This release includes 1 breaking change for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Affected surfaces
ReleasePort's take
Light signalThe config format in v2.4.0 now requires explicit per‑field opt‑ins for metadata display.
Why it matters: Affects any system using the configuration schema; deployments must update configs to specify each metadata field before upgrading to v2.4.0.
Summary
AI summaryConfig format changed to require explicit opt‑in for each metadata field
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Breaking | High |
Configuration format changed to require explicit per-field opt‑ins for metadata display. Configuration format changed to require explicit per-field opt‑ins for metadata display. Source: llm_adapter@2026-06-05 Confidence: high |
— |
| Deprecation | Low |
Legacy `ipp.showMetadata.{exif,location}.enabled` flags are deprecated and rewritten at startup. Legacy `ipp.showMetadata.{exif,location}.enabled` flags are deprecated and rewritten at startup. Source: granite4.1:30b@2026-06-05-audit Confidence: low |
— |
Full changelog
A non-breaking but important change to the config format from 2.3.0
Yesterday I released 2.3.0 which added a sidebar and allowed you to show EXIF and other metadata.
@mFIND rightly pointed out in #244 that if you turned on the master enabled switch, new fields in future versions of Immich would automatically be enabled. This is the opposite of what we want as a default (new, unknown fields should be off), so I had to make a new release to reverse all of that.
Under the new configuration style you must opt-in to each individual field. Yes it's more verbose, but it protects against a future Immich field appearing in your production IPP without you realising.
{
"ipp": {
"showMetadata": {
"exif": {
"make": true,
"model": true,
"lensModel": true,
"exposureTime": true,
"iso": true,
},
"location": {
"city": true,
"country": true
}
}
}
}
Migration
A compatibility shim runs at startup so existing 2.3.0 configs keep working without edits, and a deprecation notice is logged at startup. Legacy ipp.showMetadata.{exif,location}.enabled is rewritten in memory like so:
enabled: truedefaults every unset per-field flag in the group totrue, matching the old "everything visible" behaviour. Per-field flags you had explicitly set tofalse(the "all except X" pattern) are preserved.enabled: falseclears any per-field flags that weretrue, matching the old "nothing visible" behaviour and stopping leftover documentation flags from the shipped 2.3.0config.jsonfrom becoming live opt-ins on upgrade.
Breaking Changes
- Configuration now requires explicit opt‑in for each metadata field (exif, location) via nested flags; legacy `enabled` flag is removed.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About immich-public-proxy
Share your Immich photos and albums in a safe way without exposing your Immich instance to the public.
Related context
Related tools
Beta — feedback welcome: [email protected]