Skip to content

Lychee

v7.6.0 Breaking

This release includes 1 breaking change for platform teams planning a safe upgrade.

Published 1mo Media Servers
βœ“ No known CVEs patched
Read the diff β†’ Tool health β†’ What is this tool? β†’

✓ No known CVEs patched in this version

Topics

gallery photo-gallery photo-gallery-application photo-management photos php
+2 more
typescript vuejs

Affected surfaces

rce_ssrf

Summary

AI summary

Updates πŸ‘’ Dependencies, πŸ• Features, and deps across a mixed release.

Full changelog

What's Changed

πŸ• Features

  • Async reverse-geocoding, configurable rate limit, remove Wikimedia map provider by @Copilot in https://github.com/LycheeOrg/Lychee/pull/4275
  • Fixes the wrong name of aspect_ratio 16by9 to 1byx9 in all translations. by @mhepp63 in https://github.com/LycheeOrg/Lychee/pull/4279
  • Avoid spamming the server for auditories when we don't have the rights by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4283
  • Add admin check for uploads by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4282
  • Remove user constraint on decoding Limiter by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4292
  • feat(036): fix direct photo links in large paginated albums via ?page=N by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4294
  • fix: show Back Home button on tablets and phones by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4295
  • ldap is no longer required by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4297
  • Fixes the Czech translation, part II by @mhepp63 in https://github.com/LycheeOrg/Lychee/pull/4303
  • feat(35) Chunked Archive Download by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4300
  • feat(34): add bulk album edit by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4296
  • feat: search other pages when photo not found in suggested page by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4311
  • feat: Add setting to disable embed endpoints and UI. by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4316
  • fix: Improved support for group authorization for Album delete & edit by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4317
  • feat(37): improved admin panel by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4312
  • fix: deduplicate photos in tag album listings by @Copilot in https://github.com/LycheeOrg/Lychee/pull/4328
  • fix: optimistic UI update for album pin/unpin by @Copilot in https://github.com/LycheeOrg/Lychee/pull/4329
  • feat(white-label): hide Lychee SE / version branding on login form and all public surfaces by @Copilot in https://github.com/LycheeOrg/Lychee/pull/4335
  • fix: use file path instead of stream for PDF thumbnail generation by @mitpjones in https://github.com/LycheeOrg/Lychee/pull/4334
  • Fix SSRF on TOCTOU by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4344
  • Bump frankenphp + fix flacky test by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4354
  • Fixes the Czech translation, part III by @mhepp63 in https://github.com/LycheeOrg/Lychee/pull/4353
  • Disable response caching functionality by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4362
  • Fix not loading settings first page anymore by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4365
  • Update Markdown configuration to a more secure practice by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4377
  • Remove vulnerabilities by dropping some dependencies. by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4378
  • Add option to have timeline only at root level by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4383
  • Only call advisory after being logged in by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4384
  • Fix hidden albums leaking via "present in albums" list by @Copilot in https://github.com/LycheeOrg/Lychee/pull/4387
  • Display Camera Make in PhotoDetails Exif Data by @rschumm in https://github.com/LycheeOrg/Lychee/pull/4389
  • Feature 041: supply title/description at upload time; return expected_id in response by @Copilot in https://github.com/LycheeOrg/Lychee/pull/4385
  • feat(webshop): add print & pixel size support (feature 043) by @Copilot in https://github.com/LycheeOrg/Lychee/pull/4388
  • Add option to disable the switch photo effect by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4406
  • Add Feature 042 webshop order item display by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4411
  • Add option to disable the switch photo effect by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4410
  • Add better feedback on upload failures by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4412
  • Fix mb strings for our chinese users by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4415
  • Pin -rc releases by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4413
  • Add support for toggle select on mobile view by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4416
  • Add support for uploading folders by drag&drop by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4417
  • Avoid further complaint on api/v2/diagnostics endpoint by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4419
  • Do not re-run full CI if not necessary on PR by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4426
  • Add middleware to check if feature is enabled by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4428
  • Version 7.6.0 by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4429

πŸ‘’ Dependencies

  • chore(deps): bump axios from 1.14.0 to 1.15.0 by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4277
  • chore(deps): bump phpseclib/phpseclib from 3.0.50 to 3.0.51 by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4281
  • chore(deps): bump the actions-deps group with 4 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4291
  • chore(deps): bump the production-dependencies group with 6 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4287
  • chore(deps): bump follow-redirects from 1.15.11 to 1.16.0 by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4293
  • chore(deps-dev): bump the development-dependencies group with 6 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4290
  • chore(deps): bump the production-dependencies group with 3 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4289
  • chore(deps-dev): bump composer/composer from 2.9.5 to 2.9.7 by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4298
  • chore(deps): bump the actions-deps group with 3 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4310
  • chore(deps): bump the production-dependencies group with 6 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4306
  • chore(deps-dev): bump the development-dependencies group with 4 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4309
  • chore(deps): bump the production-dependencies group with 3 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4308
  • chore(deps): bump the production-dependencies group with 11 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4322
  • chore(deps): bump aquasecurity/trivy-action from 0.35.0 to 0.36.0 in the actions-deps group by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4326
  • chore(deps-dev): bump the development-dependencies group with 3 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4325
  • chore(deps): bump the production-dependencies group across 1 directory with 7 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4327
  • chore(deps-dev): bump the development-dependencies group across 1 directory with 11 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4323
  • chore(deps): bump the production-dependencies group with 3 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4338
  • chore(deps-dev): bump the development-dependencies group with 4 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4337
  • chore(deps-dev): bump phpstan/phpstan from 2.1.51 to 2.1.54 in the development-dependencies group by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4339
  • chore(deps): bump step-security/harden-runner from 2.19.0 to 2.19.1 in the actions-deps group by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4340
  • chore(deps): bump axios from 1.15.2 to 1.16.0 in the production-dependencies group by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4336
  • chore(deps): bump the actions-deps group with 2 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4348
  • chore(deps-dev): bump the development-dependencies group with 5 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4347
  • chore(deps): bump the production-dependencies group across 1 directory with 10 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4352
  • chore(deps): bump the production-dependencies group across 1 directory with 5 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4356
  • chore(deps): bump the production-dependencies group with 4 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4358
  • chore(deps-dev): bump the development-dependencies group with 3 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4360
  • chore(deps): bump the actions-deps group with 3 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4361
  • chore(deps-dev): bump the development-dependencies group with 5 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4359
  • chore(deps-dev): bump composer/composer from 2.9.7 to 2.9.8 by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4363
  • chore(deps): bump js-cookie from 3.0.5 to 3.0.7 by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4366
  • chore(deps-dev): bump qs from 6.15.1 to 6.15.2 by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4367
  • chore(deps): bump the actions-deps group with 5 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4374
  • chore(deps): bump vite from 8.0.13 to 8.0.14 in the production-dependencies group by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4370
  • chore(deps-dev): bump the development-dependencies group with 5 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4371
  • chore(deps-dev): bump rector/rector from 2.4.3 to 2.4.4 in the development-dependencies group by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4373
  • chore(deps): bump the production-dependencies group with 5 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4372
  • chore(deps-dev): bump symfony/dom-crawler from 8.0.8 to 8.0.12 by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4379
  • chore(deps): bump symfony/polyfill-intl-idn from 1.37.0 to 1.38.1 by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4381
  • chore(deps): bump the production-dependencies group with 5 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4391
  • chore(deps-dev): bump the development-dependencies group with 4 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4393
  • chore(deps): bump the actions-deps group with 2 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4395
  • chore(deps): bump the production-dependencies group with 2 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4392
  • chore(deps-dev): bump the development-dependencies group with 5 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4394
  • chore(deps): bump the actions-deps group across 1 directory with 3 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4405
  • chore(deps): bump the production-dependencies group across 1 directory with 4 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4409
  • chore(deps-dev): bump the development-dependencies group across 1 directory with 4 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4404
  • chore(deps-dev): bump friendsofphp/php-cs-fixer from 3.95.5 to 3.95.7 by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4423
  • chore(deps): bump form-data from 4.0.5 to 4.0.6 by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4424
  • chore(deps-dev): bump the development-dependencies group across 1 directory with 10 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4420
  • chore(deps): bump the production-dependencies group across 1 directory with 10 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4421
  • chore(deps): bump the production-dependencies group with 3 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4422

New Contributors

  • @mhepp63 made their first contribution in https://github.com/LycheeOrg/Lychee/pull/4279
  • @rschumm made their first contribution in https://github.com/LycheeOrg/Lychee/pull/4389

Full Changelog: https://github.com/LycheeOrg/Lychee/compare/v7.5.4...v7.6.0

Breaking Changes

  • Removed Wikimedia map provider from reverse‑geocoding configuration

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Lychee

Get notified when new releases ship.

Sign up free

About Lychee

A great looking and easy-to-use photo-management-system you can run on your server, to manage and share photos.

All releases β†’

Beta — feedback welcome: [email protected]