This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| ghcr.io/sahara101/movie-roulette | minor | `v5.3.0` → `v5.4.0` |
| [sahara101/Movie-Roulette](https://github.com/sahara101/Movie-Roulette) | minor | `v5.3.0` → `v5.4.0` |
---
### Release Notes
<details>
<summary>sahara101/Movie-Roulette (sahara101/Movie-Roulette)</summary>
### [`v5.4.0`](https://github.com/sahara101/Movie-Roulette/releases/tag/v5.4.0)
[Compare Source](https://github.com/sahara101/Movie-Roulette/compare/v5.3.0...v5.4.0)
#### New Features
- **Watch Together - Watchlist & Library modes** (Plex only) - find movies to watch with a partner via two modes: **Watchlist** (intersects plex.tv watchlists, no app account needed) or **Library** (intersects local watch-status caches, instant). Enable via `PLEX_WATCH_TOGETHER=true` or Settings -> Plex
- **Multi-arch Docker manifest** - `latest` and version tags are now multi-arch manifests (AMD64, ARM64, ARMv7). `arm-latest` kept for backward compatibility
- **Filter panel redesign (HeroUI)** - filter is now a full-height right sidebar on desktop and a bottom-sheet on mobile, with open/close animations and an active-filter-count badge (or **W** for Watch Together)
#### Security
- **cbor2 -> 5.9.0** (CVE-2026-26209, high) - DoS via uncontrolled recursion in `cbor2.loads()`; affects WebAuthn/Passkey flow
- **requests -> 2.33.0** (CVE-2026-25645, medium) - insecure predictable temp filename in `extract_zipped_paths()`
#### Bug Fixes
- **Plex managed/home user cache not building** - resilient fallback chain (`switchUser()` -> `switchHomeUser()`) handles Plex CVE-2025-34158 / CVE-2025-69417 endpoint restriction
- **Empty cache file suppressing rebuilds** - cache build now also triggers when the file exists but is <= 2 bytes
- **Slow search** - queries local cache instead of media server API; drops from \~3-10 s to <50 ms; debounce reduced to 150 ms
- **Search modal uncloseable on mobile/PWA** - uses centered modal with tappable backdrop on mobile
- **Watchlist pool stall (3-5 s) after reset** - TTL is now sliding with 15-minute idle timeout instead of fixed 5-minute expiry
- **"All movies seen" toast missing in HeroUI** - pool reset surfaced in Watch Together response; toast uses glassmorphism styling
- **Filter close animation missing on mobile (HeroUI)** - bottom-sheet now slides down correctly instead of using the desktop keyframe
- **Update notification wrong theme on main page** - `heroui-theme.css` and `aceternity-effects.css` now loaded in HeroUI main page block
- **Login card off-center on mobile** - switches to `justify-content: center` at <=480px
- **Collection warning x button visible on mobile** - hidden at <=480px across all stylesheets
- **User Management usernames hidden on mobile** - scoped hide rule to `.user-item .user-name` to avoid conflict with `auth.css`
**Full Changelog**: <https://github.com/sahara101/Movie-Roulette/compare/v5.3.0...v5.4.0>
</details>
---
### Configuration
📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My45NS4wIiwidXBkYXRlZEluVmVyIjoiNDMuOTUuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZG9ja2VyIiwiZG9ja2VyIl19-->
Reviewed-on: #5200
Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net>
Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| ghcr.io/sahara101/movie-roulette | minor | `v5.2.1` → `v5.3.0` |
| [sahara101/Movie-Roulette](https://github.com/sahara101/Movie-Roulette) | minor | `v5.2.1` → `v5.3.0` |
---
### Release Notes
<details>
<summary>sahara101/Movie-Roulette (sahara101/Movie-Roulette)</summary>
### [`v5.3.0`](https://github.com/sahara101/Movie-Roulette/releases/tag/v5.3.0)
[Compare Source](https://github.com/sahara101/Movie-Roulette/compare/v5.2.1...v5.3.0)
#### New Features
- **Enrichment Cache** — persistent background cache pre-fetches TMDb credits, external links, trailers, and movie logos at startup; movie cards load instantly without secondary API calls (`_enriched` flag skips all async fetches)
- **Session-Based Seen Tracking** — random selection avoids repeating movies within the same browser tab session; resets automatically when the full pool is exhausted with a toast notification
- **Media Server Web Client** — client-picker now includes the configured media server as a direct watch option; opens the movie's detail page in Plex/Jellyfin/Emby web UI in a new tab
- **Animated Login Logo** — app icon replaced with a looping silent MP4 on the login screen
- **PWA Splash Screen** — standalone home-screen launches show a custom dark splash for 1.5s, dismissed once per session
#### Visual Overhaul
- **Color System** — full amber palette replacing all purple/indigo across both HeroUI themes; buttons, glows, progress bars, focus rings, and aurora orbs all updated
- **Typography** — three-font system: Geist (UI), Instrument Serif (movie titles), Geist Mono (numbers/metadata)
- **Cinema Poster Mode** — full-bleed blurred backdrop, glassmorphism info bars, editorial director layout, spring-eased progress bar
- **Filter Island** — filter controls unified into a glass pill with active-count badge and spring-entrance dropdown
- **Icon Button Animations** — Next, Power, and service-switcher icons spin 360° on hover (disabled on touch devices)
#### Bug Fixes
- **Collection warning count mismatch** — badge and modal heading now consistently exclude Trakt-watched movies; Trakt-watched previous movies hidden from modal list (no action needed)
- **Collection warning shown for all-handled collections** — button correctly hidden when every previous movie is watched locally or on Trakt and all other collection movies are in library or on Trakt
- **Collection warning slow to appear** — moved to async `/api/collection_status` endpoint; no longer blocks movie response
- **TMDb collection cache never expiring** — weekly APScheduler job clears `lru_cache` so new sequels appear without restart
- **Next-movie background flash** — images preloaded before DOM update; old movie stays visible until new assets are ready
- **Service switch leaves stale filters** — switching service now resets filters and session seen-list
- **Apple TV pairing on macOS Docker** — optional IP Address field uses `--scan-hosts` for direct unicast pairing; failure now reports EOF/TIMEOUT reason with atvremote output
- **Apple TV device name/model** — stored on pairing and shown in settings instead of raw UUID
- **PWA icons showing white background** — all icons rebuilt with `#222222` background; 1024×1024 maskable icon added for macOS dock
- **Auth session writes on every request** — session values only written when they actually change
#### Changes
- **Default settings** — fresh installs: Movie Logos off, Login Backdrops on, Load on Start on, Poster Mode set to Screensaver
**Full Changelog**: <https://github.com/sahara101/Movie-Roulette/compare/v5.2.1...v5.3.0>
</details>
---
### Configuration
📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My44NC4yIiwidXBkYXRlZEluVmVyIjoiNDMuODQuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiaW1hZ2UiXX0=-->
Reviewed-on: #5012
Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net>
Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>
