Skip to content

immich-public-proxy

v2.4.0 Breaking

This release includes 1 breaking change for platform teams planning a safe upgrade.

Published 23h Media Servers
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Affected surfaces

breaking_upgrade

ReleasePort's take

Light signal
editorial:auto 22h

The config format in v2.4.0 now requires explicit per‑field opt‑ins for metadata display.

Why it matters: Affects any system using the configuration schema; deployments must update configs to specify each metadata field before upgrading to v2.4.0.

Summary

AI summary

Config format changed to require explicit opt‑in for each metadata field

Changes in this release

Breaking High

Configuration format changed to require explicit per-field opt‑ins for metadata display.

Configuration format changed to require explicit per-field opt‑ins for metadata display.

Source: llm_adapter@2026-06-05

Confidence: high

Deprecation Low

Legacy `ipp.showMetadata.{exif,location}.enabled` flags are deprecated and rewritten at startup.

Legacy `ipp.showMetadata.{exif,location}.enabled` flags are deprecated and rewritten at startup.

Source: granite4.1:30b@2026-06-05-audit

Confidence: low

Full changelog

A non-breaking but important change to the config format from 2.3.0

Yesterday I released 2.3.0 which added a sidebar and allowed you to show EXIF and other metadata.

@mFIND rightly pointed out in #244 that if you turned on the master enabled switch, new fields in future versions of Immich would automatically be enabled. This is the opposite of what we want as a default (new, unknown fields should be off), so I had to make a new release to reverse all of that.

Under the new configuration style you must opt-in to each individual field. Yes it's more verbose, but it protects against a future Immich field appearing in your production IPP without you realising.

{
  "ipp": {
    "showMetadata": {
      "exif": { 
        "make": true,
        "model": true,
        "lensModel": true,
        "exposureTime": true,
        "iso": true,
      },
      "location": { 
        "city": true,
        "country": true
      }
    }
  }
}

Migration

A compatibility shim runs at startup so existing 2.3.0 configs keep working without edits, and a deprecation notice is logged at startup. Legacy ipp.showMetadata.{exif,location}.enabled is rewritten in memory like so:

  • enabled: true defaults every unset per-field flag in the group to true, matching the old "everything visible" behaviour. Per-field flags you had explicitly set to false (the "all except X" pattern) are preserved.
  • enabled: false clears any per-field flags that were true, matching the old "nothing visible" behaviour and stopping leftover documentation flags from the shipped 2.3.0 config.json from becoming live opt-ins on upgrade.

Breaking Changes

  • Configuration now requires explicit opt‑in for each metadata field (exif, location) via nested flags; legacy `enabled` flag is removed.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track immich-public-proxy

Get notified when new releases ship.

Sign up free

About immich-public-proxy

Share your Immich photos and albums in a safe way without exposing your Immich instance to the public.

All releases →

Related context

Earlier breaking changes

  • v2.2.0 Deprecates `?password=...` query-param for shared links; requires Immich v2.6.0 or later.
  • v2.1.0 Removes dynamic public URL setting via HTTP header in IPP config.
  • v2.0.0 Gallery title now shown by default; hide with showTitle=false in config.json

Beta — feedback welcome: [email protected]