These notes cover changes specific to PhotoPrism® Portal, the central server that authenticates users and manages multiple PhotoPrism instances as a cluster. Portal images are published as photoprism/portal; pull a specific build with its 1.YYMM.DD tag or use latest.

Build 1.2609.15 (September 15, 2026)

This release lets you control how often the Portal rotates the keys it signs cluster tokens with, and rotate them on demand. Directory sign-in now resolves the same role every time for users who belong to more than one mapped group, and the cluster activity log records the client address as its own searchable column. It also refreshes the base image, the Go toolchain, and the module dependencies.

What’s new?

Build 1.2608.17 (August 17, 2026)

This is a maintenance release. It refreshes the base image, the Go toolchain, and the module dependencies, and polishes the wording of the cluster node command output.

What’s new?

Build 1.2608.13 (August 13, 2026)

This release improves cluster sign-in with identity providers that emit large group claims and completes the localization of authentication messages. It also requires super-admin authority to create super-admin accounts, and refreshes the base image, Go modules, and frontend packages.

What’s new?

Build 1.2607.02 (July 2, 2026)

This release improves cluster account administration: session records now display the creation date in the admin interface, Portal admins can disable two-factor authentication for instance accounts, and the built-in super-admin controls are locked against accidental changes. It also updates the default database to MariaDB 12.3 (LTS).

What’s new?

Build 1.2606.27 (June 27, 2026)

This release lets you control how the Portal re-authenticates users against an upstream identity provider, so a rejected user or someone switching accounts can pick a different account instead of being silently signed back in. Authentication messages now also follow the interface language.

What’s new?

The new PHOTOPRISM_OIDC_PROMPT option is set on the Portal (the Relying Party to your identity provider). Use select_account together with single sign-out so a user is shown the account chooser instead of being re-admitted with the previous session.

Build 1.2606.26 (June 26, 2026)

This release hardens cluster sign-in and account management.

What’s new?

Build 1.2606.24 (June 24, 2026)

This release adds RP-initiated single sign-out, so signing out of the cluster also ends the upstream provider session instead of leaving it active for silent re-admission.

What’s new?

Enabling single sign-out requires registering the post-logout redirect URI(s) on your identity-provider client, otherwise the provider rejects the logout. See the Config Options reference for details.