More researchers

src/content/docs/docs/getting-started/releases.md

@@ -11,6 +11,29 @@ sidebar:
 
 ## Version 7
 
+### v7.8.3
+
+Released on September 1st, 2026
+
+### Security Fixes
+
+A group of researchers from the University of Sydney had some fun trying to find ways to break Lychee.
+They found a few vulnerabilities and reported them to us. These issues are classified as moderate/high severity, but their real-world impact is limited: most require that the attacker already have upload rights, a prerequisite that doesn't apply to most Lychee deployments.
+Nevertheless, as a commitment to security, we have fixed these issues in a timely manner and are releasing this hotfix to address them.
+
+* `fix` #4687 : Avoid naughty pdf uploaders by @ildyria.
+  > A user could upload a pdf crafted to exhaust the computational power of the server and cause a denial of service. This is now fixed.
+  > There was already mitigations in place, but they were not sufficient to avoid this issue.
+* `fix` #4696 : Fix replay upload in the same chunk by @ildyria.
+  > A malicious user with upload access could replay the upload of chunks and subsequently fill the storage of the server without limit.
+  > We now ensure that the chunks are processed in order and that the same chunk cannot be uploaded twice. 
+* `fix` #4698 : Avoid email oracle on registration by @ildyria.
+  > When regitration page is disabled, a user could still send requests to the endpoint and try url. As the check for the authorization of the
+  > request was after the check of uniqueness of the email, an attacker could infer whether the email was used or not. This is now fixed.
+* `fix` #4700 : Prevent editing pictures if they are not validated yet by @ildyria.
+  > When a photo is flagged for moderation, a user could still send a request to put the unvalidated photo as a cover of an album.
+  > This is now fixed.
+
 ### v7.8.2
 
 Released on August 30th, 2026

src/data/releases.ts

@@ -8,6 +8,7 @@ export interface Release {
 
 // Release data extracted from releases.md
 export const releases: Release[] = [
+  { version: 'v7.8.3', date: 'Sep 1, 2026', title: 'Hotfix', type: 'security', highlights: ['Fixes four vulnerabilities reported by researchers from the University of Sydney'] },
   { version: 'v7.8.2', date: 'Aug 30, 2026', title: 'Fixes', type: 'bugfix', highlights: ['Fixes missing migration on album configuration for photo ordering'] },
   { version: 'v7.8.1', date: 'Aug 30, 2026', title: 'Fixes', type: 'bugfix', highlights: ['Fixes missing migration on album configuration for sub-album ordering'] },
   { version: 'v7.8.0', date: 'Aug 29, 2026', title: 'Dropping ordering by Descriptions', type: 'enhancement', highlights: ['Improved support for title ordering', 'Dropped sort by description', 'Metadata persistence in photos files'] },

src/pages/support.astro

@@ -374,6 +374,41 @@ const metadata = {
           src: 'https://avatars.githubusercontent.com/u/298925831?v=4',
           alt: 'skeletonsec',
         },
+      },
+      {
+        title: 'Zyy0530 (Ziyue Wang)',
+        image: {
+          src: 'https://avatars.githubusercontent.com/u/202744044?v=4',
+          alt: 'Zyy0530',
+        },
+      },
+      {
+        title: 'lzhou1110 (Liyi Zhou)',
+        image: {
+          src: 'https://avatars.githubusercontent.com/u/12844719?v=4',
+          alt: 'lzhou1110',
+        },
+      },
+      {
+        title: 'Str1ckl4nd (Strick Sheng)',
+        image: {
+          src: 'https://avatars.githubusercontent.com/u/73695323?v=4',
+          alt: 'Str1ckl4nd',
+        },
+      },
+      {
+        title: 'mauriceng98 (Maurice Ng)',
+        image: {
+          src: 'https://avatars.githubusercontent.com/u/97803816?v=4',
+          alt: 'mauriceng98',
+        },
+      },
+      {
+        title: '7thParkk (Chenchen Yu)',
+        image: {
+          src: 'https://avatars.githubusercontent.com/u/91473103?v=4',
+          alt: '7thParkk',
+        },
       }
 
     ]}