PhotoPrism build 260305 is out. This one is a maintenance release: tighter security defaults, fewer edge case surprises, and less friction if you use Ollama for local AI. The big feature work is coming in later builds.
The short version
- Go 1.26 (security and performance fixes)
- New HTTP response header options for self-hosters behind reverse proxies
- Ollama config via
OLLAMA_BASE_URLandOLLAMA_API_KEYenvironment variables - WebDAV headers fixed for Cyberduck, Transmit, rclone, and similar clients
- Google OIDC login on SQLite works properly now
Security and infrastructure
Go has been upgraded to v1.26 (changelog). There are new config options for HTTP security headers, so you can set things like CSP and CORS at the PhotoPrism level without patching your reverse proxy (#5471). Gzip route exclusions are faster and more configurable (#5384).
If you run PhotoPrism on a shared domain alongside other services, a set of hosting issues that caused unexpected behavior has been resolved (#2391).
Easier Ollama setup
If you run Ollama for caption generation, two environment variables replace the config file approach:
OLLAMA_BASE_URL: "http://ollama:11434"
OLLAMA_API_KEY: "your-key-here" # only if your setup requires it
Same names Ollama itself uses. If you already have them set, PhotoPrism picks them up. (#5361)
Separately, reasoning models (the ones that “think” before answering) used to break caption generation. PhotoPrism didn’t know what to do with the thinking output and just failed. Now it strips the thinking part and uses the actual response. (#5455)
Bug fixes
Merged photos kept the wrong media type after a video file merge, which meant wrong thumbnails in search results (#5418). GPS coordinates slightly outside valid bounds, common in Google JSON exports, caused indexing errors instead of being clamped quietly (#5373). Minor GPS overshoots near map tile boundaries placed photos in wrong spots on the map (#5445).
Emoji characters in subfolder names broke parent folder albums (#5366). Truncated folder slugs caused path collisions (#5437).
Some JPEG files showed blank thumbnails when the interoperability index was missing from EXIF (#5389). Hidden files in Library view now tell you why they were hidden, right in the Card and List views, instead of making you check logs (#5391). And caption thumbnail / video remux errors produce clearer log messages now (#5398).
WebDAV and interoperability
WebDAV is how most people sync PhotoPrism with desktop file managers and backup tools. The response headers have been reworked for better compatibility with Cyberduck, Transmit, rclone, and others. If you had sync problems before, worth another try. (#5472)
CLI commands validate input paths consistently now and return proper exit codes. Matters for scripts and cron jobs. (#5457)
Google OIDC on SQLite had a data handling bug that blocked login. Fixed. (#4951)
Translations
French, German, Latvian, and Romanian got updates. Machine translations fill gaps where human ones are missing. Native speakers who spot something wrong can fix it on Weblate.
Updating
Docker Compose:
docker compose pull
docker compose stop
docker compose up -d
For all other installation methods, see the update guide.
Contributors
Thanks to everyone who filed the bug reports behind these fixes. GitHub Discussions is where most conversation happens, and the contribution guidelines are there if you want to help.