> For the complete documentation index, see [llms.txt](https://docs.fylr.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.fylr.io/releases/2026/v6.34.4.md).

# Release v6.34.4 (2026-08-31)

Published 2026-08-31 10:58:46Z

* [fylr\_checksums.txt](https://s3.eu-central-1.wasabisys.com/fylr-releases/v6.34.4/fylr_checksums.txt)
* [fylr\_v6.34.4\_darwin\_amd64.tar.gz](https://s3.eu-central-1.wasabisys.com/fylr-releases/v6.34.4/fylr_v6.34.4_darwin_amd64.tar.gz)
* [fylr\_v6.34.4\_darwin\_arm64.tar.gz](https://s3.eu-central-1.wasabisys.com/fylr-releases/v6.34.4/fylr_v6.34.4_darwin_arm64.tar.gz)
* [fylr\_v6.34.4\_linux\_amd64.tar.gz](https://s3.eu-central-1.wasabisys.com/fylr-releases/v6.34.4/fylr_v6.34.4_linux_amd64.tar.gz)
* [fylr\_v6.34.4\_windows\_amd64.zip](https://s3.eu-central-1.wasabisys.com/fylr-releases/v6.34.4/fylr_v6.34.4_windows_amd64.zip)

## Server

### Important

* **Clipping paths are honored more narrowly.** An image that carries a Photoshop path but designates none of them as *the* clipping path is no longer cut out along it, so such a file's previews now show the whole motif instead of a cut-out. Assets already in the instance keep the previews they have until their metadata is read again — check the affected files before [regenerating their preview images](https://docs.fylr.io/help/tutorials/for-system-administrators/regenerating-preview-images). JPEG and PSD are covered by the option now as well. See the full note under **Fixed**.
* **A session that fails the browser binding can no longer be refreshed.** `/oauth2/refresh` now requires the browser cookie the session was bound to. The web frontend handles this; a custom frontend or integration that answers `InvalidToken` with a refresh has to discard the session and log in again instead of retrying. Tokens issued to API clients are unbound and unaffected. See the full note under **Fixed**.

### Fixed

* **A SAML login no longer ends the browser's other sessions**: the identity provider posts its assertion cross-site, so the `SameSite=Lax` browser-id cookie does not ride along and fylr minted a fresh one for that request — handing the browser a new identity and rejecting every session token bound to the previous one. The other tabs stopped rendering and dropped to the login page, and the keep-login cookie stopped working. A cross-site request no longer establishes a browser identity; the same-site steps that follow the assertion carry the browser's own cookie and keep owning the binding. See [Session binding](https://docs.fylr.io/for-developers/api/endpoints/api-oauth2#session-binding-anti-hijacking). Rejections are also logged more usefully: they name what the request carried (`BrowserCookie=absent` or `mismatch`), and only a foreign cookie is a warning — a session whose cookie is simply gone is ordinary and logs at debug. \[857284c16]
* **A session that fails the browser binding can no longer be refreshed back to life**: `/oauth2/refresh` validated the refresh token but not the binding, so a client that answered a rejected token with a refresh was handed a new one carrying the same broken binding, which was rejected again in turn. A frontend retrying that loop could produce hundreds of rejected requests per second for as long as the tab stayed open. A refresh now has to come from the browser the session was bound to; unbound sessions (API clients, password grant, cross-origin logins) are unaffected. A client that meets `InvalidToken` should discard the session and start a new login rather than retry — see [Session binding](https://docs.fylr.io/for-developers/api/endpoints/api-oauth2#session-binding-anti-hijacking). \[aa08db14b]
* **The file-deletion janitor keeps finishing on large instances**: the background job that removes the files of superseded object versions could run for hours without ever completing, and while it did, no dead row anywhere in the database was reclaimed — the job holds a write transaction, which stops autovacuum instance-wide — and the janitor steps queued behind it never ran either. Its query looked up the candidate objects in a way PostgreSQL could only plan efficiently while that intermediate result was small enough to hold in memory, and the set grows with the version history, so every instance reaches the tipping point eventually. Both lookups of the query are index-backed anti-joins now, which no longer depend on that limit. A first part of this was fixed in 6.33.1. See [Removing file links from historic versions](https://docs.fylr.io/for-administrators/readme/services#removing-file-links-from-historic-versions). \[cecfe7ed0]
* **root can change its own password again**: setting a new root password in the frontend was answered with *The user type "system" doesn't allow to set a password* since 6.34.0. Restricting password management to the user types that actually log in with a fylr-managed password had left out `system` — the type of the root user, which does log in with one. The other types keep the restriction: `ldap` and `sso` authenticate against the external directory or identity provider, an `email` user only follows a collection share link, and the anonymous and collection users never log in with a password at all. As before, root cannot be reset by email from the password-forgot page; a root password is set with a password, or through [`POST /api/v1/user`](https://docs.fylr.io/for-developers/api/endpoints/api-user). \[b9dbeef69]
* **A `HEAD` request for a file in an S3 location answers again**: asking for just the headers of a download — what a client does to read size, type or file name without fetching the bytes — answered `400` for every file stored in an S3 location that **fylr** delivers itself, while `GET` on the same URL worked. The signed storage URL is issued for `GET`, and an S3 signature covers the method, so the forwarded `HEAD` came back from the storage as `403`. The storage is always asked with `GET` now; the body is still not sent to the client. See [`/api/v1/eas/download`](https://docs.fylr.io/for-developers/api/endpoints/eas/download). \[91ae519c5]
* **Backup dumps restore under `ON_ERROR_STOP` again**: the dump emitted a `setval` for every table it lists as owning a sequence, but the `task` table has none — its ids are assigned by **fylr**, not by the database — so a strict psql restore aborted on that statement. The table no longer claims a sequence. See [Restoring a copy](https://docs.fylr.io/for-administrators/backup-manager#restore). \[17669478d]
* **Only a designated clipping path clips a preview**: an image that carries a Photoshop path without designating one of them as the clipping path was cut out along that path anyway, so its previews showed a masked motif while the download stayed whole. Whether an image clips is decided by the clipping path **Photoshop** records, and the path is addressed by the name recorded with it rather than by taking the first one — a name with an umlaut in it finds its path as well, whether the file was written on macOS or on Windows. A clipping path saved without a name keeps its meaning, the first path. Besides TIFF this now covers JPEG and PSD, which carry the same metadata; for a JPEG the path is reported but not applied, because its versions are JPEG and have no transparency to cut a background out of — a custom version that writes PNG does clip it. Reading the clipping path no longer scans the whole image, so the previous limit of 200MB for that check is gone. Assets already in an instance keep the clipping they were produced with until their metadata is read again. The name of the clipping path is reported in the technical metadata as it reads, whichever system the file was saved on. See [Clipping paths](https://docs.fylr.io/for-administrators/readme/file-worker/preview-configuration#clipping-paths). \[4aec70b8d]
* **A tiled watermark is tiled on a custom rendition too**: a watermark configured as tiled in the pool or objecttype covered the normal renditions in tiles, but a download through a custom rendition preset placed a single watermark wherever the gravity pointed instead. Custom renditions are produced by their own recipe, which was never told about the tiling — the watermark image, its placement, its size and its transparency all reached it, only the tile flag was missing. See [Watermarks](https://docs.fylr.io/for-administrators/permissions/pools#watermarks) and [Custom Version Presets](https://docs.fylr.io/for-administrators/readme/file-worker/custom-version-presets). \[f72462b4b]
* **A watermark sized in percent no longer breaks the download of a custom rendition**: if the watermark size was given as a percentage rather than in pixels, a custom rendition with that watermark failed to be produced at all and the download stayed empty, with `exec #0: exit status 1` in the log. The percentage refers to the size of the converted image, which was read back from the rendition file — and that file is never written while the rendition is streamed straight to the download, as custom renditions are. Pixel sizes were unaffected, as were the normal renditions, which are written to disk. See [Watermarks](https://docs.fylr.io/for-administrators/permissions/pools#watermarks). \[f72462b4b]

## Frontend

### Fixed

* **Pool short links no longer hang on the splash screen**: Opening a link that addresses a pool by its short name could leave the frontend on the welcome splash forever. The splash paints over the dialog layer, so a dialog raised while the apps were still loading — a login prompt, an error, a confirmation — was invisible, and loading kept waiting for an answer that nobody could give. The splash now steps aside for the first dialog that is not a passive notice. (4bc8a8480)
* **"Add to collection" for users without collections**: The search context menu hid the entry for users who had no collection yet but were allowed to create one, so neither the right-click menu nor the three-dot menu offered a way to start the first one. Accounts that already owned a collection were unaffected, which made the report look like a rights problem. The entry now stays visible whenever the collection manager offers to create a new collection. See [Collections](https://docs.fylr.io/for-users/quick-access/collections-and-presentations). (ca8803077)
* **Moving a shared collection warns before it changes the owner**: Dropping a collection into a tree that belongs to somebody else hands it, and all of its subcollections, over to the owner of the new parent, and the previous owner silently loses access. The move is now confirmed first, naming both owners, and dropping onto the *My collections* header takes the same path instead of moving right away. A move the user may not make is refused as the drop happens — it needs write and ACL rights on the collection plus create on the new parent — so no dialog appears for a move that could only end in a server error. See [Setting up collection sharing](https://docs.fylr.io/help/tutorials/for-administrators/setting-up-collection-sharing). (fd249b855) (7e1f3e3c9)
* **Quick Access hides object types the user cannot read**: The *Quick Access* panel listed every object type configured for it, including the ones the user has no read right on, so picking one of them led to an empty result. A single aggregation now tells which of them actually hold something the user may see and the rest are left out. If that request cannot be answered the panel is shown unfiltered, so it is never emptied by accident. See [Quick Access](https://docs.fylr.io/for-users/quick-access). (2e07e26af)
* **A refused token ends the session instead of retrying without limit**: When the server refused a session token, the frontend refreshed it and retried the request with no limit, so a session that could not be repaired kept a client sending requests at full rate. The decision now sits in one place: a batch of parallel failures triggers a single refresh, a refreshed token that is refused on first use ends the session, further refreshes back off and are capped, and the tokens are cleared before the login screen appears. Once the session is over no further requests go out, and the user's other tabs are told over a BroadcastChannel instead of each running the same loop on its own. The Safari fallback header also kept sending the dead token on a retry, and the logout event listener was registered before the version was known, so it never took effect at all. See [Session binding](https://docs.fylr.io/for-developers/api/endpoints/api-oauth2#session-binding-anti-hijacking). (8be5463ed)
* **Downloading records from a connector instance**: The download dialog offered custom renditions for records that come from a connected instance, and that section left an undefined entry in the form data, so collecting the file URLs crashed and the *Download* button never became enabled. Custom renditions are produced server-side from the original while the connector dialog only hands out ready file URLs, so they are no longer offered there. See [Connector](https://docs.fylr.io/for-administrators/plugin-manager/connector). (4f43ee0ac)
* **Crop frame when a rendition fixes both width and height**: Entering a width and a height on a *Resize/Crop* rendition collapsed the crop frame to a few pixels, so the selection shown on the asset no longer matched the area that would be downloaded — the downloaded file itself was correct. Locking a ratio reshaped the current crop, which only ever shrinks, and typing a height digit by digit fired intermediate extreme ratios that compounded it further. The crop is now re-fitted to the largest frame that fits the image. See [Custom Version Presets](https://docs.fylr.io/for-administrators/readme/file-worker/custom-version-presets). (bc19f135b)
* **CSV import into nested fields inside nested fields**: Columns that address a row of the outer nested field — `events[1].dates[].date` — were assigned to the wrong row: a value belonging to the second event landed in the first one behind an empty row, and a field mapped only for the second event went to the first. The innermost index is now counted per outer row, columns are grouped by their indices instead of being kept in a sparse list that lost the link to its configuration, and indices with more than one digit are recognized. See [CSV Importer](https://docs.fylr.io/for-administrators/tools/csv-importer/general-information). (9322985eb)
* **CSV import into a linked object's localized field**: A column that addresses a field inside a linked object names it after a `#`, but a localized field is itself stored as `name#de-DE`, so only the part before the second `#` was compared and such a column never matched. The comparison also went through the option label, which changes with *Show Display Names*, so the same header matched or not depending on that checkbox. The option's value is used now, longest match first. (9fde69d03)
* **CSV import into a date and time field**: A value carrying only a date was stored with a time of 02:00, because the importer forced full second precision and read the value as UTC, so an imported 18:00 came out as 20:00 in Berlin. The value is now formatted with the precision the target field accepts, a date stays a date, and a value that cannot be parsed is marked invalid instead of being dropped in silence. Date and time values written without seconds, such as 2026-05-15 14:30, are recognized as well. (a8a34e212) (CUI, 26004c0a)
* **Copy buttons in the ACL manager**: *Copy selected row* stayed enabled with nothing selected and threw when it was clicked, and the minus button failed the same way silently. *Copy all rows* only turned on with more than one row, so a pool holding a single permission could not be copied at all. Both buttons now follow the selection, and the pressed state stays on the button that was actually used. See [Pool permissions](https://docs.fylr.io/for-administrators/permissions/pools). (7b120e9b0) (12b8d087b)

### Docker images

```
docker.fylr.io/fylr/fylr:v6.34.4
docker.fylr.io/fylr/fylr-server:v6.34.4
```