v7.8.3
Released on September 1st, 2026

	fix #4687 : Avoid naughty pdf uploaders by @ildyria.
	A user could upload a pdf crafted to exhaust the computational power of the server and cause a denial of service. This is now fixed. There was already mitigations in place, but they were not sufficient to avoid this issue.

	fix #4696 : Fix replay upload in the same chunk by @ildyria.
	A malicious user with upload access could replay the upload of chunks and subsequently fill the storage of the server without limit. We now ensure that the chunks are processed in order and that the same chunk cannot be uploaded twice.

	fix #4698 : Avoid email oracle on registration by @ildyria.
	When regitration page is disabled, a user could still send requests to the endpoint and try url. As the check for the authorization of the request was after the check of uniqueness of the email, an attacker could infer whether the email was used or not. This is now fixed.

	fix #4700 : Prevent editing pictures if they are not validated yet by @ildyria.
	When a photo is flagged for moderation, a user could still send a request to put the unvalidated photo as a cover of an album. This is now fixed.

v7.8.2
Released on August 30th, 2026

	fix #4685 : Fix photo ordering on albums by @ildyria.

v7.8.1
Released on August 30th, 2026

	fix #4682 : Fix missing album migration by @ildyria.

v7.8.0
Released on August 29th, 2026

	new #4677 : Dropping description sorting, merging natural and lexicographic by @ildyria.
	new #4678 : Saving metadata (tags, rating etc) into photos when editing by @ildyria.
	new #4665 : Show inline error for wrong album password instead of opening login by @matthewbolding.
	fix #4668 : AWS crash fix by @ildyria.
	fix #4675 : Improve wording on upload modal by @ildyria.

New Contributors

	@matthewbolding made their first contribution in https://github.com/LycheeOrg/Lychee/pull/4665

v7.7.5
What's Changed
🏕 Features

    (fix): do not display the warning-misconfiguration.blade.php by @jphuguet in #4641
    Fix overflowing by @ildyria in #4644
    Fix time always changing when editing pictures. by @ildyria in #4646
    Fix missing support for livekit by @ildyria in #4647
    Make dependabot auto update docker files by @ildyria in #4648
    Mitigate crashes when the album sizes is larger than 2GB by @ildyria in #4658
    fix the 401 error on faces when a visitor loads a photo by @jphuguet in #4642
    Version 7.7.5 by @ildyria in #4659

👒 Dependencies

    chore(deps): bump docker/setup-buildx-action from 4.2.0 to 4.3.0 in the actions-deps group by @dependabot[bot] in #4653
    chore(deps): bump node from 24-alpine to 26-alpine by @dependabot[bot] in #4649
    chore(deps): bump the production-dependencies group with 3 updates by @dependabot[bot] in #4650
    chore(deps-dev): bump the development-dependencies group with 5 updates by @dependabot[bot] in #4651

v7.7.4

What's Changed
🏕 Features

    Improve feedback on mail notification command by @ildyria in #4625
    Fix wrong frame detection by @ildyria in #4624
    Add failsafe on wrong version style from advisories by @ildyria in #4630
    Fix sneaky guest users by @ildyria in #4629
    Add query string integration for the search by @ildyria in #4628
    Add support for multi track in albums by @ildyria in #4637
    Add missing check on face displays by @ildyria in #4631
    Version 7.7.4 by @ildyria in #4639

👒 Dependencies

    chore(deps-dev): bump the development-dependencies group with 2 updates by @dependabot[bot] in #4635
    chore(deps): bump the production-dependencies group with 3 updates by @dependabot[bot] in #4632
    chore(deps): bump the actions-deps group with 5 updates by @dependabot[bot] in #4636
    chore(deps): bump the production-dependencies group with 5 updates by @dependabot[bot] in #4633
    chore(deps-dev): bump rector/rector from 2.6.1 to 2.6.2 in the development-dependencies group by @dependabot[bot] in #4634

v7.7.3

What's Changed
🏕 Features

	Avoid alert() in titles by @ildyria in #4593
	Fix slipery zip extraction by @ildyria in #4592
	Upgrade typescript types generations by @ildyria in #4596
	Add missing migration by @ildyria in #4597
	Add bit size informations by @ildyria in #4607
	Fixes per_page by @ildyria in #4608
	Close menu once a left-menu item is clicked by @jphuguet in #4614
	Add album-queries caching by @ildyria in #4602
	Keep image selection and position when many images are selected by @jphuguet in #4613
	Show existing tags when tagging images by @jphuguet in #4612
	Fix caching issue on tree global update by @ildyria in #4619
	Just print the message and die by @ildyria in #4620
	Version 7.7.3 by @ildyria in #4621

👒 Dependencies

	chore(deps): bump the actions-deps group with 7 updates by @dependabot[bot] in #4605
	chore(deps): bump the production-dependencies group with 5 updates by @dependabot[bot] in #4603
	chore(deps-dev): bump the development-dependencies group with 6 updates by @dependabot[bot] in #4604

v7.7.2

What's Changed
🏕 Features

    fa by @ildyria in #4529
    Do not display pending orders: too much noise. by @ildyria in #4531
    Add QR share by @ildyria in #4533
    Improve security posture by not dumping secrets all the time... by @ildyria in #4536
    Mitigate Zip Bombs by @ildyria in #4535
    Security update by @ildyria in #4540
    Translations update from LycheeOrg - Weblate by @ildyria in #4539
    French translations by @ildyria in #4538
    Norwegian by @ildyria in #4547
    Translations update from LycheeOrg - Weblate by @ildyria in #4548
    Add support for WASM even when CSP is active. by @ildyria in #4550
    Frankenphp update by @ildyria in #4554
    Translations update from LycheeOrg - Weblate by @ildyria in #4555
    Add table relation cache for smart albums by @ildyria in #4553
    Fix inheritance issue on album creation by @ildyria in #4563
    Do not watermark placeholders by @ildyria in #4568
    ar by @ildyria in #4552
    Dutch translations by @ildyria in #4537
    Update README.md - Fix URL for upgrade process from v6 > v7 by @jessienab in #4579
    Fix access rights by @ildyria in #4580
    Add support for more file secret by @ildyria in #4581
    Fix LinuxServer.io base path (though, they should fix their env) by @ildyria in #4589
    Notes on sorting: Lexicographic vs Natural by @ildyria in #4590
    Version 7.7.2 by @ildyria in #4591

👒 Dependencies

    chore(deps): bump the actions-deps group with 6 updates by @dependabot[bot] in #4521
    chore(deps-dev): bump the development-dependencies group with 2 updates by @dependabot[bot] in #4518
    chore(deps): bump the production-dependencies group with 2 updates by @dependabot[bot] in #4517
    chore(deps-dev): bump the development-dependencies group with 6 updates by @dependabot[bot] in #4520
    chore(deps): bump the actions-deps group with 6 updates by @dependabot[bot] in #4546
    chore(deps-dev): bump the development-dependencies group with 2 updates by @dependabot[bot] in #4543
    chore(deps-dev): bump tomasvotruba/class-leak from 2.1.4 to 2.1.8 in the development-dependencies group by @dependabot[bot] in #4544
    chore(deps): bump the production-dependencies group across 1 directory with 22 updates by @dependabot[bot] in #4558
    chore(deps): bump the actions-deps group with 6 updates by @dependabot[bot] in #4562
    chore(deps-dev): bump prettier from 3.9.5 to 3.9.6 in the development-dependencies group by @dependabot[bot] in #4559
    chore(deps-dev): bump the development-dependencies group with 2 updates by @dependabot[bot] in #4561
    chore(deps): bump socialiteproviders/microsoft from 4.9.1 to 4.10.0 in the production-dependencies group by @dependabot[bot] in #4560
    chore(deps): bump the production-dependencies group with 4 updates by @dependabot[bot] in #4569
    chore(deps-dev): bump the development-dependencies group with 4 updates by @dependabot[bot] in #4570
    chore(deps-dev): bump the development-dependencies group with 2 updates by @dependabot[bot] in #4572
    chore(deps): bump the production-dependencies group with 5 updates by @dependabot[bot] in #4582
    chore(deps-dev): bump the development-dependencies group with 2 updates by @dependabot[bot] in #4584
    chore(deps-dev): bump the development-dependencies group with 3 updates by @dependabot[bot] in #4583
    chore(deps): bump guzzlehttp/guzzle from 7.15.1 to 7.15.2 by @dependabot[bot] in #4586
    chore(deps): bump dedoc/scramble from 0.13.35 to 0.13.36 in the production-dependencies group across 1 directory by @dependabot[bot] in #4571
    chore(deps): bump the actions-deps group with 6 updates by @dependabot[bot] in #4585