steilerDev/icloud-photos-sync v5.0.0-beta.1 on GitHub

5.0.0-beta.1 (2026-10-06)

HTTP_PROXY/HTTPS_PROXY/NO_PROXY are no longer applied
implicitly. Set --use-system-proxy (USE_SYSTEM_PROXY=true) to route
requests through the configured proxy.
The Docker image is based on Docker Hardened Images and no longer includes a shell, package manager or other system utilities. docker exec -it <container> sh is no longer possible - commands of this application can still be executed directly (e.g. docker exec -it <container> icloud-photos-sync token), use docker debug to debug the container. The application still runs with UID 100 and GID 101, however the default library path /opt/icloud-photos-library is no longer world-writable, but owned by this user.
Node.js >= 26 is required when installing through npm.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com

monitoring: #1008 Prometheus Compatible Metrics Endpoint (6e8a7a4)
[app] read AppleID credentials from files via APPLE_ID_USER_FILE/APPLE_ID_PWD_FILE (57b2864), closes #1000
[app] rework prometheus exporter for spec compliance and alerting (f6881cf), closes #1008
[app] support Node.js permission model & shell-free crash reporting (55f9b66), closes #1116 #1119
[docker] build image on Docker Hardened Images (fd73d7d), closes #1119
[docker] Docker image no longer provides a shell (bb254cc), closes #1119

[app] detect icloud accounts requiring an action on icloud.com (940440d), closes #1071
[app] exit with code 0 on help/version and draw banner line without terminal width (4ffb209), closes #1123
[app] forward nonFTEU flag when requesting sms/voice mfa code (a9c7b59)
[app] replace axios-har-tracker with built-in network capture (96edd8a), closes #1114
[app] restore MFA flow for iOS 26.4+ (e06da11), closes #1071 #1007 #1103 #1104
[app] scheduled syncs and Web UI re-authentication failing with APP_NOT_READY (2929f60)
[app] surface photos setup errors on reconnect instead of timing out (dfcfb69), closes #1071
[app] workaround iOS 26.4 MFA by switching default to SMS (5b803f2), closes #1007
add missing EOL to Prometheus metrics (1dc73bb)
Correctly reading resource file instead of overwriting (f7454e2)
disable buggy state check (c9ed864)
state metric may not be string (1901e3c)
use 'account ready' as event for authentication done (5dd17a9)
whitespace related issues (7a20033)

[app] dependency-free SRP implementation matching Apple's web client (4ee837b)
[app] replace axios with node's built-in fetch (99f0a05), closes #1115
[app] replace small dependencies with Node built-ins & adopt Node 26 features (db47db2)
[app] require schema validation for every response (d76a28f)
[app] validate health check pings as plain text (9f95243), closes #1115
Move library locking logic into state (3e6d9c0)

[app] add use-system-proxy option to expected help output (3336ee2)
[app] align web server tests with SMS default MFA method (eb69a5a)
[app] cover prometheus metrics exporter and endpoint (8805eb2), closes #1008
[app] replace mock-fs with a real file system based helper (3cc834b)
[docker] await help output assertion & update expected text (4f0f9ba)

[docker] drop Docker Scout recommendations (da1dce2)
Add timeout and manual trigger to API monitor workflow (9bfa087)
Fix workflow_dispatch condition for API monitor (808ca81)
move semantic-release dependencies back into prepare-semantic-release (baafda7), closes #1045 #1052
open a pr to merge main into dev after production release (9bfd688), closes #1122
re-enable scheduled API monitor (3a96f3f)
refresh GitHub Actions, relocate release dependencies & rework Dependabot (7c91666)
remove unsupported semver cooldown from github-actions dependabot config (d2d20eb)
Removed caching from docker release action (48509aa)
run trust token container as the invoking user (e602aff)
run unit tests before releasing from push and pause API monitor schedule (79ad2d6)

[app] bump jsonc from 2.0.0 to 3.0.0 (546abf9), closes #1114
[app] security & drop-in dependency upgrades (167e009)
[app] TypeScript 6 in strict mode, commander 15, inquirer 8 (b3ef080)
[docs] bump mkdocs dependencies and Python to 3.13 (4c753fe)
[docs] freeze docs toolchain instead of migrating off material (48b57c3), closes #1118
bulk upgrade all dependencies (a570716)
upgrade runtime to Node 26 (33d7e72)

add CLAUDE.md with build, test and architecture guidance (116372d)
add issue class/status label rules to CLAUDE.md (9789b7d)
add rule to remove worktrees after their PR is merged (1df0b49)
also delete the remote branch after a PR is merged (cd30c8d)
define status label meanings in CLAUDE.md (c509684)
document backtrace error report api in CLAUDE.md (ea4b21e)
document IP-bound, co-existing trust tokens and why CI needs a residential runner (3b181fd)
document prometheus metrics endpoint (8172efa), closes #1008
document runtime hardening & building the Docker image (de58a58), closes #1116
expand CLAUDE.md with iCloud API surface, CI map, coding style and secrets handling (2dc3f49)
note dev as worktree base branch in CLAUDE.md (7ac948f)
note roughly 30 day trust token lifetime (0f589f3)
note that the prod account receives MFA via trusted device push (47bda51)
run API and full Docker tests with the stored test account credentials (e8c38e5)