This release includes 1 breaking change for platform teams planning a safe upgrade.
Published 1mo
Media Servers
β No known CVEs patched
✓ No known CVEs patched in this version
Topics
gallery
photo-gallery
photo-gallery-application
photo-management
photos
php
+2 more
typescript
vuejs
Affected surfaces
rce_ssrf
Summary
AI summaryUpdates π Dependencies, π Features, and deps across a mixed release.
Full changelog
What's Changed
π Features
- Async reverse-geocoding, configurable rate limit, remove Wikimedia map provider by @Copilot in https://github.com/LycheeOrg/Lychee/pull/4275
- Fixes the wrong name of aspect_ratio 16by9 to 1byx9 in all translations. by @mhepp63 in https://github.com/LycheeOrg/Lychee/pull/4279
- Avoid spamming the server for auditories when we don't have the rights by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4283
- Add admin check for uploads by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4282
- Remove user constraint on decoding Limiter by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4292
- feat(036): fix direct photo links in large paginated albums via ?page=N by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4294
- fix: show Back Home button on tablets and phones by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4295
- ldap is no longer required by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4297
- Fixes the Czech translation, part II by @mhepp63 in https://github.com/LycheeOrg/Lychee/pull/4303
- feat(35) Chunked Archive Download by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4300
- feat(34): add bulk album edit by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4296
- feat: search other pages when photo not found in suggested page by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4311
- feat: Add setting to disable embed endpoints and UI. by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4316
- fix: Improved support for group authorization for Album delete & edit by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4317
- feat(37): improved admin panel by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4312
- fix: deduplicate photos in tag album listings by @Copilot in https://github.com/LycheeOrg/Lychee/pull/4328
- fix: optimistic UI update for album pin/unpin by @Copilot in https://github.com/LycheeOrg/Lychee/pull/4329
- feat(white-label): hide Lychee SE / version branding on login form and all public surfaces by @Copilot in https://github.com/LycheeOrg/Lychee/pull/4335
- fix: use file path instead of stream for PDF thumbnail generation by @mitpjones in https://github.com/LycheeOrg/Lychee/pull/4334
- Fix SSRF on TOCTOU by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4344
- Bump frankenphp + fix flacky test by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4354
- Fixes the Czech translation, part III by @mhepp63 in https://github.com/LycheeOrg/Lychee/pull/4353
- Disable response caching functionality by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4362
- Fix not loading settings first page anymore by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4365
- Update Markdown configuration to a more secure practice by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4377
- Remove vulnerabilities by dropping some dependencies. by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4378
- Add option to have timeline only at root level by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4383
- Only call advisory after being logged in by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4384
- Fix hidden albums leaking via "present in albums" list by @Copilot in https://github.com/LycheeOrg/Lychee/pull/4387
- Display Camera Make in PhotoDetails Exif Data by @rschumm in https://github.com/LycheeOrg/Lychee/pull/4389
- Feature 041: supply title/description at upload time; return expected_id in response by @Copilot in https://github.com/LycheeOrg/Lychee/pull/4385
- feat(webshop): add print & pixel size support (feature 043) by @Copilot in https://github.com/LycheeOrg/Lychee/pull/4388
- Add option to disable the switch photo effect by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4406
- Add Feature 042 webshop order item display by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4411
- Add option to disable the switch photo effect by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4410
- Add better feedback on upload failures by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4412
- Fix mb strings for our chinese users by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4415
- Pin -rc releases by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4413
- Add support for toggle select on mobile view by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4416
- Add support for uploading folders by drag&drop by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4417
- Avoid further complaint on api/v2/diagnostics endpoint by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4419
- Do not re-run full CI if not necessary on PR by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4426
- Add middleware to check if feature is enabled by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4428
- Version 7.6.0 by @ildyria in https://github.com/LycheeOrg/Lychee/pull/4429
π Dependencies
- chore(deps): bump axios from 1.14.0 to 1.15.0 by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4277
- chore(deps): bump phpseclib/phpseclib from 3.0.50 to 3.0.51 by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4281
- chore(deps): bump the actions-deps group with 4 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4291
- chore(deps): bump the production-dependencies group with 6 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4287
- chore(deps): bump follow-redirects from 1.15.11 to 1.16.0 by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4293
- chore(deps-dev): bump the development-dependencies group with 6 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4290
- chore(deps): bump the production-dependencies group with 3 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4289
- chore(deps-dev): bump composer/composer from 2.9.5 to 2.9.7 by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4298
- chore(deps): bump the actions-deps group with 3 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4310
- chore(deps): bump the production-dependencies group with 6 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4306
- chore(deps-dev): bump the development-dependencies group with 4 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4309
- chore(deps): bump the production-dependencies group with 3 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4308
- chore(deps): bump the production-dependencies group with 11 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4322
- chore(deps): bump aquasecurity/trivy-action from 0.35.0 to 0.36.0 in the actions-deps group by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4326
- chore(deps-dev): bump the development-dependencies group with 3 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4325
- chore(deps): bump the production-dependencies group across 1 directory with 7 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4327
- chore(deps-dev): bump the development-dependencies group across 1 directory with 11 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4323
- chore(deps): bump the production-dependencies group with 3 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4338
- chore(deps-dev): bump the development-dependencies group with 4 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4337
- chore(deps-dev): bump phpstan/phpstan from 2.1.51 to 2.1.54 in the development-dependencies group by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4339
- chore(deps): bump step-security/harden-runner from 2.19.0 to 2.19.1 in the actions-deps group by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4340
- chore(deps): bump axios from 1.15.2 to 1.16.0 in the production-dependencies group by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4336
- chore(deps): bump the actions-deps group with 2 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4348
- chore(deps-dev): bump the development-dependencies group with 5 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4347
- chore(deps): bump the production-dependencies group across 1 directory with 10 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4352
- chore(deps): bump the production-dependencies group across 1 directory with 5 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4356
- chore(deps): bump the production-dependencies group with 4 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4358
- chore(deps-dev): bump the development-dependencies group with 3 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4360
- chore(deps): bump the actions-deps group with 3 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4361
- chore(deps-dev): bump the development-dependencies group with 5 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4359
- chore(deps-dev): bump composer/composer from 2.9.7 to 2.9.8 by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4363
- chore(deps): bump js-cookie from 3.0.5 to 3.0.7 by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4366
- chore(deps-dev): bump qs from 6.15.1 to 6.15.2 by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4367
- chore(deps): bump the actions-deps group with 5 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4374
- chore(deps): bump vite from 8.0.13 to 8.0.14 in the production-dependencies group by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4370
- chore(deps-dev): bump the development-dependencies group with 5 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4371
- chore(deps-dev): bump rector/rector from 2.4.3 to 2.4.4 in the development-dependencies group by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4373
- chore(deps): bump the production-dependencies group with 5 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4372
- chore(deps-dev): bump symfony/dom-crawler from 8.0.8 to 8.0.12 by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4379
- chore(deps): bump symfony/polyfill-intl-idn from 1.37.0 to 1.38.1 by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4381
- chore(deps): bump the production-dependencies group with 5 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4391
- chore(deps-dev): bump the development-dependencies group with 4 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4393
- chore(deps): bump the actions-deps group with 2 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4395
- chore(deps): bump the production-dependencies group with 2 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4392
- chore(deps-dev): bump the development-dependencies group with 5 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4394
- chore(deps): bump the actions-deps group across 1 directory with 3 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4405
- chore(deps): bump the production-dependencies group across 1 directory with 4 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4409
- chore(deps-dev): bump the development-dependencies group across 1 directory with 4 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4404
- chore(deps-dev): bump friendsofphp/php-cs-fixer from 3.95.5 to 3.95.7 by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4423
- chore(deps): bump form-data from 4.0.5 to 4.0.6 by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4424
- chore(deps-dev): bump the development-dependencies group across 1 directory with 10 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4420
- chore(deps): bump the production-dependencies group across 1 directory with 10 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4421
- chore(deps): bump the production-dependencies group with 3 updates by @dependabot[bot] in https://github.com/LycheeOrg/Lychee/pull/4422
New Contributors
- @mhepp63 made their first contribution in https://github.com/LycheeOrg/Lychee/pull/4279
- @rschumm made their first contribution in https://github.com/LycheeOrg/Lychee/pull/4389
Full Changelog: https://github.com/LycheeOrg/Lychee/compare/v7.5.4...v7.6.0
Breaking Changes
- Removed Wikimedia map provider from reverseβgeocoding configuration
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Lychee
A great looking and easy-to-use photo-management-system you can run on your server, to manage and share photos.
Related context
Related tools
Beta — feedback welcome: [email protected]