chore(deps): Update dependency lodash to v4.18.1 [SECURITY]

bun.lock

@@ -52,7 +52,7 @@
         "expo-web-browser": "~15.0.10",
         "i18next": "^25.0.0",
         "jotai": "2.16.2",
-        "lodash": "4.17.23",
+        "lodash": "4.18.1",
         "nativewind": "^2.0.11",
         "patch-package": "^8.0.0",
         "react": "19.1.0",
@@ -1376,7 +1376,7 @@
 
     "locate-path": ["locate-path@6.0.0", "", { "dependencies": { "p-locate": "^5.0.0" } }, "sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw=="],
 
-    "lodash": ["lodash@4.17.23", "", {}, "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w=="],
+    "lodash": ["lodash@4.18.1", "", {}, "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q=="],
 
     "lodash.debounce": ["lodash.debounce@4.0.8", "", {}, "sha512-FT1yDzDYEoYWhnSGnpE/4Kj1fLZkDFyqRb7fNt6FdYOSxlUWAtp42Eh6Wb0rGIv/m9Bgo7x4GhQbm5Ys4SG5ow=="],
 
@@ -1696,7 +1696,7 @@
 
     "react-native-text-ticker": ["react-native-text-ticker@1.15.0", "", {}, "sha512-d/uK+PIOhsYMy1r8h825iq/nADiHsabz3WMbRJSnkpQYn+K9aykUAXRRhu8ZbTAzk4CgnUWajJEFxS5ZDygsdg=="],
 
-    "react-native-track-player": ["react-native-track-player@github:lovegaoshi/react-native-track-player#003afd0", { "peerDependencies": { "react": "*", "react-native": "*", "react-native-windows": "*", "shaka-player": "^4.7.9" }, "optionalPeers": ["react-native-windows", "shaka-player"] }, "lovegaoshi-react-native-track-player-003afd0"],
+    "react-native-track-player": ["react-native-track-player@github:lovegaoshi/react-native-track-player#003afd0", { "peerDependencies": { "react": "*", "react-native": "*", "react-native-windows": "*", "shaka-player": "^4.7.9" }, "optionalPeers": ["react-native-windows", "shaka-player"] }, "lovegaoshi-react-native-track-player-003afd0", "sha512-HR7BaMDMBhQ4xAy5XeQEkT0fBosWw2x9+X2QOD4buocxuX03D770LaRKm5rgQ/qDzchr92KW7+d8fISI14fRLA=="],
 
     "react-native-udp": ["react-native-udp@4.1.7", "", { "dependencies": { "buffer": "^5.6.0", "events": "^3.1.0" } }, "sha512-NUE3zewu61NCdSsLlj+l0ad6qojcVEZPT4hVG/x6DU9U4iCzwtfZSASh9vm7teAcVzLkdD+cO3411LHshAi/wA=="],
 

components/settings/OtherSettings.tsx

@@ -204,10 +204,7 @@ export const OtherSettings: React.FC = () => {
             }
           />
         </ListItem>
-        <ListItem
-          title={t("home.settings.other.max_auto_play_episode_count")}
-          disabled={pluginSettings?.maxAutoPlayEpisodeCount?.locked}
-        >
+        <ListItem title={t("home.settings.other.max_auto_play_episode_count")}>
           <PlatformDropdown
             groups={autoPlayEpisodeOptions}
             trigger={

components/settings/PlaybackControlsSettings.tsx

@@ -229,10 +229,7 @@ export const PlaybackControlsSettings: React.FC = () => {
 
         <ListItem
           title={t("home.settings.other.max_auto_play_episode_count")}
-          disabled={
-            !settings.autoPlayNextEpisode ||
-            pluginSettings?.maxAutoPlayEpisodeCount?.locked
-          }
+          disabled={!settings.autoPlayNextEpisode}
         >
           <PlatformDropdown
             groups={autoPlayEpisodeOptions}

modules/mpv-player/ios/MPVLayerRenderer.swift

@@ -171,11 +171,7 @@ final class MPVLayerRenderer {
         // Enable composite OSD mode - renders subtitles directly onto video frames using GPU
         // This is better for PiP as subtitles are baked into the video
         // NOTE: Must be set BEFORE the #if targetEnvironment check or tvOS will freeze on player exit
-        #if targetEnvironment(simulator)
-        checkError(mpv_set_option_string(handle, "avfoundation-composite-osd", "no"))
-        #else
         checkError(mpv_set_option_string(handle, "avfoundation-composite-osd", "yes"))
-        #endif
 
         // Hardware decoding with VideoToolbox
         // On simulator, use software decoding since VideoToolbox is not available

package.json

@@ -72,7 +72,7 @@
     "expo-web-browser": "~15.0.10",
     "i18next": "^25.0.0",
     "jotai": "2.16.2",
-    "lodash": "4.17.23",
+    "lodash": "4.18.1",
     "nativewind": "^2.0.11",
     "patch-package": "^8.0.0",
     "react": "19.1.0",

utils/atoms/settings.ts

@@ -6,7 +6,6 @@ import {
   type SortOrder,
   SubtitlePlaybackMode,
 } from "@jellyfin/sdk/lib/generated-client";
-import { t } from "i18next";
 import { atom, useAtom, useAtomValue } from "jotai";
 import { useCallback, useEffect, useMemo } from "react";
 import { BITRATES, type Bitrate } from "@/components/BitrateSelector";
@@ -122,46 +121,6 @@ export interface MaxAutoPlayEpisodeCount {
   value: number;
 }
 
-/**
- * The plugin may send object-typed settings as plain primitives.
- * Resolve to the proper option object from the available choices.
- */
-const normalizePluginValue = (
-  settingsKey: keyof Settings,
-  value: unknown,
-): unknown => {
-  if (typeof value !== "object" || value === null) {
-    const defaultVal = defaultValues[settingsKey];
-    if (
-      typeof defaultVal === "object" &&
-      defaultVal !== null &&
-      "key" in defaultVal &&
-      "value" in defaultVal
-    ) {
-      // defaultBitrate needs a lookup because its keys are human-readable
-      // (e.g. "8 Mb/s") that can't be derived from the raw value (e.g. 8000000).
-      // Other { key, value } settings like maxAutoPlayEpisodeCount work with
-      // the fallback because their keys are just String(value) (e.g. "5").
-      if (settingsKey === "defaultBitrate") {
-        const match = BITRATES.find(
-          (b) => b.key === value || b.value === value,
-        );
-        if (match) return match;
-      }
-      // maxAutoPlayEpisodeCount: 0 is invalid (breaks autoplay), clamp to -1
-      // -1 key must match the translated dropdown label so the UI shows "Disabled"
-      if (
-        settingsKey === "maxAutoPlayEpisodeCount" &&
-        (value === 0 || value === -1)
-      ) {
-        return { key: t("home.settings.other.disabled"), value: -1 };
-      }
-      return { key: String(value), value };
-    }
-  }
-  return value;
-};
-
 export type HomeSectionLatestResolver = {
   parentId?: string;
   limit?: number;
@@ -403,7 +362,7 @@ export const useSettings = () => {
   );
 
   const refreshStreamyfinPluginSettings = useCallback(
-    async (_forceOverride = false) => {
+    async (forceOverride = false) => {
       if (!api) {
         return;
       }
@@ -416,17 +375,20 @@ export const useSettings = () => {
       );
       setPluginSettings(newPluginSettings);
 
-      // Apply locked plugin values to settings (unlocked values are handled
-      // by the settings memo, which respects user customizations)
+      // Apply plugin values to settings
       if (newPluginSettings && _settings) {
         const updates: Partial<Settings> = {};
         for (const [key, setting] of Object.entries(newPluginSettings)) {
-          if (setting?.locked) {
+          if (setting && !setting.locked && setting.value !== undefined) {
             const settingsKey = key as keyof Settings;
-            (updates as any)[settingsKey] = normalizePluginValue(
-              settingsKey,
-              setting.value,
-            );
+            // Apply if forceOverride is true, or if user hasn't explicitly set this value
+            if (
+              forceOverride ||
+              _settings[settingsKey] === undefined ||
+              _settings[settingsKey] === ""
+            ) {
+              (updates as any)[settingsKey] = setting.value;
+            }
           }
         }
 
@@ -478,31 +440,26 @@ export const useSettings = () => {
   // If admin sets locked to false but provides a value,
   // use user settings first and fallback on admin setting if required.
   const settings: Settings = useMemo(() => {
-    const _unlockedPluginDefaults: Partial<Settings> = {};
+    const unlockedPluginDefaults: Partial<Settings> = {};
     const overrideSettings = Object.entries(pluginSettings ?? {}).reduce<
       Partial<Settings>
     >((acc, [key, setting]) => {
       if (setting) {
-        let { value } = setting;
-        const { locked } = setting;
+        const { value, locked } = setting;
         const settingsKey = key as keyof Settings;
 
-        // Normalize object-typed settings from plugin (plain primitive → { key, value })
-        value = normalizePluginValue(settingsKey, value);
-
-        // For unlocked settings: use plugin value unless user explicitly
-        // customized (their saved value differs from the default)
-        const userVal = _settings?.[settingsKey];
-        const defaultVal = defaultValues[settingsKey];
-        const userCustomized =
-          userVal !== undefined &&
-          JSON.stringify(userVal) !== JSON.stringify(defaultVal);
+        // Make sure we override default settings with plugin settings when they are not locked.
+        if (
+          !locked &&
+          value !== undefined &&
+          _settings?.[settingsKey] !== value
+        ) {
+          (unlockedPluginDefaults as any)[settingsKey] = value;
+        }
 
         (acc as any)[settingsKey] = locked
           ? value
-          : userCustomized
-            ? userVal
-            : value;
+          : (_settings?.[settingsKey] ?? value);
       }
       return acc;
     }, {});