drolosoft/immich-photo-manager

v1.3.1 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 11d MCP Data & Storage

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

albums claude claude-plugin cleanup duplicates gallery

+10 more

geolocation immich immich-plugin mcp mcp-server metadata photo-management photos python self-hosted

Affected surfaces

deps

Summary

AI summary

Updates Security & Packaging, Housekeeping, and What's Fixed across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Security	High	PyPI sdist now ships only package sources, reducing attack surface. PyPI sdist now ships only package sources, reducing attack surface. Source: llm_adapter@2026-07-16 Confidence: high	—
Feature	Medium	Adds `uvx` entry point to run server directly via `uvx immich-photo-manager`. Adds `uvx` entry point to run server directly via `uvx immich-photo-manager`. Source: llm_adapter@2026-07-16 Confidence: high	—
Feature	Low	Adds `__version__` attribute and a proper CHANGELOG file to the package. Adds `__version__` attribute and a proper CHANGELOG file to the package. Source: llm_adapter@2026-07-16 Confidence: high	—
Dependency	Medium	Caps dependency versions in the released package. Caps dependency versions in the released package. Source: llm_adapter@2026-07-16 Confidence: high	—
Bugfix	Medium	Defaults MCP_HOST to localhost, allowing override via environment variable. Defaults MCP_HOST to localhost, allowing override via environment variable. Source: llm_adapter@2026-07-16 Confidence: high	—
Bugfix	Low	`test-mcp.py` now inherits the environment and uses `sys.executable`. `test-mcp.py` now inherits the environment and uses `sys.executable`. Source: llm_adapter@2026-07-16 Confidence: high	—
Refactor	Low	Removed internal maintenance files from the repository. Removed internal maintenance files from the repository. Source: llm_adapter@2026-07-16 Confidence: high	—

Full changelog

What's Fixed

Security & Packaging

PyPI sdist now ships only the package sources (src/immich_mcp_server, README, LICENSE, SECURITY.md) instead of the full working tree.
First tagged release carrying the localhost-by-default HTTP bind (MCP_HOST to override) and capped dependency versions.

Added

uvx entry point — uvx immich-photo-manager runs the server directly (#3, thanks @kirel).
__version__ in the package and a proper CHANGELOG.

Docs — aligned with reality

Every skill, command, and reference now documents only what the 50 tools actually do:

Geographic search: city/country text search + CLIP + client-side filtering of get_map_markers output (there is no radius search parameter).
People reports: built from list_people/get_person (there is no asset-search-by-person).
Screenshot cleanup: search_smart("screenshot") + filename patterns, confirmed per-asset via get_asset_info.
Correct merge_people(person_id, merge_ids) signature, real taken_after/taken_before date params, delete_assets(force=False) trash semantics.
One version and one set of counts everywhere: 50 MCP tools, 12 skills.

Housekeeping

Removed internal maintenance files from the repo.
test-mcp.py now inherits the environment and uses sys.executable.

Full Changelog: https://github.com/drolosoft/immich-photo-manager/compare/v1.3.0...v1.3.1

Security Fixes

PyPI sdist now ships only package sources, reducing exposure of internal files

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track drolosoft/immich-photo-manager

Get notified when new releases ship.

About drolosoft/immich-photo-manager

Turn your self-hosted Immich photo library into a conversation — natural language search via CLIP, geographic album curation from GPS data, cross-source duplicate detection with perceptual hashing, library health reports, and offline-ready interactive HTML galleries. Claude Code plugin with 21 MCP tools, 11 skills, and 5 slash commands.

All releases →