v0.6.2 — Dynamic Spotify GQL Hash Management
What's new
Spotify periodically rotates the SHA-256 hashes required by its internal GraphQL API. Previously, these hashes were hardcoded — meaning a new app release was needed every time Spotify rotated them, leaving users unable to access Spotify features in the meantime.
This release introduces a fully automated hash synchronization system that keeps the app working transparently, without user intervention.
How it works
- Remote hash registry — A GitHub Actions workflow runs daily, extracts the latest hashes from the Spotify web player bundle, and publishes them to a publicly accessible JSON endpoint.
- Startup sync — Every time the app launches, it fetches the latest hashes from the remote registry in the background, ensuring maximum freshness.
- Local caching — Fetched hashes are persisted via DataStore so they're available immediately on next launch, even before the remote fetch completes.
- Automatic retry with fallback — If a GQL request fails with
PersistedQueryNotFound(HTTP 412), the app automatically retries with the previous known hash. If all known hashes fail, a force-refresh from the remote registry is triggered. - Hardcoded safety net — If both the remote registry and local cache are unavailable (e.g. first launch with no internet), the app falls back to hashes hardcoded at build time.