A theme-consistency pass plus a round of real correctness/security fixes underneath, including a Last.fm crash and a Wireless PC Upload path-traversal issue.
Changed
- Classic themes tightened up: edge-to-edge, tighter main-menu rows; consistent 21dp bold list type; saturated blue selection gradient shared by both the dynamic menus and library lists; silver status-bar gradient, darker secondary text, and more compact chevrons.
- Battery silhouette is more rectangular, and battery percentage is now clamped to 0–100.
- Main Menu, Cover Flow, Wi-Fi and equalizer views now use generated Android view IDs with a stable logical-key mapping instead of ad hoc constants.
Fixed
- Last.fm scrobbling could crash its background worker outright — the pending-scrobble queue called
JSONArray.remove(int), which doesn't exist on the Y1's Android API 17 (added in API 19). Also, Last.fm can return HTTP 200 with an API-level error payload, which was previously treated as a successful scrobble and silently dropped instead of retried. - Wireless PC Upload (the web server) had a path-traversal weakness — file operations now canonicalize and confine paths to the shared root, reject cross-origin writes, and render filenames as plain text. Interrupted uploads now write to a temp file and atomically replace the target only once complete, so a dropped connection can no longer corrupt an existing file. Server connections now have timeouts and a bounded worker pool; shutdown properly closes active sockets.
- Recycled album rows in the library list could show a stale cover thumbnail if an in-flight request finished after the row was recycled for a different album.
- Removed a duplicate broadcast-receiver registration and duplicate manifest permission entries; added the newer Android receiver-flags overload with an API 17 fallback and additional Bluetooth/location permission checks.
- Sound Check no longer calls an API-19-only method unguarded on this API-17 device.
- Launcher icons switched from WebP to PNG for reliable API 17 rendering; fixed a malformed vector icon path.
- Audiobook bookmark saving now checks the playlist index is still valid before writing.
Full engineering write-up: docs/release-review-1.4.3.md.
Install
rom.zip— flash via the Innioasis Updater, no ADB required. Must keep the filename exactlyrom.zip.InniClassic-1.4.3.apk— install over an existing JJ Launcher / InniClassic install viaadb install InniClassic-1.4.3.apk.
Full changelog: CHANGELOG.md