This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| [ollama/ollama](https://github.com/ollama/ollama) | minor | `0.18.3` → `0.19.0` |
| ollama/ollama | minor | `0.18.3` → `0.19.0` |
---
### Release Notes
<details>
<summary>ollama/ollama (ollama/ollama)</summary>
### [`v0.19.0`](https://github.com/ollama/ollama/releases/tag/v0.19.0)
[Compare Source](https://github.com/ollama/ollama/compare/v0.18.3...v0.19.0)
#### What's Changed
- Ollama's app will now no longer incorrectly show "model is out of date"
- `ollama launch pi` now includes web search plugin that uses Ollama's web search
- Improved KV cache hit rate when using the Anthropic-compatible API
- Fixed tool call parsing issue with Qwen3.5 where tool calls would be output in thinking
- MLX runner will now create periodic snapshots during prompt processing
- Fixed KV cache snapshot memory leak in MLX runner
- Fixed issue where flash attention would be incorrectly enabled for `grok` models
- Fixed `qwen3-next:80b` not loading in Ollama
#### New Contributors
- [@​amatas](https://github.com/amatas) made their first contribution in [#​15022](https://github.com/ollama/ollama/pull/15022)
**Full Changelog**: <https://github.com/ollama/ollama/compare/v0.18.3...v0.19.0>
</details>
---
### Configuration
📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My45OS4xIiwidXBkYXRlZEluVmVyIjoiNDMuOTkuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZG9ja2VyIl19-->
Reviewed-on: #5286
Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net>
Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| [ghcr.io/rybbit-io/rybbit-backend](https://github.com/rybbit-io/rybbit) | minor | `v2.4.0` → `v2.5.0` |
| [rybbit-io/rybbit](https://github.com/rybbit-io/rybbit) | minor | `v2.4.0` → `v2.5.0` |
---
### Release Notes
<details>
<summary>rybbit-io/rybbit (ghcr.io/rybbit-io/rybbit-backend)</summary>
### [`v2.5.0`](https://github.com/rybbit-io/rybbit/releases/tag/v2.5.0)
[Compare Source](https://github.com/rybbit-io/rybbit/compare/v2.4.0...v2.5.0)
- Improved bot blocking capabilities
- Added teams to further subdivide organizations into groups of users and sites <https://rybbit.com/docs/teams>
- Added tagging that allows easy slicing of analytics into different cohorts, similar to an existing feature from Umami <https://rybbit.com/docs/tagging>
- Various minor performance improvements
Thank you [@​lukyrys](https://github.com/lukyrys) for multiple contributions over this period
</details>
---
### Configuration
📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My45OS4xIiwidXBkYXRlZEluVmVyIjoiNDMuOTkuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZG9ja2VyIl19-->
Reviewed-on: #5275
Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net>
Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| [Freika/dawarich](https://github.com/Freika/dawarich) | minor | `1.4.0` → `1.6.0` |
| [freikin/dawarich](https://github.com/Freika/dawarich) | minor | `1.4.0` → `1.6.0` |
---
### Release Notes
<details>
<summary>Freika/dawarich (Freika/dawarich)</summary>
### [`v1.6.0`](https://github.com/Freika/dawarich/blob/HEAD/CHANGELOG.md#160---2026-03-29)
[Compare Source](https://github.com/Freika/dawarich/compare/1.5.1...1.6.0)
##### Added
- Immich users can now enrich their photos with geodata.
- Users can now optionally enable two-factor authentication (2FA) for their accounts in Settings > Two-Factor Authentication. Supported methods: TOTP apps (Google Authenticator, Authy, etc.) and backup codes. Once enabled, users will be prompted for a 2FA code on login. This adds an extra layer of security to protect your location data.
##### Fixed
- Fix OIDC account linking failing when the email from the identity provider has different casing than the existing Dawarich account [#​1983](https://github.com/Freika/dawarich/issues/1983).
- Fix confirmation dialogs being ignored when clicking "Cancel" — destructive actions (account deletion, import/export deletion, place deletion) fired regardless of user choice due to Rails UJS and Turbo both handling the same click [#​1978](https://github.com/Freika/dawarich/issues/1978).
- Fix Year in Review share link being empty when toggling public access [#​2418](https://github.com/Freika/dawarich/issues/2418).
- Fix address field on Points page being empty when geodata properties are unavailable [#​2419](https://github.com/Freika/dawarich/issues/2419).
- Fix Stats API returning the same country/city count for every year instead of per-year counts [#​2280](https://github.com/Freika/dawarich/issues/2280).
- Fix flyover countries (with no visited cities) still showing in monthly stats views [#​2423](https://github.com/Freika/dawarich/issues/2423).
- Fix importing Google Timeline files. [#​2427](https://github.com/Freika/dawarich/issues/2427)
### [`v1.5.1`](https://github.com/Freika/dawarich/blob/HEAD/CHANGELOG.md#151---2026-03-28)
[Compare Source](https://github.com/Freika/dawarich/compare/1.5.0...1.5.1)
##### Fixed
- Fix points and tracks interactions on Map v2 being unresponsive after the latest update.
- Fix creating demo data from the onboarding modal.
- Fix navbar for cloud trial users.
- Reset months stats instead of deleting when there is no data.
### [`v1.5.0`](https://github.com/Freika/dawarich/blob/HEAD/CHANGELOG.md#150---2026-03-28)
[Compare Source](https://github.com/Freika/dawarich/compare/1.4.0...1.5.0)
##### Added
- GPS noise filtering. An automatic system to detect ahd filter out points with unrealistic speeds, altitudes, or sudden jumps.
- Support for signing in via web view using our Android app.
- On the map settings page user now can enable and disable map layers.
- Onboarding modal now offers a third option to load demo data (3 days in Berlin, \~1000 points) so new users can instantly see what the map looks like. Demo imports bypass trial limits, are clearly labeled with a "Demo" badge, and can be deleted from a banner on the map page or from the imports list.
- New tool to the Map V2 tools: The "Day per Country" button will open a modal showing a breakdown of how many days the user has spent in each country, based on their points data. This is calculated by grouping points by country and counting unique days with at least one point in that country.
##### Changed
- \[Cloud] The point creation API endpoints are being excluded from the default Lite/Pro rate limits (200/1,000 requests/hour). They now have general rate limits of 10,000 requests/hour.
- Buildings numbers on map V2 are now shown on closer zoom.
##### Fixed
- Users who registered via Google (or other OAuth providers) can now change their password and email without needing to enter their current password.
- Fix deadlocks in reverse geocoding job when multiple Sidekiq workers update points concurrently.
- Fix `counter_cache_column` error in points counter reset job by using direct SQL count instead of `reset_counters`.
- Fix duplicate place records causing `ON CONFLICT` cardinality violations during reverse geocoding.
- Fix `TypeError` crash in transportation mode backfill when Google export files have unexpected JSON structure.
- Fix inability to disable visit suggestions background job due to conflicting Rails UJS and Turbo handlers causing request cancellation [#​2118](https://github.com/Freika/dawarich/issues/2118).
- Fix visit confirm/decline buttons firing twice [#​2379](https://github.com/Freika/dawarich/issues/2379).
- Fix clicking on a point in Map v2 silently moving it to the cursor position. Points now only update when intentionally dragged [#​2149](https://github.com/Freika/dawarich/issues/2149), [#​2150](https://github.com/Freika/dawarich/issues/2150).
- Fix visit name suggester not recognizing Photon reverse geocoding data format, causing all suggested places to show as "Suggested place" [#​2151](https://github.com/Freika/dawarich/issues/2151), [#​2377](https://github.com/Freika/dawarich/issues/2377).
- Fix visit edit form displaying UTC times instead of the user's configured timezone [#​2168](https://github.com/Freika/dawarich/issues/2168).
- Fix export deletion failing when the export file was manually removed from disk [#​915](https://github.com/Freika/dawarich/issues/915).
- Fix PhotoPrism `before` date filter being off by one day, excluding photos taken on the end date [#​747](https://github.com/Freika/dawarich/issues/747).
- Fix datetime inputs allowing 5-digit years on Chrome by adding `max` attribute to all datetime-local fields [#​578](https://github.com/Freika/dawarich/issues/578).
- Fix Points page datetime fields requiring seconds input, preventing search on mobile browsers and some desktop browsers [#​1040](https://github.com/Freika/dawarich/issues/1040), [#​1478](https://github.com/Freika/dawarich/issues/1478).
- Fix altitude values being truncated to integers instead of preserving decimal precision [#​1573](https://github.com/Freika/dawarich/issues/1573).
- Fix suggested visits keeping "Suggested Visit" name when confirmed directly without selecting a place [#​1725](https://github.com/Freika/dawarich/issues/1725).
- Fix visit name becoming empty and uneditable when clicking the name field and then clicking away [#​1776](https://github.com/Freika/dawarich/issues/1776).
- Fix trips page crashing with `undefined method 'coordinates' for nil` when trip path calculation hasn't completed yet [#​1356](https://github.com/Freika/dawarich/issues/1356), [#​1765](https://github.com/Freika/dawarich/issues/1765).
- Fix Immich/PhotoPrism photos on map not being filtered by the selected date range [#​1755](https://github.com/Freika/dawarich/issues/1755).
- Fix short trips (less than one full day) not showing photos due to PhotoPrism `before` date filter being exclusive [#​1688](https://github.com/Freika/dawarich/issues/1688).
- Fix health check endpoint (`/api/v1/health`) triggering unnecessary `User Load` database queries on every request [#​1770](https://github.com/Freika/dawarich/issues/1770).
- Fix points created via Overland API (Home Assistant, GPSLogger) not being automatically reverse geocoded after creation [#​1242](https://github.com/Freika/dawarich/issues/1242).
- Fix monthly stats map crashing with `Invalid LatLng object: (NaN, NaN)` when points have missing coordinates [#​1762](https://github.com/Freika/dawarich/issues/1762).
- Fix trips failing with self-signed certificates by leveraging per-integration SSL skip settings [#​455](https://github.com/Freika/dawarich/issues/455).
- Fix non-admin users unable to access Background Jobs settings to trigger reverse geocoding or manage visit suggestions [#​1714](https://github.com/Freika/dawarich/issues/1714).
- Fix family page map not loading due to `escape_javascript` producing invalid JSON in the Stimulus data attribute.
- Fix countries appearing in visited statistics despite only being driven through without spending meaningful time in any city [#​1595](https://github.com/Freika/dawarich/issues/1595), [#​1779](https://github.com/Freika/dawarich/issues/1779).
- Fix `migrate_to_new_storage` rake task crashing when export URL is blank, already migrated, or points to a directory instead of a file [#​1018](https://github.com/Freika/dawarich/issues/1018), [#​1037](https://github.com/Freika/dawarich/issues/1037).
- Fix selecting the only suggested place for a visit having no effect because the dropdown `change` event never fires with a single option [#​471](https://github.com/Freika/dawarich/issues/471).
- Fix city duration calculation undercounting time spent due to integer division truncating sub-minute GPS intervals to zero [#​2408](https://github.com/Freika/dawarich/issues/2408).
- Fix tooltips in data tables (Imports, Exports, Points) being hidden behind adjacent rows [#​2409](https://github.com/Freika/dawarich/issues/2409).
- Fix iOS QR code in Account settings being cut off on the right side [#​2406](https://github.com/Freika/dawarich/issues/2406).
</details>
---
### Configuration
📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My45OS4wIiwidXBkYXRlZEluVmVyIjoiNDMuOTkuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZG9ja2VyIl19-->
Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/5260
Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net>
Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| [ghcr.io/unpoller/unpoller](https://github.com/unpoller/unpoller) | minor | `v2.38.0` → `v2.39.0` |
| [unpoller/unpoller](https://github.com/unpoller/unpoller) | minor | `v2.38.0` → `v2.39.0` |
---
### Release Notes
<details>
<summary>unpoller/unpoller (ghcr.io/unpoller/unpoller)</summary>
### [`v2.39.0`](https://github.com/unpoller/unpoller/releases/tag/v2.39.0)
[Compare Source](https://github.com/unpoller/unpoller/compare/v2.38.0...v2.39.0)
##### Changelog
- [`c596e82`](c596e82cf2) fix: use v2 traffic API as DPI fallback for Network 9.1+ firmware ([#​985](https://github.com/unpoller/unpoller/issues/985))
</details>
---
### Configuration
📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My45OS4wIiwidXBkYXRlZEluVmVyIjoiNDMuOTkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZG9ja2VyIl19-->
Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/5255
Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net>
Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| [cert-manager/cert-manager](https://github.com/cert-manager/cert-manager) | patch | `v1.20.0` → `v1.20.1` |
---
### Release Notes
<details>
<summary>cert-manager/cert-manager (cert-manager/cert-manager)</summary>
### [`v1.20.1`](https://github.com/cert-manager/cert-manager/releases/tag/v1.20.1)
[Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.20.0...v1.20.1)
v1.20.1 fixes an issue for OpenShift users that has to do with the finalizer RBAC, bumps gRPC to address a reported non-affecting vulnerability, and fixes a duplicate `parentRef` bug when both issuer config and annotations are present (Gateway API).
##### Bug or Regression
- Fixed duplicate `parentRef` bug when both issuer config and annotations are present. ([#​8658](https://github.com/cert-manager/cert-manager/issues/8658), [@​hjoshi123](https://github.com/hjoshi123))
- Add missing issuer finalizer RBAC to the order controller to support owner references. This was preventing OpenShift users from being able to upgrade to v1.20.0. ([#​8655](https://github.com/cert-manager/cert-manager/issues/8655), [@​erikgb](https://github.com/erikgb))
- Bump google.golang.org/grpc to fix vulnerability reported by scanners. This isn't a vulnerability that affects cert-manager, but we are bumping it because it is reported by scanners. ([#​8657](https://github.com/cert-manager/cert-manager/issues/8657), [@​erikgb](https://github.com/erikgb))
</details>
---
### Configuration
📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My45Ni4wIiwidXBkYXRlZEluVmVyIjoiNDMuOTYuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/5206
Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net>
Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| [tailscale/tailscale](https://github.com/tailscale/tailscale) | patch | `v1.96.3` → `v1.96.4` |
---
### Release Notes
<details>
<summary>tailscale/tailscale (tailscale/tailscale)</summary>
### [`v1.96.4`](https://github.com/tailscale/tailscale/releases/tag/v1.96.4)
[Compare Source](https://github.com/tailscale/tailscale/compare/v1.96.3...v1.96.4)
Please refer to the changelog available at <https://tailscale.com/changelog>
</details>
---
### Configuration
📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My45Ni4wIiwidXBkYXRlZEluVmVyIjoiNDMuOTYuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
Reviewed-on: #5208
Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net>
Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| [grafana/loki](https://github.com/grafana/loki) | patch | `3.7.0` → `3.7.1` |
---
### Release Notes
<details>
<summary>grafana/loki (grafana/loki)</summary>
### [`v3.7.1`](https://github.com/grafana/loki/releases/tag/v3.7.1)
[Compare Source](https://github.com/grafana/loki/compare/v3.7.0...v3.7.1)
##### Bug Fixes
- Upgrade Go and gRPC versions on 3.7.x ([#​21282](https://github.com/grafana/loki/issues/21282)) ([2c8fff2](2c8fff222b))
</details>
---
### Configuration
📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My45Ni4wIiwidXBkYXRlZEluVmVyIjoiNDMuOTYuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
Reviewed-on: #5207
Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net>
Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| clickhouse/clickhouse-server | minor | `26.2.5` → `26.3.2` |
---
### Configuration
📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My45Mi4wIiwidXBkYXRlZEluVmVyIjoiNDMuOTUuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZG9ja2VyIiwiZG9ja2VyIl19-->
Reviewed-on: #5191
Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net>
Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| ghcr.io/sahara101/movie-roulette | minor | `v5.3.0` → `v5.4.0` |
| [sahara101/Movie-Roulette](https://github.com/sahara101/Movie-Roulette) | minor | `v5.3.0` → `v5.4.0` |
---
### Release Notes
<details>
<summary>sahara101/Movie-Roulette (sahara101/Movie-Roulette)</summary>
### [`v5.4.0`](https://github.com/sahara101/Movie-Roulette/releases/tag/v5.4.0)
[Compare Source](https://github.com/sahara101/Movie-Roulette/compare/v5.3.0...v5.4.0)
#### New Features
- **Watch Together - Watchlist & Library modes** (Plex only) - find movies to watch with a partner via two modes: **Watchlist** (intersects plex.tv watchlists, no app account needed) or **Library** (intersects local watch-status caches, instant). Enable via `PLEX_WATCH_TOGETHER=true` or Settings -> Plex
- **Multi-arch Docker manifest** - `latest` and version tags are now multi-arch manifests (AMD64, ARM64, ARMv7). `arm-latest` kept for backward compatibility
- **Filter panel redesign (HeroUI)** - filter is now a full-height right sidebar on desktop and a bottom-sheet on mobile, with open/close animations and an active-filter-count badge (or **W** for Watch Together)
#### Security
- **cbor2 -> 5.9.0** (CVE-2026-26209, high) - DoS via uncontrolled recursion in `cbor2.loads()`; affects WebAuthn/Passkey flow
- **requests -> 2.33.0** (CVE-2026-25645, medium) - insecure predictable temp filename in `extract_zipped_paths()`
#### Bug Fixes
- **Plex managed/home user cache not building** - resilient fallback chain (`switchUser()` -> `switchHomeUser()`) handles Plex CVE-2025-34158 / CVE-2025-69417 endpoint restriction
- **Empty cache file suppressing rebuilds** - cache build now also triggers when the file exists but is <= 2 bytes
- **Slow search** - queries local cache instead of media server API; drops from \~3-10 s to <50 ms; debounce reduced to 150 ms
- **Search modal uncloseable on mobile/PWA** - uses centered modal with tappable backdrop on mobile
- **Watchlist pool stall (3-5 s) after reset** - TTL is now sliding with 15-minute idle timeout instead of fixed 5-minute expiry
- **"All movies seen" toast missing in HeroUI** - pool reset surfaced in Watch Together response; toast uses glassmorphism styling
- **Filter close animation missing on mobile (HeroUI)** - bottom-sheet now slides down correctly instead of using the desktop keyframe
- **Update notification wrong theme on main page** - `heroui-theme.css` and `aceternity-effects.css` now loaded in HeroUI main page block
- **Login card off-center on mobile** - switches to `justify-content: center` at <=480px
- **Collection warning x button visible on mobile** - hidden at <=480px across all stylesheets
- **User Management usernames hidden on mobile** - scoped hide rule to `.user-item .user-name` to avoid conflict with `auth.css`
**Full Changelog**: <https://github.com/sahara101/Movie-Roulette/compare/v5.3.0...v5.4.0>
</details>
---
### Configuration
📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My45NS4wIiwidXBkYXRlZEluVmVyIjoiNDMuOTUuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZG9ja2VyIiwiZG9ja2VyIl19-->
Reviewed-on: #5200
Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net>
Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>
