develop
Tests: Improve isolation and add fixes #5263
UX: Refactor video formats and codecs in front and backend #1307 #3168
Dependencies: Update packages and fix APNG media type handling
Docs: Split AGENTS guides into a hierarchical structure
Docs: Document the API JSON field-casing convention
i18n: Localize invalid-credentials OAuth token responses #5682
API: Consolidate album visibility gates into shared helpers
API: Search X-Count header for Labels and Services #5649
Albums: Broaden album search test coverage #5748
API: Scope photo reads and updates to the session
Links: Use canonical trailing-slash form for website URLs
API: Add AuthorizeSuperAdmin helper for account-creation gating
Logging: Report backend internals on the console-only system log
Downloads: Add signed tokens and file-level album selection #5733 #5743
Tests: Add release-review regression tests #5647 #5638 #5666 #5699 #5733
People: Load name suggestions from typeahead cache #5666
API: Add config.updated broadcast tests to api_client_config_test.go
Events: Refactor entity change notifications for sharing features #1307
Logs: Shorten the names of error log helper functions
API: Improve form and tests for POST /batch/photos/edit endpoint #271
Pkg: Move /service/http/... to /http/... and add package /http/dns
Auth: Use hashed auth tokens for enhanced security #3943 #808 #782
Auth: Deliver signed download tokens to every session #5733 #5743
Test: Use PascalCase names for all Go subtests in /internal
API: Adopt download visibility helpers and simplify token parsing #5733 #5743
API: Export request limit helpers and align test guidance
API: Align i18n.Response Go field names with JSON keys #5682
Metadata: Add Camera Make and Model updates via CLI & API #5663 #5656
Security: Add gosec fixes with shared URL and fs validation helpers
AI: Enhance "GET /api/v1/metrics" endpoint with additional stats #213
Config: Gate node roles by edition and align tests/lint
Cluster: Accept all instance roles in group config, tolerate spaces
Cluster: Revalidate portal proxy cache & tighten OAuth scope usage
Cluster: Protect register mutations and enforce CIDR gate
Logs: Replace status string literals with generic constants
API: Extend pre-parse request limits to more JSON handlers
Config: Add an option to disable the web user interface #5111
API: Apply "golangci-lint" recommendations #5330
API: Add const, func, and struct comments for easier troubleshooting
Backend: Remove legacy Go build tags #5330
Downloads: Record completed album downloads in the audit trail #5733 #5743
PWA: Improve service worker server endpoint #5274
CLI: Added JWT issuance and diagnostics sub commands #5230
API: Add additional fields to label and subject edit forms #383 #3168
Config: Add "develop" feature flag to disable new viewer sidebar #3168
Auth: Refactor cluster configuration and provisioning API endpoints #98
Photos: Limit by-UID label, marker & file edits to the session scope #1307
Files: Redact InstanceID for shared sessions and drop unused search field
Tests: Make GetFile redaction test self-contained for suite ordering
Tests: Add unit tests for recent metadata, auth, and config changes #5697
API: Add cluster operations endpoints to manage and register nodes #98
i18n: Localize index, import & upload completion notifications #5682
Backend: Contain all file paths within their base directories #5735
UX: Render backend error responses in the current UI locale #5682
Metadata: Add Lens Make and Model updates via CLI & API #5644 #5656
Backend: Clean up error handling and unit tests in internal/ packages
Backend: Compact verbose comments in config and MCP handler
MCP: Add HTTP scope-gate tests for admin app password #5024
Metrics: Use string constants in API endpoint #5355
API: Fix incorrect Swagger response schemas and "Fore more" typos
Auth: Serve Portal OIDC OP endpoints under /api/v1/oauth/* #4368 #4369
Auth: Land cluster sign-out on the Portal login without return_to
Auth: Add RP-initiated OIDC logout via PHOTOPRISM_OIDC_LOGOUT #5684 #5433
Auth: Gate app passwords behind a settings feature flag #5647
Go: Apply go fix modernizations across backend packages
Auth: Localize login/session/OIDC error responses via messageId #5699 #5682
Tests: Add unit tests
API: Resolve pre-existing gosec and gocritic lint warnings
API: Update swagger endpoint documentation #5133
Auth: Open album share links in the regular user interface #98 #782
API: Document "GET /api/v1/photos/view" in swagger.json
Sharing: Align photo search results and details on metadata fields
Places: Add config option to specify location details locale #465 #883
Tests: Add unit tests #465
MCP: Cap /api/v1/mcp body size and shorten session idle timeout #5024
API: Update endpoints to return HTTP 201 when a new resource was created
Backend: Move get package to /internal/photoprism/get
Auth: Delegate cluster OIDC logout to the Portal end-session endpoint #5684
API: Set Cache-Control no-store on the session response
Config: Refactor frontend URI handling for configurable base paths
Clean-up: Drop imaging and pigo library integrations #5353 #5508 #668
Auth: Add CLI command to create access tokens for apps #782 #808 #3943
UX: New Action Menu for Faces in People Editing Tab #4151 #797 #5249
API: Add missing Swagger annotations and update swagger.json
Vision: Add Normalize option for label names #5773
Security: Use individual preview tokens for each user account #98
Auth: Revoke derived sessions & gate app passwords by login state #5647
API: Improve user profile authorization checks and code comments #5619
Videos: Refactor codec, content and file type specifications #4770
Users: Apply 2FA changes for the cluster service principal
API: Enforce pre-parse body limits for login and uploads
Media: Render original-format 360° files via FFmpeg v360 #5711 #5716
Vision: Reject undecodable images on the face endpoint #5734
Vision: Validate image inputs consistently across API endpoints #5734
Vision: Make image-request builders source-aware #5734
Auth: Add "node" and "portal" roles, refactor session entity #98
Portal: Add cluster admin UI #98
Download: Record archive activity in the audit log