immich-public-proxy

v2.2.0 Breaking

This release includes 1 breaking change for platform teams planning a safe upgrade.

Published 5d Media Servers

✓ No known CVEs patched

✓ No known CVEs patched in this version

Affected surfaces

auth breaking_upgrade

ReleasePort's take

Light signal

editorial:auto 4d

Immich v2.2.0 deprecates the `?password=...` query‑parameter for shared links; use Immich v2.6.0 or later to continue password‑protected sharing.

Why it matters: Deprecation triggers on versions before v2.6.0, requiring immediate upgrade to maintain functional password‑protected shares.

AI summary

Updates https://api.immich.app/endpoints/shared-links/sharedLinkLogin, https://photoswipe.com/options/, and og across a mixed release.

Type	Severity	Summary	CVE
Breaking	High	Deprecates `?password=...` query-param for shared links; requires Immich v2.6.0 or later. Deprecates `?password=...` query-param for shared links; requires Immich v2.6.0 or later. Source: llm_adapter@2026-05-30 Confidence: high	—
Feature
Feature	Low	Uses album cover photo as og:image for link previews when set, falling back to first asset. Uses album cover photo as og:image for link previews when set, falling back to first asset. Source: llm_adapter@2026-05-30 Confidence: high	—
Feature	Low	Allows free‑form `options` object under `ipp.lightbox.options` in config.json for PhotoSwipe lightbox customization. Allows free‑form `options` object under `ipp.lightbox.options` in config.json for PhotoSwipe lightbox customization. Source: llm_adapter@2026-05-30 Confidence: high	—
Feature	Low	Thumbnails now fade in over their thumbhash placeholder as they load. Thumbnails now fade in over their thumbhash placeholder as they load. Source: llm_adapter@2026-05-30 Confidence: high	—
Bugfix	Medium	Fixes broken password-protected shares on newer Immich versions. Fixes broken password-protected shares on newer Immich versions. Source: llm_adapter@2026-05-30 Confidence: high	—
Bugfix	Medium	Corrects og:image preview for video‑only shares to use a still instead of the .mp4 file. Corrects og:image preview for video‑only shares to use a still instead of the .mp4 file. Source: llm_adapter@2026-05-30 Confidence: high	—

Full changelog

Immich has deprecated the ?password=... query-param method for shared links in favour of POST /shared-links/login (docs)

🚨 Password-protected shares now require Immich v2.6.0 or later. Non-password shares continue to work on any Immich version.

Album cover photo is used as the og:image for link previews when set, falling back to the first asset (#237 - thanks @rootmout)
The PhotoSwipe lightbox now accepts a free-form options object under ipp.lightbox.options in config.json, letting you pass any native PhotoSwipe options through without IPP having to map each one explicitly (#229 - thanks @e1jo)
Thumbnails fade in over their thumbhash placeholder as they load, so the blurred preview smoothly resolves into the image

#214 / #235 password-protected shares were broken on newer Immich (see Notable above)
og:image previews of video-only shares pointed at the .mp4 file rather than a still

Deprecated `?password=...` query‑param for shared links; password‑protected shares now require POST `/shared-links/login` (Immich v2.6.0+).

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track immich-public-proxy

Get notified when new releases ship.

About immich-public-proxy

Share your Immich photos and albums in a safe way without exposing your Immich instance to the public.

v2.1.0 Removes dynamic public URL setting via HTTP header in IPP config.
v2.0.0 Gallery title now shown by default; hide with showTitle=false in config.json