sahara101/Movie-Roulette v5.4.0 on GitHub

New Features

Watch Together - Watchlist & Library modes (Plex only) - find movies to watch with a partner via two modes: Watchlist (intersects plex.tv watchlists, no app account needed) or Library (intersects local watch-status caches, instant). Enable via PLEX_WATCH_TOGETHER=true or Settings -> Plex
Multi-arch Docker manifest - latest and version tags are now multi-arch manifests (AMD64, ARM64, ARMv7). arm-latest kept for backward compatibility
Filter panel redesign (HeroUI) - filter is now a full-height right sidebar on desktop and a bottom-sheet on mobile, with open/close animations and an active-filter-count badge (or W for Watch Together)

cbor2 -> 5.9.0 (CVE-2026-26209, high) - DoS via uncontrolled recursion in cbor2.loads(); affects WebAuthn/Passkey flow
requests -> 2.33.0 (CVE-2026-25645, medium) - insecure predictable temp filename in extract_zipped_paths()

Plex managed/home user cache not building - resilient fallback chain (switchUser() -> switchHomeUser()) handles Plex CVE-2025-34158 / CVE-2025-69417 endpoint restriction
Empty cache file suppressing rebuilds - cache build now also triggers when the file exists but is <= 2 bytes
Slow search - queries local cache instead of media server API; drops from ~3-10 s to <50 ms; debounce reduced to 150 ms
Search modal uncloseable on mobile/PWA - uses centered modal with tappable backdrop on mobile
Watchlist pool stall (3-5 s) after reset - TTL is now sliding with 15-minute idle timeout instead of fixed 5-minute expiry
"All movies seen" toast missing in HeroUI - pool reset surfaced in Watch Together response; toast uses glassmorphism styling
Filter close animation missing on mobile (HeroUI) - bottom-sheet now slides down correctly instead of using the desktop keyframe
Update notification wrong theme on main page - heroui-theme.css and aceternity-effects.css now loaded in HeroUI main page block
Login card off-center on mobile - switches to justify-content: center at <=480px
Collection warning x button visible on mobile - hidden at <=480px across all stylesheets
User Management usernames hidden on mobile - scoped hide rule to .user-item .user-name to avoid conflict with auth.css

Full Changelog: v5.3.0...v5.4.0