soccer-scoreboard). They don't — different architecture:

• Team filtering there is list-membership equality (abbr in self.favorite_teams), not substring matching, so an empty string can't accidentally match everything the way it could in cricket's series-name matching.
• No overs math, no series-discovery cache (single stable ESPN league id, unlike cricket's per-season series ids).
• Logo downloading goes through the core src.logo_downloader module, not a plugin-local file, so there's no cross-plugin module-collision risk to rename away.
• Both on_config_change implementations already update state in-place under self._config_lock (draining in-flight update threads) rather than calling self.__init__(), so the lock-replacement bug doesn't exist there.

No changes needed on #182/#183 for these specific findings.

Generated by Claude Code