Skip to content

Add two new security researchers & Version 7.7.4 #330

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ildyria wants to merge 4 commits into
base: master
Choose a base branch
from
+48 −4
Open

Add two new security researchers & Version 7.7.4 #330

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
508dc6b
Add two new security researcher
ildyria Aug 17, 2026
c9221d9
Version 7.7.4
ildyria Aug 18, 2026
9440a61
fix
ildyria Aug 18, 2026
9eb9ea6
typos
ildyria Aug 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 31 additions & 3 deletions src/content/docs/docs/getting-started/releases.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,34 @@ sidebar:

## Version 7

### v7.7.4

Released on August 19th, 2026

#### Fixes

A quick release containing mainly a security fix and a few minor new additions.
As we are currently working towards the next major version, we are collecting feedback and bug reports
from our canary users. If you are interested in joining the beta, please reach out to us on our discord.

* `new` #4625 : Improve feedback on mail notification command by @ildyria.
> When running the mail notification command, if there are no mails to be sent, we no longer
> return silently.
* `new` #4624 : Fix wrong frame detection by @ildyria.
> The frame detection was not using the correct value to select the frame, this is now fixed.
> Additionally we added a configuration option which allows the admin to choose at which time
> the frame should be picked: beginning, middle or custom.
* `fix` #4630 : Add failsafe on wrong version style from advisories by @ildyria.
> In the case of advisories using a wrong version style, we now have a failsafe to avoid
> computing the wrong ranges.
* `fix` #4629 : Fix sneaky guest users by @ildyria.
> A guest user could trick the server into returning the basket of another user.
> This was reported by @d3do-23 and is now fixed.

First we would like to thank @d3do-23 for reporting the guest user bypass vulnerability.
As we are working towards the next major version, we also would like to extend our gratitude to
@skeletonsec for their audit of the code base, catching a vulnerability before it made it live.

### v7.7.3

Released on August 15th, 2026
Expand Down Expand Up @@ -531,7 +559,7 @@ For all users, this version introduces full RAW image support with automatic JPE
* `klo` #4124 : Remove endpoint to fetch all data in one go for an album by @ildyria
> This endpoing has been replaced with the head, photos, albums endpoints. This change allowed us to paginate the photos & albums. Now we no longer need it, so let's get rid of this legacy code.
* `SE` #4123 : Slugs as album ids by @ildyria
> To have prettier URLs, we added the possibility to use slugs as album IDs instead of the default UUIDs. The slug is unique for the full Lychee installation, but you can chose yourself exactly which to slug to use for each album.
> To have prettier URLs, we added the possibility to use slugs as album IDs instead of the default UUIDs. The slug is unique for the full Lychee installation, but you can choose yourself exactly which to slug to use for each album.
* `fix` #4125 : add inner transactions to avoid aborting (#4072) by @FredPraca
> On rare occasions, one of the migrations was failing. @FredPraca added some failsafes to avoid a cascade of failure in such cases.
* `new` #4130 : Raw support by @ildyria
Expand Down Expand Up @@ -3431,8 +3459,8 @@ Released Nov 19, 2020
- `new` #764 : Add Diagnotics warnings if the php init values are too low (less than 30M).
- `new` #757 : Add limits on the number of logs seen.
> Too many logs lines where crashing php by using too much memory.
- `new` #758 : Add the possibility to chose the picture ordering per album
> the admin can now chose whether to order by name etc per album instead of globally.
- `new` #758 : Add the possibility to choose the picture ordering per album
> the admin can now choose whether to order by name etc per album instead of globally.

### v4.0.7

Expand Down
3 changes: 2 additions & 1 deletion src/data/releases.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,8 @@ export interface Release {

// Release data extracted from releases.md
export const releases: Release[] = [
{ version: 'v7.7.3', date: 'Aug 15, 2026', title: 'Fixes', type: 'bugfix', highlights: ['Small QoL improvements', 'Minor bug fixes'] },
{ version: 'v7.7.4', date: 'Aug 19, 2026', title: 'Fixes', type: 'security', highlights: ['Fix video frame detection', 'Fix security issue'] },
{ version: 'v7.7.3', date: 'Aug 15, 2026', title: 'Fixes', type: 'security', highlights: ['Small QoL improvements', 'Minor bug fixes'] },
Comment thread
ildyria marked this conversation as resolved.
{ version: 'v7.7.2', date: 'Aug 6, 2026', title: 'Fixes', type: 'bugfix', highlights: ['Improved translations', 'Minor bug fixes'] },
{ version: 'v7.7.1', date: 'Jul 13, 2026', title: 'Hotfix', type: 'security', highlights: ['Fixes a major vulnerability in the webshop', 'minor sqlite fix'] },
{ version: 'v7.7.0', date: 'Jul 13, 2026', title: 'Album thumbs, and RSS feed customization', type: 'feature', highlights: ['Add cover to tag albums', 'Add option to disable the second line on album thumbs', 'Allow customizing RSS feed title & description', 'Fixes access rights with multiple groups', 'Fixes webshop bypass vulnerability (8.3)'] },
Expand Down
15 changes: 15 additions & 0 deletions src/pages/support.astro
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -360,7 +360,22 @@ const metadata = {
src: 'https://avatars.githubusercontent.com/u/93777011?v=4',
alt: 'Alpastx',
},
},
{
title: 'd3do-23 (Wu Wenhao)',
image: {
src: 'https://avatars.githubusercontent.com/u/73107878?v=4',
alt: 'd3do-23',
},
},
{
title: 'skeletonsec',
image: {
src: 'https://avatars.githubusercontent.com/u/298925831?v=4',
alt: 'skeletonsec',
},
}

Comment on lines +363 to +378

@coderabbitai coderabbitai Bot Aug 18, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Preserve the avatar metadata when rendering.

The new entries provide image.alt, but ItemGrid4 currently renders a raw <img> with hard-coded alt="A bird."; Features5 forwards these items to that renderer. (raw.githubusercontent.com) This discards the researcher names and bypasses src/components/common/Image.astro. Update src/components/ui/ItemGrid4.astro to use the shared component and pass alt={image.alt}.

Proposed renderer fix 
+import Image from '~/components/common/Image.astro';
+
-<img src={image.src} alt="A bird." class=" rounded-full h-20 w-20" />
+<Image src={image.src} alt={image.alt} width={80} height={80} layout="fixed" class="rounded-full h-20 w-20" />

Sources: Coding guidelines, MCP tools

]}
/>

Expand Down
Loading