[service.subtitles.opensubtitles-com] 1.0.90

[opensubtitles]

Description

Update of the existing OpenSubtitles.com subtitle service add-on from v1.0.9 to v1.0.84.

This is a large cumulative update. After v1.0.9 we built an extensive internal QA pipeline (automated AI code review over ~45 review rounds, ~90 findings fixed with regression tests; 186-test pytest suite; kodi-addon-checker in CI against matrix/nexus/omega/piers; headless real-Kodi smoke tests on Kodi 19-22), and this release is the first that passes every gate with zero findings.

What changed since v1.0.9 (highlights):

Search and matching

• Smart release matcher: results scored against the playing file (moviehash first, then release group, source, resolution, codec), best match on top with a score badge - purely reordering
• TV episodes found reliably: id type verified via the /features endpoint instead of guessed; original titles used for localized libraries; non-IMDb library ids handled; season 0 (specials) searchable
• A release year that disagrees with the feature year no longer hides the film: the title search is retried without the year; look-alike fuzzy results no longer end the fallback chain
• Multipart RAR moviehash fixed (Python 3 float-division bug); multi-language grouping with adaptive language memory

Robustness

• No malformed API response, player InfoLabel, or library field can abort a search: every payload layer is shape-checked and degrades instead of raising
• One bad result entry can no longer empty the list or disable ranking; atomic subtitle downloads with temp cleanup; timeouts on every request

Privacy and security

• Credentials, session tokens, API keys and playback-derived paths/URLs never reach the Kodi debug log (users paste logs on public forums); redaction decodes nested percent-encoding and fails closed
• Remote XML is size-capped and rejected on DOCTYPE/ENTITY declarations before parsing (including scraper-written library fields)

Account UX

• Test Connection with live VIP/quota status; clear error dialogs for every HTTP failure mode; automatic session refresh

The full release-by-release changelog is in changelog.txt (shipped) and at https://github.com/opensubtitles/service.subtitles.opensubtitles-com/blob/master/CHANGELOG.md.

Checklist:

• My code follows the add-on rules and piracy stance of this project.
• I have read the CONTRIBUTING document
• Each add-on submission should be a single commit with using the following style: [service.subtitles.opensubtitles-com] 1.0.84

Source repository: https://github.com/opensubtitles/service.subtitles.opensubtitles-com (development: opensubtitles-dev, same code)
kodi-addon-checker: no problems on matrix/nexus/omega/piers; shipped code holds the Python 3.6 floor for Matrix.

[greptile-apps]

Greptile Summary

The add-on is updated to version 1.0.90 with extensive search, matching, caching, download, account, update-checking, and robustness improvements. The latest changes close the previously reported logging channels by retaining only structural or status information in the affected paths.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
service.subtitles.opensubtitles-com/resources/lib/osclient/provider.py	Reworks API operations and ensures the search HTTP-error handler logs only an exception class or static information, resolving the prior response-body and message leaks.
service.subtitles.opensubtitles-com/resources/lib/data_collector.py	Expands metadata collection and fallback behavior while removing playback filenames, queries, and parsed titles from the previously identified log paths.
service.subtitles.opensubtitles-com/resources/lib/utilities.py	Adds centralized recursive log sanitization and URL/path redaction used by the changed logging paths.
service.subtitles.opensubtitles-com/check_updates.py	Adds update discovery and bounded XML manifest parsing with declaration rejection before parsing.
service.subtitles.opensubtitles-com/addon.xml	Bumps the add-on to version 1.0.90 and refreshes metadata, release notes, assets, and source links.

_{Reviews (7): Last reviewed commit: "[service.subtitles.opensubtitles-com] 1...." | Re-trigger Greptile}

[opensubtitles]

Updated to v1.0.85 addressing the review finding, applied as a policy rather than a point fix: playback-derived viewing history (file paths, filenames, parsed titles, query values) no longer appears in ANY debug log line across the add-on - only structural information (season/episode coordinates, match ratios, cache-key prefixes) remains. Our internal static gate now enforces this class permanently.

[opensubtitles]

@greptileai review

[opensubtitles]

v1.0.86 addresses the remaining reservation precisely: every structured mapping that reaches a log line now passes through one RECURSIVE scrubber - query, titles, filenames become presence markers at every nesting level (the fallback-attempt lists included, which is where item["query"] previously slipped through), and URL values lose query strings and credentials. An end-to-end regression test plants a distinctive title through the full search flow (query, show title, original title, filename, fallback attempts) and asserts no log line carries it. @greptileai please re-review.

[opensubtitles]

v1.0.87 clears the three log lines your review pinpointed: the final media-data summary logged item['query'] verbatim, and the two look-alike gate messages carried the expected/attempt title - all three now log presence or structural information only. The end-to-end regression test plants a distinctive title through the full flow (query, show/original title, filename, fallback attempts, AND a non-matching result set so the gate messages fire) and asserts no log line carries it. @greptileai please re-review.

[opensubtitles]

v1.0.88: both guessit clients now log structural results only (year, type, title presence marker) - the parsed title never reaches the debug log. To the best of our verification the debug log is now fully free of viewing history: no path, filename, parsed or library title, or query value appears in any log line, enforced by a static gate in our CI and an end-to-end regression test. @greptileai please re-review.

[opensubtitles]

v1.0.89 closes the error-body channel: search HTTP-error logging now parses the body and keeps only the server-authored message field (truncated), so an error body echoing request parameters can never reach the log verbatim. Going further than the finding: the request builders' per-property debug lines (which carried the query value under its underscore-internal name) are replaced by a keys-only summary, and the recursive scrubber treats underscore-prefixed keys like their public names. The regression test feeds an error body containing an echoed query and asserts the log carries the message field only. @greptileai please re-review.

[opensubtitles]

v1.0.90 closes the channel terminally: the search HTTP-error handler logs the status code only - not one byte of any error response body (message field included) reaches the log, so no echo of a request parameter is possible by construction. Regression test asserts an error body containing both an echoed query and a server message leaves zero trace in the log. @greptileai please re-review.