v2.1.1

Emby Watch Party v2.1.1

A dependency-only security patch. Two upstream advisories are closed, one of which affects the JavaScript that runs in every viewer's browser. No application code changed, no .env changes, no migration, nothing to reconfigure. Pull the new image, restart, done.

If you build from source, run npm ci in frontend/ so the updated lockfile is actually installed; npm install alone may keep the old resolutions.

Security

• socket.io-parser 4.2.6 to 4.2.7 closes CVE-2026-69185 (high), "Zero-attachment Memory Exhaustion", affecting every version from 4.0.0 up to 4.2.7. This is the one that matters most here: the parser is bundled into socket.io-client and runs in the browser, decoding every frame the server sends, so it sits on the path each viewer uses for the whole session. Watch Party never enabled the attachment features involved, but the parse path is shared, and the fix is a drop-in patch release from the Socket.IO maintainers.
• postcss 8.5.19 to 8.5.25 closes CVE-2026-69153 (medium), an incomplete fix of GHSA-6g55-p6wh-862q in which an attacker-controlled sourceMappingURL can read arbitrary .map files when from is unset. Patched upstream in 8.5.23; this goes to 8.5.25. Despite GitHub classifying it as runtime scope, postcss reaches this project only through vite and @vue/compiler-sfc, both build-time, so the realistic exposure is to whoever runs the build rather than to viewers. Included because there is no reason to ship a known-vulnerable build toolchain.

Both are transitive dependencies. package.json is unchanged; the patched versions already sit inside its existing ranges, so only frontend/package-lock.json moved. npm audit reports zero vulnerabilities on the result.

Technical details

Neither advisory was reachable through anything Watch Party calls directly, which is why this is a patch and not an emergency. The socket.io-parser bump is the substantive one purely because of where it executes: it ships to the client, so leaving it unpatched means shipping known-vulnerable JavaScript to every viewer regardless of whether this application exercises the affected code path.

Both bumps arrived through Dependabot, as #54 and #55, and this release is the version bump and changelog that publish them.

One incidental detail worth recording, since it will show up in a lockfile diff and looks alarming out of context: alongside its three-line version change, #54 also removed "dev": true from 54 @esbuild/* platform binaries, reclassifying them as production dependencies. It does not change the built output, because vite build emits the same static assets either way, but it does change what a vulnerability scanner configured to skip dev dependencies will report against this lockfile.

---

---

Installation

Option 1: Docker (Recommended)

Version specific:

docker pull ghcr.io/oratorian/emby-watchparty:2.1.1

Or always latest stable version:

docker pull ghcr.io/oratorian/emby-watchparty:latest

Or use docker-compose with the provided docker-compose.yml.example

Option 2: Manual Installation

1. Download and extract emby-watchparty-2.1.1.zip
2. Copy .env.example to .env and configure your Emby server details
3. Install dependencies: pip install -r requirements.txt
4. Run: python app.py
5. Open browser to http://localhost:5000

What's Included

• Complete application source code
• Docker support with pre-built images
• Requirements file for easy dependency installation
• Example configuration file
• README with full documentation
• MIT License

Requirements

• Python 3.8 or higher (manual install)
• Docker (container install)
• Emby server with API key
• Modern web browser

See README.md for full documentation.