🐛 Fixes
Multi-GPU NVIDIA enumeration via nvidia-smi (#221)
nvidia-smi is now the primary NVIDIA enumeration source. Each card registers as cuda:<index>, is probed with -hwaccel_device <N>, and is dispatched per-GPU at FFmpeg runtime. The two legacy WSL2 /
Linux-container fallback blocks collapse into this single path, and DRM enumeration is now AMD/Intel only.
Upgrade note: schema v6 strips stale generic cuda entries from gpu_config, so the UI repopulates cleanly on first start.
Localhost webhook URL guard in Docker
Users leaving the auto-filled http://localhost:PORT/api/webhooks/plex and clicking Test Reachability inside a container previously hit a ConnectionRefused stack trace. The test now short-circuits with
actionable guidance (use the host's LAN IP or a reachable DNS name) and the webhook status card surfaces the same warning. Docs and the in-app trigger card also update the Plex menu path — Mobile Push
Notifications moved from Notifications to Settings → General.
Specific error messages in Plex connection test
POST /api/plex/test now classifies SSL, timeout, connection, HTTP 401/403/404, invalid URL, and JSON decode failures instead of flattening every RequestException to a generic "Connection test failed."
Settings toasts now show guidance like "Plex rejected the authentication token (401)" or "SSL certificate verification failed… uncheck 'Verify SSL'". Mirrors the pattern already used by /api/plex/libraries.
🔒 Security
flask-cors bumped to >=6.0.0,<7 (CVE-2024-6866)
The old >=4.0.0,<5 pin resolved to 4.0.2, within the vulnerable range for CVE-2024-6866 / GHSA-43qf-4rqw-9q2g (case-insensitive path matching via
try_match). 6.0.0 switches to case-sensitive matching. No app changes required — CORS(app, origins=...) is unchanged.