Edit: /var/softaculous/lychee/changelog.txt (8665B)
v7.8.3
Released on September 1st, 2026
fix #4687 : Avoid naughty pdf uploaders by @ildyria.
A user could upload a pdf crafted to exhaust the computational power of the server and cause a denial of service. This is now fixed. There was already mitigations in place, but they were not sufficient to avoid this issue.
fix #4696 : Fix replay upload in the same chunk by @ildyria.
A malicious user with upload access could replay the upload of chunks and subsequently fill the storage of the server without limit. We now ensure that the chunks are processed in order and that the same chunk cannot be uploaded twice.
fix #4698 : Avoid email oracle on registration by @ildyria.
When regitration page is disabled, a user could still send requests to the endpoint and try url. As the check for the authorization of the request was after the check of uniqueness of the email, an attacker could infer whether the email was used or not. This is now fixed.
fix #4700 : Prevent editing pictures if they are not validated yet by @ildyria.
When a photo is flagged for moderation, a user could still send a request to put the unvalidated photo as a cover of an album. This is now fixed.
v7.8.2
Released on August 30th, 2026
fix #4685 : Fix photo ordering on albums by @ildyria.
v7.8.1
Released on August 30th, 2026
fix #4682 : Fix missing album migration by @ildyria.
v7.8.0
Released on August 29th, 2026
new #4677 : Dropping description sorting, merging natural and lexicographic by @ildyria.
new #4678 : Saving metadata (tags, rating etc) into photos when editing by @ildyria.
new #4665 : Show inline error for wrong album password instead of opening login by @matthewbolding.
fix #4668 : AWS crash fix by @ildyria.
fix #4675 : Improve wording on upload modal by @ildyria.
New Contributors
@matthewbolding made their first contribution in https://github.com/LycheeOrg/Lychee/pull/4665
v7.7.5
What's Changed
🏕 Features
(fix): do not display the warning-misconfiguration.blade.php by @jphuguet in #4641
Fix overflowing by @ildyria in #4644
Fix time always changing when editing pictures. by @ildyria in #4646
Fix missing support for livekit by @ildyria in #4647
Make dependabot auto update docker files by @ildyria in #4648
Mitigate crashes when the album sizes is larger than 2GB by @ildyria in #4658
fix the 401 error on faces when a visitor loads a photo by @jphuguet in #4642
Version 7.7.5 by @ildyria in #4659
👒 Dependencies
chore(deps): bump docker/setup-buildx-action from 4.2.0 to 4.3.0 in the actions-deps group by @dependabot[bot] in #4653
chore(deps): bump node from 24-alpine to 26-alpine by @dependabot[bot] in #4649
chore(deps): bump the production-dependencies group with 3 updates by @dependabot[bot] in #4650
chore(deps-dev): bump the development-dependencies group with 5 updates by @dependabot[bot] in #4651
v7.7.4
What's Changed
🏕 Features
Improve feedback on mail notification command by @ildyria in #4625
Fix wrong frame detection by @ildyria in #4624
Add failsafe on wrong version style from advisories by @ildyria in #4630
Fix sneaky guest users by @ildyria in #4629
Add query string integration for the search by @ildyria in #4628
Add support for multi track in albums by @ildyria in #4637
Add missing check on face displays by @ildyria in #4631
Version 7.7.4 by @ildyria in #4639
👒 Dependencies
chore(deps-dev): bump the development-dependencies group with 2 updates by @dependabot[bot] in #4635
chore(deps): bump the production-dependencies group with 3 updates by @dependabot[bot] in #4632
chore(deps): bump the actions-deps group with 5 updates by @dependabot[bot] in #4636
chore(deps): bump the production-dependencies group with 5 updates by @dependabot[bot] in #4633
chore(deps-dev): bump rector/rector from 2.6.1 to 2.6.2 in the development-dependencies group by @dependabot[bot] in #4634
v7.7.3
What's Changed
🏕 Features
Avoid alert() in titles by @ildyria in #4593
Fix slipery zip extraction by @ildyria in #4592
Upgrade typescript types generations by @ildyria in #4596
Add missing migration by @ildyria in #4597
Add bit size informations by @ildyria in #4607
Fixes per_page by @ildyria in #4608
Close menu once a left-menu item is clicked by @jphuguet in #4614
Add album-queries caching by @ildyria in #4602
Keep image selection and position when many images are selected by @jphuguet in #4613
Show existing tags when tagging images by @jphuguet in #4612
Fix caching issue on tree global update by @ildyria in #4619
Just print the message and die by @ildyria in #4620
Version 7.7.3 by @ildyria in #4621
👒 Dependencies
chore(deps): bump the actions-deps group with 7 updates by @dependabot[bot] in #4605
chore(deps): bump the production-dependencies group with 5 updates by @dependabot[bot] in #4603
chore(deps-dev): bump the development-dependencies group with 6 updates by @dependabot[bot] in #4604
v7.7.2
What's Changed
🏕 Features
fa by @ildyria in #4529
Do not display pending orders: too much noise. by @ildyria in #4531
Add QR share by @ildyria in #4533
Improve security posture by not dumping secrets all the time... by @ildyria in #4536
Mitigate Zip Bombs by @ildyria in #4535
Security update by @ildyria in #4540
Translations update from LycheeOrg - Weblate by @ildyria in #4539
French translations by @ildyria in #4538
Norwegian by @ildyria in #4547
Translations update from LycheeOrg - Weblate by @ildyria in #4548
Add support for WASM even when CSP is active. by @ildyria in #4550
Frankenphp update by @ildyria in #4554
Translations update from LycheeOrg - Weblate by @ildyria in #4555
Add table relation cache for smart albums by @ildyria in #4553
Fix inheritance issue on album creation by @ildyria in #4563
Do not watermark placeholders by @ildyria in #4568
ar by @ildyria in #4552
Dutch translations by @ildyria in #4537
Update README.md - Fix URL for upgrade process from v6 > v7 by @jessienab in #4579
Fix access rights by @ildyria in #4580
Add support for more file secret by @ildyria in #4581
Fix LinuxServer.io base path (though, they should fix their env) by @ildyria in #4589
Notes on sorting: Lexicographic vs Natural by @ildyria in #4590
Version 7.7.2 by @ildyria in #4591
👒 Dependencies
chore(deps): bump the actions-deps group with 6 updates by @dependabot[bot] in #4521
chore(deps-dev): bump the development-dependencies group with 2 updates by @dependabot[bot] in #4518
chore(deps): bump the production-dependencies group with 2 updates by @dependabot[bot] in #4517
chore(deps-dev): bump the development-dependencies group with 6 updates by @dependabot[bot] in #4520
chore(deps): bump the actions-deps group with 6 updates by @dependabot[bot] in #4546
chore(deps-dev): bump the development-dependencies group with 2 updates by @dependabot[bot] in #4543
chore(deps-dev): bump tomasvotruba/class-leak from 2.1.4 to 2.1.8 in the development-dependencies group by @dependabot[bot] in #4544
chore(deps): bump the production-dependencies group across 1 directory with 22 updates by @dependabot[bot] in #4558
chore(deps): bump the actions-deps group with 6 updates by @dependabot[bot] in #4562
chore(deps-dev): bump prettier from 3.9.5 to 3.9.6 in the development-dependencies group by @dependabot[bot] in #4559
chore(deps-dev): bump the development-dependencies group with 2 updates by @dependabot[bot] in #4561
chore(deps): bump socialiteproviders/microsoft from 4.9.1 to 4.10.0 in the production-dependencies group by @dependabot[bot] in #4560
chore(deps): bump the production-dependencies group with 4 updates by @dependabot[bot] in #4569
chore(deps-dev): bump the development-dependencies group with 4 updates by @dependabot[bot] in #4570
chore(deps-dev): bump the development-dependencies group with 2 updates by @dependabot[bot] in #4572
chore(deps): bump the production-dependencies group with 5 updates by @dependabot[bot] in #4582
chore(deps-dev): bump the development-dependencies group with 2 updates by @dependabot[bot] in #4584
chore(deps-dev): bump the development-dependencies group with 3 updates by @dependabot[bot] in #4583
chore(deps): bump guzzlehttp/guzzle from 7.15.1 to 7.15.2 by @dependabot[bot] in #4586
chore(deps): bump dedoc/scramble from 0.13.35 to 0.13.36 in the production-dependencies group across 1 directory by @dependabot[bot] in #4571
chore(deps): bump the actions-deps group with 6 updates by @dependabot[bot] in #4585