v7.12.1 πŸ• Features Fixes by @ildyria in #4918 fix(auth): clear front-end stores on login and logout instead of Clear-Site-Data by @ildyria in #4932 feat(lightbox): play live photos from a dock button in v7 and v8 by @mlapaglia in #4933 ci: add an always-running PHP tests result check by @mlapaglia in #4934 fix(album): show the applied value and thumbnails in v8 album edit by @ildyria in #4939 Make caching on client side optional by @ildyria in #4940 feat(smart-albums): index On This Day by month and day by @ildyria in #4941 feat(diagnostics): check album size statistics and taken date ranges by @ildyria in #4942 Fix Person take over by @ildyria in #4951 Version 7.12.1 by @ildyria in #4952 πŸ‘’ Dependencies chore(deps): bump the actions-deps group with 7 updates by @dependabot[bot] in #4928 chore(deps): bump the production-dependencies group with 5 updates by @dependabot[bot] in #4921 chore(deps-dev): bump sass from 1.105.2 to 1.106.1 in the development-dependencies group by @dependabot[bot] in #4922 chore(deps): bump node from 6f08a52 to 40cd011 by @dependabot[bot] in #4926 chore(deps): bump php from e343d72 to f49965c by @dependabot[bot] in #4927 chore(deps): bump composer from af98f42 to b6dcd72 by @dependabot[bot] in #4925 chore(deps-dev): bump the development-dependencies group with 4 updates by @dependabot[bot] in #4924 chore(deps): bump the production-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #4929 chore(deps): bump vite-plus from 1.3.0 to 1.4.0 in the vite-plus group by @dependabot[bot] in #4920 chore(deps): bump follow-redirects from 1.16.1 to 1.16.2 by @dependabot[bot] in #4938 chore(deps-dev): bump phpunit/phpunit from 13.4.3 to 13.4.4 by @dependabot[bot] in #4937 chore(deps): bump the production-dependencies group with 5 updates by @dependabot[bot] in #4943 chore(deps-dev): bump the development-dependencies group with 3 updates by @dependabot[bot] in #4945 chore(deps): bump dunglas/frankenphp from 1.13.2-php8-trixie to 1.13.3-php8-trixie by @dependabot[bot] in #4949 chore(deps): bump node from 40cd011 to c6ad9e9 by @dependabot[bot] in #4948 chore(deps): bump composer from 2.10.3 to 2.11.0 by @dependabot[bot] in #4947 chore(deps): bump the production-dependencies group with 5 updates by @dependabot[bot] in #4944 chore(deps): bump step-security/harden-runner from 2.22.2 to 2.22.3 in the actions-deps group by @dependabot[bot] in #4950 chore(deps-dev): bump the development-dependencies group with 7 updates by @dependabot[bot] in #4946 v7.12.0 πŸ• Features Ensure that config always have translation keys by @ildyria in #4872 Add support for email login by @ildyria in #4871 Worktree moderation history by @ildyria in #4881 Translations [AI GENERATED] - if you are native speaker, we do accept pull requests ;) by @ildyria in #4885 Bucketing refactor by @ildyria in #4883 Translations update from LycheeOrg - Weblate by @ildyria in #4889 Support Vite+ by @ildyria in #4891 open-new-tab by @ildyria in #4896 Translations update from LycheeOrg - Weblate by @ildyria in #4897 Add tag-person album section by @ildyria in #4895 fix(photo): scroll PDF pages instead of changing photo by @ildyria in #4898 Fixes the link in CONTRIBUTING.md by @mlapaglia in #4902 Claude is just a tool, however we expect you to understand what you write by @ildyria in #4904 Translations update from LycheeOrg - Weblate by @ildyria in #4903 Google Motion Photos: Android 11+ format and grid hover playback by @mlapaglia in #4900 Jxl support by @ildyria in #4899 Fixes PHP RCE CVE-2026-109618 and CVE-2026-109619 in the Docker image by @timo-reymann in #4913 speed up thumb loading by @ildyria in #4912 Migrate from debian-slim to php base image by @ildyria in #4915 Version 7.11.2 by @ildyria in #4914 πŸ‘’ Dependencies chore(deps): bump the actions-deps group with 10 updates by @dependabot[bot] in #4878 chore(deps): bump node from 0b36e8c to 143494b by @dependabot[bot] in #4880 chore(deps-dev): bump the development-dependencies group with 3 updates by @dependabot[bot] in #4877 chore(deps): bump the production-dependencies group with 8 updates by @dependabot[bot] in #4875 chore(deps-dev): bump the development-dependencies group with 4 updates by @dependabot[bot] in #4876 chore(deps): bump debian from a99cfc5 to a29215f by @dependabot[bot] in #4879 chore(deps): bump the production-dependencies group with 5 updates by @dependabot[bot] in #4893 chore(deps-dev): bump the development-dependencies group with 3 updates by @dependabot[bot] in #4892 chore(deps): bump the production-dependencies group with 5 updates by @dependabot[bot] in #4906 chore(deps-dev): bump the development-dependencies group with 4 updates by @dependabot[bot] in #4908 chore(deps): bump the actions-deps group with 4 updates by @dependabot[bot] in #4910 chore(deps-dev): bump brianium/paratest from 7.27.0 to 7.27.2 in the development-dependencies group by @dependabot[bot] in #4905 chore(deps): bump node from 143494b to 6f08a52 by @dependabot[bot] in #4909 chore(deps): bump the production-dependencies group across 1 directory with 6 updates by @dependabot[bot] in #4907 v7.11.1 What's Changed πŸ• Features Version 7.11.1 by @ildyria in #4870 v7.11.0 Released on October 12th, 2026 new #4855 : Improve the album unlock dialog by @matthewbolding. When using the propagation of unlocking, the UI seemed unresponsive for a few seconds. This change adds a user feedback, indicating that the unlocking process is in progress. klo #4818 : Laravel 13 by @ildyria. KLO changes mostly. fix #4822 : Fix concurency on album creation ordering by @ildyria. When uploading two folders simultaneously, the thumbs were not correctly selected. This is now resolved. fix #4821 : Don’t show sensitive photos in landing by @hyperdefined. Sensitive photos will no longer be displayed on the landing page, enhancing privacy. fix #4823 : Let the browser pick 1x/2x variants by rendered size by @NikitaTH. Improve the loading performance of images on high-resolution displays. fix #4824 : Fix unsanized description of photos by @ildyria. A small possible XSS vulnerability on the map. This has now been fixed. fix #4830 : Update endpoint refactoring by @ildyria. Refactoring the way updates and versions are checked. We are also dropping the support for update via the web interface. The recommended way to use Lychee is via docker, as it makes it easier to manage dependencies etc. fix #4834 : fix: make PDF /MediaBox match limit configurable by @mitpjones. It is now possible to support more than 25 /MediaBox items in a single pdf. The limit is now set via configuration by the admin. fix #4837 : Fix Tag renaming & listing by @ildyria. One of the issue with tags and database with case insensitivity was that capitalizing an existing tag was not working. This should now be fixed. fix #4843 : Insert missing statistics by @ildyria. This ensures that all relevant statistics are correctly recorded and displayed. This also aims to prevent error 500 to show up when statistics were missing. new #4847 : Show album names in browser tab titles by @koonweee. Long over due, navigating an album will now update the browser tab title to reflect the current album name. This improves the user experience by providing context in the browser tab. fix #4852 : Add Pocket ID OAuth provider by @tinuh. Another Oauth provider support. :) fix #4598 : Adding OpenTelemetry and provide traces by @FredPraca. This was on the whish list of some of our users and Fred decided to tackle it. We are now providing 4 docker images depending of the desired flavour: lychee:edge lychee:edge-telemetry lychee:edge-legacy lychee:edge-legacy-telemetry fix #4856 : Fix sprintf vulnerability by @ildyria. We migrated out of sprintf library to implement our own version. This avoids having to deal with another transitive CVE. fix #4863 : Fix memory leak when uploading 3000 photos at the same time by @ildyria. When uploading a photo in an album with a large number of photos, the relations of the album would be loaded in memory, this also includes the relations of the relations etc… As a result uploading a photo in an album with already 2000 would cause memory exhaustion and simply… kill the php process. fix #4864 : Jobs: change processing priorities by @ildyria. New Contributors @koonweee made their first contribution in https://github.com/LycheeOrg/Lychee/pull/4847 @tinuh made their first contribution in https://github.com/LycheeOrg/Lychee/pull/4852 v7.10.0 What's Changed πŸ• Features Strip completely at the php level to avoid xss by @ildyria in #4789 Add CAN_MOVE rights by @ildyria in #4787 fix(security): block all IPv6-transition spellings that embed an internal IPv4 by @anzal1 in #4791 Configurable size variant format (WebP) and lossless quality by @NikitaTH in #4790 Translations update from LycheeOrg - Weblate by @ildyria in #4793 Refactor agentic to reduce the number of merge conflicts by @ildyria in #4796 Fixes advisories crash when on internal network without internet access by @ildyria in #4798 Global password gallery setting by @ildyria in #4799 Avoid XSS in GPX tracks by @ildyria in #4804 Fix dock being visible when user has not edit rights by @ildyria in #4806 Avoid uploading a picture of another user and getting extra perks by @ildyria in #4805 Add support for video loop attribute by @ildyria in #4807 Fix video player? by @ildyria in #4808 Version 7.10.0 by @ildyria in #4800 πŸ‘’ Dependencies chore(deps): bump node from dbaa92e to 0b36e8c by @dependabot[bot] in #4810 chore(deps): bump composer from a5f59b9 to 9715c7f by @dependabot[bot] in #4812 chore(deps): bump dunglas/frankenphp from f92d81e to 81231b5 by @dependabot[bot] in #4813 chore(deps): bump debian from d7e1218 to a99cfc5 by @dependabot[bot] in #4811 chore(deps): bump the actions-deps group with 4 updates by @dependabot[bot] in #4817 chore(deps): bump the production-dependencies group with 6 updates by @dependabot[bot] in #4815 chore(deps-dev): bump the development-dependencies group with 6 updates by @dependabot[bot] in #4816 New Contributors @anzal1 made their first contribution in #4791 @NikitaTH made their first contribution in #4790 v7.8.5 Latest What's Changed πŸ• Features Fix language by @ildyria in #4757