add env to docs

* fix: set persist-credentials explicitly for checkout

https://woodruffw.github.io/zizmor/audits/#artipacked

* fix: minimize permissions scope for workflows

https://woodruffw.github.io/zizmor/audits/#excessive-permissions

* fix: remove potential template injections

https://woodruffw.github.io/zizmor/audits/#template-injection

* fix: only pass needed secrets in workflow_call

https://woodruffw.github.io/zizmor/audits/#secrets-inherit

* fix: push perm for single-arch build jobs

I hadn't realised these push to the registry too :x

* chore: fix formatting

* fix: $

* fix: retag job quoting

---------

Co-authored-by: github-actions <41898282+github-actions[bot]@users.noreply.github.com>

.devcontainer/Dockerfile

@@ -1,10 +1,10 @@
-ARG BASEIMAGE=mcr.microsoft.com/devcontainers/typescript-node:22@sha256:9791f4aa527774bc370c6bd2f6705ce5a686f1e6f204badd8dfaacce28c631ae
+ARG BASEIMAGE=mcr.microsoft.com/devcontainers/typescript-node:22@sha256:a20b8a3538313487ac9266875bbf733e544c1aa2091df2bb99ab592a6d4f7399
 FROM ${BASEIMAGE}
 
 # Flutter SDK
 # https://flutter.dev/docs/development/tools/sdk/releases?tab=linux
 ENV FLUTTER_CHANNEL="stable"
-ENV FLUTTER_VERSION="3.24.5"
+ENV FLUTTER_VERSION="3.29.1"
 ENV FLUTTER_HOME=/flutter
 ENV PATH=${PATH}:${FLUTTER_HOME}/bin
 

.gitattributes

@@ -6,6 +6,9 @@ mobile/openapi/**/*.dart linguist-generated=true
 mobile/lib/**/*.g.dart -diff -merge
 mobile/lib/**/*.g.dart linguist-generated=true
 
+mobile/lib/**/*.drift.dart -diff -merge
+mobile/lib/**/*.drift.dart linguist-generated=true
+
 open-api/typescript-sdk/fetch-client.ts -diff -merge
 open-api/typescript-sdk/fetch-client.ts linguist-generated=true
 

.github/.nvmrc

@@ -0,0 +1 @@
+22.14.0

.github/DISCUSSION_TEMPLATE/feature-request.yaml

@@ -1,5 +1,5 @@
-title: "[Feature] feature-name-goes-here"
+title: '[Feature] feature-name-goes-here'
-labels: ["feature"]
+labels: ['feature']
 
 body:
   - type: markdown
@@ -13,7 +13,7 @@ body:
     attributes:
       label: I have searched the existing feature requests, both open and closed, to make sure this is not a duplicate request.
       options:
-        - label: "Yes"
+        - label: 'Yes'
           required: true
 
   - type: textarea

.github/ISSUE_TEMPLATE/bug_report.yaml

@@ -5,7 +5,7 @@ body:
     attributes:
       label: I have searched the existing issues, both open and closed, to make sure this is not a duplicate report.
       options:
-        - label: "Yes"
+        - label: 'Yes'
           required: true
 
   - type: markdown
@@ -84,7 +84,7 @@ body:
     id: repro
     attributes:
       label: Reproduction steps
-      description: "How do you trigger this bug? Please walk us through it step by step."
+      description: 'How do you trigger this bug? Please walk us through it step by step.'
       value: |
         1.
         2.
@@ -97,12 +97,13 @@ body:
     id: logs
     attributes:
       label: Relevant log output
-      description: Please copy and paste any relevant logs below. (code formatting is
+      description:
+        Please copy and paste any relevant logs below. (code formatting is
         enabled, no need for backticks)
       render: shell
     validations:
       required: false
-      
+
   - type: textarea
     attributes:
       label: Additional information

.github/package-lock.json

@@ -0,0 +1,28 @@
+{
+  "name": ".github",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "devDependencies": {
+        "prettier": "^3.5.3"
+      }
+    },
+    "node_modules/prettier": {
+      "version": "3.5.3",
+      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.5.3.tgz",
+      "integrity": "sha512-QQtaxnoDJeAkDvDKWCLiwIXkTgRhwYDEQCghU9Z6q03iyek/rxRh/2lC3HB7P8sWT2xC/y5JDctPLBIGzHKbhw==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "prettier": "bin/prettier.cjs"
+      },
+      "engines": {
+        "node": ">=14"
+      },
+      "funding": {
+        "url": "https://github.com/prettier/prettier?sponsor=1"
+      }
+    }
+  }
+}

.github/package.json

@@ -0,0 +1,9 @@
+{
+  "scripts": {
+    "format": "prettier --check .",
+    "format:fix": "prettier --write ."
+  },
+  "devDependencies": {
+    "prettier": "^3.5.3"
+  }
+}

.github/pull_request_template.md

@@ -32,5 +32,5 @@ The `/api/something` endpoint is now `/api/something-else`
 - [ ] I have confirmed that any new dependencies are strictly necessary.
 - [ ] I have written tests for new code (if applicable)
 - [ ] I have followed naming conventions/patterns in the surrounding code
-- [ ] All code in `src/services` uses repositories implementations for database calls, filesystem operations, etc.
+- [ ] All code in `src/services/` uses repositories implementations for database calls, filesystem operations, etc.
-- [ ] All code in `src/repositories/` is pretty basic/simple and does not have any immich specific logic (that belongs in `src/services`)
+- [ ] All code in `src/repositories/` is pretty basic/simple and does not have any immich specific logic (that belongs in `src/services/`)

.github/release.yml

@@ -1,33 +1,33 @@
-changelog:
+changelog:
-  categories:
+  categories:
-    - title: 🚨 Breaking Changes
+    - title: 🚨 Breaking Changes
-      labels:
+      labels:
-        - changelog:breaking-change
+        - changelog:breaking-change
-
+
-    - title: 🫥 Deprecated Changes
+    - title: 🫥 Deprecated Changes
-      labels:
+      labels:
-        - changelog:deprecated
+        - changelog:deprecated
-
+
-    - title: 🔒 Security
+    - title: 🔒 Security
-      labels:
+      labels:
-        - changelog:security
+        - changelog:security
-
+
-    - title: 🚀 Features
+    - title: 🚀 Features
-      labels:
+      labels:
-        - changelog:feature
+        - changelog:feature
-
+
-    - title: 🌟 Enhancements
+    - title: 🌟 Enhancements
-      labels:
+      labels:
-        - changelog:enhancement
+        - changelog:enhancement
-
+
-    - title: 🐛 Bug fixes
+    - title: 🐛 Bug fixes
-      labels:
+      labels:
-        - changelog:bugfix
+        - changelog:bugfix
-
+
-    - title: 📚 Documentation
+    - title: 📚 Documentation
-      labels:
+      labels:
-        - changelog:documentation
+        - changelog:documentation
-
+
-    - title: 🌐 Translations
+    - title: 🌐 Translations
-      labels:
+      labels:
-        - changelog:translation
+        - changelog:translation

.github/workflows/build-mobile.yml

@@ -7,6 +7,15 @@ on:
       ref:
         required: false
         type: string
+    secrets:
+      KEY_JKS:
+        required: true
+      ALIAS:
+        required: true
+      ANDROID_KEY_PASSWORD:
+        required: true
+      ANDROID_STORE_PASSWORD:
+        required: true
   pull_request:
   push:
     branches: [main]
@@ -15,16 +24,23 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   pre-job:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
       should_run: ${{ steps.found_paths.outputs.mobile == 'true' || steps.should_force.outputs.should_force == 'true' }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
+
       - id: found_paths
-        uses: dorny/paths-filter@v3
+        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
         with:
           filters: |
             mobile:
@@ -38,31 +54,26 @@ jobs:
   build-sign-android:
     name: Build and sign Android
     needs: pre-job
+    permissions:
+      contents: read
     # Skip when PR from a fork
     if: ${{ !github.event.pull_request.head.repo.fork && github.actor != 'dependabot[bot]' && needs.pre-job.outputs.should_run == 'true' }}
     runs-on: macos-14
 
     steps:
-      - name: Determine ref
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        id: get-ref
-        run: |
-          input_ref="${{ inputs.ref }}"
-          github_ref="${{ github.sha }}"
-          ref="${input_ref:-$github_ref}"
-          echo "ref=$ref" >> $GITHUB_OUTPUT
-
-      - uses: actions/checkout@v4
         with:
-          ref: ${{ steps.get-ref.outputs.ref }}
+          ref: ${{ inputs.ref || github.sha }}
+          persist-credentials: false
 
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4
         with:
           distribution: 'zulu'
           java-version: '17'
           cache: 'gradle'
 
       - name: Setup Flutter SDK
-        uses: subosito/flutter-action@v2
+        uses: subosito/flutter-action@e938fdf56512cc96ef2f93601a5a40bde3801046 # v2
         with:
           channel: 'stable'
           flutter-version-file: ./mobile/pubspec.yaml
@@ -78,6 +89,10 @@ jobs:
         working-directory: ./mobile
         run: flutter pub get
 
+      - name: Generate translation file
+        run: make translation
+        working-directory: ./mobile
+
       - name: Build Android App Bundle
         working-directory: ./mobile
         env:
@@ -89,7 +104,7 @@ jobs:
           flutter build apk --release --split-per-abi --target-platform android-arm,android-arm64,android-x64
 
       - name: Publish Android Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: release-apk-signed
           path: mobile/build/app/outputs/flutter-apk/*.apk

.github/workflows/cache-cleanup.yml

@@ -8,31 +8,38 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   cleanup:
     name: Cleanup
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: write
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
 
       - name: Cleanup
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REF: ${{ github.ref }}
         run: |
           gh extension install actions/gh-actions-cache
 
           REPO=${{ github.repository }}
-          BRANCH=${{ github.ref }}
 
           echo "Fetching list of cache keys"
-          cacheKeysForPR=$(gh actions-cache list -R $REPO -B $BRANCH -L 100 | cut -f 1 )
+          cacheKeysForPR=$(gh actions-cache list -R $REPO -B ${REF} -L 100 | cut -f 1 )
 
           ## Setting this to not fail the workflow while deleting cache keys.
           set +e
           echo "Deleting caches..."
           for cacheKey in $cacheKeysForPR
           do
-              gh actions-cache delete $cacheKey -R $REPO -B $BRANCH --confirm
+              gh actions-cache delete $cacheKey -R "$REPO" -B "${REF}" --confirm
           done
           echo "Done"
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/cli.yml

@@ -6,7 +6,6 @@ on:
       - 'cli/**'
       - '.github/workflows/cli.yml'
   pull_request:
-    branches: [main]
     paths:
       - 'cli/**'
       - '.github/workflows/cli.yml'
@@ -17,21 +16,25 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions:
+permissions: {}
-  packages: write
 
 jobs:
   publish:
     name: CLI Publish
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     defaults:
       run:
         working-directory: ./cli
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
+
       # Setup .npmrc file to publish to npm
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version-file: './cli/.nvmrc'
           registry-url: 'https://registry.npmjs.org'
@@ -49,20 +52,25 @@ jobs:
   docker:
     name: Docker
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
     needs: publish
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3.5.0
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.10.0
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
         if: ${{ !github.event.pull_request.head.repo.fork }}
         with:
           registry: ghcr.io
@@ -77,7 +85,7 @@ jobs:
 
       - name: Generate docker image tags
         id: metadata
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5
         with:
           flavor: |
             latest=false
@@ -88,7 +96,7 @@ jobs:
             type=raw,value=latest,enable=${{ github.event_name == 'release' }}
 
       - name: Build and push image
-        uses: docker/build-push-action@v6.15.0
+        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
         with:
           file: cli/Dockerfile
           platforms: linux/amd64,linux/arm64

.github/workflows/codeql-analysis.yml

@@ -9,14 +9,14 @@
 # the `language` matrix defined below to confirm you have the correct set of
 # supported CodeQL languages.
 #
-name: "CodeQL"
+name: 'CodeQL'
 
 on:
   push:
-    branches: [ "main" ]
+    branches: ['main']
   pull_request:
     # The branches below must be a subset of the branches above
-    branches: [ "main" ]
+    branches: ['main']
   schedule:
     - cron: '20 13 * * 1'
 
@@ -24,6 +24,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   analyze:
     name: Analyze
@@ -36,43 +38,44 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        language: [ 'javascript', 'python' ]
+        language: ['javascript', 'python']
         # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
         # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
 
     steps:
-    - name: Checkout repository
+      - name: Checkout repository
-      uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
 
-    # Initializes the CodeQL tools for scanning.
+      # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
+      - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@45775bd8235c68ba998cffa5171334d58593da47 # v3
-      with:
+        with:
-        languages: ${{ matrix.language }}
+          languages: ${{ matrix.language }}
-        # If you wish to specify custom queries, you can do so here or in a config file.
+          # If you wish to specify custom queries, you can do so here or in a config file.
-        # By default, queries listed here will override any specified in a config file.
+          # By default, queries listed here will override any specified in a config file.
-        # Prefix the list here with "+" to use these queries and those in the config file.
+          # Prefix the list here with "+" to use these queries and those in the config file.
 
-        # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+          # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
-        # queries: security-extended,security-and-quality
+          # queries: security-extended,security-and-quality
 
+      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+      # If this step fails, then you should remove it and run the build manually (see below)
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@45775bd8235c68ba998cffa5171334d58593da47 # v3
 
-    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+      # ℹ️ Command-line programs to run using the OS shell.
-    # If this step fails, then you should remove it and run the build manually (see below)
+      # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@v3
 
-    # ℹ️ Command-line programs to run using the OS shell.
+      #   If the Autobuild fails above, remove it and uncomment the following three lines.
-    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+      #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
 
-    #   If the Autobuild fails above, remove it and uncomment the following three lines.
+      # - run: |
-    #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
+      #   echo "Run, Build Application using script"
+      #   ./location_of_script_within_repo/buildscript.sh
 
-    # - run: |
+      - name: Perform CodeQL Analysis
-    #   echo "Run, Build Application using script"
+        uses: github/codeql-action/analyze@45775bd8235c68ba998cffa5171334d58593da47 # v3
-    #   ./location_of_script_within_repo/buildscript.sh
+        with:
-
+          category: '/language:${{matrix.language}}'
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
-      with:
-        category: "/language:${{matrix.language}}"

.github/workflows/docker.yml

@@ -12,20 +12,23 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions:
+permissions: {}
-  packages: write
 
 jobs:
   pre-job:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
       should_run_server: ${{ steps.found_paths.outputs.server == 'true' || steps.should_force.outputs.should_force == 'true' }}
       should_run_ml: ${{ steps.found_paths.outputs.machine-learning == 'true' || steps.should_force.outputs.should_force == 'true' }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
       - id: found_paths
-        uses: dorny/paths-filter@v3
+        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
         with:
           filters: |
             server:
@@ -45,56 +48,67 @@ jobs:
   retag_ml:
     name: Re-Tag ML
     needs: pre-job
+    permissions:
+      contents: read
+      packages: write
     if: ${{ needs.pre-job.outputs.should_run_ml == 'false' && !github.event.pull_request.head.repo.fork }}
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        suffix: ["", "-cuda", "-openvino", "-armnn"]
+        suffix: ['', '-cuda', '-rocm', '-openvino', '-armnn', '-rknn']
-    steps:
-        - name: Login to GitHub Container Registry
-          uses: docker/login-action@v3
-          with:
-            registry: ghcr.io
-            username: ${{ github.repository_owner }}
-            password: ${{ secrets.GITHUB_TOKEN }}
-        - name: Re-tag image
-          run: |
-              REGISTRY_NAME="ghcr.io"
-              REPOSITORY=${{ github.repository_owner }}/immich-machine-learning
-              TAG_OLD=main${{ matrix.suffix }}
-              TAG_PR=${{ github.event.number == 0 && github.ref_name ||  format('pr-{0}', github.event.number)  }}${{ matrix.suffix }}
-              TAG_COMMIT=commit-${{ github.event_name != 'pull_request' && github.sha || github.event.pull_request.head.sha }}${{ matrix.suffix }}
-              docker buildx imagetools create -t $REGISTRY_NAME/$REPOSITORY:$TAG_PR $REGISTRY_NAME/$REPOSITORY:$TAG_OLD
-              docker buildx imagetools create -t $REGISTRY_NAME/$REPOSITORY:$TAG_COMMIT $REGISTRY_NAME/$REPOSITORY:$TAG_OLD
-
-  retag_server:
-    name: Re-Tag Server
-    needs: pre-job
-    if: ${{ needs.pre-job.outputs.should_run_server == 'false' && !github.event.pull_request.head.repo.fork }}
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        suffix: [""]
     steps:
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Re-tag image
+        env:
+          REGISTRY_NAME: 'ghcr.io'
+          REPOSITORY: ${{ github.repository_owner }}/immich-machine-learning
+          TAG_OLD: main${{ matrix.suffix }}
+          TAG_PR: ${{ github.event.number == 0 && github.ref_name || format('pr-{0}', github.event.number) }}${{ matrix.suffix }}
+          TAG_COMMIT: commit-${{ github.event_name != 'pull_request' && github.sha || github.event.pull_request.head.sha }}${{ matrix.suffix }}
         run: |
-          REGISTRY_NAME="ghcr.io"
+          docker buildx imagetools create -t "${REGISTRY_NAME}/${REPOSITORY}:${TAG_PR}" "${REGISTRY_NAME}/${REPOSITORY}:${TAG_OLD}"
-          REPOSITORY=${{ github.repository_owner }}/immich-server
+          docker buildx imagetools create -t "${REGISTRY_NAME}/${REPOSITORY}:${TAG_COMMIT}" "${REGISTRY_NAME}/${REPOSITORY}:${TAG_OLD}"
-          TAG_OLD=main${{ matrix.suffix }}
+
-          TAG_PR=${{ github.event.number == 0 && github.ref_name ||  format('pr-{0}', github.event.number)  }}${{ matrix.suffix }}
+  retag_server:
-          TAG_COMMIT=commit-${{ github.event_name != 'pull_request' && github.sha || github.event.pull_request.head.sha }}${{ matrix.suffix }}
+    name: Re-Tag Server
-          docker buildx imagetools create -t $REGISTRY_NAME/$REPOSITORY:$TAG_PR $REGISTRY_NAME/$REPOSITORY:$TAG_OLD
+    needs: pre-job
-          docker buildx imagetools create -t $REGISTRY_NAME/$REPOSITORY:$TAG_COMMIT $REGISTRY_NAME/$REPOSITORY:$TAG_OLD
+    permissions:
+      contents: read
+      packages: write
+    if: ${{ needs.pre-job.outputs.should_run_server == 'false' && !github.event.pull_request.head.repo.fork }}
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        suffix: ['']
+    steps:
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Re-tag image
+        env:
+          REGISTRY_NAME: 'ghcr.io'
+          REPOSITORY: ${{ github.repository_owner }}/immich-server
+          TAG_OLD: main${{ matrix.suffix }}
+          TAG_PR: ${{ github.event.number == 0 && github.ref_name || format('pr-{0}', github.event.number) }}${{ matrix.suffix }}
+          TAG_COMMIT: commit-${{ github.event_name != 'pull_request' && github.sha || github.event.pull_request.head.sha }}${{ matrix.suffix }}
+        run: |
+          docker buildx imagetools create -t "${REGISTRY_NAME}/${REPOSITORY}:${TAG_PR}" "${REGISTRY_NAME}/${REPOSITORY}:${TAG_OLD}"
+          docker buildx imagetools create -t "${REGISTRY_NAME}/${REPOSITORY}:${TAG_COMMIT}" "${REGISTRY_NAME}/${REPOSITORY}:${TAG_OLD}"
 
   build_and_push_ml:
     name: Build and Push ML
     needs: pre-job
+    permissions:
+      contents: read
+      packages: write
     if: ${{ needs.pre-job.outputs.should_run_ml == 'true' }}
     runs-on: ${{ matrix.runner }}
     env:
@@ -120,6 +134,11 @@ jobs:
             device: cuda
             suffix: -cuda
 
+          - platform: linux/amd64
+            runner: mich
+            device: rocm
+            suffix: -rocm
+
           - platform: linux/amd64
             runner: ubuntu-latest
             device: openvino
@@ -130,6 +149,11 @@ jobs:
             device: armnn
             suffix: -armnn
 
+          - platform: linux/arm64
+            runner: ubuntu-24.04-arm
+            device: rknn
+            suffix: -rknn
+
     steps:
       - name: Prepare
         run: |
@@ -137,13 +161,15 @@ jobs:
           echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.10.0
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
         if: ${{ !github.event.pull_request.head.repo.fork }}
         with:
           registry: ghcr.io
@@ -151,11 +177,14 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Generate cache key suffix
+        env:
+          REF: ${{ github.ref_name }}
         run: |
           if [[ "${{ github.event_name }}" == "pull_request" ]]; then
             echo "CACHE_KEY_SUFFIX=pr-${{ github.event.number }}" >> $GITHUB_ENV
           else
-            echo "CACHE_KEY_SUFFIX=$(echo ${{ github.ref_name }} | sed 's/[^a-zA-Z0-9]/-/g')" >> $GITHUB_ENV
+            SUFFIX=$(echo "${REF}" | sed 's/[^a-zA-Z0-9]/-/g')
+            echo "CACHE_KEY_SUFFIX=${SUFFIX}" >> $GITHUB_ENV
           fi
 
       - name: Generate cache target
@@ -165,17 +194,23 @@ jobs:
             # Essentially just ignore the cache output (forks can't write to registry cache)
             echo "cache-to=type=local,dest=/tmp/discard,ignore-error=true" >> $GITHUB_OUTPUT
           else
-            echo "cache-to=type=registry,ref=${{ env.GHCR_REPO }}-build-cache:${{ env.PLATFORM_PAIR }}-${{ matrix.device }}-${{ env.CACHE_KEY_SUFFIX }},mode=max,compression=zstd" >> $GITHUB_OUTPUT
+            echo "cache-to=type=registry,ref=${GHCR_REPO}-build-cache:${PLATFORM_PAIR}-${{ matrix.device }}-${CACHE_KEY_SUFFIX},mode=max,compression=zstd" >> $GITHUB_OUTPUT
           fi
 
+      - name: Generate docker image tags
+        id: meta
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5
+        env:
+          DOCKER_METADATA_PR_HEAD_SHA: 'true'
+
       - name: Build and push image
         id: build
-        uses: docker/build-push-action@v6.15.0
+        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
         with:
           context: ${{ env.context }}
           file: ${{ env.file }}
           platforms: ${{ matrix.platforms }}
-          labels: ${{ steps.metadata.outputs.labels }}
+          labels: ${{ steps.meta.outputs.labels }}
           cache-to: ${{ steps.cache-target.outputs.cache-to }}
           cache-from: |
             type=registry,ref=${{ env.GHCR_REPO }}-build-cache:${{ env.PLATFORM_PAIR }}-${{ matrix.device }}-${{ env.CACHE_KEY_SUFFIX }}
@@ -195,7 +230,7 @@ jobs:
           touch "${{ runner.temp }}/digests/${digest#sha256:}"
 
       - name: Upload digest
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: ml-digests-${{ matrix.device }}-${{ env.PLATFORM_PAIR }}
           path: ${{ runner.temp }}/digests/*
@@ -205,6 +240,10 @@ jobs:
   merge_ml:
     name: Merge & Push ML
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: read
+      packages: write
     if: ${{ needs.pre-job.outputs.should_run_ml == 'true' && !github.event.pull_request.head.repo.fork }}
     env:
       GHCR_REPO: ghcr.io/${{ github.repository_owner }}/immich-machine-learning
@@ -215,15 +254,19 @@ jobs:
           - device: cpu
           - device: cuda
             suffix: -cuda
+          - device: rocm
+            suffix: -rocm
           - device: openvino
             suffix: -openvino
           - device: armnn
             suffix: -armnn
+          - device: rknn
+            suffix: -rknn
     needs:
       - build_and_push_ml
     steps:
       - name: Download digests
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4
         with:
           path: ${{ runner.temp }}/digests
           pattern: ml-digests-${{ matrix.device }}-*
@@ -231,53 +274,73 @@ jobs:
 
       - name: Login to Docker Hub
         if: ${{ github.event_name == 'release' }}
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Login to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3
 
       - name: Generate docker image tags
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5
         env:
-          DOCKER_METADATA_PR_HEAD_SHA: "true"
+          DOCKER_METADATA_PR_HEAD_SHA: 'true'
         with:
           flavor: |
             # Disable latest tag
             latest=false
+            suffix=${{ matrix.suffix }}
           images: |
             name=${{ env.GHCR_REPO }}
             name=${{ env.DOCKER_REPO }},enable=${{ github.event_name == 'release' }}
           tags: |
             # Tag with branch name
-            type=ref,event=branch,suffix=${{ matrix.suffix }}
+            type=ref,event=branch
             # Tag with pr-number
-            type=ref,event=pr,suffix=${{ matrix.suffix }}
+            type=ref,event=pr
             # Tag with long commit sha hash
-            type=sha,format=long,prefix=commit-,suffix=${{ matrix.suffix }}
+            type=sha,format=long,prefix=commit-
             # Tag with git tag on release
-            type=ref,event=tag,suffix=${{ matrix.suffix }}
+            type=ref,event=tag
-            type=raw,value=release,enable=${{ github.event_name == 'release' }},suffix=${{ matrix.suffix }}
+            type=raw,value=release,enable=${{ github.event_name == 'release' }}
 
       - name: Create manifest list and push
         working-directory: ${{ runner.temp }}/digests
         run: |
-          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+          # Process annotations
-            $(printf '${{ env.GHCR_REPO }}@sha256:%s ' *)
+          declare -a ANNOTATIONS=()
+          if [[ -n "$DOCKER_METADATA_OUTPUT_JSON" ]]; then
+            while IFS= read -r annotation; do
+              # Extract key and value by removing the manifest: prefix
+              if [[ "$annotation" =~ ^manifest:(.+)=(.+)$ ]]; then
+                key="${BASH_REMATCH[1]}"
+                value="${BASH_REMATCH[2]}"
+                # Use array to properly handle arguments with spaces
+                ANNOTATIONS+=(--annotation "index:$key=$value")
+              fi
+            done < <(jq -r '.annotations[]' <<< "$DOCKER_METADATA_OUTPUT_JSON")
+          fi
+
+          TAGS=$(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+          SOURCE_ARGS=$(printf "${GHCR_REPO}@sha256:%s " *)
+
+          docker buildx imagetools create $TAGS "${ANNOTATIONS[@]}" $SOURCE_ARGS
 
   build_and_push_server:
     name: Build and Push Server
     runs-on: ${{ matrix.runner }}
+    permissions:
+      contents: read
+      packages: write
     needs: pre-job
     if: ${{ needs.pre-job.outputs.should_run_server == 'true' }}
     env:
@@ -300,13 +363,15 @@ jobs:
           echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
         if: ${{ !github.event.pull_request.head.repo.fork }}
         with:
           registry: ghcr.io
@@ -314,11 +379,14 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Generate cache key suffix
+        env:
+          REF: ${{ github.ref_name }}
         run: |
           if [[ "${{ github.event_name }}" == "pull_request" ]]; then
             echo "CACHE_KEY_SUFFIX=pr-${{ github.event.number }}" >> $GITHUB_ENV
           else
-            echo "CACHE_KEY_SUFFIX=$(echo ${{ github.ref_name }} | sed 's/[^a-zA-Z0-9]/-/g')" >> $GITHUB_ENV
+            SUFFIX=$(echo "${REF}" | sed 's/[^a-zA-Z0-9]/-/g')
+            echo "CACHE_KEY_SUFFIX=${SUFFIX}" >> $GITHUB_ENV
           fi
 
       - name: Generate cache target
@@ -328,17 +396,23 @@ jobs:
             # Essentially just ignore the cache output (forks can't write to registry cache)
             echo "cache-to=type=local,dest=/tmp/discard,ignore-error=true" >> $GITHUB_OUTPUT
           else
-            echo "cache-to=type=registry,ref=${{ env.GHCR_REPO }}-build-cache:${{ env.PLATFORM_PAIR }}-${{ matrix.device }}-${{ env.CACHE_KEY_SUFFIX }},mode=max,compression=zstd" >> $GITHUB_OUTPUT
+            echo "cache-to=type=registry,ref=${GHCR_REPO}-build-cache:${PLATFORM_PAIR}-${CACHE_KEY_SUFFIX},mode=max,compression=zstd" >> $GITHUB_OUTPUT
           fi
 
+      - name: Generate docker image tags
+        id: meta
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5
+        env:
+          DOCKER_METADATA_PR_HEAD_SHA: 'true'
+
       - name: Build and push image
         id: build
-        uses: docker/build-push-action@v6.15.0
+        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
         with:
           context: ${{ env.context }}
           file: ${{ env.file }}
           platforms: ${{ matrix.platform }}
-          labels: ${{ steps.metadata.outputs.labels }}
+          labels: ${{ steps.meta.outputs.labels }}
           cache-to: ${{ steps.cache-target.outputs.cache-to }}
           cache-from: |
             type=registry,ref=${{ env.GHCR_REPO }}-build-cache:${{ env.PLATFORM_PAIR }}-${{ env.CACHE_KEY_SUFFIX }}
@@ -358,7 +432,7 @@ jobs:
           touch "${{ runner.temp }}/digests/${digest#sha256:}"
 
       - name: Upload digest
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: server-digests-${{ env.PLATFORM_PAIR }}
           path: ${{ runner.temp }}/digests/*
@@ -368,6 +442,10 @@ jobs:
   merge_server:
     name: Merge & Push Server
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: read
+      packages: write
     if: ${{ needs.pre-job.outputs.should_run_server == 'true' && !github.event.pull_request.head.repo.fork }}
     env:
       GHCR_REPO: ghcr.io/${{ github.repository_owner }}/immich-server
@@ -376,7 +454,7 @@ jobs:
       - build_and_push_server
     steps:
       - name: Download digests
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4
         with:
           path: ${{ runner.temp }}/digests
           pattern: server-digests-*
@@ -384,53 +462,71 @@ jobs:
 
       - name: Login to Docker Hub
         if: ${{ github.event_name == 'release' }}
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Login to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3
 
       - name: Generate docker image tags
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5
         env:
-          DOCKER_METADATA_PR_HEAD_SHA: "true"
+          DOCKER_METADATA_PR_HEAD_SHA: 'true'
         with:
           flavor: |
             # Disable latest tag
             latest=false
+            suffix=${{ matrix.suffix }}
           images: |
             name=${{ env.GHCR_REPO }}
             name=${{ env.DOCKER_REPO }},enable=${{ github.event_name == 'release' }}
           tags: |
             # Tag with branch name
-            type=ref,event=branch,suffix=${{ matrix.suffix }}
+            type=ref,event=branch
             # Tag with pr-number
-            type=ref,event=pr,suffix=${{ matrix.suffix }}
+            type=ref,event=pr
             # Tag with long commit sha hash
-            type=sha,format=long,prefix=commit-,suffix=${{ matrix.suffix }}
+            type=sha,format=long,prefix=commit-
             # Tag with git tag on release
-            type=ref,event=tag,suffix=${{ matrix.suffix }}
+            type=ref,event=tag
-            type=raw,value=release,enable=${{ github.event_name == 'release' }},suffix=${{ matrix.suffix }}
+            type=raw,value=release,enable=${{ github.event_name == 'release' }}
 
       - name: Create manifest list and push
         working-directory: ${{ runner.temp }}/digests
         run: |
-          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+          # Process annotations
-            $(printf '${{ env.GHCR_REPO }}@sha256:%s ' *)
+          declare -a ANNOTATIONS=()
+          if [[ -n "$DOCKER_METADATA_OUTPUT_JSON" ]]; then
+            while IFS= read -r annotation; do
+              # Extract key and value by removing the manifest: prefix
+              if [[ "$annotation" =~ ^manifest:(.+)=(.+)$ ]]; then
+                key="${BASH_REMATCH[1]}"
+                value="${BASH_REMATCH[2]}"
+                # Use array to properly handle arguments with spaces
+                ANNOTATIONS+=(--annotation "index:$key=$value")
+              fi
+            done < <(jq -r '.annotations[]' <<< "$DOCKER_METADATA_OUTPUT_JSON")
+          fi
+
+          TAGS=$(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+          SOURCE_ARGS=$(printf "${GHCR_REPO}@sha256:%s " *)
+
+          docker buildx imagetools create $TAGS "${ANNOTATIONS[@]}" $SOURCE_ARGS
 
   success-check-server:
     name: Docker Build & Push Server Success
     needs: [merge_server, retag_server]
+    permissions: {}
     runs-on: ubuntu-latest
     if: always()
     steps:
@@ -444,6 +540,7 @@ jobs:
   success-check-ml:
     name: Docker Build & Push ML Success
     needs: [merge_ml, retag_ml]
+    permissions: {}
     runs-on: ubuntu-latest
     if: always()
     steps:

.github/workflows/docs-build.yml

@@ -3,7 +3,6 @@ on:
   push:
     branches: [main]
   pull_request:
-    branches: [main]
   release:
     types: [published]
 
@@ -11,16 +10,22 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   pre-job:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
       should_run: ${{ steps.found_paths.outputs.docs == 'true' ||  steps.should_force.outputs.should_force == 'true' }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
       - id: found_paths
-        uses: dorny/paths-filter@v3
+        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
         with:
           filters: |
             docs:
@@ -34,6 +39,8 @@ jobs:
   build:
     name: Docs Build
     needs: pre-job
+    permissions:
+      contents: read
     if: ${{ needs.pre-job.outputs.should_run == 'true' }}
     runs-on: ubuntu-latest
     defaults:
@@ -42,10 +49,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version-file: './docs/.nvmrc'
 
@@ -59,7 +68,7 @@ jobs:
         run: npm run build
 
       - name: Upload build output
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: docs-build-output
           path: docs/build/

.github/workflows/docs-deploy.yml

@@ -1,7 +1,7 @@
 name: Docs deploy
 on:
   workflow_run:
-    workflows: ["Docs build"]
+    workflows: ['Docs build']
     types:
       - completed
 
@@ -9,6 +9,9 @@ jobs:
   checks:
     name: Docs Deploy Checks
     runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      pull-requests: read
     outputs:
       parameters: ${{ steps.parameters.outputs.result }}
       artifact: ${{ steps.get-artifact.outputs.result }}
@@ -17,7 +20,7 @@ jobs:
         run: echo 'The triggering workflow did not succeed' && exit 1
       - name: Get artifact
         id: get-artifact
-        uses: actions/github-script@v7
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
         with:
           script: |
             let allArtifacts = await github.rest.actions.listWorkflowRunArtifacts({
@@ -35,7 +38,9 @@ jobs:
             return { found: true, id: matchArtifact.id };
       - name: Determine deploy parameters
         id: parameters
-        uses: actions/github-script@v7
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
+        env:
+          HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
         with:
           script: |
             const eventType = context.payload.workflow_run.event;
@@ -57,7 +62,8 @@ jobs:
             } else if (eventType == "pull_request") {
               let pull_number = context.payload.workflow_run.pull_requests[0]?.number;
               if(!pull_number) {
-                const response = await github.rest.search.issuesAndPullRequests({q: 'repo:${{ github.repository }} is:pr sha:${{ github.event.workflow_run.head_sha }}',per_page: 1,})
+                const {HEAD_SHA} = process.env;
+                const response = await github.rest.search.issuesAndPullRequests({q: `repo:${{ github.repository }} is:pr sha:${HEAD_SHA}`,per_page: 1,})
                 const items = response.data.items
                 if (items.length < 1) {
                   throw new Error("No pull request found for the commit")
@@ -95,14 +101,20 @@ jobs:
     name: Docs Deploy
     runs-on: ubuntu-latest
     needs: checks
+    permissions:
+      contents: read
+      actions: read
+      pull-requests: write
     if: ${{ fromJson(needs.checks.outputs.artifact).found && fromJson(needs.checks.outputs.parameters).shouldDeploy }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
 
       - name: Load parameters
         id: parameters
-        uses: actions/github-script@v7
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
         with:
           script: |
             const json = `${{ needs.checks.outputs.parameters }}`;
@@ -115,7 +127,7 @@ jobs:
           echo "Starting docs deployment for ${{ steps.parameters.outputs.event }} ${{ steps.parameters.outputs.name }}"
 
       - name: Download artifact
-        uses: actions/github-script@v7
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
         with:
           script: |
             let artifact = ${{ needs.checks.outputs.artifact }};
@@ -138,12 +150,12 @@ jobs:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
           TF_STATE_POSTGRES_CONN_STR: ${{ secrets.TF_STATE_POSTGRES_CONN_STR }}
-        uses: gruntwork-io/terragrunt-action@v2
+        uses: gruntwork-io/terragrunt-action@9559e51d05873b0ea467c42bbabcb5c067642ccc # v2
         with:
-          tg_version: "0.58.12"
+          tg_version: '0.58.12'
-          tofu_version: "1.7.1"
+          tofu_version: '1.7.1'
-          tg_dir: "deployment/modules/cloudflare/docs"
+          tg_dir: 'deployment/modules/cloudflare/docs'
-          tg_command: "apply"
+          tg_command: 'apply'
 
       - name: Deploy Docs Subdomain Output
         id: docs-output
@@ -153,27 +165,29 @@ jobs:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
           TF_STATE_POSTGRES_CONN_STR: ${{ secrets.TF_STATE_POSTGRES_CONN_STR }}
-        uses: gruntwork-io/terragrunt-action@v2
+        uses: gruntwork-io/terragrunt-action@9559e51d05873b0ea467c42bbabcb5c067642ccc # v2
         with:
-          tg_version: "0.58.12"
+          tg_version: '0.58.12'
-          tofu_version: "1.7.1"
+          tofu_version: '1.7.1'
-          tg_dir: "deployment/modules/cloudflare/docs"
+          tg_dir: 'deployment/modules/cloudflare/docs'
-          tg_command: "output -json"
+          tg_command: 'output -json'
 
       - name: Output Cleaning
         id: clean
+        env:
+          TG_OUTPUT: ${{ steps.docs-output.outputs.tg_action_output }}
         run: |
-          TG_OUT=$(echo '${{ steps.docs-output.outputs.tg_action_output }}' | sed 's|%0A|\n|g ; s|%3C|<|g' | jq -c .)
+          CLEANED=$(echo "$TG_OUTPUT" | sed 's|%0A|\n|g ; s|%3C|<|g' | jq -c .)
-          echo "output=$TG_OUT" >> $GITHUB_OUTPUT
+          echo "output=$CLEANED" >> $GITHUB_OUTPUT
 
       - name: Publish to Cloudflare Pages
-        uses: cloudflare/pages-action@v1
+        uses: cloudflare/pages-action@f0a1cd58cd66095dee69bfa18fa5efd1dde93bca # v1
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN_PAGES_UPLOAD }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
           projectName: ${{ fromJson(steps.clean.outputs.output).pages_project_name.value }}
-          workingDirectory: "docs"
+          workingDirectory: 'docs'
-          directory: "build"
+          directory: 'build'
           branch: ${{ steps.parameters.outputs.name }}
           wranglerVersion: '3'
 
@@ -184,7 +198,7 @@ jobs:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
           TF_STATE_POSTGRES_CONN_STR: ${{ secrets.TF_STATE_POSTGRES_CONN_STR }}
-        uses: gruntwork-io/terragrunt-action@v2
+        uses: gruntwork-io/terragrunt-action@9559e51d05873b0ea467c42bbabcb5c067642ccc # v2
         with:
           tg_version: '0.58.12'
           tofu_version: '1.7.1'
@@ -192,7 +206,7 @@ jobs:
           tg_command: 'apply'
 
       - name: Comment
-        uses: actions-cool/maintain-one-comment@v3
+        uses: actions-cool/maintain-one-comment@4b2dbf086015f892dcb5e8c1106f5fccd6c1476b # v3
         if: ${{ steps.parameters.outputs.event == 'pr' }}
         with:
           number: ${{ fromJson(needs.checks.outputs.parameters).pr_number }}

.github/workflows/docs-destroy.yml

@@ -3,30 +3,37 @@ on:
   pull_request_target:
     types: [closed]
 
+permissions: {}
+
 jobs:
   deploy:
     name: Docs Destroy
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
 
       - name: Destroy Docs Subdomain
         env:
-          TF_VAR_prefix_name: "pr-${{ github.event.number }}"
+          TF_VAR_prefix_name: 'pr-${{ github.event.number }}'
-          TF_VAR_prefix_event_type: "pr"
+          TF_VAR_prefix_event_type: 'pr'
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
           TF_STATE_POSTGRES_CONN_STR: ${{ secrets.TF_STATE_POSTGRES_CONN_STR }}
-        uses: gruntwork-io/terragrunt-action@v2
+        uses: gruntwork-io/terragrunt-action@9559e51d05873b0ea467c42bbabcb5c067642ccc # v2
         with:
-          tg_version: "0.58.12"
+          tg_version: '0.58.12'
-          tofu_version: "1.7.1"
+          tofu_version: '1.7.1'
-          tg_dir: "deployment/modules/cloudflare/docs"
+          tg_dir: 'deployment/modules/cloudflare/docs'
-          tg_command: "destroy -refresh=false"
+          tg_command: 'destroy -refresh=false'
 
       - name: Comment
-        uses: actions-cool/maintain-one-comment@v3
+        uses: actions-cool/maintain-one-comment@4b2dbf086015f892dcb5e8c1106f5fccd6c1476b # v3
         with:
           number: ${{ github.event.number }}
           delete: true

.github/workflows/fix-format.yml

@@ -4,28 +4,32 @@ on:
   pull_request:
     types: [labeled]
 
+permissions: {}
+
 jobs:
   fix-formatting:
     runs-on: ubuntu-latest
     if: ${{ github.event.label.name == 'fix:formatting' }}
     permissions:
+      contents: write
       pull-requests: write
     steps:
       - name: Generate a token
         id: generate-token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5 # v2
         with:
           app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
 
       - name: 'Checkout'
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           ref: ${{ github.event.pull_request.head.ref }}
           token: ${{ steps.generate-token.outputs.token }}
+          persist-credentials: true
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version-file: './server/.nvmrc'
 
@@ -33,13 +37,13 @@ jobs:
         run: make install-all && make format-all
 
       - name: Commit and push
-        uses: EndBug/add-and-commit@v9
+        uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9
         with:
           default_author: github_actions
           message: 'chore: fix formatting'
 
       - name: Remove label
-        uses: actions/github-script@v7
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
         if: always()
         with:
           script: |
@@ -49,4 +53,3 @@ jobs:
               repo: context.repo.repo,
               name: 'fix:formatting'
             })
-

.github/workflows/pr-label-validation.yml

@@ -4,6 +4,8 @@ on:
   pull_request_target:
     types: [opened, labeled, unlabeled, synchronize]
 
+permissions: {}
+
 jobs:
   validate-release-label:
     runs-on: ubuntu-latest
@@ -12,11 +14,11 @@ jobs:
       pull-requests: write
     steps:
       - name: Require PR to have a changelog label
-        uses: mheap/github-action-required-labels@v5
+        uses: mheap/github-action-required-labels@388fd6af37b34cdfe5a23b37060e763217e58b03 # v5
         with:
           mode: exactly
           count: 1
           use_regex: true
-          labels: "changelog:.*"
+          labels: 'changelog:.*'
           add_comment: true
-          message: "Label error. Requires {{errorString}} {{count}} of: {{ provided }}. Found: {{ applied }}. A maintainer will add the required label."
+          message: 'Label error. Requires {{errorString}} {{count}} of: {{ provided }}. Found: {{ applied }}. A maintainer will add the required label.'

.github/workflows/pr-labeler.yml

@@ -1,6 +1,8 @@
-name: "Pull Request Labeler"
+name: 'Pull Request Labeler'
 on:
-- pull_request_target
+  - pull_request_target
+
+permissions: {}
 
 jobs:
   labeler:
@@ -9,4 +11,4 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/labeler@v5
+      - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5

.github/workflows/pr-require-conventional-commit.yml

@@ -4,12 +4,16 @@ on:
   pull_request:
     types: [opened, synchronize, reopened, edited]
 
+permissions: {}
+
 jobs:
   validate-pr-title:
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
     steps:
       - name: PR Conventional Commit Validation
-        uses:  ytanikin/PRConventionalCommits@1.3.0
+        uses: ytanikin/PRConventionalCommits@b628c5a234cc32513014b7bfdd1e47b532124d98 # 1.3.0
         with:
           task_types: '["feat","fix","docs","test","ci","refactor","perf","chore","revert"]'
           add_label: 'false'

.github/workflows/prepare-release.yml

@@ -21,35 +21,37 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}-root
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   bump_version:
     runs-on: ubuntu-latest
-
     outputs:
       ref: ${{ steps.push-tag.outputs.commit_long_sha }}
-
+    permissions: {} # No job-level permissions are needed because it uses the app-token
     steps:
       - name: Generate a token
         id: generate-token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5 # v2
         with:
           app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           token: ${{ steps.generate-token.outputs.token }}
+          persist-credentials: true
 
-      - name: Install Poetry
+      - name: Install uv
-        run: pipx install poetry
+        uses: astral-sh/setup-uv@0c5e2b8115b80b4c7c5ddf6ffdd634974642d182 # v5
 
       - name: Bump version
         run: misc/release/pump-version.sh -s "${{ inputs.serverBump }}" -m "${{ inputs.mobileBump }}"
 
       - name: Commit and tag
         id: push-tag
-        uses: EndBug/add-and-commit@v9
+        uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9
         with:
           default_author: github_actions
           message: 'chore: version ${{ env.IMMICH_VERSION }}'
@@ -59,37 +61,45 @@ jobs:
   build_mobile:
     uses: ./.github/workflows/build-mobile.yml
     needs: bump_version
-    secrets: inherit
+    secrets:
+      KEY_JKS: ${{ secrets.KEY_JKS }}
+      ALIAS: ${{ secrets.ALIAS }}
+      ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
+      ANDROID_STORE_PASSWORD: ${{ secrets.ANDROID_STORE_PASSWORD }}
     with:
       ref: ${{ needs.bump_version.outputs.ref }}
 
   prepare_release:
     runs-on: ubuntu-latest
     needs: build_mobile
-
+    permissions:
+      actions: read # To download the app artifact
+      # No content permissions are needed because it uses the app-token
     steps:
       - name: Generate a token
         id: generate-token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5 # v2
         with:
           app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-      
+
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           token: ${{ steps.generate-token.outputs.token }}
+          persist-credentials: false
 
       - name: Download APK
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4
         with:
           name: release-apk-signed
 
       - name: Create draft release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda # v2
         with:
           draft: true
           tag_name: ${{ env.IMMICH_VERSION }}
+          token: ${{ steps.generate-token.outputs.token }}
           generate_release_notes: true
           body_path: misc/release/notes.tmpl
           files: |

.github/workflows/preview-label.yaml

@@ -2,7 +2,9 @@ name: Preview label
 
 on:
   pull_request:
-    types: [labeled]
+    types: [labeled, closed]
+
+permissions: {}
 
 jobs:
   comment-status:
@@ -11,10 +13,10 @@ jobs:
     permissions:
       pull-requests: write
     steps:
-      - uses: mshick/add-pr-comment@v2
+      - uses: mshick/add-pr-comment@b8f338c590a895d50bcbfa6c5859251edc8952fc # v2
         with:
-          message-id: "preview-status"
+          message-id: 'preview-status'
-          message: "Deploying preview environment to https://pr-${{ github.event.pull_request.number }}.preview.internal.immich.cloud/"
+          message: 'Deploying preview environment to https://pr-${{ github.event.pull_request.number }}.preview.internal.immich.cloud/'
 
   remove-label:
     runs-on: ubuntu-latest
@@ -22,7 +24,7 @@ jobs:
     permissions:
       pull-requests: write
     steps:
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
         with:
           script: |
             github.rest.issues.removeLabel({

.github/workflows/sdk.yml

@@ -4,20 +4,24 @@ on:
   release:
     types: [published]
 
-permissions:
+permissions: {}
-  packages: write
 
 jobs:
   publish:
     name: Publish `@immich/sdk`
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     defaults:
       run:
         working-directory: ./open-api/typescript-sdk
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
+
       # Setup .npmrc file to publish to npm
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version-file: './open-api/typescript-sdk/.nvmrc'
           registry-url: 'https://registry.npmjs.org'

.github/workflows/static_analysis.yml

@@ -9,16 +9,22 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   pre-job:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
       should_run: ${{ steps.found_paths.outputs.mobile == 'true' || steps.should_force.outputs.should_force == 'true' }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
       - id: found_paths
-        uses: dorny/paths-filter@v3
+        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
         with:
           filters: |
             mobile:
@@ -33,15 +39,17 @@ jobs:
     name: Run Dart Code Analysis
     needs: pre-job
     if: ${{ needs.pre-job.outputs.should_run == 'true' }}
-
     runs-on: ubuntu-latest
-
+    permissions:
+      contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
 
       - name: Setup Flutter SDK
-        uses: subosito/flutter-action@v2
+        uses: subosito/flutter-action@e938fdf56512cc96ef2f93601a5a40bde3801046 # v2
         with:
           channel: 'stable'
           flutter-version-file: ./mobile/pubspec.yaml
@@ -50,6 +58,32 @@ jobs:
         run: dart pub get
         working-directory: ./mobile
 
+      - name: Generate translation file
+        run: make translation; dart format lib/generated/codegen_loader.g.dart
+        working-directory: ./mobile
+
+      - name: Run Build Runner
+        run: make build
+        working-directory: ./mobile
+
+      - name: Find file changes
+        uses: tj-actions/verify-changed-files@a1c6acee9df209257a246f2cc6ae8cb6581c1edf # v20
+        id: verify-changed-files
+        with:
+          files: |
+            mobile/**/*.g.dart
+            mobile/**/*.gr.dart
+            mobile/**/*.drift.dart
+
+      - name: Verify files have not changed
+        if: steps.verify-changed-files.outputs.files_changed == 'true'
+        env:
+          CHANGED_FILES: ${{ steps.verify-changed-files.outputs.changed_files }}
+        run: |
+          echo "ERROR: Generated files not up to date! Run make_build inside the mobile directory"
+          echo "Changed files: ${CHANGED_FILES}"
+          exit 1
+
       - name: Run dart analyze
         run: dart analyze --fatal-infos
         working-directory: ./mobile
@@ -61,8 +95,3 @@ jobs:
       - name: Run dart custom_lint
         run: dart run custom_lint
         working-directory: ./mobile
-
-      # Enable after riverpod generator migration is completed
-      # - name: Run dart custom lint
-      #   run: dart run custom_lint
-      #   working-directory: ./mobile

.github/workflows/test.yml

@@ -9,9 +9,13 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   pre-job:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
       should_run_web: ${{ steps.found_paths.outputs.web == 'true' || steps.should_force.outputs.should_force == 'true' }}
       should_run_server: ${{ steps.found_paths.outputs.server == 'true' || steps.should_force.outputs.should_force == 'true' }}
@@ -21,11 +25,15 @@ jobs:
       should_run_ml: ${{ steps.found_paths.outputs.machine-learning == 'true' || steps.should_force.outputs.should_force == 'true' }}
       should_run_e2e_web: ${{ steps.found_paths.outputs.e2e == 'true' || steps.found_paths.outputs.web == 'true' || steps.should_force.outputs.should_force == 'true' }}
       should_run_e2e_server_cli: ${{ steps.found_paths.outputs.e2e == 'true' || steps.found_paths.outputs.server == 'true' || steps.found_paths.outputs.cli == 'true' || steps.should_force.outputs.should_force == 'true' }}
+      should_run_.github: ${{ steps.found_paths.outputs['.github'] == 'true' || steps.should_force.outputs.should_force == 'true' }} # redundant to have should_force but if someone changes the trigger then this won't have to be changed
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
+
       - id: found_paths
-        uses: dorny/paths-filter@v3
+        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
         with:
           filters: |
             web:
@@ -45,6 +53,8 @@ jobs:
               - 'machine-learning/**'
             workflow:
               - '.github/workflows/test.yml'
+            .github:
+              - '.github/**'
 
       - name: Check if we should force jobs to run
         id: should_force
@@ -55,16 +65,20 @@ jobs:
     needs: pre-job
     if: ${{ needs.pre-job.outputs.should_run_server == 'true' }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     defaults:
       run:
         working-directory: ./server
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version-file: './server/.nvmrc'
 
@@ -92,16 +106,20 @@ jobs:
     needs: pre-job
     if: ${{ needs.pre-job.outputs.should_run_cli == 'true' }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     defaults:
       run:
         working-directory: ./cli
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version-file: './cli/.nvmrc'
 
@@ -133,16 +151,20 @@ jobs:
     needs: pre-job
     if: ${{ needs.pre-job.outputs.should_run_cli == 'true' }}
     runs-on: windows-latest
+    permissions:
+      contents: read
     defaults:
       run:
         working-directory: ./cli
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version-file: './cli/.nvmrc'
 
@@ -167,16 +189,20 @@ jobs:
     needs: pre-job
     if: ${{ needs.pre-job.outputs.should_run_web == 'true' }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     defaults:
       run:
         working-directory: ./web
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version-file: './web/.nvmrc'
 
@@ -212,16 +238,20 @@ jobs:
     needs: pre-job
     if: ${{ needs.pre-job.outputs.should_run_e2e == 'true' }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     defaults:
       run:
         working-directory: ./e2e
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version-file: './e2e/.nvmrc'
 
@@ -251,16 +281,20 @@ jobs:
     needs: pre-job
     if: ${{ needs.pre-job.outputs.should_run_server == 'true' }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     defaults:
       run:
         working-directory: ./server
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version-file: './server/.nvmrc'
 
@@ -276,18 +310,21 @@ jobs:
     needs: pre-job
     if: ${{ needs.pre-job.outputs.should_run_e2e_server_cli == 'true' }}
     runs-on: mich
+    permissions:
+      contents: read
     defaults:
       run:
         working-directory: ./e2e
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
+          persist-credentials: false
           submodules: 'recursive'
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version-file: './e2e/.nvmrc'
 
@@ -318,18 +355,21 @@ jobs:
     needs: pre-job
     if: ${{ needs.pre-job.outputs.should_run_e2e_web == 'true' }}
     runs-on: mich
+    permissions:
+      contents: read
     defaults:
       run:
         working-directory: ./e2e
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
+          persist-credentials: false
           submodules: 'recursive'
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version-file: './e2e/.nvmrc'
 
@@ -359,10 +399,15 @@ jobs:
     needs: pre-job
     if: ${{ needs.pre-job.outputs.should_run_mobile == 'true' }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
+
       - name: Setup Flutter SDK
-        uses: subosito/flutter-action@v2
+        uses: subosito/flutter-action@e938fdf56512cc96ef2f93601a5a40bde3801046 # v2
         with:
           channel: 'stable'
           flutter-version-file: ./mobile/pubspec.yaml
@@ -375,55 +420,99 @@ jobs:
     needs: pre-job
     if: ${{ needs.pre-job.outputs.should_run_ml == 'true' }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     defaults:
       run:
         working-directory: ./machine-learning
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-      - name: Install poetry
-        run: pipx install poetry
-      - uses: actions/setup-python@v5
         with:
-          python-version: 3.11
+          persist-credentials: false
-          cache: 'poetry'
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@0c5e2b8115b80b4c7c5ddf6ffdd634974642d182 # v5
+      - uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5
+        # TODO: add caching when supported (https://github.com/actions/setup-python/pull/818)
+        # with:
+        #   python-version: 3.11
+        #   cache: 'uv'
       - name: Install dependencies
         run: |
-          poetry install --with dev --with cpu
+          uv sync --extra cpu
       - name: Lint with ruff
         run: |
-          poetry run ruff check --output-format=github app export
+          uv run ruff check --output-format=github immich_ml
       - name: Check black formatting
         run: |
-          poetry run black --check app export
+          uv run black --check immich_ml
       - name: Run mypy type checking
         run: |
-          poetry run mypy --install-types --non-interactive --strict app/
+          uv run mypy --strict immich_ml/
       - name: Run tests and coverage
         run: |
-          poetry run pytest app --cov=app --cov-report term-missing
+          uv run pytest --cov=immich_ml --cov-report term-missing
+
+  github-files-formatting:
+    name: .github Files Formatting
+    needs: pre-job
+    if: ${{ needs.pre-job.outputs['should_run_.github'] == 'true' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    defaults:
+      run:
+        working-directory: ./.github
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
+
+      - name: Setup Node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version-file: './.github/.nvmrc'
+
+      - name: Run npm install
+        run: npm ci
+
+      - name: Run formatter
+        run: npm run format
+        if: ${{ !cancelled() }}
 
   shellcheck:
     name: ShellCheck
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
+
       - name: Run ShellCheck
         uses: ludeeus/action-shellcheck@master
         with:
           ignore_paths: >-
             **/open-api/**
-            **/openapi/**
+            **/openapi**
             **/node_modules/**
 
   generated-api-up-to-date:
     name: OpenAPI Clients
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version-file: './server/.nvmrc'
 
@@ -437,7 +526,7 @@ jobs:
         run: make open-api
 
       - name: Find file changes
-        uses: tj-actions/verify-changed-files@v20
+        uses: tj-actions/verify-changed-files@a1c6acee9df209257a246f2cc6ae8cb6581c1edf # v20
         id: verify-changed-files
         with:
           files: |
@@ -447,14 +536,18 @@ jobs:
 
       - name: Verify files have not changed
         if: steps.verify-changed-files.outputs.files_changed == 'true'
+        env:
+          CHANGED_FILES: ${{ steps.verify-changed-files.outputs.changed_files }}
         run: |
           echo "ERROR: Generated files not up to date!"
-          echo "Changed files: ${{ steps.verify-changed-files.outputs.changed_files }}"
+          echo "Changed files: ${CHANGED_FILES}"
           exit 1
 
   generated-typeorm-migrations-up-to-date:
     name: TypeORM Checks
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     services:
       postgres:
         image: tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:739cdd626151ff1f796dc95a6591b55a714f341c737e27f045019ceabf8e8c52
@@ -475,10 +568,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version-file: './server/.nvmrc'
 
@@ -489,27 +584,29 @@ jobs:
         run: npm run build
 
       - name: Run existing migrations
-        run: npm run typeorm:migrations:run
+        run: npm run migrations:run
 
       - name: Test npm run schema:reset command works
-        run: npm run typeorm:schema:reset
+        run: npm run schema:reset
 
       - name: Generate new migrations
         continue-on-error: true
-        run: npm run typeorm:migrations:generate ./src/migrations/TestMigration
+        run: npm run migrations:generate TestMigration
 
       - name: Find file changes
-        uses: tj-actions/verify-changed-files@v20
+        uses: tj-actions/verify-changed-files@a1c6acee9df209257a246f2cc6ae8cb6581c1edf # v20
         id: verify-changed-files
         with:
           files: |
-            server/src/migrations/
+            server/src
       - name: Verify migration files have not changed
         if: steps.verify-changed-files.outputs.files_changed == 'true'
+        env:
+          CHANGED_FILES: ${{ steps.verify-changed-files.outputs.changed_files }}
         run: |
           echo "ERROR: Generated migration files not up to date!"
-          echo "Changed files: ${{ steps.verify-changed-files.outputs.changed_files }}"
+          echo "Changed files: ${CHANGED_FILES}"
-          cat ./src/migrations/*-TestMigration.ts
+          cat ./src/*-TestMigration.ts
           exit 1
 
       - name: Run SQL generation
@@ -518,7 +615,7 @@ jobs:
           DB_URL: postgres://postgres:postgres@localhost:5432/immich
 
       - name: Find file changes
-        uses: tj-actions/verify-changed-files@v20
+        uses: tj-actions/verify-changed-files@a1c6acee9df209257a246f2cc6ae8cb6581c1edf # v20
         id: verify-changed-sql-files
         with:
           files: |
@@ -526,9 +623,11 @@ jobs:
 
       - name: Verify SQL files have not changed
         if: steps.verify-changed-sql-files.outputs.files_changed == 'true'
+        env:
+          CHANGED_FILES: ${{ steps.verify-changed-sql-files.outputs.changed_files }}
         run: |
           echo "ERROR: Generated SQL files not up to date!"
-          echo "Changed files: ${{ steps.verify-changed-sql-files.outputs.changed_files }}"
+          echo "Changed files: ${CHANGED_FILES}"
           exit 1
 
   # mobile-integration-tests:

.github/workflows/weblate-lock.yml

@@ -4,23 +4,32 @@ on:
   pull_request:
     branches: [main]
 
+permissions: {}
+
 jobs:
   pre-job:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
       should_run: ${{ steps.found_paths.outputs.i18n == 'true' && github.head_ref != 'chore/translations'}}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
       - id: found_paths
-        uses: dorny/paths-filter@v3
+        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
         with:
           filters: |
             i18n:
               - 'i18n/!(en)**\.json'
+
   enforce-lock:
     name: Check Weblate Lock
+    needs: [pre-job]
     runs-on: ubuntu-latest
+    permissions: {}
     if: ${{ needs.pre-job.outputs.should_run == 'true' }}
     steps:
       - name: Check weblate lock
@@ -29,7 +38,7 @@ jobs:
             exit 1
           fi
       - name: Find Pull Request
-        uses: juliangruber/find-pull-request-action@v1
+        uses: juliangruber/find-pull-request-action@48b6133aa6c826f267ebd33aa2d29470f9d9e7d0 # v1
         id: find-pr
         with:
           branch: chore/translations
@@ -38,8 +47,9 @@ jobs:
         run: exit 1
   success-check-lock:
     name: Weblate Lock Check Success
-    needs: [ enforce-lock ]
+    needs: [enforce-lock]
     runs-on: ubuntu-latest
+    permissions: {}
     if: always()
     steps:
       - name: Any jobs failed?

.vscode/settings.json

@@ -39,6 +39,7 @@
   ],
   "explorer.fileNesting.enabled": true,
   "explorer.fileNesting.patterns": {
-    "*.ts": "${capture}.spec.ts,${capture}.mock.ts"
+    "*.ts": "${capture}.spec.ts,${capture}.mock.ts",
+    "*.dart": "${capture}.g.dart,${capture}.gr.dart,${capture}.drift.dart"
   }
 }

Makefile

@@ -39,7 +39,7 @@ attach-server:
 renovate:
   LOG_LEVEL=debug npx renovate --platform=local --repository-cache=reset
 
-MODULES = e2e server web cli sdk docs
+MODULES = e2e server web cli sdk docs .github
 
 audit-%:
 	npm --prefix $(subst sdk,open-api/typescript-sdk,$*) audit fix
@@ -77,14 +77,14 @@ test-medium:
 test-medium-dev:
 	docker exec -it immich_server /bin/sh -c "npm run test:medium"
 
-build-all: $(foreach M,$(filter-out e2e,$(MODULES)),build-$M) ;
+build-all: $(foreach M,$(filter-out e2e .github,$(MODULES)),build-$M) ;
 install-all: $(foreach M,$(MODULES),install-$M) ;
-check-all: $(foreach M,$(filter-out sdk cli docs,$(MODULES)),check-$M) ;
+check-all: $(foreach M,$(filter-out sdk cli docs .github,$(MODULES)),check-$M) ;
-lint-all: $(foreach M,$(filter-out sdk docs,$(MODULES)),lint-$M) ;
+lint-all: $(foreach M,$(filter-out sdk docs .github,$(MODULES)),lint-$M) ;
 format-all: $(foreach M,$(filter-out sdk,$(MODULES)),format-$M) ;
 audit-all:  $(foreach M,$(MODULES),audit-$M) ;
 hygiene-all: lint-all format-all check-all sql audit-all;
-test-all: $(foreach M,$(filter-out sdk docs,$(MODULES)),test-$M) ;
+test-all: $(foreach M,$(filter-out sdk docs .github,$(MODULES)),test-$M) ;
 
 clean:
 	find . -name "node_modules" -type d -prune -exec rm -rf '{}' +

README.md

@@ -1,11 +1,11 @@
 <p align="center"> 
-  <br/>  
+  <br/>
   <a href="https://opensource.org/license/agpl-v3"><img src="https://img.shields.io/badge/License-AGPL_v3-blue.svg?color=3F51B5&style=for-the-badge&label=License&logoColor=000000&labelColor=ececec" alt="License: AGPLv3"></a>
   <a href="https://discord.immich.app">
     <img src="https://img.shields.io/discord/979116623879368755.svg?label=Discord&logo=Discord&style=for-the-badge&logoColor=000000&labelColor=ececec" alt="Discord"/>
   </a>
-  <br/>  
+  <br/>
-  <br/>   
+  <br/>
 </p>
 
 <p align="center">
@@ -61,9 +61,7 @@
 
 ## Demo
 
-Access the demo [here](https://demo.immich.app). The demo is running on a Free-tier Oracle VM in Amsterdam with a 2.4Ghz quad-core ARM64 CPU and 24GB RAM.
+Access the demo [here](https://demo.immich.app). For the mobile app, you can use `https://demo.immich.app` for the `Server Endpoint URL`.
-
-For the mobile app, you can use `https://demo.immich.app/api` for the `Server Endpoint URL`
 
 ### Login credentials
 
@@ -104,7 +102,7 @@ For the mobile app, you can use `https://demo.immich.app/api` for the `Server En
 | Read-only gallery                            | Yes    | Yes |
 | Stacked Photos                               | Yes    | Yes |
 | Tags                                         | No     | Yes |
-| Folder View                                  | No     | Yes |
+| Folder View                                  | Yes    | Yes |
 
 ## Translations
 

cli/eslint.config.mjs

@@ -1,39 +1,29 @@
-import { FlatCompat } from '@eslint/eslintrc';
 import js from '@eslint/js';
-import typescriptEslint from '@typescript-eslint/eslint-plugin';
+import eslintPluginPrettierRecommended from 'eslint-plugin-prettier/recommended';
-import tsParser from '@typescript-eslint/parser';
+import eslintPluginUnicorn from 'eslint-plugin-unicorn';
 import globals from 'globals';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import typescriptEslint from 'typescript-eslint';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
-const compat = new FlatCompat({
-  baseDirectory: __dirname,
-  recommendedConfig: js.configs.recommended,
-  allConfig: js.configs.all,
-});
 
-export default [
+export default typescriptEslint.config([
+  eslintPluginUnicorn.configs.recommended,
+  eslintPluginPrettierRecommended,
+  js.configs.recommended,
+  typescriptEslint.configs.recommended,
   {
     ignores: ['eslint.config.mjs', 'dist'],
   },
-  ...compat.extends(
-    'plugin:@typescript-eslint/recommended',
-    'plugin:prettier/recommended',
-    'plugin:unicorn/recommended',
-  ),
   {
-    plugins: {
-      '@typescript-eslint': typescriptEslint,
-    },
-
     languageOptions: {
       globals: {
         ...globals.node,
       },
 
-      parser: tsParser,
+      parser: typescriptEslint.parser,
       ecmaVersion: 5,
       sourceType: 'module',
 
@@ -58,4 +48,4 @@ export default [
       'object-shorthand': ['error', 'always'],
     },
   },
-];
+]);

cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@immich/cli",
-  "version": "2.2.52",
+  "version": "2.2.61",
   "description": "Command Line Interface (CLI) for Immich",
   "type": "module",
   "exports": "./dist/index.js",
@@ -21,9 +21,7 @@
     "@types/lodash-es": "^4.17.12",
     "@types/micromatch": "^4.0.9",
     "@types/mock-fs": "^4.13.1",
-    "@types/node": "^22.13.5",
+    "@types/node": "^22.14.0",
-    "@typescript-eslint/eslint-plugin": "^8.15.0",
-    "@typescript-eslint/parser": "^8.15.0",
     "@vitest/coverage-v8": "^3.0.0",
     "byte-size": "^9.0.0",
     "cli-progress": "^3.12.0",
@@ -31,12 +29,13 @@
     "eslint": "^9.14.0",
     "eslint-config-prettier": "^10.0.0",
     "eslint-plugin-prettier": "^5.1.3",
-    "eslint-plugin-unicorn": "^56.0.1",
+    "eslint-plugin-unicorn": "^57.0.0",
     "globals": "^16.0.0",
     "mock-fs": "^5.2.0",
     "prettier": "^3.2.5",
     "prettier-plugin-organize-imports": "^4.0.0",
     "typescript": "^5.3.3",
+    "typescript-eslint": "^8.28.0",
     "vite": "^6.0.0",
     "vite-tsconfig-paths": "^5.0.0",
     "vitest": "^3.0.0",
@@ -72,4 +71,4 @@
   "volta": {
     "node": "22.14.0"
   }
-}
+}

docker/docker-compose.dev.yml

@@ -25,7 +25,7 @@ services:
       context: ../
       dockerfile: server/Dockerfile
       target: dev
-    restart: always
+    restart: unless-stopped
     volumes:
       - ../server:/usr/src/app
       - ../open-api:/usr/src/open-api
@@ -95,12 +95,12 @@ services:
     image: immich-machine-learning-dev:latest
     # extends:
     #   file: hwaccel.ml.yml
-    #   service: cpu # set to one of [armnn, cuda, openvino, openvino-wsl] for accelerated inference
+    #   service: cpu # set to one of [armnn, cuda, rocm, openvino, openvino-wsl, rknn] for accelerated inference
     build:
       context: ../machine-learning
       dockerfile: Dockerfile
       args:
-        - DEVICE=cpu # set to one of [armnn, cuda, openvino, openvino-wsl] for accelerated inference
+        - DEVICE=cpu # set to one of [armnn, cuda, rocm, openvino, openvino-wsl, rknn] for accelerated inference
     ports:
       - 3003:3003
     volumes:
@@ -116,7 +116,7 @@ services:
 
   redis:
     container_name: immich_redis
-    image: redis:6.2-alpine@sha256:148bb5411c184abd288d9aaed139c98123eeb8824c5d3fce03cf721db58066d8
+    image: docker.io/valkey/valkey:8-bookworm@sha256:42cba146593a5ea9a622002c1b7cba5da7be248650cbb64ecb9c6c33d29794b1
     healthcheck:
       test: redis-cli ping || exit 1
 

docker/docker-compose.prod.yml

@@ -38,12 +38,12 @@ services:
     image: immich-machine-learning:latest
     # extends:
     #   file: hwaccel.ml.yml
-    #   service: cpu # set to one of [armnn, cuda, openvino, openvino-wsl] for accelerated inference
+    #   service: cpu # set to one of [armnn, cuda, rocm, openvino, openvino-wsl, rknn] for accelerated inference
     build:
       context: ../machine-learning
       dockerfile: Dockerfile
       args:
-        - DEVICE=cpu # set to one of [armnn, cuda, openvino, openvino-wsl] for accelerated inference
+        - DEVICE=cpu # set to one of [armnn, cuda, rocm, openvino, openvino-wsl, rknn] for accelerated inference
     ports:
       - 3003:3003
     volumes:
@@ -56,7 +56,7 @@ services:
 
   redis:
     container_name: immich_redis
-    image: redis:6.2-alpine@sha256:148bb5411c184abd288d9aaed139c98123eeb8824c5d3fce03cf721db58066d8
+    image: docker.io/valkey/valkey:8-bookworm@sha256:42cba146593a5ea9a622002c1b7cba5da7be248650cbb64ecb9c6c33d29794b1
     healthcheck:
       test: redis-cli ping || exit 1
     restart: always
@@ -77,22 +77,12 @@ services:
       - 5432:5432
     healthcheck:
       test: >-
-        pg_isready --dbname="$${POSTGRES_DB}" --username="$${POSTGRES_USER}" || exit 1;
+        pg_isready --dbname="$${POSTGRES_DB}" --username="$${POSTGRES_USER}" || exit 1; Chksum="$$(psql --dbname="$${POSTGRES_DB}" --username="$${POSTGRES_USER}" --tuples-only --no-align --command='SELECT COALESCE(SUM(checksum_failures), 0) FROM pg_stat_database')"; echo "checksum failure count is $$Chksum"; [ "$$Chksum" = '0' ] || exit 1
-        Chksum="$$(psql --dbname="$${POSTGRES_DB}" --username="$${POSTGRES_USER}" --tuples-only --no-align
-        --command='SELECT COALESCE(SUM(checksum_failures), 0) FROM pg_stat_database')";
-        echo "checksum failure count is $$Chksum";
-        [ "$$Chksum" = '0' ] || exit 1
       interval: 5m
       start_interval: 30s
       start_period: 5m
     command: >-
-      postgres
+      postgres -c shared_preload_libraries=vectors.so -c 'search_path="$$user", public, vectors' -c logging_collector=on -c max_wal_size=2GB -c shared_buffers=512MB -c wal_compression=on
-      -c shared_preload_libraries=vectors.so
-      -c 'search_path="$$user", public, vectors'
-      -c logging_collector=on
-      -c max_wal_size=2GB
-      -c shared_buffers=512MB
-      -c wal_compression=on
     restart: always
 
   # set IMMICH_TELEMETRY_INCLUDE=all in .env to enable metrics
@@ -100,7 +90,7 @@ services:
     container_name: immich_prometheus
     ports:
       - 9090:9090
-    image: prom/prometheus@sha256:6927e0919a144aa7616fd0137d4816816d42f6b816de3af269ab065250859a62
+    image: prom/prometheus@sha256:502ad90314c7485892ce696cb14a99fceab9fc27af29f4b427f41bd39701a199
     volumes:
       - ./prometheus.yml:/etc/prometheus/prometheus.yml
       - prometheus-data:/prometheus
@@ -109,10 +99,10 @@ services:
   # add data source for http://immich-prometheus:9090 to get started
   immich-grafana:
     container_name: immich_grafana
-    command: ['./run.sh', '-disable-reporting']
+    command: [ './run.sh', '-disable-reporting' ]
     ports:
       - 3000:3000
-    image: grafana/grafana:11.5.2-ubuntu@sha256:8b5858c447e06fd7a89006b562ba7bba7c4d5813600c7982374c41852adefaeb
+    image: grafana/grafana:11.6.0-ubuntu@sha256:fd8fa48213c624e1a95122f1d93abbf1cf1cbe85fc73212c1e599dbd76c63ff8
     volumes:
       - grafana-data:/var/lib/grafana
 

docker/docker-compose.yml

@@ -33,12 +33,12 @@ services:
 
   immich-machine-learning:
     container_name: immich_machine_learning
-    # For hardware acceleration, add one of -[armnn, cuda, openvino] to the image tag.
+    # For hardware acceleration, add one of -[armnn, cuda, rocm, openvino, rknn] to the image tag.
     # Example tag: ${IMMICH_VERSION:-release}-cuda
     image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
     # extends: # uncomment this section for hardware acceleration - see https://immich.app/docs/features/ml-hardware-acceleration
     #   file: hwaccel.ml.yml
-    #   service: cpu # set to one of [armnn, cuda, openvino, openvino-wsl] for accelerated inference - use the `-wsl` version for WSL2 where applicable
+    #   service: cpu # set to one of [armnn, cuda, rocm, openvino, openvino-wsl, rknn] for accelerated inference - use the `-wsl` version for WSL2 where applicable
     volumes:
       - model-cache:/cache
     env_file:
@@ -49,7 +49,7 @@ services:
 
   redis:
     container_name: immich_redis
-    image: docker.io/redis:6.2-alpine@sha256:148bb5411c184abd288d9aaed139c98123eeb8824c5d3fce03cf721db58066d8
+    image: docker.io/valkey/valkey:8-bookworm@sha256:42cba146593a5ea9a622002c1b7cba5da7be248650cbb64ecb9c6c33d29794b1
     healthcheck:
       test: redis-cli ping || exit 1
     restart: always
@@ -67,22 +67,12 @@ services:
       - ${DB_DATA_LOCATION}:/var/lib/postgresql/data
     healthcheck:
       test: >-
-        pg_isready --dbname="$${POSTGRES_DB}" --username="$${POSTGRES_USER}" || exit 1;
+        pg_isready --dbname="$${POSTGRES_DB}" --username="$${POSTGRES_USER}" || exit 1; Chksum="$$(psql --dbname="$${POSTGRES_DB}" --username="$${POSTGRES_USER}" --tuples-only --no-align --command='SELECT COALESCE(SUM(checksum_failures), 0) FROM pg_stat_database')"; echo "checksum failure count is $$Chksum"; [ "$$Chksum" = '0' ] || exit 1
-        Chksum="$$(psql --dbname="$${POSTGRES_DB}" --username="$${POSTGRES_USER}" --tuples-only --no-align
-        --command='SELECT COALESCE(SUM(checksum_failures), 0) FROM pg_stat_database')";
-        echo "checksum failure count is $$Chksum";
-        [ "$$Chksum" = '0' ] || exit 1
       interval: 5m
       start_interval: 30s
       start_period: 5m
     command: >-
-      postgres
+      postgres -c shared_preload_libraries=vectors.so -c 'search_path="$$user", public, vectors' -c logging_collector=on -c max_wal_size=2GB -c shared_buffers=512MB -c wal_compression=on
-      -c shared_preload_libraries=vectors.so
-      -c 'search_path="$$user", public, vectors'
-      -c logging_collector=on
-      -c max_wal_size=2GB
-      -c shared_buffers=512MB
-      -c wal_compression=on
     restart: always
 
 volumes:

docker/example.env

@@ -2,7 +2,8 @@
 
 # The location where your uploaded files are stored
 UPLOAD_LOCATION=./library
-# The location where your database files are stored
+
+# The location where your database files are stored. Network shares are not supported for the database
 DB_DATA_LOCATION=./postgres
 
 # To set a timezone, uncomment the next line and change Etc/UTC to a TZ identifier from this list: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List

docker/hwaccel.ml.yml

@@ -13,6 +13,13 @@ services:
     volumes:
       - /lib/firmware/mali_csffw.bin:/lib/firmware/mali_csffw.bin:ro # Mali firmware for your chipset (not always required depending on the driver)
       - /usr/lib/libmali.so:/usr/lib/libmali.so:ro # Mali driver for your chipset (always required)
+  
+  rknn:
+    security_opt:
+      - systempaths=unconfined
+      - apparmor=unconfined
+    devices:
+      - /dev/dri:/dev/dri
 
   cpu: {}
 
@@ -26,6 +33,13 @@ services:
               capabilities:
                 - gpu
 
+  rocm:
+    group_add:
+      - video
+    devices:
+      - /dev/dri:/dev/dri
+      - /dev/kfd:/dev/kfd
+
   openvino:
     device_cgroup_rules:
       - 'c 189:* rmw'

docs/docs/FAQ.mdx

@@ -117,7 +117,7 @@ See [Backup and Restore](/docs/administration/backup-and-restore.md).
 
 ### Does Immich support reading existing face tag metadata?
 
-No, it currently does not. There is an [open feature request on GitHub](https://github.com/immich-app/immich/discussions/4348).
+Yes, it creates new faces and persons from the imported asset metadata. For details see the [feature request #4348](https://github.com/immich-app/immich/discussions/4348) and [PR #6455](https://github.com/immich-app/immich/pull/6455).
 
 ### Does Immich support the filtering of NSFW images?
 
@@ -262,7 +262,7 @@ No, this is not supported. Only models listed in the [Hugging Face][huggingface]
 
 ### I want to be able to search in other languages besides English. How can I do that?
 
-You can change to a multilingual CLIP model. See [here](/docs/features/searching#clip-model) for instructions.
+You can change to a multilingual CLIP model. See [here](/docs/features/searching#clip-models) for instructions.
 
 ### Does Immich support Facial Recognition for videos?
 

docs/docs/administration/backup-and-restore.md

@@ -30,6 +30,13 @@ As mentioned above, you should make your own backup of these together with the a
 You can adjust the schedule and amount of kept backups in the [admin settings](http://my.immich.app/admin/system-settings?isOpen=backup).  
 By default, Immich will keep the last 14 backups and create a new backup every day at 2:00 AM.
 
+#### Trigger Backup
+
+You are able to trigger a backup in the [admin job status page](http://my.immich.app/admin/jobs-status).
+Visit the page, open the "Create job" modal from the top right, select "Backup Database" and click "Confirm".
+A job will run and trigger a backup, you can verify this worked correctly by checking the logs or the backup folder.
+This backup will count towards the last X backups that will be kept based on your settings.
+
 #### Restoring
 
 We hope to make restoring simpler in future versions, for now you can find the backups in the `UPLOAD_LOCATION/backups` folder on your host.  
@@ -53,7 +60,7 @@ docker compose create           # Create Docker containers for Immich apps witho
 docker start immich_postgres    # Start Postgres server
 sleep 10                        # Wait for Postgres server to start up
 # Check the database user if you deviated from the default
-gunzip < "/path/to/backup/dump.sql.gz" \
+gunzip --stdout "/path/to/backup/dump.sql.gz" \
 | sed "s/SELECT pg_catalog.set_config('search_path', '', false);/SELECT pg_catalog.set_config('search_path', 'public, pg_catalog', true);/g" \
 | docker exec -i immich_postgres psql --dbname=postgres --username=<DB_USERNAME>  # Restore Backup
 docker compose up -d            # Start remainder of Immich apps
@@ -76,8 +83,8 @@ docker compose create                             # Create Docker containers for
 docker start immich_postgres                      # Start Postgres server
 sleep 10                                          # Wait for Postgres server to start up
 docker exec -it immich_postgres bash              # Enter the Docker shell and run the following command
-# Check the database user if you deviated from the default. If your backup ends in `.gz`, replace `cat` with `gunzip`
+# Check the database user if you deviated from the default. If your backup ends in `.gz`, replace `cat` with `gunzip --stdout`
-cat < "/dump.sql" | sed "s/SELECT pg_catalog.set_config('search_path', '', false);/SELECT pg_catalog.set_config('search_path', 'public, pg_catalog', true);/g" | psql --dbname=postgres --username=<DB_USERNAME>
+cat "/dump.sql" | sed "s/SELECT pg_catalog.set_config('search_path', '', false);/SELECT pg_catalog.set_config('search_path', 'public, pg_catalog', true);/g" | psql --dbname=postgres --username=<DB_USERNAME>
 exit                                              # Exit the Docker shell
 docker compose up -d                              # Start remainder of Immich apps
 ```

docs/docs/administration/server-commands.md

@@ -11,6 +11,7 @@ The `immich-server` docker image comes preinstalled with an administrative CLI (
 | `enable-oauth-login`     | Enable OAuth login                    |
 | `disable-oauth-login`    | Disable OAuth login                   |
 | `list-users`             | List Immich users                     |
+| `version`                | Print Immich version                  |
 
 ## How to run a command
 
@@ -80,3 +81,10 @@ immich-admin list-users
   }
 ]
 ```
+
+Print Immich Version
+
+```
+immich-admin version
+v1.129.0
+```

docs/docs/administration/user-management.mdx

@@ -31,7 +31,7 @@ Admin can send a welcome email if the Email option is set, you can learn here ho
 
 Admin can specify the storage quota for the user as the instance's admin; once the limit is reached, the user won't be able to upload to the instance anymore.
 
-In order to select a storage quota, click on the pencil icon and enter the storage quota in GiB. You can choose an unlimited quota using the value 0 (default).
+In order to select a storage quota, click on the pencil icon and enter the storage quota in GiB. You can choose an unlimited quota by leaving it empty (default).
 
 :::tip
 The system administrator can see the usage quota percentage of all users in Server Stats page.

docs/docs/developer/database-migrations.md

@@ -1,14 +1,14 @@
 # Database Migrations
 
-After making any changes in the `server/src/entities`, a database migration need to run in order to register the changes in the database. Follow the steps below to create a new migration.
+After making any changes in the `server/src/schema`, a database migration need to run in order to register the changes in the database. Follow the steps below to create a new migration.
 
 1. Run the command
 
 ```bash
-npm run typeorm:migrations:generate <migration-name>
+npm run migrations:generate <migration-name>
 ```
 
 2. Check if the migration file makes sense.
-3. Move the migration file to folder `./server/src/migrations` in your code editor.
+3. Move the migration file to folder `./server/src/schema/migrations` in your code editor.
 
 The server will automatically detect `*.ts` file changes and restart. Part of the server start-up process includes running any new migrations, so it will be applied immediately.

docs/docs/developer/setup.md

@@ -63,6 +63,13 @@ If you only want to do web development connected to an existing, remote backend,
 IMMICH_SERVER_URL=https://demo.immich.app/ npm run dev
 ```
 
+If you're using PowerShell on Windows you may need to set the env var separately like so:
+
+```powershell
+$env:IMMICH_SERVER_URL = "https://demo.immich.app/"
+npm run dev
+```
+
 #### `@immich/ui`
 
 To see local changes to `@immich/ui` in Immich, do the following:
@@ -76,9 +83,20 @@ To see local changes to `@immich/ui` in Immich, do the following:
 
 ### Mobile app
 
-The mobile app `(/mobile)` will required Flutter toolchain 3.13.x and FVM to be installed on your system.
+#### Setup
 
-Please refer to the [Flutter's official documentation](https://flutter.dev/docs/get-started/install) for more information on setting up the toolchain on your machine.
+1. Setup Flutter toolchain using FVM.
+2. Run `flutter pub get` to install the dependencies.
+3. Run `make translation` to generate the translation file.
+4. Run `fvm flutter run` to start the app.
+
+#### Translation
+
+To add a new translation text, enter the key-value pair in the `i18n/en.json` in the root of the immich project. Then, from the `mobile/` directory, run
+
+```bash
+make translation
+```
 
 The mobile app asks you what backend to connect to. You can utilize the demo backend (https://demo.immich.app/) if you don't need to change server code or upload photos. Alternatively, you can run the server yourself per the instructions above.
 

docs/docs/features/command-line-interface.md

@@ -42,6 +42,12 @@ docker run -it -v "$(pwd)":/import:ro -e IMMICH_INSTANCE_URL=https://your-immich
 
 Please modify the `IMMICH_INSTANCE_URL` and `IMMICH_API_KEY` environment variables as suitable. You can also use a Docker env file to store your sensitive API key.
 
+This `docker run` command will directly run the command `immich` inside the container. You can directly append the desired parameters (see under "usage") to the commandline like this:
+
+```bash
+docker run -it -v "$(pwd)":/import:ro -e IMMICH_INSTANCE_URL=https://your-immich-instance/api -e IMMICH_API_KEY=your-api-key ghcr.io/immich-app/immich-cli:latest upload -a -c 5 --recursive directory/
+```
+
 ## Usage
 
 <details>
@@ -112,7 +118,7 @@ You begin by authenticating to your Immich server. For instance:
 immich login http://192.168.1.216:2283/api HFEJ38DNSDUEG
 ```
 
-This will store your credentials in a `auth.yml` file in the configuration directory which defaults to `~/.config/`. The directory can be set with the `-d` option or the environment variable `IMMICH_CONFIG_DIR`. Please keep the file secure, either by performing the logout command after you are done, or deleting it manually.
+This will store your credentials in a `auth.yml` file in the configuration directory which defaults to `~/.config/immich/`. The directory can be set with the `-d` option or the environment variable `IMMICH_CONFIG_DIR`. Please keep the file secure, either by performing the logout command after you are done, or deleting it manually.
 
 Once you are authenticated, you can upload assets to your Immich server.
 

docs/docs/features/libraries.md

@@ -37,7 +37,7 @@ To validate that Immich can reach your external library, start a shell inside th
 
 ### Exclusion Patterns
 
-By default, all files in the import paths will be added to the library. If there are files that should not be added, exclusion patterns can be used to exclude them. Exclusion patterns are glob patterns are matched against the full file path. If a file matches an exclusion pattern, it will not be added to the library. Exclusion patterns can be added in the Scan Settings page for each library. Under the hood, Immich uses the [glob](https://www.npmjs.com/package/glob) package to match patterns, so please refer to [their documentation](https://github.com/isaacs/node-glob#glob-primer) to see what patterns are supported.
+By default, all files in the import paths will be added to the library. If there are files that should not be added, exclusion patterns can be used to exclude them. Exclusion patterns are glob patterns are matched against the full file path. If a file matches an exclusion pattern, it will not be added to the library. Exclusion patterns can be added in the Scan Settings page for each library.
 
 Some basic examples:
 
@@ -48,7 +48,11 @@ Some basic examples:
 
 Special characters such as @ should be escaped, for instance:
 
-- `**/\@eadir/**` will exclude all files in any directory named `@eadir`
+- `**/\@eaDir/**` will exclude all files in any directory named `@eaDir`
+
+:::info
+Internally, Immich uses the [glob](https://www.npmjs.com/package/glob) package to process exclusion patterns, and sometimes those patterns are translated into [Postgres LIKE patterns](https://www.postgresql.org/docs/current/functions-matching.html). The intention is to support basic folder exclusions but we recommend against advanced usage since those can't reliably be translated to the Postgres syntax. Please refer to the [glob documentation](https://github.com/isaacs/node-glob#glob-primer) for a basic overview on glob patterns.
+:::
 
 ### Automatic watching (EXPERIMENTAL)
 
@@ -91,7 +95,7 @@ The `immich-server` container will need access to the gallery. Modify your docke
 +     - /mnt/nas/christmas-trip:/mnt/media/christmas-trip:ro
 +     - /home/user/old-pics:/mnt/media/old-pics:ro
 +     - /mnt/media/videos:/mnt/media/videos:ro
-+     - /mnt/media/videos2:/mnt/media/videos2 # the files in this folder can be deleted, as it does not end with :ro
++     - /mnt/media/videos2:/mnt/media/videos2 # WARNING: Immich will be able to delete the files in this folder, as it does not end with :ro
 +     - "C:/Users/user_name/Desktop/my media:/mnt/media/my-media:ro" # import path in Windows system.
 ```
 

docs/docs/features/ml-hardware-acceleration.md

@@ -11,7 +11,9 @@ You do not need to redo any machine learning jobs after enabling hardware accele
 
 - ARM NN (Mali)
 - CUDA (NVIDIA GPUs with [compute capability](https://developer.nvidia.com/cuda-gpus) 5.2 or higher)
+- ROCm (AMD GPUs)
 - OpenVINO (Intel GPUs such as Iris Xe and Arc)
+- RKNN (Rockchip)
 
 ## Limitations
 
@@ -19,6 +21,7 @@ You do not need to redo any machine learning jobs after enabling hardware accele
 - Only Linux and Windows (through WSL2) servers are supported.
 - ARM NN is only supported on devices with Mali GPUs. Other Arm devices are not supported.
 - Some models may not be compatible with certain backends. CUDA is the most reliable.
+- Search latency isn't improved by ARM NN due to model compatibility issues preventing its use. However, smart search jobs do make use of ARM NN.
 
 ## Prerequisites
 
@@ -33,6 +36,7 @@ You do not need to redo any machine learning jobs after enabling hardware accele
   - The `hwaccel.ml.yml` file assumes the path to it is `/usr/lib/libmali.so`, so update accordingly if it is elsewhere
   - The `hwaccel.ml.yml` file assumes an additional file `/lib/firmware/mali_csffw.bin`, so update accordingly if your device's driver does not require this file
 - Optional: Configure your `.env` file, see [environment variables](/docs/install/environment-variables) for ARM NN specific settings
+  - In particular, the `MACHINE_LEARNING_ANN_FP16_TURBO` can significantly improve performance at the cost of very slightly lower accuracy
 
 #### CUDA
 
@@ -41,22 +45,38 @@ You do not need to redo any machine learning jobs after enabling hardware accele
 - The installed driver must be >= 535 (it must support CUDA 12.2).
 - On Linux (except for WSL2), you also need to have [NVIDIA Container Toolkit][nvct] installed.
 
+#### ROCm
+
+- The GPU must be supported by ROCm. If it isn't officially supported, you can attempt to use the `HSA_OVERRIDE_GFX_VERSION` environmental variable: `HSA_OVERRIDE_GFX_VERSION=<a supported version, e.g. 10.3.0>`. If this doesn't work, you might need to also set `HSA_USE_SVM=0`.
+- The ROCm image is quite large and requires at least 35GiB of free disk space. However, pulling later updates to the service through Docker will generally only amount to a few hundred megabytes as the rest will be cached.
+- This backend is new and may experience some issues. For example, GPU power consumption can be higher than usual after running inference, even if the machine learning service is idle. In this case, it will only go back to normal after being idle for 5 minutes (configurable with the [MACHINE_LEARNING_MODEL_TTL](/docs/install/environment-variables) setting).
+
 #### OpenVINO
 
 - Integrated GPUs are more likely to experience issues than discrete GPUs, especially for older processors or servers with low RAM.
 - Ensure the server's kernel version is new enough to use the device for hardware accceleration.
 - Expect higher RAM usage when using OpenVINO compared to CPU processing.
 
+#### RKNN
+
+- You must have a supported Rockchip SoC: only RK3566, RK3568, RK3576 and RK3588 are supported at this moment.
+- Make sure you have the appropriate linux kernel driver installed
+  - This is usually pre-installed on the device vendor's Linux images
+- RKNPU driver V0.9.8 or later must be available in the host server
+  - You may confirm this by running `cat /sys/kernel/debug/rknpu/version` to check the version
+- Optional: Configure your `.env` file, see [environment variables](/docs/install/environment-variables) for RKNN specific settings
+  - In particular, setting `MACHINE_LEARNING_RKNN_THREADS` to 2 or 3 can _dramatically_ improve performance for RK3576 and RK3588 compared to the default of 1, at the expense of multiplying the amount of RAM each model uses by that amount.
+
 ## Setup
 
 1. If you do not already have it, download the latest [`hwaccel.ml.yml`][hw-file] file and ensure it's in the same folder as the `docker-compose.yml`.
 2. In the `docker-compose.yml` under `immich-machine-learning`, uncomment the `extends` section and change `cpu` to the appropriate backend.
-3. Still in `immich-machine-learning`, add one of -[armnn, cuda, openvino] to the `image` section's tag at the end of the line.
+3. Still in `immich-machine-learning`, add one of -[armnn, cuda, rocm, openvino, rknn] to the `image` section's tag at the end of the line.
 4. Redeploy the `immich-machine-learning` container with these updated settings.
 
 ### Confirming Device Usage
 
-You can confirm the device is being recognized and used by checking its utilization. There are many tools to display this, such as `nvtop` for NVIDIA or Intel and `intel_gpu_top` for Intel.
+You can confirm the device is being recognized and used by checking its utilization. There are many tools to display this, such as `nvtop` for NVIDIA or Intel, `intel_gpu_top` for Intel, and `radeontop` for AMD.
 
 You can also check the logs of the `immich-machine-learning` container. When a Smart Search or Face Detection job begins, or when you search with text in Immich, you should either see a log for `Available ORT providers` containing the relevant provider (e.g. `CUDAExecutionProvider` in the case of CUDA), or a `Loaded ANN model` log entry without errors in the case of ARM NN.
 
@@ -127,3 +147,12 @@ Note that you should increase job concurrencies to increase overall utilization
 - If you encounter an error when a model is running, try a different model to see if the issue is model-specific.
 - You may want to increase concurrency past the default for higher utilization. However, keep in mind that this will also increase VRAM consumption.
 - Larger models benefit more from hardware acceleration, if you have the VRAM for them.
+- Compared to ARM NN, RKNPU has:
+  - Wider model support (including for search, which ARM NN does not accelerate)
+  - Less heat generation
+  - Very slightly lower accuracy (RKNPU always uses FP16, while ARM NN by default uses higher precision FP32 unless `MACHINE_LEARNING_ANN_FP16_TURBO` is enabled)
+  - Varying speed (tested on RK3588):
+    - If `MACHINE_LEARNING_RKNN_THREADS` is at the default of 1, RKNPU will have substantially lower throughput for ML jobs than ARM NN in most cases, but similar latency (such as when searching)
+    - If `MACHINE_LEARNING_RKNN_THREADS` is set to 3, it will be somewhat faster than ARM NN at FP32, but somewhat slower than ARM NN if `MACHINE_LEARNING_ANN_FP16_TURBO` is enabled
+    - When other tasks also use the GPU (like transcoding), RKNPU has a significant advantage over ARM NN as it uses the otherwise idle NPU instead of competing for GPU usage
+  - Lower RAM usage if `MACHINE_LEARNING_RKNN_THREADS` is at the default of 1, but significantly higher if greater than 1 (which is necessary for it to fully utilize the NPU and hence be comparable in speed to ARM NN)

docs/docs/features/supported-formats.md

@@ -18,7 +18,7 @@ For the full list, refer to the [Immich source code](https://github.com/immich-a
 | `JPEG 2000` | `.jp2`                        | :white_check_mark: |                 |
 | `JPEG`      | `.webp` `.jpg` `.jpe` `.insp` | :white_check_mark: |                 |
 | `JPEG XL`   | `.jxl`                        | :white_check_mark: |                 |
-| `PNG`       | `.webp`                       | :white_check_mark: |                 |
+| `PNG`       | `.png`                        | :white_check_mark: |                 |
 | `PSD`       | `.psd`                        | :white_check_mark: | Adobe Photoshop |
 | `RAW`       | `.raw`                        | :white_check_mark: |                 |
 | `RW2`       | `.rw2`                        | :white_check_mark: |                 |

docs/docs/guides/remote-machine-learning.md

@@ -23,12 +23,12 @@ name: immich_remote_ml
 services:
   immich-machine-learning:
     container_name: immich_machine_learning
-    # For hardware acceleration, add one of -[armnn, cuda, openvino] to the image tag.
+    # For hardware acceleration, add one of -[armnn, cuda, rocm, openvino, rknn] to the image tag.
     # Example tag: ${IMMICH_VERSION:-release}-cuda
     image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
     # extends:
     #   file: hwaccel.ml.yml
-    #   service: # set to one of [armnn, cuda, openvino, openvino-wsl] for accelerated inference - use the `-wsl` version for WSL2 where applicable
+    #   service: # set to one of [armnn, cuda, rocm, openvino, openvino-wsl, rknn] for accelerated inference - use the `-wsl` version for WSL2 where applicable
     volumes:
       - model-cache:/cache
     restart: always

docs/docs/install/config-file.md

@@ -1,3 +1,7 @@
+---
+sidebar_position: 100
+---
+
 # Config File
 
 A config file can be provided as an alternative to the UI configuration.

docs/docs/install/docker-compose.mdx

@@ -69,39 +69,7 @@ If you get an error `can't set healthcheck.start_interval as feature require Doc
 
 ## Next Steps
 
-Read the [Post Installation](/docs/install/post-install.mdx) steps or setup optional features below.
+Read the [Post Installation](/docs/install/post-install.mdx) steps and [upgrade instructions](/docs/install/upgrading.md).
-
-### Setting up optional features
-
-- [External Libraries](/docs/features/libraries.md): Adding your existing photo library to Immich
-- [Hardware Transcoding](/docs/features/hardware-transcoding.md): Speeding up video transcoding
-- [Hardware-Accelerated Machine Learning](/docs/features/ml-hardware-acceleration.md): Speeding up various machine learning tasks in Immich
-
-### Upgrading
-
-:::danger Read the release notes
-Immich is currently under heavy development, which means you can expect [breaking changes][breaking] and bugs. Therefore, we recommend reading the release notes prior to updating and to take special care when using automated tools like [Watchtower][watchtower].
-
-You can see versions that had breaking changes [here][breaking].
-:::
-
-If `IMMICH_VERSION` is set, it will need to be updated to the latest or desired version.
-
-When a new version of Immich is [released][releases], the application can be upgraded and restarted with the following commands, run in the directory with the `docker-compose.yml` file:
-
-```bash title="Upgrade and restart Immich"
-docker compose pull && docker compose up -d
-```
-
-To clean up disk space, the old version's obsolete container images can be deleted with the following command:
-
-```bash title="Clean up unused Docker images"
-docker image prune
-```
 
 [compose-file]: https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml
 [env-file]: https://github.com/immich-app/immich/releases/latest/download/example.env
-[watchtower]: https://containrrr.dev/watchtower/
-[breaking]: https://github.com/immich-app/immich/discussions?discussions_q=label%3Achangelog%3Abreaking-change+sort%3Adate_created
-[container-auth]: https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry#authenticating-to-the-container-registry
-[releases]: https://github.com/immich-app/immich/releases

docs/docs/install/environment-variables.md

@@ -148,28 +148,31 @@ Redis (Sentinel) URL example JSON before encoding:
 
 ## Machine Learning
 
-| Variable                                                    | Description                                                                                         |             Default             | Containers       |
+| Variable                                                    | Description                                                                                         |           Default            | Containers       |
-| :---------------------------------------------------------- | :-------------------------------------------------------------------------------------------------- | :-----------------------------: | :--------------- |
+| :---------------------------------------------------------- | :-------------------------------------------------------------------------------------------------- | :--------------------------: | :--------------- |
-| `MACHINE_LEARNING_MODEL_TTL`                                | Inactivity time (s) before a model is unloaded (disabled if \<= 0)                                  |              `300`              | machine learning |
+| `MACHINE_LEARNING_MODEL_TTL`                                | Inactivity time (s) before a model is unloaded (disabled if \<= 0)                                  |            `300`             | machine learning |
-| `MACHINE_LEARNING_MODEL_TTL_POLL_S`                         | Interval (s) between checks for the model TTL (disabled if \<= 0)                                   |              `10`               | machine learning |
+| `MACHINE_LEARNING_MODEL_TTL_POLL_S`                         | Interval (s) between checks for the model TTL (disabled if \<= 0)                                   |             `10`             | machine learning |
-| `MACHINE_LEARNING_CACHE_FOLDER`                             | Directory where models are downloaded                                                               |            `/cache`             | machine learning |
+| `MACHINE_LEARNING_CACHE_FOLDER`                             | Directory where models are downloaded                                                               |           `/cache`           | machine learning |
-| `MACHINE_LEARNING_REQUEST_THREADS`<sup>\*1</sup>            | Thread count of the request thread pool (disabled if \<= 0)                                         |       number of CPU cores       | machine learning |
+| `MACHINE_LEARNING_REQUEST_THREADS`<sup>\*1</sup>            | Thread count of the request thread pool (disabled if \<= 0)                                         |     number of CPU cores      | machine learning |
-| `MACHINE_LEARNING_MODEL_INTER_OP_THREADS`                   | Number of parallel model operations                                                                 |               `1`               | machine learning |
+| `MACHINE_LEARNING_MODEL_INTER_OP_THREADS`                   | Number of parallel model operations                                                                 |             `1`              | machine learning |
-| `MACHINE_LEARNING_MODEL_INTRA_OP_THREADS`                   | Number of threads for each model operation                                                          |               `2`               | machine learning |
+| `MACHINE_LEARNING_MODEL_INTRA_OP_THREADS`                   | Number of threads for each model operation                                                          |             `2`              | machine learning |
-| `MACHINE_LEARNING_WORKERS`<sup>\*2</sup>                    | Number of worker processes to spawn                                                                 |               `1`               | machine learning |
+| `MACHINE_LEARNING_MODEL_ARENA`                              | Pre-allocates CPU memory to avoid memory fragmentation                                              |             true             | machine learning |
-| `MACHINE_LEARNING_HTTP_KEEPALIVE_TIMEOUT_S`<sup>\*3</sup>   | HTTP Keep-alive time in seconds                                                                     |               `2`               | machine learning |
+| `MACHINE_LEARNING_WORKERS`<sup>\*2</sup>                    | Number of worker processes to spawn                                                                 |             `1`              | machine learning |
-| `MACHINE_LEARNING_WORKER_TIMEOUT`                           | Maximum time (s) of unresponsiveness before a worker is killed                                      | `120` (`300` if using OpenVINO) | machine learning |
+| `MACHINE_LEARNING_HTTP_KEEPALIVE_TIMEOUT_S`<sup>\*3</sup>   | HTTP Keep-alive time in seconds                                                                     |             `2`              | machine learning |
-| `MACHINE_LEARNING_PRELOAD__CLIP__TEXTUAL`                   | Comma-separated list of (textual) CLIP model(s) to preload and cache                                |                                 | machine learning |
+| `MACHINE_LEARNING_WORKER_TIMEOUT`                           | Maximum time (s) of unresponsiveness before a worker is killed                                      |            `300`             | machine learning |
-| `MACHINE_LEARNING_PRELOAD__CLIP__VISUAL`                    | Comma-separated list of (visual) CLIP model(s) to preload and cache                                 |                                 | machine learning |
+| `MACHINE_LEARNING_PRELOAD__CLIP__TEXTUAL`                   | Comma-separated list of (textual) CLIP model(s) to preload and cache                                |                              | machine learning |
-| `MACHINE_LEARNING_PRELOAD__FACIAL_RECOGNITION__RECOGNITION` | Comma-separated list of (recognition) facial recognition model(s) to preload and cache              |                                 | machine learning |
+| `MACHINE_LEARNING_PRELOAD__CLIP__VISUAL`                    | Comma-separated list of (visual) CLIP model(s) to preload and cache                                 |                              | machine learning |
-| `MACHINE_LEARNING_PRELOAD__FACIAL_RECOGNITION__DETECTION`   | Comma-separated list of (detection) facial recognition model(s) to preload and cache                |                                 | machine learning |
+| `MACHINE_LEARNING_PRELOAD__FACIAL_RECOGNITION__RECOGNITION` | Comma-separated list of (recognition) facial recognition model(s) to preload and cache              |                              | machine learning |
-| `MACHINE_LEARNING_ANN`                                      | Enable ARM-NN hardware acceleration if supported                                                    |             `True`              | machine learning |
+| `MACHINE_LEARNING_PRELOAD__FACIAL_RECOGNITION__DETECTION`   | Comma-separated list of (detection) facial recognition model(s) to preload and cache                |                              | machine learning |
-| `MACHINE_LEARNING_ANN_FP16_TURBO`                           | Execute operations in FP16 precision: increasing speed, reducing precision (applies only to ARM-NN) |             `False`             | machine learning |
+| `MACHINE_LEARNING_ANN`                                      | Enable ARM-NN hardware acceleration if supported                                                    |            `True`            | machine learning |
-| `MACHINE_LEARNING_ANN_TUNING_LEVEL`                         | ARM-NN GPU tuning level (1: rapid, 2: normal, 3: exhaustive)                                        |               `2`               | machine learning |
+| `MACHINE_LEARNING_ANN_FP16_TURBO`                           | Execute operations in FP16 precision: increasing speed, reducing precision (applies only to ARM-NN) |           `False`            | machine learning |
-| `MACHINE_LEARNING_DEVICE_IDS`<sup>\*4</sup>                 | Device IDs to use in multi-GPU environments                                                         |               `0`               | machine learning |
+| `MACHINE_LEARNING_ANN_TUNING_LEVEL`                         | ARM-NN GPU tuning level (1: rapid, 2: normal, 3: exhaustive)                                        |             `2`              | machine learning |
-| `MACHINE_LEARNING_MAX_BATCH_SIZE__FACIAL_RECOGNITION`       | Set the maximum number of faces that will be processed at once by the facial recognition model      |  None (`1` if using OpenVINO)   | machine learning |
+| `MACHINE_LEARNING_DEVICE_IDS`<sup>\*4</sup>                 | Device IDs to use in multi-GPU environments                                                         |             `0`              | machine learning |
-| `MACHINE_LEARNING_PING_TIMEOUT`                             | How long (ms) to wait for a PING response when checking if an ML server is available                |             `2000`              | server           |
+| `MACHINE_LEARNING_MAX_BATCH_SIZE__FACIAL_RECOGNITION`       | Set the maximum number of faces that will be processed at once by the facial recognition model      | None (`1` if using OpenVINO) | machine learning |
-| `MACHINE_LEARNING_AVAILABILITY_BACKOFF_TIME`                | How long to ignore ML servers that are offline before trying again                                  |             `30000`             | server           |
+| `MACHINE_LEARNING_PING_TIMEOUT`                             | How long (ms) to wait for a PING response when checking if an ML server is available                |            `2000`            | server           |
+| `MACHINE_LEARNING_AVAILABILITY_BACKOFF_TIME`                | How long to ignore ML servers that are offline before trying again                                  |           `30000`            | server           |
+| `MACHINE_LEARNING_RKNN`                                     | Enable RKNN hardware acceleration if supported                                                      |            `True`            | machine learning |
+| `MACHINE_LEARNING_RKNN_THREADS`                             | How many threads of RKNN runtime should be spinned up while inferencing.                            |             `1`              | machine learning |
 
 \*1: It is recommended to begin with this parameter when changing the concurrency levels of the machine learning service and then tune the other ones.
 

docs/docs/install/post-install.mdx

@@ -41,3 +41,9 @@ A list of common steps to take after installing Immich include:
 ## Step 7 - Setup Server Backups
 
 <ServerBackup />
+
+## Setting up optional features
+
+- [External Libraries](/docs/features/libraries.md): Adding your existing photo library to Immich
+- [Hardware Transcoding](/docs/features/hardware-transcoding.md): Speeding up video transcoding
+- [Hardware-Accelerated Machine Learning](/docs/features/ml-hardware-acceleration.md): Speeding up various machine learning tasks in Immich

docs/docs/install/synology.md

@@ -67,10 +67,4 @@ Click "**Edit Rules**" and add the following firewall rules:
 
 ## Next Steps
 
-Read the [Post Installation](/docs/install/post-install.mdx) steps or setup optional features below.
+Read the [Post Installation](/docs/install/post-install.mdx) steps and [upgrade instructions](/docs/install/upgrading.md).
-
-### Setting up optional features
-
-- [External Libraries](/docs/features/libraries.md): Adding your existing photo library to Immich
-- [Hardware Transcoding](/docs/features/hardware-transcoding.md): Speeding up video transcoding
-- [Hardware-Accelerated Machine Learning](/docs/features/ml-hardware-acceleration.md): Speeding up various machine learning tasks in Immich

docs/docs/install/truenas.md

@@ -247,6 +247,10 @@ Some examples are: `IMMICH_VERSION`, `UPLOAD_LOCATION`, `DB_DATA_LOCATION`, `TZ`
 
 ## Updating the App
 
+:::danger
+Make sure to read the general [upgrade instructions](/docs/install/upgrading.md).
+:::
+
 When updates become available, SCALE alerts and provides easy updates.
 To update the app to the latest version:
 

docs/docs/install/unraid.md

@@ -77,7 +77,7 @@ alt="Select Plugins > Compose.Manager > Add New Stack > Label it Immich"
 7.  Paste the entire contents of the [Immich example.env](https://github.com/immich-app/immich/releases/latest/download/example.env) file into the Unraid editor, then **before saving** edit the following:
 
     - `UPLOAD_LOCATION`: Create a folder in your Images Unraid share and place the **absolute** location here > For example my _"images"_ share has a folder within it called _"immich"_. If I browse to this directory in the terminal and type `pwd` the output is `/mnt/user/images/immich`. This is the exact value I need to enter as my `UPLOAD_LOCATION`
-    - `DB_DATA_LOCATION`: Change this to use an Unraid share (preferably a cache pool, e.g. `/mnt/user/appdata`). If left at default it will try to use Unraid's `/boot/config/plugins/compose.manager/projects/[stack_name]/postgres` folder which it doesn't have permissions to, resulting in this container continuously restarting.
+    - `DB_DATA_LOCATION`: Change this to use an Unraid share (preferably a cache pool, e.g. `/mnt/user/appdata/postgresql/data`). This uses the `appdata` share. Do also create the `postgresql` folder, by running `mkdir /mnt/user/{share_location}/postgresql/data`. If left at default it will try to use Unraid's `/boot/config/plugins/compose.manager/projects/[stack_name]/postgres` folder which it doesn't have permissions to, resulting in this container continuously restarting.
 
       <img
       src={require('./img/unraid05.webp').default}
@@ -131,6 +131,10 @@ For more information on how to use the application once installed, please refer
 
 ## Updating Steps
 
+:::danger
+Make sure to read the general [upgrade instructions](/docs/install/upgrading.md).
+:::
+
 Updating is extremely easy however it's important to be aware that containers managed via the Docker Compose Manager plugin do not integrate with Unraid's native dockerman UI, the label "_update ready_" will always be present on containers installed via the Docker Compose Manager.
 
 <img

docs/docs/install/upgrading.md

@@ -0,0 +1,29 @@
+---
+sidebar_position: 95
+---
+
+# Upgrading
+
+:::danger Read the release notes
+Immich is currently under heavy development, which means you can expect [breaking changes][breaking] and bugs. You should read the release notes prior to updating and take special care when using automated tools like [Watchtower][watchtower].
+
+You can see versions that had breaking changes [here][breaking].
+:::
+
+When a new version of Immich is [released][releases], you should read the release notes and account for any breaking changes noted (as mentioned above).
+If you use `IMMICH_VERSION` in your `.env` file, it will need to be updated to the latest or desired version.
+After that, the application can be upgraded and restarted with the following commands, run in the directory with the `docker-compose.yml` file:
+
+```bash title="Upgrade and restart Immich"
+docker compose pull && docker compose up -d
+```
+
+To clean up disk space, the old version's obsolete container images can be deleted with the following command:
+
+```bash title="Clean up unused Docker images"
+docker image prune
+```
+
+[watchtower]: https://containrrr.dev/watchtower/
+[breaking]: https://github.com/immich-app/immich/discussions?discussions_q=label%3Achangelog%3Abreaking-change+sort%3Adate_created
+[releases]: https://github.com/immich-app/immich/releases

docs/docs/partials/_server-backup.md

@@ -1,2 +1,7 @@
 Now that you have imported some pictures, you should setup server backups to preserve your memories.
 You can do so by following our [backup guide](/docs/administration/backup-and-restore.md).
+
+:::danger
+Immich is still under heavy development _and_ handles very important data.
+It is essential that you set up good backups, and test them.
+:::

docs/src/components/svg-paths.ts

@@ -1,2 +1,3 @@
 export const discordPath =
-  'M 9.1367188 3.8691406 C 9.1217187 3.8691406 9.1067969 3.8700938 9.0917969 3.8710938 C 8.9647969 3.8810937 5.9534375 4.1403594 4.0234375 5.6933594 C 3.0154375 6.6253594 1 12.073203 1 16.783203 C 1 16.866203 1.0215 16.946531 1.0625 17.019531 C 2.4535 19.462531 6.2473281 20.102859 7.1113281 20.130859 L 7.1269531 20.130859 C 7.2799531 20.130859 7.4236719 20.057594 7.5136719 19.933594 L 8.3886719 18.732422 C 6.0296719 18.122422 4.8248594 17.086391 4.7558594 17.025391 C 4.5578594 16.850391 4.5378906 16.549563 4.7128906 16.351562 C 4.8068906 16.244563 4.9383125 16.189453 5.0703125 16.189453 C 5.1823125 16.189453 5.2957188 16.228594 5.3867188 16.308594 C 5.4157187 16.334594 7.6340469 18.216797 11.998047 18.216797 C 16.370047 18.216797 18.589328 16.325641 18.611328 16.306641 C 18.702328 16.227641 18.815734 16.189453 18.927734 16.189453 C 19.059734 16.189453 19.190156 16.243562 19.285156 16.351562 C 19.459156 16.549563 19.441141 16.851391 19.244141 17.025391 C 19.174141 17.087391 17.968375 18.120469 15.609375 18.730469 L 16.484375 19.933594 C 16.574375 20.057594 16.718094 20.130859 16.871094 20.130859 L 16.886719 20.130859 C 17.751719 20.103859 21.5465 19.463531 22.9375 17.019531 C 22.9785 16.947531 23 16.866203 23 16.783203 C 23 12.073203 20.984172 6.624875 19.951172 5.671875 C 18.047172 4.140875 15.036203 3.8820937 14.908203 3.8710938 C 14.895203 3.8700938 14.880188 3.8691406 14.867188 3.8691406 C 14.681188 3.8691406 14.510594 3.9793906 14.433594 4.1503906 C 14.427594 4.1623906 14.362062 4.3138281 14.289062 4.5488281 C 15.548063 4.7608281 17.094141 5.1895937 18.494141 6.0585938 C 18.718141 6.1975938 18.787437 6.4917969 18.648438 6.7167969 C 18.558438 6.8627969 18.402188 6.9433594 18.242188 6.9433594 C 18.156188 6.9433594 18.069234 6.9200937 17.990234 6.8710938 C 15.584234 5.3800938 12.578 5.3046875 12 5.3046875 C 11.422 5.3046875 8.4157187 5.3810469 6.0117188 6.8730469 C 5.9327188 6.9210469 5.8457656 6.9433594 5.7597656 6.9433594 C 5.5997656 6.9433594 5.4425625 6.86475 5.3515625 6.71875 C 5.2115625 6.49375 5.2818594 6.1985938 5.5058594 6.0585938 C 6.9058594 5.1905937 8.4528906 4.7627812 9.7128906 4.5507812 C 9.6388906 4.3147813 9.5714062 4.1643437 9.5664062 4.1523438 C 9.4894063 3.9813438 9.3217188 3.8691406 9.1367188 3.8691406 z M 12 7.3046875 C 12.296 7.3046875 14.950594 7.3403125 16.933594 8.5703125 C 17.326594 8.8143125 17.777234 8.9453125 18.240234 8.9453125 C 18.633234 8.9453125 19.010656 8.8555 19.347656 8.6875 C 19.964656 10.2405 20.690828 12.686219 20.923828 15.199219 C 20.883828 15.143219 20.840922 15.089109 20.794922 15.037109 C 20.324922 14.498109 19.644687 14.191406 18.929688 14.191406 C 18.332687 14.191406 17.754078 14.405437 17.330078 14.773438 C 17.257078 14.832437 15.505 16.21875 12 16.21875 C 8.496 16.21875 6.7450313 14.834687 6.7070312 14.804688 C 6.2540312 14.407687 5.6742656 14.189453 5.0722656 14.189453 C 4.3612656 14.189453 3.6838438 14.494391 3.2148438 15.025391 C 3.1658438 15.080391 3.1201719 15.138266 3.0761719 15.197266 C 3.3091719 12.686266 4.0344375 10.235594 4.6484375 8.6835938 C 4.9864375 8.8525938 5.3657656 8.9433594 5.7597656 8.9433594 C 6.2217656 8.9433594 6.6724531 8.8143125 7.0644531 8.5703125 C 9.0494531 7.3393125 11.704 7.3046875 12 7.3046875 z M 8.890625 10.044922 C 7.966625 10.044922 7.2167969 10.901031 7.2167969 11.957031 C 7.2167969 13.013031 7.965625 13.869141 8.890625 13.869141 C 9.815625 13.869141 10.564453 13.013031 10.564453 11.957031 C 10.564453 10.900031 9.815625 10.044922 8.890625 10.044922 z M 15.109375 10.044922 C 14.185375 10.044922 13.435547 10.901031 13.435547 11.957031 C 13.435547 13.013031 14.184375 13.869141 15.109375 13.869141 C 16.034375 13.869141 16.783203 13.013031 16.783203 11.957031 C 16.783203 10.900031 16.033375 10.044922 15.109375 10.044922 z';
+  'M81.15,0c-1.2376,2.1973-2.3489,4.4704-3.3591,6.794-9.5975-1.4396-19.3718-1.4396-28.9945,0-.985-2.3236-2.1216-4.5967-3.3591-6.794-9.0166,1.5407-17.8059,4.2431-26.1405,8.0568C2.779,32.5304-1.6914,56.3725.5312,79.8863c9.6732,7.1476,20.5083,12.603,32.0505,16.0884,2.6014-3.4854,4.8998-7.1981,6.8698-11.0623-3.738-1.3891-7.3497-3.1318-10.8098-5.1523.9092-.6567,1.7932-1.3386,2.6519-1.9953,20.281,9.547,43.7696,9.547,64.0758,0,.8587.7072,1.7427,1.3891,2.6519,1.9953-3.4601,2.0457-7.0718,3.7632-10.835,5.1776,1.97,3.8642,4.2683,7.5769,6.8698,11.0623,11.5419-3.4854,22.3769-8.9156,32.0509-16.0631,2.626-27.2771-4.496-50.9172-18.817-71.8548C98.9811,4.2684,90.1918,1.5659,81.1752.0505l-.0252-.0505ZM42.2802,65.4144c-6.2383,0-11.4159-5.6575-11.4159-12.6535s4.9755-12.6788,11.3907-12.6788,11.5169,5.708,11.4159,12.6788c-.101,6.9708-5.026,12.6535-11.3907,12.6535ZM84.3576,65.4144c-6.2637,0-11.3907-5.6575-11.3907-12.6535s4.9755-12.6788,11.3907-12.6788,11.4917,5.708,11.3906,12.6788c-.101,6.9708-5.026,12.6535-11.3906,12.6535Z';
+export const discordViewBox = '0 0 126.644 96';

docs/src/components/version-switcher.tsx

@@ -4,7 +4,7 @@ import React, { useEffect, useState } from 'react';
 
 export default function VersionSwitcher(): JSX.Element {
   const [versions, setVersions] = useState([]);
-  const [label, setLabel] = useState('Versions');
+  const [activeLabel, setLabel] = useState('Versions');
 
   const windowSize = useWindowSize();
 
@@ -48,12 +48,13 @@ export default function VersionSwitcher(): JSX.Element {
     versions.length > 0 && (
       <DropdownNavbarItem
         className="version-switcher-34ab39"
-        label={label}
+        label={activeLabel}
         mobile={windowSize === 'mobile'}
         items={versions.map(({ label, url }) => ({
           label,
           to: new URL(location.pathname + location.search + location.hash, url).href,
           target: '_self',
+          className: label === activeLabel ? 'dropdown__link--active menu__link--active' : '', // workaround because React Router `<NavLink>` only supports using URL path for checking if active: https://v5.reactrouter.com/web/api/NavLink/isactive-func
         }))}
       />
     )

docs/src/pages/errors.md

@@ -0,0 +1,5 @@
+# Errors
+
+## TypeORM Upgrade
+
+The upgrade to Immich `v2.x.x` has a required upgrade path to `v1.132.0+`. This means it is required to start up the application at least once on version `1.132.0` (or later). Doing so will complete database schema upgrades that are required for `v2.0.0`. After Immich has successfully booted on this version, shut the system down and try the `v2.x.x` upgrade again.

docs/src/pages/index.tsx

@@ -1,12 +1,10 @@
 import React from 'react';
 import Link from '@docusaurus/Link';
 import Layout from '@theme/Layout';
-import { useColorMode } from '@docusaurus/theme-common';
+import { discordPath, discordViewBox } from '@site/src/components/svg-paths';
-import { discordPath } from '@site/src/components/svg-paths';
+import ThemedImage from '@theme/ThemedImage';
 import Icon from '@mdi/react';
 function HomepageHeader() {
-  const { isDarkTheme } = useColorMode();
-
   return (
     <header>
       <div className="top-[calc(12%)]  md:top-[calc(30%)] h-screen w-full absolute -z-10">
@@ -14,8 +12,8 @@ function HomepageHeader() {
         <div className="w-full h-[120vh] absolute left-0 top-0 backdrop-blur-3xl bg-immich-bg/40 dark:bg-transparent"></div>
       </div>
       <section className="text-center pt-12 sm:pt-24 bg-immich-bg/50 dark:bg-immich-dark-bg/80">
-        <img
+        <ThemedImage
-          src={isDarkTheme ? 'img/logomark-dark.svg' : 'img/logomark-light.svg'}
+          sources={{ dark: 'img/logomark-dark.svg', light: 'img/logomark-light.svg' }}
           className="h-[115px] w-[115px] mb-2 antialiased rounded-none"
           alt="Immich logo"
         />
@@ -35,7 +33,6 @@ function HomepageHeader() {
             sacrificing your privacy.
           </p>
         </div>
-
         <div className="flex flex-col sm:flex-row place-items-center place-content-center mt-9 gap-4 ">
           <Link
             className="flex place-items-center place-content-center py-3 px-8 border bg-immich-primary dark:bg-immich-dark-primary rounded-xl no-underline hover:no-underline text-white hover:text-gray-50 dark:text-immich-dark-bg font-bold uppercase"
@@ -58,27 +55,27 @@ function HomepageHeader() {
             Buy Merch
           </Link>
         </div>
-
         <div className="my-12 flex gap-1 font-medium place-items-center place-content-center text-immich-primary dark:text-immich-dark-primary">
-          <Icon path={discordPath} size={1} />
+          <Icon
+            path={discordPath}
+            viewBox={discordViewBox} /* viewBox may show an error in your IDE but it is normal. */
+            size={1}
+          />
           <Link to="https://discord.immich.app/">Join our Discord</Link>
         </div>
-        <img
+        <ThemedImage
-          src={isDarkTheme ? '/img/screenshot-dark.webp' : '/img/screenshot-light.webp'}
+          sources={{ dark: '/img/screenshot-dark.webp', light: '/img/screenshot-light.webp' }}
           alt="screenshots"
           className="w-[95%] lg:w-[85%] xl:w-[70%] 2xl:w-[60%] "
         />
-
         <div className="mx-[25%] m-auto my-14 md:my-28">
           <hr className="border bg-gray-500 dark:bg-gray-400" />
         </div>
-
+        <ThemedImage
-        <img
+          sources={{ dark: 'img/logomark-dark.svg', light: 'img/logomark-light.svg' }}
-          src={isDarkTheme ? 'img/logomark-dark.svg' : 'img/logomark-light.svg'}
           className="h-[115px] w-[115px] mb-2 antialiased rounded-none"
           alt="Immich logo"
         />
-
         <div>
           <p className="font-bold text-2xl md:text-5xl ">Download the mobile app</p>
           <p className="text-lg">
@@ -97,9 +94,8 @@ function HomepageHeader() {
             </a>
           </div>
         </div>
-
+        <ThemedImage
-        <img
+          sources={{ dark: '/img/app-qr-code-dark.svg', light: '/img/app-qr-code-light.svg' }}
-          src={isDarkTheme ? '/img/app-qr-code-dark.svg' : '/img/app-qr-code-light.svg'}
           alt="app qr code"
           width={'150px'}
           className="shadow-lg p-3 my-8 dark:bg-immich-dark-bg "

docs/src/pages/privacy-policy.tsx

@@ -1,10 +1,7 @@
 import React from 'react';
 import Link from '@docusaurus/Link';
 import Layout from '@theme/Layout';
-import { useColorMode } from '@docusaurus/theme-common';
 function HomepageHeader() {
-  const { isDarkTheme } = useColorMode();
-
   return (
     <header>
       <section className="max-w-[900px] m-4 p-4 md:p-6 md:m-auto md:my-12 border border-red-400 rounded-2xl  bg-slate-200 dark:bg-immich-dark-gray">

docs/src/pages/roadmap.tsx

@@ -242,6 +242,13 @@ const roadmap: Item[] = [
 ];
 
 const milestones: Item[] = [
+  {
+    icon: mdiStar,
+    iconColor: 'gold',
+    title: '60,000 Stars',
+    description: 'Reached 60K Stars on GitHub!',
+    getDateLabel: withLanguage(new Date(2025, 2, 4)),
+  },
   withRelease({
     icon: mdiLinkEdit,
     iconColor: 'crimson',

docs/static/archived-versions.json

@@ -1,4 +1,40 @@
 [
+  {
+    "label": "v1.131.3",
+    "url": "https://v1.131.3.archive.immich.app"
+  },
+  {
+    "label": "v1.131.2",
+    "url": "https://v1.131.2.archive.immich.app"
+  },
+  {
+    "label": "v1.131.1",
+    "url": "https://v1.131.1.archive.immich.app"
+  },
+  {
+    "label": "v1.131.0",
+    "url": "https://v1.131.0.archive.immich.app"
+  },
+  {
+    "label": "v1.130.3",
+    "url": "https://v1.130.3.archive.immich.app"
+  },
+  {
+    "label": "v1.130.2",
+    "url": "https://v1.130.2.archive.immich.app"
+  },
+  {
+    "label": "v1.130.1",
+    "url": "https://v1.130.1.archive.immich.app"
+  },
+  {
+    "label": "v1.130.0",
+    "url": "https://v1.130.0.archive.immich.app"
+  },
+  {
+    "label": "v1.129.0",
+    "url": "https://v1.129.0.archive.immich.app"
+  },
   {
     "label": "v1.128.0",
     "url": "https://v1.128.0.archive.immich.app"

e2e/eslint.config.mjs

@@ -1,39 +1,29 @@
-import { FlatCompat } from '@eslint/eslintrc';
 import js from '@eslint/js';
-import typescriptEslint from '@typescript-eslint/eslint-plugin';
+import eslintPluginPrettierRecommended from 'eslint-plugin-prettier/recommended';
-import tsParser from '@typescript-eslint/parser';
+import eslintPluginUnicorn from 'eslint-plugin-unicorn';
 import globals from 'globals';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import typescriptEslint from 'typescript-eslint';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
-const compat = new FlatCompat({
-  baseDirectory: __dirname,
-  recommendedConfig: js.configs.recommended,
-  allConfig: js.configs.all,
-});
 
-export default [
+export default typescriptEslint.config([
+  eslintPluginUnicorn.configs.recommended,
+  eslintPluginPrettierRecommended,
+  js.configs.recommended,
+  typescriptEslint.configs.recommended,
   {
     ignores: ['eslint.config.mjs'],
   },
-  ...compat.extends(
-    'plugin:@typescript-eslint/recommended',
-    'plugin:prettier/recommended',
-    'plugin:unicorn/recommended',
-  ),
   {
-    plugins: {
-      '@typescript-eslint': typescriptEslint,
-    },
-
     languageOptions: {
       globals: {
         ...globals.node,
       },
 
-      parser: tsParser,
+      parser: typescriptEslint.parser,
       ecmaVersion: 5,
       sourceType: 'module',
 
@@ -62,4 +52,4 @@ export default [
       'object-shorthand': ['error', 'always'],
     },
   },
-];
+]);

e2e/package.json

@@ -1,6 +1,6 @@
 {
   "name": "immich-e2e",
-  "version": "1.128.0",
+  "version": "1.131.3",
   "description": "",
   "main": "index.js",
   "type": "module",
@@ -25,18 +25,16 @@
     "@immich/sdk": "file:../open-api/typescript-sdk",
     "@playwright/test": "^1.44.1",
     "@types/luxon": "^3.4.2",
-    "@types/node": "^22.13.5",
+    "@types/node": "^22.14.0",
     "@types/oidc-provider": "^8.5.1",
     "@types/pg": "^8.11.0",
     "@types/pngjs": "^6.0.4",
     "@types/supertest": "^6.0.2",
-    "@typescript-eslint/eslint-plugin": "^8.15.0",
-    "@typescript-eslint/parser": "^8.15.0",
     "@vitest/coverage-v8": "^3.0.0",
     "eslint": "^9.14.0",
     "eslint-config-prettier": "^10.0.0",
     "eslint-plugin-prettier": "^5.1.3",
-    "eslint-plugin-unicorn": "^56.0.1",
+    "eslint-plugin-unicorn": "^57.0.0",
     "exiftool-vendored": "^28.3.1",
     "globals": "^16.0.0",
     "jose": "^5.6.3",
@@ -49,6 +47,7 @@
     "socket.io-client": "^4.7.4",
     "supertest": "^7.0.0",
     "typescript": "^5.3.3",
+    "typescript-eslint": "^8.28.0",
     "utimes": "^5.2.1",
     "vitest": "^3.0.0"
   },

e2e/src/api/specs/asset.e2e-spec.ts

@@ -1141,7 +1141,7 @@ describe('/asset', () => {
             fNumber: 8,
             focalLength: 97,
             iso: 100,
-            lensModel: 'E PZ 18-105mm F4 G OSS',
+            lensModel: 'Sony E PZ 18-105mm F4 G OSS',
             fileSizeInByte: 25_001_984,
             dateTimeOriginal: '2016-09-27T10:51:44+00:00',
             orientation: '1',
@@ -1163,7 +1163,7 @@ describe('/asset', () => {
             fNumber: 22,
             focalLength: 25,
             iso: 100,
-            lensModel: 'E 25mm F2',
+            lensModel: 'Zeiss Batis 25mm F2',
             fileSizeInByte: 49_512_448,
             dateTimeOriginal: '2016-01-08T14:08:01+00:00',
             orientation: '1',
@@ -1234,7 +1234,7 @@ describe('/asset', () => {
             focalLength: 18.3,
             iso: 100,
             latitude: 36.613_24,
-            lensModel: 'GR LENS 18.3mm F2.8',
+            lensModel: '18.3mm F2.8',
             longitude: -121.897_85,
             make: 'RICOH IMAGING COMPANY, LTD.',
             model: 'RICOH GR III',
@@ -1257,6 +1257,7 @@ describe('/asset', () => {
 
       for (const { id, status } of assets) {
         expect(status).toBe(AssetMediaStatus.Created);
+        // longer timeout as the thumbnail generation from full-size raw files can take a while
         await utils.waitForWebsocketEvent({ event: 'assetUpload', id });
       }
 

e2e/src/api/specs/auth.e2e-spec.ts

@@ -5,7 +5,7 @@ import { app, utils } from 'src/utils';
 import request from 'supertest';
 import { beforeEach, describe, expect, it } from 'vitest';
 
-const { name, email, password } = signupDto.admin;
+const { email, password } = signupDto.admin;
 
 describe(`/auth/admin-sign-up`, () => {
   beforeEach(async () => {
@@ -13,33 +13,6 @@ describe(`/auth/admin-sign-up`, () => {
   });
 
   describe('POST /auth/admin-sign-up', () => {
-    const invalid = [
-      {
-        should: 'require an email address',
-        data: { name, password },
-      },
-      {
-        should: 'require a password',
-        data: { name, email },
-      },
-      {
-        should: 'require a name',
-        data: { email, password },
-      },
-      {
-        should: 'require a valid email',
-        data: { name, email: 'immich', password },
-      },
-    ];
-
-    for (const { should, data } of invalid) {
-      it(`should ${should}`, async () => {
-        const { status, body } = await request(app).post('/auth/admin-sign-up').send(data);
-        expect(status).toEqual(400);
-        expect(body).toEqual(errorDto.badRequest());
-      });
-    }
-
     it(`should sign up the admin`, async () => {
       const { status, body } = await request(app).post('/auth/admin-sign-up').send(signupDto.admin);
       expect(status).toBe(201);
@@ -57,14 +30,6 @@ describe(`/auth/admin-sign-up`, () => {
       });
     });
 
-    it('should transform email to lower case', async () => {
-      const { status, body } = await request(app)
-        .post('/auth/admin-sign-up')
-        .send({ ...signupDto.admin, email: 'aDmIn@IMMICH.cloud' });
-      expect(status).toEqual(201);
-      expect(body).toEqual(signupResponseDto.admin);
-    });
-
     it('should not allow a second admin to sign up', async () => {
       await signUpAdmin({ signUpDto: signupDto.admin });
 

e2e/src/api/specs/library.e2e-spec.ts

@@ -329,7 +329,7 @@ describe('/libraries', () => {
       const library = await utils.createLibrary(admin.accessToken, {
         ownerId: admin.userId,
         importPaths: [`${testAssetDirInternal}/temp`],
-        exclusionPatterns: ['**/directoryA'],
+        exclusionPatterns: ['**/directoryA/**'],
       });
 
       await utils.scan(admin.accessToken, library.id);
@@ -337,7 +337,82 @@ describe('/libraries', () => {
       const { assets } = await utils.searchAssets(admin.accessToken, { libraryId: library.id });
 
       expect(assets.count).toBe(1);
-      expect(assets.items[0].originalPath.includes('directoryB'));
+
+      expect(assets.items).toEqual(
+        expect.arrayContaining([
+          expect.objectContaining({ originalPath: expect.stringContaining('directoryB/assetB.png') }),
+        ]),
+      );
+    });
+
+    it('should scan external library with multiple exclusion patterns', async () => {
+      const library = await utils.createLibrary(admin.accessToken, {
+        ownerId: admin.userId,
+        importPaths: [`${testAssetDirInternal}/temp`],
+        exclusionPatterns: ['**/directoryA/**', '**/directoryB/**'],
+      });
+
+      await utils.scan(admin.accessToken, library.id);
+
+      const { assets } = await utils.searchAssets(admin.accessToken, { libraryId: library.id });
+
+      expect(assets.count).toBe(0);
+
+      expect(assets.items).toEqual([]);
+    });
+
+    it('should remove assets covered by a new exclusion pattern', async () => {
+      const library = await utils.createLibrary(admin.accessToken, {
+        ownerId: admin.userId,
+        importPaths: [`${testAssetDirInternal}/temp`],
+      });
+
+      await utils.scan(admin.accessToken, library.id);
+
+      {
+        const { assets } = await utils.searchAssets(admin.accessToken, { libraryId: library.id });
+
+        expect(assets.count).toBe(2);
+
+        expect(assets.items).toEqual(
+          expect.arrayContaining([
+            expect.objectContaining({ originalPath: expect.stringContaining('directoryA/assetA.png') }),
+            expect.objectContaining({ originalPath: expect.stringContaining('directoryB/assetB.png') }),
+          ]),
+        );
+      }
+
+      await utils.updateLibrary(admin.accessToken, library.id, {
+        exclusionPatterns: ['**/directoryA/**'],
+      });
+
+      await utils.scan(admin.accessToken, library.id);
+
+      {
+        const { assets } = await utils.searchAssets(admin.accessToken, { libraryId: library.id });
+
+        expect(assets.count).toBe(1);
+
+        expect(assets.items).toEqual(
+          expect.arrayContaining([
+            expect.objectContaining({ originalPath: expect.stringContaining('directoryB/assetB.png') }),
+          ]),
+        );
+      }
+
+      await utils.updateLibrary(admin.accessToken, library.id, {
+        exclusionPatterns: ['**/directoryA/**', '**/directoryB/**'],
+      });
+
+      await utils.scan(admin.accessToken, library.id);
+
+      {
+        const { assets } = await utils.searchAssets(admin.accessToken, { libraryId: library.id });
+
+        expect(assets.count).toBe(0);
+
+        expect(assets.items).toEqual([]);
+      }
     });
 
     it('should scan multiple import paths', async () => {
@@ -454,6 +529,133 @@ describe('/libraries', () => {
       utils.removeImageFile(`${testAssetDir}/temp/folder${char}2/asset2.png`);
     });
 
+    it('should respect exclusion patterns when using multiple import paths', async () => {
+      // https://github.com/immich-app/immich/issues/17121
+      const library = await utils.createLibrary(admin.accessToken, {
+        ownerId: admin.userId,
+        importPaths: [`${testAssetDirInternal}/temp/exclusion/`, `${testAssetDirInternal}/temp/exclusion2/`],
+      });
+
+      const excludedFolder = `Raw`;
+
+      utils.createImageFile(`${testAssetDir}/temp/exclusion/asset1.png`);
+      utils.createImageFile(`${testAssetDir}/temp/exclusion/${excludedFolder}/asset2.png`);
+
+      await utils.scan(admin.accessToken, library.id);
+
+      {
+        const { assets } = await utils.searchAssets(admin.accessToken, { libraryId: library.id });
+
+        expect(assets.items).toEqual(
+          expect.arrayContaining([
+            expect.objectContaining({ originalPath: expect.stringContaining(`/asset1.png`) }),
+            expect.objectContaining({ originalPath: expect.stringContaining(`${excludedFolder}/asset2.png`) }),
+          ]),
+        );
+      }
+
+      await utils.scan(admin.accessToken, library.id);
+
+      {
+        const { assets } = await utils.searchAssets(admin.accessToken, { libraryId: library.id });
+
+        expect(assets.items).toEqual(
+          expect.arrayContaining([
+            expect.objectContaining({ originalPath: expect.stringContaining(`/asset1.png`) }),
+            expect.objectContaining({ originalPath: expect.stringContaining(`${excludedFolder}/asset2.png`) }),
+          ]),
+        );
+      }
+
+      await utils.updateLibrary(admin.accessToken, library.id, { exclusionPatterns: [`**/${excludedFolder}/**`] });
+      await utils.scan(admin.accessToken, library.id);
+
+      {
+        const { assets } = await utils.searchAssets(admin.accessToken, { libraryId: library.id });
+
+        expect(assets.items).toEqual([
+          expect.objectContaining({ originalPath: expect.stringContaining(`/asset1.png`) }),
+        ]);
+      }
+
+      await utils.scan(admin.accessToken, library.id);
+
+      {
+        const { assets } = await utils.searchAssets(admin.accessToken, { libraryId: library.id });
+
+        expect(assets.items).toEqual([
+          expect.objectContaining({ originalPath: expect.stringContaining(`/asset1.png`) }),
+        ]);
+      }
+
+      utils.removeImageFile(`${testAssetDir}/temp/exclusion/asset1.png`);
+      utils.removeImageFile(`${testAssetDir}/temp/exclusion/${excludedFolder}/asset2.png`);
+    });
+
+    const annoyingExclusionPatterns = ['@', '#', '$', '%', '^', '&', '='];
+
+    it.each(annoyingExclusionPatterns)('should support exclusion patterns with %s', async (char) => {
+      const library = await utils.createLibrary(admin.accessToken, {
+        ownerId: admin.userId,
+        importPaths: [`${testAssetDirInternal}/temp/exclusion/`],
+      });
+
+      const excludedFolder = `${char}folder`;
+
+      utils.createImageFile(`${testAssetDir}/temp/exclusion/asset1.png`);
+      utils.createImageFile(`${testAssetDir}/temp/exclusion/${excludedFolder}/asset2.png`);
+
+      await utils.scan(admin.accessToken, library.id);
+
+      {
+        const { assets } = await utils.searchAssets(admin.accessToken, { libraryId: library.id });
+
+        expect(assets.items).toEqual(
+          expect.arrayContaining([
+            expect.objectContaining({ originalPath: expect.stringContaining(`/asset1.png`) }),
+            expect.objectContaining({ originalPath: expect.stringContaining(`${excludedFolder}/asset2.png`) }),
+          ]),
+        );
+      }
+
+      await utils.scan(admin.accessToken, library.id);
+
+      {
+        const { assets } = await utils.searchAssets(admin.accessToken, { libraryId: library.id });
+
+        expect(assets.items).toEqual(
+          expect.arrayContaining([
+            expect.objectContaining({ originalPath: expect.stringContaining(`/asset1.png`) }),
+            expect.objectContaining({ originalPath: expect.stringContaining(`${excludedFolder}/asset2.png`) }),
+          ]),
+        );
+      }
+
+      await utils.updateLibrary(admin.accessToken, library.id, { exclusionPatterns: [`**/${excludedFolder}/**`] });
+      await utils.scan(admin.accessToken, library.id);
+
+      {
+        const { assets } = await utils.searchAssets(admin.accessToken, { libraryId: library.id });
+
+        expect(assets.items).toEqual([
+          expect.objectContaining({ originalPath: expect.stringContaining(`/asset1.png`) }),
+        ]);
+      }
+
+      await utils.scan(admin.accessToken, library.id);
+
+      {
+        const { assets } = await utils.searchAssets(admin.accessToken, { libraryId: library.id });
+
+        expect(assets.items).toEqual([
+          expect.objectContaining({ originalPath: expect.stringContaining(`/asset1.png`) }),
+        ]);
+      }
+
+      utils.removeImageFile(`${testAssetDir}/temp/exclusion/asset1.png`);
+      utils.removeImageFile(`${testAssetDir}/temp/exclusion/${excludedFolder}/asset2.png`);
+    });
+
     it('should reimport a modified file', async () => {
       const library = await utils.createLibrary(admin.accessToken, {
         ownerId: admin.userId,
@@ -490,7 +692,7 @@ describe('/libraries', () => {
       utils.removeImageFile(`${testAssetDir}/temp/reimport/asset.jpg`);
     });
 
-    it('should not reimport unmodified files', async () => {
+    it('should not reimport a file with unchanged timestamp', async () => {
       const library = await utils.createLibrary(admin.accessToken, {
         ownerId: admin.userId,
         importPaths: [`${testAssetDirInternal}/temp/reimport`],
@@ -933,6 +1135,8 @@ describe('/libraries', () => {
 
       const { assets } = await utils.searchAssets(admin.accessToken, { libraryId: library.id });
 
+      expect(assets.count).toBe(1);
+
       utils.renameImageFile(`${testAssetDir}/temp/offline/offline.png`, `${testAssetDir}/temp/offline.png`);
 
       await utils.scan(admin.accessToken, library.id);
@@ -963,6 +1167,58 @@ describe('/libraries', () => {
       }
     });
 
+    it('should set a trashed offline asset to online but keep it in trash', async () => {
+      utils.createImageFile(`${testAssetDir}/temp/offline/offline.png`);
+
+      const library = await utils.createLibrary(admin.accessToken, {
+        ownerId: admin.userId,
+        importPaths: [`${testAssetDirInternal}/temp/offline`],
+      });
+
+      await utils.scan(admin.accessToken, library.id);
+
+      const { assets } = await utils.searchAssets(admin.accessToken, { libraryId: library.id });
+
+      expect(assets.count).toBe(1);
+
+      await utils.deleteAssets(admin.accessToken, [assets.items[0].id]);
+
+      {
+        const trashedAsset = await utils.getAssetInfo(admin.accessToken, assets.items[0].id);
+
+        expect(trashedAsset.isTrashed).toBe(true);
+      }
+
+      utils.renameImageFile(`${testAssetDir}/temp/offline/offline.png`, `${testAssetDir}/temp/offline.png`);
+
+      await utils.scan(admin.accessToken, library.id);
+
+      const offlineAsset = await utils.getAssetInfo(admin.accessToken, assets.items[0].id);
+      expect(offlineAsset.isTrashed).toBe(true);
+      expect(offlineAsset.originalPath).toBe(`${testAssetDirInternal}/temp/offline/offline.png`);
+      expect(offlineAsset.isOffline).toBe(true);
+
+      {
+        const { assets } = await utils.searchAssets(admin.accessToken, { libraryId: library.id, withDeleted: true });
+        expect(assets.count).toBe(1);
+      }
+
+      utils.renameImageFile(`${testAssetDir}/temp/offline.png`, `${testAssetDir}/temp/offline/offline.png`);
+
+      await utils.scan(admin.accessToken, library.id);
+
+      const backOnlineAsset = await utils.getAssetInfo(admin.accessToken, assets.items[0].id);
+
+      expect(backOnlineAsset.originalPath).toBe(`${testAssetDirInternal}/temp/offline/offline.png`);
+      expect(backOnlineAsset.isOffline).toBe(false);
+      expect(backOnlineAsset.isTrashed).toBe(true);
+
+      {
+        const { assets } = await utils.searchAssets(admin.accessToken, { libraryId: library.id, withDeleted: true });
+        expect(assets.count).toBe(1);
+      }
+    });
+
     it('should not set an offline asset to online if its file exists, is not covered by an exclusion pattern, but is outside of all import paths', async () => {
       utils.createImageFile(`${testAssetDir}/temp/offline/offline.png`);
 
@@ -1024,16 +1280,17 @@ describe('/libraries', () => {
 
       await utils.scan(admin.accessToken, library.id);
 
-      const { assets } = await utils.searchAssets(admin.accessToken, { libraryId: library.id });
+      {
+        const { assets: assetsBefore } = await utils.searchAssets(admin.accessToken, { libraryId: library.id });
+        expect(assetsBefore.count).toBe(1);
+      }
 
       utils.renameImageFile(`${testAssetDir}/temp/offline/offline.png`, `${testAssetDir}/temp/offline.png`);
 
       await utils.scan(admin.accessToken, library.id);
 
-      {
+      const { assets } = await utils.searchAssets(admin.accessToken, { libraryId: library.id, withDeleted: true });
-        const { assets } = await utils.searchAssets(admin.accessToken, { libraryId: library.id, withDeleted: true });
+      expect(assets.count).toBe(1);
-        expect(assets.count).toBe(1);
-      }
 
       const offlineAsset = await utils.getAssetInfo(admin.accessToken, assets.items[0].id);
 

e2e/src/api/specs/person.e2e-spec.ts

@@ -201,7 +201,7 @@ describe('/people', () => {
       expect(body).toMatchObject({
         id: expect.any(String),
         name: 'New Person',
-        birthDate: '1990-01-01T00:00:00.000Z',
+        birthDate: '1990-01-01',
       });
     });
 
@@ -262,7 +262,7 @@ describe('/people', () => {
         .set('Authorization', `Bearer ${admin.accessToken}`)
         .send({ birthDate: '1990-01-01' });
       expect(status).toBe(200);
-      expect(body).toMatchObject({ birthDate: '1990-01-01T00:00:00.000Z' });
+      expect(body).toMatchObject({ birthDate: '1990-01-01' });
     });
 
     it('should clear a date of birth', async () => {

e2e/src/api/specs/search.e2e-spec.ts

@@ -633,7 +633,6 @@ describe('/search', () => {
         .set('Authorization', `Bearer ${admin.accessToken}`);
       expect(body).toEqual([
         'Andalusia',
-        'Berlin',
         'Glarus',
         'Greater Accra',
         'Havana',
@@ -642,6 +641,7 @@ describe('/search', () => {
         'Mississippi',
         'New York',
         'Shanghai',
+        'State of Berlin',
         'St.-Petersburg',
         'Tbilisi',
         'Tokyo',
@@ -657,7 +657,6 @@ describe('/search', () => {
         .set('Authorization', `Bearer ${admin.accessToken}`);
       expect(body).toEqual([
         'Andalusia',
-        'Berlin',
         'Glarus',
         'Greater Accra',
         'Havana',
@@ -666,6 +665,7 @@ describe('/search', () => {
         'Mississippi',
         'New York',
         'Shanghai',
+        'State of Berlin',
         'St.-Petersburg',
         'Tbilisi',
         'Tokyo',

e2e/src/api/specs/shared-link.e2e-spec.ts

@@ -117,7 +117,7 @@ describe('/shared-links', () => {
       const resp = await request(shareUrl).get(`/${linkWithAssets.key}`);
       expect(resp.status).toBe(200);
       expect(resp.header['content-type']).toContain('text/html');
-      expect(resp.text).toContain(`<meta property="og:image" content="http://`);
+      expect(resp.text).toContain(`<meta property="og:image" content="https://my.immich.app`);
     });
   });
 
@@ -246,15 +246,7 @@ describe('/shared-links', () => {
       const { status, body } = await request(app).get('/shared-links/me').query({ key: linkWithMetadata.key });
 
       expect(status).toBe(200);
-      expect(body.assets).toHaveLength(1);
+      expect(body.assets).toHaveLength(0);
-      expect(body.assets[0]).toEqual(
-        expect.objectContaining({
-          originalFileName: 'example.png',
-          localDateTime: expect.any(String),
-          fileCreatedAt: expect.any(String),
-          exifInfo: expect.any(Object),
-        }),
-      );
       expect(body.album).toBeDefined();
     });
 

e2e/src/api/specs/user.e2e-spec.ts

@@ -31,33 +31,7 @@ describe('/users', () => {
     );
   });
 
-  describe('GET /users', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(app).get('/users');
-      expect(status).toBe(401);
-      expect(body).toEqual(errorDto.unauthorized);
-    });
-
-    it('should get users', async () => {
-      const { status, body } = await request(app).get('/users').set('Authorization', `Bearer ${admin.accessToken}`);
-      expect(status).toEqual(200);
-      expect(body).toHaveLength(2);
-      expect(body).toEqual(
-        expect.arrayContaining([
-          expect.objectContaining({ email: 'admin@immich.cloud' }),
-          expect.objectContaining({ email: 'user2@immich.cloud' }),
-        ]),
-      );
-    });
-  });
-
   describe('GET /users/me', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(app).get(`/users/me`);
-      expect(status).toBe(401);
-      expect(body).toEqual(errorDto.unauthorized);
-    });
-
     it('should not work for shared links', async () => {
       const album = await utils.createAlbum(admin.accessToken, { albumName: 'Album' });
       const sharedLink = await utils.createSharedLink(admin.accessToken, {
@@ -99,24 +73,6 @@ describe('/users', () => {
   });
 
   describe('PUT /users/me', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(app).put(`/users/me`);
-      expect(status).toBe(401);
-      expect(body).toEqual(errorDto.unauthorized);
-    });
-
-    for (const key of ['email', 'name']) {
-      it(`should not allow null ${key}`, async () => {
-        const dto = { [key]: null };
-        const { status, body } = await request(app)
-          .put(`/users/me`)
-          .set('Authorization', `Bearer ${admin.accessToken}`)
-          .send(dto);
-        expect(status).toBe(400);
-        expect(body).toEqual(errorDto.badRequest());
-      });
-    }
-
     it('should update first and last name', async () => {
       const before = await getMyUser({ headers: asBearerAuth(admin.accessToken) });
 
@@ -269,11 +225,6 @@ describe('/users', () => {
   });
 
   describe('GET /users/:id', () => {
-    it('should require authentication', async () => {
-      const { status } = await request(app).get(`/users/${admin.userId}`);
-      expect(status).toEqual(401);
-    });
-
     it('should get the user', async () => {
       const { status, body } = await request(app)
         .get(`/users/${admin.userId}`)
@@ -292,12 +243,6 @@ describe('/users', () => {
   });
 
   describe('GET /server/license', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(app).get('/users/me/license');
-      expect(status).toBe(401);
-      expect(body).toEqual(errorDto.unauthorized);
-    });
-
     it('should return the user license', async () => {
       await request(app)
         .put('/users/me/license')
@@ -315,11 +260,6 @@ describe('/users', () => {
   });
 
   describe('PUT /users/me/license', () => {
-    it('should require authentication', async () => {
-      const { status } = await request(app).put(`/users/me/license`);
-      expect(status).toEqual(401);
-    });
-
     it('should set the user license', async () => {
       const { status, body } = await request(app)
         .put(`/users/me/license`)

e2e/src/cli/specs/upload.e2e-spec.ts

@@ -22,7 +22,7 @@ const tests: Test[] = [
   },
   {
     test: 'should support paths with an asterisk',
-    paths: [`/photos\*/image1.jpg`],
+    paths: [`/photos*/image1.jpg`],
     files: {
       '/photos*/image1.jpg': true,
       '/photos*/image2.jpg': false,
@@ -40,7 +40,7 @@ const tests: Test[] = [
   },
   {
     test: 'should support paths with a single quote',
-    paths: [`/photos\'/image1.jpg`],
+    paths: [`/photos'/image1.jpg`],
     files: {
       "/photos'/image1.jpg": true,
       "/photos'/image2.jpg": false,
@@ -49,7 +49,7 @@ const tests: Test[] = [
   },
   {
     test: 'should support paths with a double quote',
-    paths: [`/photos\"/image1.jpg`],
+    paths: [`/photos"/image1.jpg`],
     files: {
       '/photos"/image1.jpg': true,
       '/photos"/image2.jpg': false,
@@ -67,7 +67,7 @@ const tests: Test[] = [
   },
   {
     test: 'should support paths with an opening brace',
-    paths: [`/photos\{/image1.jpg`],
+    paths: [`/photos{/image1.jpg`],
     files: {
       '/photos{/image1.jpg': true,
       '/photos{/image2.jpg': false,
@@ -76,7 +76,7 @@ const tests: Test[] = [
   },
   {
     test: 'should support paths with a closing brace',
-    paths: [`/photos\}/image1.jpg`],
+    paths: [`/photos}/image1.jpg`],
     files: {
       '/photos}/image1.jpg': true,
       '/photos}/image2.jpg': false,

e2e/src/utils.ts

@@ -493,7 +493,7 @@ export const utils = {
         value: accessToken,
         domain,
         path: '/',
-        expires: 1_742_402_728,
+        expires: 2_058_028_213,
         httpOnly: true,
         secure: false,
         sameSite: 'Lax',
@@ -503,7 +503,7 @@ export const utils = {
         value: 'password',
         domain,
         path: '/',
-        expires: 1_742_402_728,
+        expires: 2_058_028_213,
         httpOnly: true,
         secure: false,
         sameSite: 'Lax',
@@ -513,7 +513,7 @@ export const utils = {
         value: 'true',
         domain,
         path: '/',
-        expires: 1_742_402_728,
+        expires: 2_058_028_213,
         httpOnly: false,
         secure: false,
         sameSite: 'Lax',
@@ -537,6 +537,7 @@ export const utils = {
   },
 
   waitForQueueFinish: (accessToken: string, queue: keyof AllJobStatusResponseDto, ms?: number) => {
+    // eslint-disable-next-line no-async-promise-executor
     return new Promise<void>(async (resolve, reject) => {
       const timeout = setTimeout(() => reject(new Error('Timed out waiting for queue to empty')), ms || 10_000);
 

e2e/src/web/specs/photo-viewer.e2e-spec.ts

@@ -8,12 +8,14 @@ function imageLocator(page: Page) {
 test.describe('Photo Viewer', () => {
   let admin: LoginResponseDto;
   let asset: AssetMediaResponseDto;
+  let rawAsset: AssetMediaResponseDto;
 
   test.beforeAll(async () => {
     utils.initSdk();
     await utils.resetDatabase();
     admin = await utils.adminSetup();
     asset = await utils.createAsset(admin.accessToken);
+    rawAsset = await utils.createAsset(admin.accessToken, { assetData: { filename: 'test.arw' } });
   });
 
   test.beforeEach(async ({ context, page }) => {
@@ -36,7 +38,7 @@ test.describe('Photo Viewer', () => {
     await expect(page.getByTestId('loading-spinner')).toBeVisible();
   });
 
-  test('loads high resolution photo when zoomed', async ({ page }) => {
+  test('loads original photo when zoomed', async ({ page }) => {
     await page.goto(`/photos/${asset.id}`);
     await expect.poll(async () => await imageLocator(page).getAttribute('src')).toContain('thumbnail');
     const box = await imageLocator(page).boundingBox();
@@ -47,6 +49,17 @@ test.describe('Photo Viewer', () => {
     await expect.poll(async () => await imageLocator(page).getAttribute('src')).toContain('original');
   });
 
+  test('loads fullsize image when zoomed and original is web-incompatible', async ({ page }) => {
+    await page.goto(`/photos/${rawAsset.id}`);
+    await expect.poll(async () => await imageLocator(page).getAttribute('src')).toContain('thumbnail');
+    const box = await imageLocator(page).boundingBox();
+    expect(box).toBeTruthy();
+    const { x, y, width, height } = box!;
+    await page.mouse.move(x + width / 2, y + height / 2);
+    await page.mouse.wheel(0, -1);
+    await expect.poll(async () => await imageLocator(page).getAttribute('src')).toContain('fullsize');
+  });
+
   test('reloads photo when checksum changes', async ({ page }) => {
     await page.goto(`/photos/${asset.id}`);
     await expect.poll(async () => await imageLocator(page).getAttribute('src')).toContain('thumbnail');

e2e/src/web/specs/shared-link.e2e-spec.ts

@@ -45,10 +45,10 @@ test.describe('Shared Links', () => {
     await page.goto(`/share/${sharedLink.key}`);
     await page.getByRole('heading', { name: 'Test Album' }).waitFor();
     await page.locator(`[data-asset-id="${asset.id}"]`).hover();
-    await page.waitForSelector('#asset-group-by-date svg');
+    await page.waitForSelector('[data-group] svg');
     await page.getByRole('checkbox').click();
     await page.getByRole('button', { name: 'Download' }).click();
-    await page.getByText('DOWNLOADING', { exact: true }).waitFor();
+    await page.waitForEvent('download');
   });
 
   test('download all from shared link', async ({ page }) => {
@@ -56,6 +56,7 @@ test.describe('Shared Links', () => {
     await page.getByRole('heading', { name: 'Test Album' }).waitFor();
     await page.getByRole('button', { name: 'Download' }).click();
     await page.getByText('DOWNLOADING', { exact: true }).waitFor();
+    await page.waitForEvent('download');
   });
 
   test('enter password for a shared link', async ({ page }) => {

i18n/af.json

@@ -1,5 +1,5 @@
 {
-  "about": "Verfris",
+  "about": "Oor",
   "account": "Rekening",
   "account_settings": "Rekeninginstellings",
   "acknowledge": "Erken",
@@ -56,15 +56,16 @@
     "duplicate_detection_job_description": "Begin masjienleer op bates om soortgelyke beelde op te spoor. Maak staat op Smart Search",
     "exclusion_pattern_description": "Met uitsluitingspatrone kan jy lêers en vouers ignoreer wanneer jy jou biblioteek skandeer. Dit is nuttig as jy vouers het wat lêers bevat wat jy nie wil invoer nie, soos RAW-lêers.",
     "external_library_created_at": "Eksterne biblioteek (geskep op {date})",
-    "external_library_management": "Eksterne Biblioteek-opsies",
+    "external_library_management": "Eksterne Biblioteekbestuur",
-    "face_detection": "Gesigsopsporing",
+    "face_detection": "Gesig deteksie",
     "failed_job_command": "Opdrag {command} het misluk vir werk: {job}",
     "force_delete_user_warning": "WAARSKUWING: Dit sal onmiddellik die gebruiker en alle bates verwyder. Dit kan nie ontdoen word nie en die lêers kan nie herstel word nie.",
     "forcing_refresh_library_files": "Forseer herlaai van alle biblioteeklêers",
     "image_format": "Formaat",
     "image_format_description": "WebP produseer kleiner lêers as JPEG, maar is stadiger om te enkodeer.",
     "image_prefer_embedded_preview": "Verkies ingebedde voorskou",
-    "image_prefer_wide_gamut": "Verkies wye spektrum",
+    "image_prefer_wide_gamut": "Verkies wide gamut",
+    "image_prefer_wide_gamut_setting_description": "Gebruik Display P3 vir kleinkiekies. Dit behou die lewendheid van beelde met wye kleurruimtes beter, maar beelde kan anders verskyn op ou apparate met 'n ou blaaierweergawe. sRGB-beelde gebruik steeds sRGB om kleurverskuiwings te voorkom.",
     "image_preview_description": "Mediumgrootte prent met gestroopte metadata, wat gebruik word wanneer 'n enkele bate bekyk word en vir masjienleer",
     "image_preview_quality_description": "Voorskou kwaliteit van 1-100. Hoër is beter, maar produseer groter lêers en kan app-reaksie verminder. Die stel van 'n lae waarde kan masjienleerkwaliteit beïnvloed.",
     "image_preview_title": "Voorskou Instellings",
@@ -72,7 +73,14 @@
     "image_resolution": "Resolusie",
     "image_resolution_description": "Hoër resolusies kan meer detail bewaar, maar neem langer om te enkodeer, het groter lêergroottes en kan app-reaksie verminder.",
     "image_settings": "Prent Instellings",
-    "image_settings_description": "Bestuur die kwaliteit en resolusie van gegenereerde beelde"
+    "image_settings_description": "Bestuur die kwaliteit en resolusie van gegenereerde beelde",
+    "image_thumbnail_description": "Klein kleinkiekies sonder metadata, gebruik om groepe foto's soos die tydlyn te bekyk",
+    "image_thumbnail_quality_description": "Kleinkiekiekwaliteit van 1-100. Hoër is beter, maar produseer groter lêers en kan die toepassing vertraag.",
+    "image_thumbnail_title": "Kleinkiekie-instellings",
+    "job_concurrency": "{job} gelyktydigheid",
+    "job_created": "Taak gemaak",
+    "job_not_concurrency_safe": "Hierdie taak kan nie gelyktydig uitgevoer word nie.",
+    "job_settings": "Agtergrondtaakinstellings"
   },
   "search_by_description": "Soek by beskrywing",
   "search_by_description_example": "Stapdag in Sapa"

i18n/bg.json

@@ -20,7 +20,7 @@
   "add_partner": "Добавете партньор",
   "add_path": "Добави път",
   "add_photos": "Добавете снимки",
-  "add_to": "Добави към...",
+  "add_to": "Добави към…",
   "add_to_album": "Добави към албум",
   "add_to_shared_album": "Добави към споделен албум",
   "add_url": "Добави URL",
@@ -41,6 +41,7 @@
     "backup_settings": "Настройка на резервни копия",
     "backup_settings_description": "Управление на настройките за резервно копие на базата данни",
     "check_all": "Провери всичко",
+    "cleanup": "Почистване",
     "cleared_jobs": "Изчистени задачи от тип: {job}",
     "config_set_by_file": "Конфигурацията е зададена от файл",
     "confirm_delete_library": "Сигурни ли сте че искате да изтриете библиотеката - {library} ?",
@@ -96,7 +97,7 @@
     "library_scanning_enable_description": "Включване на периодичното сканиране на библиотеката",
     "library_settings": "Външна библиотека",
     "library_settings_description": "Управление на настройките за външна библиотека",
-    "library_tasks_description": "Извършване на задачи за библиотеката",
+    "library_tasks_description": "Сканирайте външни библиотеки за нови и/или променени активи",
     "library_watching_enable_description": "Наблюдаване за промяна на файловете във външната библиотека",
     "library_watching_settings": "Наблюдаване на библиотеката (ЕКСПЕРИМЕНТАЛНО)",
     "library_watching_settings_description": "Автоматично наблюдавай за променени файлове",
@@ -131,7 +132,7 @@
     "machine_learning_smart_search_description": "Семантично търсене на изображения с помощта на CLIP вграждания",
     "machine_learning_smart_search_enabled": "Включване на Интелигентно Търсене",
     "machine_learning_smart_search_enabled_description": "Ако е деактивирано, изображенията няма да бъдат кодирани за Интелигентно Търсене.",
-    "machine_learning_url_description": "URL на сървъра за машинно обучение. Ако са предоставени повече от един URL, всеки сървър ще бъде опитан един по един, докато един не отговори успешно, в реда от първия до последния.",
+    "machine_learning_url_description": "URL на сървъра за машинно обучение. Ако са предоставени повече от един URL, всеки сървър ще бъде опитан един по един, докато един отговори успешно, в реда от първия до последния. Сървъри, които не отговорят, ще бъдат временно игнорирани, докато не се върнат онлайн.",
     "manage_concurrency": "Управление на паралелност",
     "manage_log_settings": "Управление на настройките на записване",
     "map_dark_style": "Тъмен стил",
@@ -147,6 +148,8 @@
     "map_settings": "Карта",
     "map_settings_description": "Управление на настройките на картата",
     "map_style_description": "URL адрес към файл \"style.json\" за задаване на стил на картата",
+    "memory_cleanup_job": "Почистване на паметта",
+    "memory_generate_job": "Генериране на паметта",
     "metadata_extraction_job": "Извличане на метаданни",
     "metadata_extraction_job_description": "Извличане на метаданни от всеки от елемент, като GPS локация, лица и резолюция на файловете",
     "metadata_faces_import_setting": "Включи импорт на лице",
@@ -159,7 +162,6 @@
     "no_pattern_added": "Няма добавен модел",
     "note_apply_storage_label_previous_assets": "Забележка: За да приложите етикета за съхранение към предварително качени файлове, стартирайте",
     "note_cannot_be_changed_later": "ВНИМАНИЕ: Това не може да бъде променено по-късно!",
-    "note_unlimited_quota": "Бележка: Въведете 0 за да нямате лимит на квотата",
     "notification_email_from_address": "От адрес",
     "notification_email_from_address_description": "Електронна поща на изпращача, например: \"Immich Photo Server <noreply@example.com>\"",
     "notification_email_host_description": "Хост на сървъра за електронна поща (например: smtp.immich.app)",
@@ -219,7 +221,7 @@
     "reset_settings_to_default": "Възстановяване на настройките по подразбиране",
     "reset_settings_to_recent_saved": "Възстановяване на настройките до последните запазени настройки",
     "scanning_library": "Сканиране на библиотеката",
-    "search_jobs": "Търсене на задачи...",
+    "search_jobs": "Търсене на задачи…",
     "send_welcome_email": "Изпращане на имейл за добре дошли",
     "server_external_domain_settings": "Външен домейн",
     "server_external_domain_settings_description": "Домейн за публични споделени връзки, включително http(s)://",
@@ -299,7 +301,7 @@
     "transcoding_max_b_frames": "Максимални B-фрейма",
     "transcoding_max_b_frames_description": "По-високите стойности подобряват ефективността на компресията, но забавят разкодирането. Може да не е съвместим с хардуерното ускорение на по-стари устройства. 0 деактивира B-фрейма, докато -1 задава тази стойност автоматично.",
     "transcoding_max_bitrate": "Максимален битрейт",
-    "transcoding_max_bitrate_description": "Задаването на максимален битрейт може да направи размерите на файловете по-предвидими при незначителни разлики за качеството. При 720p типичните стойности са 2600k за VP9 или HEVC или 4500k за H.264. Деактивирано, ако е зададено на 0.",
+    "transcoding_max_bitrate_description": "Задаването на максимален битрейт може да направи размерите на файловете по-предвидими при незначителни разлики за качеството. При 720p типичните стойности са 2600 kbit/s за VP9 или HEVC или 4500 kbit/s за H.264. Деактивирано, ако е зададено на 0.",
     "transcoding_max_keyframe_interval": "Максимален интервал между ключовите кадри",
     "transcoding_max_keyframe_interval_description": "Задава максималното разстояние между ключовите кадри. По-ниските стойности влошават ефективността на компресията, но подобряват времето за търсене и могат да подобрят качеството в сцени с бързо движение. 0 задава тази стойност автоматично.",
     "transcoding_optimal_description": "Видеоклипове с по-висока от целевата разделителна способност или не в приетия формат",
@@ -391,6 +393,7 @@
   "allow_edits": "Позволяване на редакции",
   "allow_public_user_to_download": "Позволете на публичен потребител да може да изтегля",
   "allow_public_user_to_upload": "Позволете на публичния потребител да може да качва",
+  "alt_text_qr_code": "Изображение на QR код",
   "anti_clockwise": "Обратно на часовниковата стрелка",
   "api_key": "API ключ",
   "api_key_description": "Тази стойност ще бъде показана само веднъж. Моля, не забравяйте да го копирате, преди да затворите прозореца.",
@@ -406,17 +409,17 @@
   "are_these_the_same_person": "Това едно и също лице ли е?",
   "are_you_sure_to_do_this": "Сигурни ли сте, че искате да направите това?",
   "asset_added_to_album": "Добавено в албум",
-  "asset_adding_to_album": "Добавяне в албум...",
+  "asset_adding_to_album": "Добавяне в албум…",
   "asset_description_updated": "Описанието на елемента е обновено",
   "asset_filename_is_offline": "Активът {filename} е офлайн",
   "asset_has_unassigned_faces": "Елементът има незададени лица",
-  "asset_hashing": "Хеширане...",
+  "asset_hashing": "Хеширане…",
   "asset_offline": "Елементът е офлайн",
   "asset_offline_description": "Този външен актив вече не се намира на диска. Моля, свържете се с администратора на Immich за помощ.",
   "asset_skipped": "Пропуснато",
   "asset_skipped_in_trash": "В кошчето",
   "asset_uploaded": "Качено",
-  "asset_uploading": "Качване...",
+  "asset_uploading": "Качване…",
   "assets": "Елементи",
   "assets_added_count": "Добавено {count, plural, one {# asset} other {# assets}}",
   "assets_added_to_album_count": "Добавен(и) са {count, plural, one {# актив} other {# актива}} в албума",
@@ -481,6 +484,7 @@
   "comments_are_disabled": "Коментарите са деактивирани",
   "confirm": "Потвърди",
   "confirm_admin_password": "Потвърждаване на паролата на администратора",
+  "confirm_delete_face": "Сигурни ли сте, че искате да изтриете лицето на {name} от актива?",
   "confirm_delete_shared_link": "Сигурни ли сте, че искате да изтриете тази споделена връзка?",
   "confirm_keep_this_delete_others": "Всички останали файлове в стека ще бъдат изтрити, с изключение на този файл. Сигурни ли сте, че искате да продължите?",
   "confirm_password": "Потвърдете паролата",
@@ -533,6 +537,7 @@
   "delete_album": "Изтрий албум",
   "delete_api_key_prompt": "Сигурни ли сте, че искате да изтриете този API ключ?",
   "delete_duplicates_confirmation": "Сигурни ли сте, че искате да изтриете окончателно тези дубликати?",
+  "delete_face": "Изтрий лице",
   "delete_key": "Изтрий ключ",
   "delete_library": "Изтрий библиотека",
   "delete_link": "Изтрий линк",
@@ -600,6 +605,7 @@
   "enabled": "Включено",
   "end_date": "Крайна дата",
   "error": "Грешка",
+  "error_delete_face": "Грешка при изтриване на лице от актива",
   "error_loading_image": "Грешка при зареждане на изображението",
   "error_title": "Грешка - нещо се обърка",
   "errors": {
@@ -766,8 +772,10 @@
   "go_to_folder": "Отиди в папката",
   "go_to_search": "Преминаване към търсене",
   "group_albums_by": "Групирай албум по...",
+  "group_country": "Групирай по държава",
   "group_no": "Няма група",
   "group_owner": "Групиране по собственик",
+  "group_places_by": "Групирай места по…",
   "group_year": "Групиране по година",
   "has_quota": "Лимит",
   "hi_user": "Здравей, {name} {email}",
@@ -800,6 +808,7 @@
   "include_shared_albums": "Включване на споделени албуми",
   "include_shared_partner_assets": "Включване на споделените с партньор елементи",
   "individual_share": "Индивидуално споделяне",
+  "individual_shares": "Индивидуални споделяния",
   "info": "Информация",
   "interval": {
     "day_at_onepm": "Всеки ден в 13:00",
@@ -822,6 +831,7 @@
   "latest_version": "Последна версия",
   "latitude": "Ширина",
   "leave": "Излез",
+  "lens_model": "Модел леща",
   "let_others_respond": "Позволете на другите да отговорят",
   "level": "Ниво",
   "library": "Библиотека",
@@ -880,6 +890,7 @@
   "month": "Месец",
   "more": "Още",
   "moved_to_trash": "Преместено в кошчето",
+  "mute_memories": "Изключване на звука на спомените",
   "my_albums": "Мои албуми",
   "name": "Име",
   "name_or_nickname": "Име или прякор",
@@ -911,7 +922,6 @@
   "no_shared_albums_message": "Създайте албум, за да споделяте снимки и видеоклипове с хората в мрежата си",
   "not_in_any_album": "Не е в никой албум",
   "note_apply_storage_label_to_previously_uploaded assets": "Забележка: За да приложите етикета за съхранение към предварително качени активи, стартирайте",
-  "note_unlimited_quota": "Забележка: Въведете 0 за неограничена квота",
   "notes": "Бележки",
   "notification_toggle_setting_description": "Активиране на имейл известия",
   "notifications": "Известия",
@@ -984,6 +994,7 @@
   "pick_a_location": "Избери локация",
   "place": "Местоположение",
   "places": "Местоположения",
+  "places_count": "{count, plural, one {{count, number} Място} other {{count, number} Места}}",
   "play": "Възпроизвеждане",
   "play_memories": "Възпроизвеждане на спомени",
   "play_motion_photo": "Възпроизведи Motion Photo",
@@ -1067,10 +1078,12 @@
   "remove_from_shared_link": "Премахни от споделения линк",
   "remove_url": "Премахни URL",
   "remove_user": "Премахни потребителя",
-  "removed_api_key": "Премахни API Key: {name}",
+  "removed_api_key": "Премахат API ключ: {name}",
-  "removed_from_archive": "Премахни от Архива",
+  "removed_from_archive": "Премахни от архива",
-  "removed_from_favorites": "Премахнато от Любими",
+  "removed_from_favorites": "Премахнато от любими",
   "removed_from_favorites_count": "{count, plural, other {Премахнати #}} от Любими",
+  "removed_memory": "Премахнат спомен",
+  "removed_photo_from_memory": "Премахната снимка от спомен",
   "removed_tagged_assets": "Премахнат е етикетът от {count, plural, one {# елемент} other {# елемента}}",
   "rename": "Преименувай",
   "repair": "Поправи",
@@ -1079,6 +1092,7 @@
   "repository": "Хранилище",
   "require_password": "Изискай парола",
   "require_user_to_change_password_on_first_login": "Изисквай потребителят да промени паролата си при първото влизане",
+  "rescan": "Пресканиране",
   "reset": "Нулиране",
   "reset_password": "Нулиране на паролата",
   "reset_people_visibility": "Нулиране на видимостта на хората",
@@ -1107,18 +1121,22 @@
   "search": "Търсене",
   "search_albums": "Търси албуми",
   "search_by_context": "Търси по контекст",
+  "search_by_description": "Търси по описание",
+  "search_by_description_example": "Разходка в Сапа",
   "search_by_filename": "Търси по име на файла или разширение",
   "search_by_filename_example": "например IMG_1234.JPG или PNG",
   "search_camera_make": "Търси производител на камерата...",
   "search_camera_model": "Търси модел на камерата...",
   "search_city": "Търси град...",
   "search_country": "Търси държава...",
+  "search_for": "Търси за",
   "search_for_existing_person": "Търси съществуващ човек",
   "search_no_people": "Няма хора",
   "search_no_people_named": "Няма хора на име \"{name}\"",
   "search_options": "Опции за търсене",
   "search_people": "Търсете на хора",
   "search_places": "Търсене на места",
+  "search_rating": "Търси по рейтинг…",
   "search_settings": "Търсене на настройки",
   "search_state": "Търсене на щат...",
   "search_tags": "Търсене на етикети...",
@@ -1165,6 +1183,7 @@
   "shared_from_partner": "Снимки от {partner}",
   "shared_link_options": "Опции за споделена връзка",
   "shared_links": "Споделени връзки",
+  "shared_links_description": "Сподели снимки и видеа с линк",
   "shared_photos_and_videos_count": "{assetCount, plural, other {# споделени снимки и видеа.}}",
   "shared_with_partner": "Споделено с {partner}",
   "sharing": "Споделени",
@@ -1187,6 +1206,7 @@
   "show_person_options": "Показване на опции за лица",
   "show_progress_bar": "Показване на прогрес бара",
   "show_search_options": "Показване на опциите за търсене",
+  "show_shared_links": "Покажи споделени линкове",
   "show_slideshow_transition": "Покажи прехода на слайдшоуто",
   "show_supporter_badge": "Значка поддръжник",
   "show_supporter_badge_description": "Покажи значка поддръжник",
@@ -1240,6 +1260,7 @@
   "tag_created": "Създаден етикет: {tag}",
   "tag_feature_description": "Разглеждане на снимки и видеоклипове, групирани по теми с логически тагове",
   "tag_not_found_question": "Не можете да намерите етикет? Създайте такъв <link>тук</link>",
+  "tag_people": "Отбележи Хора",
   "tag_updated": "Актуализиран етикет: {tag}",
   "tagged_assets": "Тагнати {count, plural, one {# елемент} other {# елементи}}",
   "tags": "Етикет",
@@ -1274,11 +1295,13 @@
   "unfavorite": "Премахване от любимите",
   "unhide_person": "Покажи отново човека",
   "unknown": "Неизвестно",
+  "unknown_country": "Непозната Държава",
   "unknown_year": "Неизвестна година",
   "unlimited": "Неограничено",
   "unlink_motion_video": "Премахни връзката с видео",
   "unlink_oauth": "Премахни OAuth",
   "unlinked_oauth_account": "Премахни OAuth акаунт",
+  "unmute_memories": "Включване на звука на спомените",
   "unnamed_album": "Албум без име",
   "unnamed_album_delete_confirmation": "Сигурни ли сте, че искате да изтриете този албум?",
   "unnamed_share": "Споделяне без име",
@@ -1332,6 +1355,7 @@
   "view_all": "Преглед на всички",
   "view_all_users": "Преглед на всички потребители",
   "view_in_timeline": "Покажи във времева линия",
+  "view_link": "Преглед на връзката",
   "view_links": "Преглед на връзките",
   "view_name": "Прегледай",
   "view_next_asset": "Преглед на следващия файл",

i18n/bi.json

@@ -1,20 +1,22 @@
 {
-  "account": "",
+  "about": "abaot",
-  "account_settings": "",
+  "account": "Akaont",
-  "acknowledge": "",
+  "account_settings": "Seting blo Akaont",
+  "acknowledge": "Akcept",
   "action": "",
   "actions": "",
-  "active": "",
+  "active": "Stap Mekem",
-  "activity": "",
+  "activity": "Wanem hemi Mekem",
-  "add": "",
+  "activity_changed": "WAnem hemi Mekem hemi",
-  "add_a_description": "",
+  "add": "Ad",
-  "add_a_location": "",
+  "add_a_description": "Putem Description blo hem",
-  "add_a_name": "",
+  "add_a_location": "Putem place blo hem",
-  "add_a_title": "",
+  "add_a_name": "Putem nam blo hem",
-  "add_exclusion_pattern": "",
+  "add_a_title": "Putem wan name blo hem",
-  "add_import_path": "",
+  "add_exclusion_pattern": "Putem wan paten wae hemi karem aot",
-  "add_location": "",
+  "add_import_path": "Putem wan pat blo import",
-  "add_more_users": "",
+  "add_location": "Putem wan place blo hem",
+  "add_more_users": "Putem mor man",
   "add_partner": "",
   "add_path": "",
   "add_photos": "",
@@ -116,7 +118,6 @@
     "no_pattern_added": "",
     "note_apply_storage_label_previous_assets": "",
     "note_cannot_be_changed_later": "",
-    "note_unlimited_quota": "",
     "notification_email_from_address": "",
     "notification_email_from_address_description": "",
     "notification_email_host_description": "",
@@ -612,7 +613,6 @@
   "no_shared_albums_message": "",
   "not_in_any_album": "",
   "note_apply_storage_label_to_previously_uploaded assets": "",
-  "note_unlimited_quota": "",
   "notes": "",
   "notification_toggle_setting_description": "",
   "notifications": "",

i18n/et.json

@@ -41,6 +41,7 @@
     "backup_settings": "Varundamise seaded",
     "backup_settings_description": "Halda andmebaasi varundamise seadeid",
     "check_all": "Märgi kõik",
+    "cleanup": "Koristus",
     "cleared_jobs": "Tööted eemaldatud: {job}",
     "config_set_by_file": "Konfiguratsioon on määratud konfifaili abil",
     "confirm_delete_library": "Kas oled kindel, et soovid kustutada {library} kogu?",
@@ -65,6 +66,11 @@
     "forcing_refresh_library_files": "Kogu kõigi failide sundvärskendamine",
     "image_format": "Formaat",
     "image_format_description": "WebP failid on väiksemad kui JPEG, aga kodeerimine on aeglasem.",
+    "image_fullsize_description": "Täismõõdus pilt ilma metaandmeteta, kasutatakse sisse suumimisel",
+    "image_fullsize_enabled": "Luba täismõõdus piltide genereerimine",
+    "image_fullsize_enabled_description": "Genereeri mitte-veebisõbralike formaatide jaoks täismõõdus pilt. Kui \"Eelista manustatud eelvaadet\" on lubatud, kasutatakse manustatud eelvaateid otse ilma teisendamiseta. Ei mõjuta veebisõbralikke formaate nagu JPEG.",
+    "image_fullsize_quality_description": "Täismõõdus pildi kvaliteet vahemikus 1-100. Kõrgem väärtus on parem, aga tulemuseks on suuremad failid.",
+    "image_fullsize_title": "Täismõõdus pildi seaded",
     "image_prefer_embedded_preview": "Eelista manustatud eelvaadet",
     "image_prefer_embedded_preview_setting_description": "Kasuta pilditöötluse sisendina võimalusel RAW fotodesse manustatud eelvaateid. See võib mõnede piltide puhul anda tulemuseks täpsemad värvid, aga eelvaate kvaliteet sõltub konkreetsest kaamerast ning pildis võib olla rohkem tihendusmüra.",
     "image_prefer_wide_gamut": "Eelista laia värvigammat",
@@ -96,7 +102,7 @@
     "library_scanning_enable_description": "Luba kogu perioodiline skaneerimine",
     "library_settings": "Väline kogu",
     "library_settings_description": "Halda välise kogu seadeid",
-    "library_tasks_description": "Soorita kogu toiminguid",
+    "library_tasks_description": "Otsi välistest kogudest uusi ja muutunud üksuseid",
     "library_watching_enable_description": "Jälgi välises kogus failide muudatusi",
     "library_watching_settings": "Kogu jälgimine (EKSPERIMENTAALNE)",
     "library_watching_settings_description": "Jälgi automaatselt muutunud faile",
@@ -131,7 +137,7 @@
     "machine_learning_smart_search_description": "Otsi pilte semantiliselt CLIP-manuste abil",
     "machine_learning_smart_search_enabled": "Luba nutiotsing",
     "machine_learning_smart_search_enabled_description": "Kui keelatud, siis ei kodeerita pilte nutiotsingu jaoks.",
-    "machine_learning_url_description": "Masinõppe serveri URL. Kui ette on antud rohkem kui üks URL, proovitakse neid järjest ükshaaval, kuni üks edukalt vastab.",
+    "machine_learning_url_description": "Masinõppe serveri URL. Kui ette on antud rohkem kui üks URL, proovitakse neid järjest ükshaaval, kuni üks edukalt vastab. Servereid, mis ei vasta, ignoreeritakse ajutiselt, kuni ühendus taastub.",
     "manage_concurrency": "Halda samaaegsust",
     "manage_log_settings": "Halda logi seadeid",
     "map_dark_style": "Tume stiil",
@@ -147,6 +153,8 @@
     "map_settings": "Kaart",
     "map_settings_description": "Halda kaardi seadeid",
     "map_style_description": "Kaarditeema style.json URL",
+    "memory_cleanup_job": "Mälestuste korrastamine",
+    "memory_generate_job": "Mälestuste genereerimine",
     "metadata_extraction_job": "Metaandmete eraldamine",
     "metadata_extraction_job_description": "Eralda igast üksusest metaandmed, nagu GPS-koordinaadid, näod ja resolutsioon",
     "metadata_faces_import_setting": "Luba nägude import",
@@ -159,7 +167,6 @@
     "no_pattern_added": "Mustreid ei ole",
     "note_apply_storage_label_previous_assets": "Märkus: Et rakendada talletussilt varem üleslaaditud üksustele, käivita",
     "note_cannot_be_changed_later": "MÄRKUS: Seda ei saa hiljem muuta!",
-    "note_unlimited_quota": "Märkus: Piiramatu kvoodi jaoks sisesta 0",
     "notification_email_from_address": "Saatja aadress",
     "notification_email_from_address_description": "Saatja e-posti aadress, näiteks: \"Immich Photo Server <noreply@example.com>\"",
     "notification_email_host_description": "E-posti serveri host (nt. smtp.immich.app)",
@@ -240,7 +247,7 @@
     "storage_template_hash_verification_enabled_description": "Lülitab sisse räsi kontrolli; ära lülita seda välja, kui sa ei ole tagajärgedest teadlik",
     "storage_template_migration": "Talletusmalli migreerimine",
     "storage_template_migration_description": "Rakenda praegune <link>{template}</link> varem üleslaaditud üksustele",
-    "storage_template_migration_info": "Malli muudatused rakenduvad ainult uutele üksustele. Et rakendada malli tagasiulatuvalt varem üleslaaditud üksustele, käivita <link>{job}</link>.",
+    "storage_template_migration_info": "Talletusmall teeb kõik faililaiendid väiketähtedeks. Malli muudatused rakenduvad ainult uutele üksustele. Et rakendada malli tagasiulatuvalt varem üleslaaditud üksustele, käivita <link>{job}</link>.",
     "storage_template_migration_job": "Talletusmallide migreerimise tööde",
     "storage_template_more_details": "Et selle funktsiooni kohta rohkem teada saada, loe <template-link>talletusmallide</template-link> ja nende <implications-link>tagajärgede</implications-link> kohta",
     "storage_template_onboarding_description": "Kui sisse lülitatud, võimaldab see faile kasutaja määratud malli alusel automaatselt organiseerida. Stabiilsusprobleemide tõttu on see funktsioon vaikimisi välja lülitatud. Rohkem infot leiad <link>dokumentatsioonist</link>.",
@@ -299,7 +306,7 @@
     "transcoding_max_b_frames": "Maksimaalne B-kaadrite arv",
     "transcoding_max_b_frames_description": "Kõrgemad väärtused parandavad pakkimise efektiivsust, aga aeglustavad kodeerimist. See valik ei pruugi olla ühilduv riistvaralise kiirendusega vanematel seadmetel. 0 lülitab B-kaadrid välja, -1 määrab väärtuse automaatselt.",
     "transcoding_max_bitrate": "Maksimaalne bitisagedus",
-    "transcoding_max_bitrate_description": "Maksimaalse bitisageduse määramine teeb failisuurused ennustatavamaks, väikese kvaliteedikao hinnaga. 720p resolutsiooni puhul on tüüpilised väärtused 2600k (VP9 ja HEVC) või 4500k (H.264). Väärtus 0 eemaldab piirangu.",
+    "transcoding_max_bitrate_description": "Maksimaalse bitisageduse määramine teeb failisuurused ennustatavamaks, väikese kvaliteedikao hinnaga. 720p resolutsiooni puhul on tüüpilised väärtused 2600 kbit/s (VP9 ja HEVC) või 4500 kbit/s (H.264). Väärtus 0 eemaldab piirangu.",
     "transcoding_max_keyframe_interval": "Maksimaalne võtmekaadri intervall",
     "transcoding_max_keyframe_interval_description": "Määrab maksimaalse kauguse võtmekaadrite vahel. Madalamad väärtused vähendavad pakkimise efektiivsust, aga parandavad otsimiskiirust ning võivad tõsta kiire liikumisega stseenide kvaliteeti. 0 määrab väärtuse automaatselt.",
     "transcoding_optimal_description": "Kõrgema kui lubatud resolutsiooniga või mittelubatud formaadis videod",
@@ -391,6 +398,7 @@
   "allow_edits": "Luba muutmine",
   "allow_public_user_to_download": "Luba avalikul kasutajal alla laadida",
   "allow_public_user_to_upload": "Luba avalikul kasutajal üles laadida",
+  "alt_text_qr_code": "QR kood",
   "anti_clockwise": "Vastupäeva",
   "api_key": "API võti",
   "api_key_description": "Seda väärtust kuvatakse ainult üks kord. Kopeeri see enne akna sulgemist.",
@@ -431,7 +439,7 @@
   "assets_were_part_of_album_count": "{count, plural, one {Üksus oli} other {Üksused olid}} juba osa albumist",
   "authorized_devices": "Autoriseeritud seadmed",
   "back": "Tagasi",
-  "back_close_deselect": "Tagasi, sulge, või tühista valik",
+  "back_close_deselect": "Tagasi, sulge või tühista valik",
   "backward": "Tagasi",
   "birthdate_saved": "Sünnikuupäev salvestatud",
   "birthdate_set_description": "Sünnikuupäeva kasutatakse isiku vanuse arvutamiseks foto tegemise hetkel.",
@@ -481,6 +489,7 @@
   "comments_are_disabled": "Kommentaarid on keelatud",
   "confirm": "Kinnita",
   "confirm_admin_password": "Kinnita administraatori parool",
+  "confirm_delete_face": "Kas oled kindel, et soovid isiku {name} näo üksuselt kustutada?",
   "confirm_delete_shared_link": "Kas oled kindel, et soovid selle jagatud lingi kustutada?",
   "confirm_keep_this_delete_others": "Kõik muud üksused selles virnas kustutatakse. Kas oled kindel, et soovid jätkata?",
   "confirm_password": "Kinnita parool",
@@ -533,6 +542,7 @@
   "delete_album": "Kustuta album",
   "delete_api_key_prompt": "Kas oled kindel, et soovid selle API võtme kustutada?",
   "delete_duplicates_confirmation": "Kas oled kindel, et soovid need duplikaadid jäädavalt kustutada?",
+  "delete_face": "Kustuta nägu",
   "delete_key": "Kustuta võti",
   "delete_library": "Kustuta kogu",
   "delete_link": "Kustuta link",
@@ -600,6 +610,7 @@
   "enabled": "Lubatud",
   "end_date": "Lõppkuupäev",
   "error": "Viga",
+  "error_delete_face": "Viga näo kustutamisel",
   "error_loading_image": "Viga pildi laadimisel",
   "error_title": "Viga - midagi läks valesti",
   "errors": {
@@ -718,6 +729,7 @@
     "unable_to_submit_job": "Tööte edastamine ebaõnnestus",
     "unable_to_trash_asset": "Üksuse prügikasti liigutamine ebaõnnestus",
     "unable_to_unlink_account": "Konto lahtiühendamine ebaõnnestus",
+    "unable_to_unlink_motion_video": "Liikuva video linkimise tühistamine ebaõnnestus",
     "unable_to_update_album_cover": "Albumi kaanepildi muutmine ebaõnnestus",
     "unable_to_update_album_info": "Albumi info muutmine ebaõnnestus",
     "unable_to_update_library": "Kogu uuendamine ebaõnnestus",
@@ -734,6 +746,7 @@
   "expired": "Aegunud",
   "expires_date": "Aegub {date}",
   "explore": "Avasta",
+  "explorer": "Brauser",
   "export": "Ekspordi",
   "export_as_json": "Ekspordi JSON-formaati",
   "extension": "Laiend",
@@ -742,6 +755,7 @@
   "face_unassigned": "Seostamata",
   "failed_to_load_assets": "Üksuste laadimine ebaõnnestus",
   "favorite": "Lemmik",
+  "favorite_or_unfavorite_photo": "Lisa foto lemmikutesse või eemalda lemmikutest",
   "favorites": "Lemmikud",
   "feature_photo_updated": "Esiletõstetud foto muudetud",
   "features": "Funktsioonid",
@@ -799,6 +813,7 @@
   "include_shared_albums": "Kaasa jagatud albumid",
   "include_shared_partner_assets": "Kaasa partneri jagatud üksused",
   "individual_share": "Jagatud üksus",
+  "individual_shares": "Jagatud üksused",
   "info": "Info",
   "interval": {
     "day_at_onepm": "Iga päev kell 13",
@@ -828,6 +843,7 @@
   "library_options": "Kogu seaded",
   "light": "Hele",
   "like_deleted": "Meeldimine kustutatud",
+  "link_motion_video": "Lingi liikuv video",
   "link_options": "Lingi valikud",
   "link_to_oauth": "Ühenda OAuth",
   "linked_oauth_account": "OAuth konto ühendatud",
@@ -847,6 +863,7 @@
   "loop_videos": "Taasesita videod",
   "loop_videos_description": "Lülita sisse, et detailvaates videot automaatselt taasesitada.",
   "main_branch_warning": "Sa kasutad arendusversiooni; soovitame tungivalt kasutada väljalaskeversiooni!",
+  "main_menu": "Peamenüü",
   "make": "Mark",
   "manage_shared_links": "Halda jagatud linke",
   "manage_sharing_with_partners": "Halda partneritega jagamist",
@@ -879,6 +896,7 @@
   "month": "Kuu",
   "more": "Rohkem",
   "moved_to_trash": "Liigutatud prügikasti",
+  "mute_memories": "Vaigista mälestused",
   "my_albums": "Minu albumid",
   "name": "Nimi",
   "name_or_nickname": "Nimi või hüüdnimi",
@@ -910,7 +928,6 @@
   "no_shared_albums_message": "Lisa album, et fotosid ja videosid teistega jagada",
   "not_in_any_album": "Pole üheski albumis",
   "note_apply_storage_label_to_previously_uploaded assets": "Märkus: Et rakendada talletussilt varem üleslaaditud üksustele, käivita",
-  "note_unlimited_quota": "Märkus: Piiramatu kvoodi jaoks sisesta 0",
   "notes": "Märkused",
   "notification_toggle_setting_description": "Luba e-posti teel teavitused",
   "notifications": "Teavitused",
@@ -974,6 +991,7 @@
   "permanently_deleted_asset": "Üksus jäädavalt kustutatud",
   "permanently_deleted_assets_count": "{count, plural, one {# üksus} other {# üksust}} jäädavalt kustutatud",
   "person": "Isik",
+  "person_birthdate": "Sündinud {date}",
   "person_hidden": "{name}{hidden, select, true { (peidetud)} other {}}",
   "photo_shared_all_users": "Paistab, et oled oma fotosid kõigi kasutajatega jaganud, või pole ühtegi kasutajat, kellega jagada.",
   "photos": "Fotod",
@@ -1065,12 +1083,16 @@
   "remove_from_album": "Eemalda albumist",
   "remove_from_favorites": "Eemalda lemmikutest",
   "remove_from_shared_link": "Eemalda jagatud lingist",
+  "remove_memory": "Eemalda mälestus",
+  "remove_photo_from_memory": "Eemalda foto sellest mälestusest",
   "remove_url": "Eemalda URL",
   "remove_user": "Eemalda kasutaja",
   "removed_api_key": "API võti eemaldatud: {name}",
   "removed_from_archive": "Arhiivist eemaldatud",
   "removed_from_favorites": "Lemmikutest eemaldatud",
   "removed_from_favorites_count": "{count, plural, other {# eemaldatud}} lemmikutest",
+  "removed_memory": "Mäletus eemaldatud",
+  "removed_photo_from_memory": "Foto mälestustest eemaldatud",
   "removed_tagged_assets": "Silt eemaldatud {count, plural, one {# üksuselt} other {# üksuselt}}",
   "rename": "Nimeta ümber",
   "repair": "Parandus",
@@ -1079,6 +1101,7 @@
   "repository": "Koodihoidla",
   "require_password": "Nõua parooli",
   "require_user_to_change_password_on_first_login": "Nõua kasutajalt esmakordsel sisenemisel parooli muutmist",
+  "rescan": "Skaneeri uuesti",
   "reset": "Lähtesta",
   "reset_password": "Lähtesta parool",
   "reset_people_visibility": "Lähtesta isikute nähtavus",
@@ -1122,6 +1145,7 @@
   "search_options": "Otsingu valikud",
   "search_people": "Otsi inimesi",
   "search_places": "Otsi kohti",
+  "search_rating": "Otsi hinnangu järgi...",
   "search_settings": "Otsi seadeid",
   "search_state": "Otsi osariiki...",
   "search_tags": "Otsi silte...",
@@ -1131,6 +1155,7 @@
   "searching_locales": "Lokaatide otsimine...",
   "second": "Sekund",
   "see_all_people": "Vaata kõiki isikuid",
+  "select": "Vali",
   "select_album_cover": "Vali albumi kaanepilt",
   "select_all": "Vali kõik",
   "select_all_duplicates": "Vali kõik duplikaadid",
@@ -1225,7 +1250,7 @@
   "start_date": "Alguskuupäev",
   "state": "Osariik",
   "status": "Staatus",
-  "stop_motion_photo": "Peata liikuv pilt",
+  "stop_motion_photo": "Peata liikuv foto",
   "stop_photo_sharing": "Lõpeta oma fotode jagamine?",
   "stop_photo_sharing_description": "{partner} ei pääse rohkem su fotodele ligi.",
   "stop_sharing_photos_with_user": "Lõpeta oma fotode selle kasutajaga jagamine",
@@ -1245,6 +1270,7 @@
   "tag_created": "Lisatud silt: {tag}",
   "tag_feature_description": "Fotode ja videote lehitsemine siltide kaupa grupeeritult",
   "tag_not_found_question": "Ei leia silti? <link>Lisa uus silt.</link>",
+  "tag_people": "Sildista inimesi",
   "tag_updated": "Muudetud silt: {tag}",
   "tagged_assets": "{count, plural, one {# üksus} other {# üksust}} sildistatud",
   "tags": "Sildid",
@@ -1282,10 +1308,13 @@
   "unknown_country": "Tundmatu riik",
   "unknown_year": "Teadmata aasta",
   "unlimited": "Piiramatu",
+  "unlink_motion_video": "Tühista liikuva video linkimine",
   "unlink_oauth": "Eemalda OAuth ühendus",
   "unlinked_oauth_account": "OAuth ühendus eemaldatud",
+  "unmute_memories": "Tühista mälestuste vaigistamine",
   "unnamed_album": "Nimetu album",
   "unnamed_album_delete_confirmation": "Kas oled kindel, et soovid selle albumi kustutada?",
+  "unnamed_share": "Nimetu jagamine",
   "unsaved_change": "Salvestamata muudatus",
   "unselect_all": "Ära vali ühtegi",
   "unselect_all_duplicates": "Ära vali duplikaate",
@@ -1336,10 +1365,12 @@
   "view_all": "Vaata kõiki",
   "view_all_users": "Vaata kõiki kasutajaid",
   "view_in_timeline": "Vaata ajajoonel",
+  "view_link": "Vaata linki",
   "view_links": "Vaata linke",
   "view_name": "Vaade",
   "view_next_asset": "Vaata järgmist üksust",
   "view_previous_asset": "Vaata eelmist üksust",
+  "view_qr_code": "Vaata QR-koodi",
   "view_stack": "Vaata virna",
   "visibility_changed": "{count, plural, one {# isiku} other {# isiku}} nähtavus muudetud",
   "waiting": "Ootel",

i18n/eu.json

@@ -0,0 +1 @@
+{}

i18n/fa.json

@@ -132,7 +132,6 @@
     "no_pattern_added": "هیچ الگوی اضافه نشده",
     "note_apply_storage_label_previous_assets": "توجه: برای اعمال برچسب ذخیره سازی به دارایی هایی که قبلاً بارگذاری شده اند، دستور زیر را اجرا کنید",
     "note_cannot_be_changed_later": "توجه: این را نمی توان بعداً تغییر داد!",
-    "note_unlimited_quota": "توجه: برای سهمیه نامحدود، عدد 0 را وارد کنید",
     "notification_email_from_address": "آدرس فرستنده",
     "notification_email_from_address_description": "آدرس ایمیل فرستنده، به عنوان مثال:\"Immich سرور عکس <noreply@example.com>\"",
     "notification_email_host_description": "میزبان سرور ایمیل (مثلاً smtp.immich.app)",
@@ -254,7 +253,7 @@
     "transcoding_max_b_frames": "بیشترین B-frames",
     "transcoding_max_b_frames_description": "مقادیر بالاتر کارایی فشرده سازی را بهبود می‌بخشند، اما کدگذاری را کند می‌کنند. ممکن است با شتاب دهی سخت‌افزاری در دستگاه‌های قدیمی سازگار نباشد. مقدار( 0 ) B-frames را غیرفعال می‌کند، در حالی که مقدار ( 1 ) این مقدار را به صورت خودکار تنظیم می‌کند.",
     "transcoding_max_bitrate": "بیشترین بیت ریت",
-    "transcoding_max_bitrate_description": "تنظیم حداکثر بیت‌ریت می‌تواند اندازه فایل‌ها را در حدی قابل پیش‌بینی‌تر کند، هرچند که هزینه کمی برای کیفیت دارد. در وضوح 720p، مقادیر معمول 2600k برای VP9 یا HEVC و 4500k برای H.264 است. اگر به 0 تنظیم شود، غیرفعال می‌شود.",
+    "transcoding_max_bitrate_description": "تنظیم حداکثر بیت‌ریت می‌تواند اندازه فایل‌ها را در حدی قابل پیش‌بینی‌تر کند، هرچند که هزینه کمی برای کیفیت دارد. در وضوح 720p، مقادیر معمول 2600 kbit/s برای VP9 یا HEVC و 4500 kbit/s برای H.264 است. اگر به 0 تنظیم شود، غیرفعال می‌شود.",
     "transcoding_max_keyframe_interval": "حداکثر فاصله کلید فریم",
     "transcoding_max_keyframe_interval_description": "حداکثر فاصله فریم بین کلیدفریم‌ها را تنظیم می‌کند. مقادیر پایین‌تر کارایی فشرده‌سازی را کاهش می‌دهند، اما زمان جستجو را بهبود می‌بخشند و ممکن است کیفیت را در صحنه‌های با حرکت سریع بهبود دهند. مقدار 0 این مقدار را به‌طور خودکار تنظیم می‌کند.",
     "transcoding_optimal_description": "ویدیوهایی که از رزولوشن هدف بالاتر هستند یا در قالب پذیرفته شده نیستند",
@@ -664,7 +663,6 @@
   "no_shared_albums_message": "",
   "not_in_any_album": "در هیچ آلبومی نیست",
   "note_apply_storage_label_to_previously_uploaded assets": "",
-  "note_unlimited_quota": "",
   "notes": "یادداشت‌ها",
   "notification_toggle_setting_description": "اعلان‌های ایمیلی را فعال کنید",
   "notifications": "اعلان‌ها",

i18n/gl.json

@@ -1,15 +1,65 @@
 {
-  "action_common_back": "Back",
+  "about": "Acerca de",
-  "action_common_cancel": "Cancel",
+  "account": "Conta",
-  "action_common_clear": "Clear",
+  "account_settings": "Configuración da conta",
-  "action_common_confirm": "Confirm",
+  "acknowledge": "De acordo",
-  "action_common_save": "Save",
+  "action": "Acción",
-  "action_common_select": "Select",
   "action_common_update": "Update",
-  "add_a_name": "Add a name",
+  "actions": "Accións",
+  "active": "Activo",
+  "activity": "Actividade",
+  "activity_changed": "A actividade está {enabled, select, true {habilitada} other {deshabilitada}}",
+  "add": "Engadir",
+  "add_a_description": "Engadir unha descrición",
+  "add_a_location": "Engadir unha localización",
+  "add_a_name": "Engadir un nome",
+  "add_a_title": "Engadir un título",
   "add_endpoint": "Add endpoint",
+  "add_exclusion_pattern": "Engadir patrón de exclusión",
+  "add_import_path": "Engadir ruta de importación",
+  "add_location": "Engadir localización",
+  "add_more_users": "Engadir máis usuarios",
+  "add_partner": "Engadir compañeiro",
+  "add_path": "Engadir ruta",
+  "add_photos": "Engadir fotos",
+  "add_to": "Engadir a…",
+  "add_to_album": "Engadir ao álbum",
   "add_to_album_bottom_sheet_added": "Added to {album}",
   "add_to_album_bottom_sheet_already_exists": "Already in {album}",
+  "add_to_shared_album": "Engadir ao álbum compartido",
+  "add_url": "Engadir URL",
+  "added_to_archive": "Engadido ao arquivo",
+  "added_to_favorites": "Engadido a favoritos",
+  "added_to_favorites_count": "Engadidos {count, number} a favoritos",
+  "admin": {
+    "authentication_settings": "Configuración de autenticación",
+    "authentication_settings_description": "Xestionar contrasinal, OAuth e outros parámetros de autenticación",
+    "authentication_settings_disable_all": "Estás seguro de deshabilitar todos os métodos de inicio de sesión? Iniciar a sesión quedará completamente deshabilitado.",
+    "authentication_settings_reenable": "Para rehabilitala, usa un <link>Comando do servidor</link>.",
+    "background_task_job": "Tarefas en segundo plano",
+    "backup_database": "Respaldo da base de datos",
+    "backup_database_enable_description": "Habilitar as copias de seguridade da base de datos",
+    "backup_keep_last_amount": "Cantidade de copias de seguridade previas a manter",
+    "backup_settings": "Configuración de copias de seguridade",
+    "backup_settings_description": "Xestionar a configuración das copias de seguridade da base de datos",
+    "check_all": "Comprobar todo",
+    "cleared_jobs": "Traballos borrados para: {job}",
+    "config_set_by_file": "As configuracións están actualmente seleccionadas por un ficheiro de configuracións",
+    "confirm_delete_library": "Estás seguro de que queres eliminar a biblioteca {library}?",
+    "exclusion_pattern_description": "Os patróns de exclusión permítenche ignorar ficheiros e cartafoles ao escanear a túa biblioteca. Isto é útil se tes cartafoles que conteñen ficheiros que non queres importar, coma ficheiros RAW.",
+    "external_library_created_at": "Biblioteca externa (creada o {date})",
+    "external_library_management": "Xestión de bibliotecas externas",
+    "face_detection": "Detección de caras",
+    "job_settings": "Configuración de tarefas",
+    "job_settings_description": "Administrar tarefas simultáneas",
+    "job_status": "Estado da tarefa",
+    "jobs_failed": "{jobCount, one {# errado}, plural, other {# errados}}",
+    "note_cannot_be_changed_later": "NOTA: Non editable posteriormente!",
+    "notification_email_host_description": "Host do servidor de correo electrónico (p. ex.: smtp.immich.app)",
+    "notification_email_ignore_certificate_errors": "Ignorar erros de certificado",
+    "notification_email_ignore_certificate_errors_description": "Ignorar erros de validación de certificados TLS (non recomendado)",
+    "notification_settings": "Configuración de notificacións"
+  },
   "advanced_settings_log_level_title": "Log level: {}",
   "advanced_settings_prefer_remote_subtitle": "Some devices are painfully slow to load thumbnails from assets on the device. Activate this setting to load remote images instead.",
   "advanced_settings_prefer_remote_title": "Prefer remote images",
@@ -18,56 +68,49 @@
   "advanced_settings_self_signed_ssl_subtitle": "Skips SSL certificate verification for the server endpoint. Required for self-signed certificates.",
   "advanced_settings_self_signed_ssl_title": "Allow self-signed SSL certificates (EXPERIMENTAL)",
   "advanced_settings_tile_subtitle": "Advanced user's settings",
-  "advanced_settings_tile_title": "Advanced",
   "advanced_settings_troubleshooting_subtitle": "Enable additional features for troubleshooting",
   "advanced_settings_troubleshooting_title": "Troubleshooting",
   "album_info_card_backup_album_excluded": "EXCLUDED",
   "album_info_card_backup_album_included": "INCLUDED",
-  "albums": "Albums",
   "album_thumbnail_card_item": "1 item",
   "album_thumbnail_card_items": "{} items",
   "album_thumbnail_card_shared": " · Shared",
-  "album_thumbnail_owned": "Owned",
   "album_thumbnail_shared_by": "Shared by {}",
   "album_viewer_appbar_delete_confirm": "Are you sure you want to delete this album from your account?",
-  "album_viewer_appbar_share_delete": "Delete album",
   "album_viewer_appbar_share_err_delete": "Failed to delete album",
   "album_viewer_appbar_share_err_leave": "Failed to leave album",
   "album_viewer_appbar_share_err_remove": "There are problems in removing assets from album",
   "album_viewer_appbar_share_err_title": "Failed to change album title",
   "album_viewer_appbar_share_leave": "Leave album",
-  "album_viewer_appbar_share_remove": "Remove from album",
   "album_viewer_appbar_share_to": "Share To",
   "album_viewer_page_share_add_users": "Add users",
+  "albums": "Albums",
   "all": "All",
-  "all_people_page_title": "People",
-  "all_videos_page_title": "Videos",
   "app_bar_signout_dialog_content": "Are you sure you want to sign out?",
   "app_bar_signout_dialog_ok": "Yes",
   "app_bar_signout_dialog_title": "Sign out",
-  "archived": "Archived",
   "archive_page_no_archived_assets": "No archived assets found",
   "archive_page_title": "Archive ({})",
+  "archived": "Archived",
   "asset_action_delete_err_read_only": "Cannot delete read only asset(s), skipping",
   "asset_action_share_err_offline": "Cannot fetch offline asset(s), skipping",
   "asset_list_group_by_sub_title": "Group by",
   "asset_list_layout_settings_dynamic_layout_title": "Dynamic layout",
   "asset_list_layout_settings_group_automatically": "Automatic",
   "asset_list_layout_settings_group_by": "Group assets by",
-  "asset_list_layout_settings_group_by_month": "Month",
   "asset_list_layout_settings_group_by_month_day": "Month + day",
   "asset_list_layout_sub_title": "Layout",
   "asset_list_settings_subtitle": "Photo grid layout settings",
   "asset_list_settings_title": "Photo Grid",
   "asset_restored_successfully": "Asset restored successfully",
+  "asset_viewer_settings_subtitle": "Manage your gallery viewer settings",
+  "asset_viewer_settings_title": "Asset Viewer",
   "assets_deleted_permanently": "{} asset(s) deleted permanently",
   "assets_deleted_permanently_from_server": "{} asset(s) deleted permanently from the Immich server",
   "assets_removed_permanently_from_device": "{} asset(s) removed permanently from your device",
   "assets_restored_successfully": "{} asset(s) restored successfully",
   "assets_trashed": "{} asset(s) trashed",
   "assets_trashed_from_server": "{} asset(s) trashed from the Immich server",
-  "asset_viewer_settings_subtitle": "Manage your gallery viewer settings",
-  "asset_viewer_settings_title": "Asset Viewer",
   "automatic_endpoint_switching_subtitle": "Connect locally over designated Wi-Fi when available and use alternative connections elsewhere",
   "automatic_endpoint_switching_title": "Automatic URL switching",
   "background_location_permission": "Background location permission",
@@ -106,7 +149,6 @@
   "backup_controller_page_backup": "Backup",
   "backup_controller_page_backup_selected": "Selected: ",
   "backup_controller_page_backup_sub": "Backed up photos and videos",
-  "backup_controller_page_cancel": "Cancel",
   "backup_controller_page_created": "Created on: {}",
   "backup_controller_page_desc_backup": "Turn on foreground backup to automatically upload new assets to the server when opening the app.",
   "backup_controller_page_excluded": "Excluded: ",
@@ -117,14 +159,12 @@
   "backup_controller_page_none_selected": "None selected",
   "backup_controller_page_remainder": "Remainder",
   "backup_controller_page_remainder_sub": "Remaining photos and videos to back up from selection",
-  "backup_controller_page_select": "Select",
   "backup_controller_page_server_storage": "Server Storage",
   "backup_controller_page_start_backup": "Start Backup",
   "backup_controller_page_status_off": "Automatic foreground backup is off",
   "backup_controller_page_status_on": "Automatic foreground backup is on",
   "backup_controller_page_storage_format": "{} of {} used",
   "backup_controller_page_to_backup": "Albums to be backed up",
-  "backup_controller_page_total": "Total",
   "backup_controller_page_total_sub": "All unique photos and videos from selected albums",
   "backup_controller_page_turn_off": "Turn off foreground backup",
   "backup_controller_page_turn_on": "Turn on foreground backup",
@@ -132,7 +172,6 @@
   "backup_err_only_album": "Cannot remove the only album",
   "backup_info_card_assets": "assets",
   "backup_manual_cancelled": "Cancelled",
-  "backup_manual_failed": "Failed",
   "backup_manual_in_progress": "Upload already in progress. Try after some time",
   "backup_manual_success": "Success",
   "backup_manual_title": "Upload status",
@@ -172,46 +211,26 @@
   "client_cert_import": "Import",
   "client_cert_import_success_msg": "Client certificate is imported",
   "client_cert_invalid_msg": "Invalid certificate file or wrong password",
-  "client_cert_remove": "Remove",
   "client_cert_remove_msg": "Client certificate is removed",
   "client_cert_subtitle": "Supports PKCS12 (.p12, .pfx) format only. Certificate Import/Remove is available only before login",
   "client_cert_title": "SSL Client Certificate (EXPERIMENTAL)",
-  "common_add_to_album": "Add to album",
-  "common_change_password": "Change Password",
   "common_create_new_album": "Create new album",
   "common_server_error": "Please check your network connection, make sure the server is reachable and app/server versions are compatible.",
-  "common_shared": "Shared",
   "completed": "Completed",
-  "contextual_search": "Sunrise on the beach",
-  "control_bottom_app_bar_add_to_album": "Add to album",
-  "control_bottom_app_bar_album_info": "{} items",
   "control_bottom_app_bar_album_info_shared": "{} items · Shared",
-  "control_bottom_app_bar_archive": "Archive",
   "control_bottom_app_bar_create_new_album": "Create new album",
-  "control_bottom_app_bar_delete": "Delete",
   "control_bottom_app_bar_delete_from_immich": "Delete from Immich",
   "control_bottom_app_bar_delete_from_local": "Delete from device",
-  "control_bottom_app_bar_download": "Download",
-  "control_bottom_app_bar_edit": "Edit",
   "control_bottom_app_bar_edit_location": "Edit Location",
   "control_bottom_app_bar_edit_time": "Edit Date & Time",
-  "control_bottom_app_bar_favorite": "Favorite",
-  "control_bottom_app_bar_share": "Share",
   "control_bottom_app_bar_share_to": "Share To",
-  "control_bottom_app_bar_stack": "Stack",
   "control_bottom_app_bar_trash_from_immich": "Move to Trash",
-  "control_bottom_app_bar_unarchive": "Unarchive",
-  "control_bottom_app_bar_unfavorite": "Unfavorite",
-  "control_bottom_app_bar_upload": "Upload",
   "create_album": "Create album",
   "create_album_page_untitled": "Untitled",
   "create_new": "CREATE NEW",
-  "create_shared_album_page_create": "Create",
-  "create_shared_album_page_share": "Share",
   "create_shared_album_page_share_add_assets": "ADD ASSETS",
   "create_shared_album_page_share_select_photos": "Select Photos",
   "crop": "Crop",
-  "curated_location_page_title": "Places",
   "curated_object_page_title": "Things",
   "current_server_address": "Current server address",
   "daily_title_text_date": "E, MMM dd",
@@ -221,13 +240,10 @@
   "delete_dialog_alert_local": "These items will be permanently removed from your device but still be available on the Immich server",
   "delete_dialog_alert_local_non_backed_up": "Some of the items aren't backed up to Immich and will be permanently removed from your device",
   "delete_dialog_alert_remote": "These items will be permanently deleted from the Immich server",
-  "delete_dialog_cancel": "Cancel",
-  "delete_dialog_ok": "Delete",
   "delete_dialog_ok_force": "Delete Anyway",
   "delete_dialog_title": "Delete Permanently",
   "delete_local_dialog_ok_backed_up_only": "Delete Backed Up Only",
   "delete_local_dialog_ok_force": "Delete Anyway",
-  "delete_shared_link_dialog_content": "Are you sure you want to delete this shared link?",
   "delete_shared_link_dialog_title": "Delete Shared Link",
   "description_input_hint_text": "Add description...",
   "description_input_submit_error": "Error updating description, check the log for more details",
@@ -238,17 +254,14 @@
   "download_failed": "Download failed",
   "download_filename": "file: {}",
   "download_finished": "Download finished",
-  "downloading": "Downloading...",
-  "downloading_media": "Downloading media",
   "download_notfound": "Download not found",
   "download_paused": "Download paused",
   "download_started": "Download started",
   "download_sucess": "Download success",
   "download_sucess_android": "The media has been downloaded to DCIM/Immich",
   "download_waiting_to_retry": "Waiting to retry",
-  "edit_date_time_dialog_date_time": "Date and Time",
+  "downloading": "Downloading...",
-  "edit_date_time_dialog_timezone": "Timezone",
+  "downloading_media": "Downloading media",
-  "edit_image_title": "Edit",
   "edit_location_dialog_title": "Location",
   "end_date": "End date",
   "enqueued": "Enqueued",
@@ -258,7 +271,6 @@
   "exif_bottom_sheet_description": "Add Description...",
   "exif_bottom_sheet_details": "DETAILS",
   "exif_bottom_sheet_location": "LOCATION",
-  "exif_bottom_sheet_location_add": "Add a location",
   "exif_bottom_sheet_people": "PEOPLE",
   "exif_bottom_sheet_person_add_person": "Add name",
   "experimental_settings_new_asset_list_subtitle": "Work in progress",
@@ -270,8 +282,6 @@
   "failed": "Failed",
   "favorites": "Favorites",
   "favorites_page_no_favorites": "No favorite assets found",
-  "favorites_page_title": "Favorites",
-  "filename_search": "File name or extension",
   "filter": "Filter",
   "get_wifiname_error": "Could not get Wi-Fi name. Make sure you have granted the necessary permissions and are connected to a Wi-Fi network",
   "grant_permission": "Grant permission",
@@ -281,7 +291,6 @@
   "header_settings_field_validator_msg": "Value cannot be empty",
   "header_settings_header_name_input": "Header name",
   "header_settings_header_value_input": "Header value",
-  "header_settings_page_title": "Proxy Headers (EXPERIMENTAL)",
   "headers_settings_tile_subtitle": "Define proxy headers the app should send with each network request",
   "headers_settings_tile_title": "Custom proxy headers",
   "home_page_add_to_album_conflicts": "Added {added} assets to album {album}. {failed} assets are already in the album.",
@@ -301,40 +310,30 @@
   "ignore_icloud_photos": "Ignore iCloud photos",
   "ignore_icloud_photos_description": "Photos that are stored on iCloud will not be uploaded to the Immich server",
   "image_saved_successfully": "Image saved",
-  "image_viewer_page_state_provider_download_error": "Download Error",
   "image_viewer_page_state_provider_download_started": "Download Started",
   "image_viewer_page_state_provider_download_success": "Download Success",
   "image_viewer_page_state_provider_share_error": "Share Error",
   "invalid_date": "Invalid date",
   "invalid_date_format": "Invalid date format",
   "library": "Library",
-  "library_page_albums": "Albums",
-  "library_page_archive": "Archive",
   "library_page_device_albums": "Albums on Device",
-  "library_page_favorites": "Favorites",
   "library_page_new_album": "New album",
-  "library_page_sharing": "Sharing",
   "library_page_sort_asset_count": "Number of assets",
   "library_page_sort_created": "Created date",
   "library_page_sort_last_modified": "Last modified",
-  "library_page_sort_most_oldest_photo": "Oldest photo",
-  "library_page_sort_most_recent_photo": "Most recent photo",
   "library_page_sort_title": "Album title",
   "local_network": "Local network",
   "local_network_sheet_info": "The app will connect to the server through this URL when using the specified Wi-Fi network",
   "location_permission": "Location permission",
   "location_permission_content": "In order to use the auto-switching feature, Immich needs precise location permission so it can read the current WiFi network's name",
   "location_picker_choose_on_map": "Choose on map",
-  "location_picker_latitude": "Latitude",
   "location_picker_latitude_error": "Enter a valid latitude",
   "location_picker_latitude_hint": "Enter your latitude here",
-  "location_picker_longitude": "Longitude",
   "location_picker_longitude_error": "Enter a valid longitude",
   "location_picker_longitude_hint": "Enter your longitude here",
   "login_disabled": "Login has been disabled",
   "login_form_api_exception": "API exception. Please check the server URL and try again.",
   "login_form_back_button_text": "Back",
-  "login_form_button_text": "Login",
   "login_form_email_hint": "youremail@email.com",
   "login_form_endpoint_hint": "http://your-server-ip:port",
   "login_form_endpoint_url": "Server Endpoint URL",
@@ -347,9 +346,6 @@
   "login_form_failed_get_oauth_server_disable": "OAuth feature is not available on this server",
   "login_form_failed_login": "Error logging you in, check server URL, email and password",
   "login_form_handshake_exception": "There was an Handshake Exception with the server. Enable self-signed certificate support in the settings if you are using a self-signed certificate.",
-  "login_form_label_email": "Email",
-  "login_form_label_password": "Password",
-  "login_form_next_button": "Next",
   "login_form_password_hint": "password",
   "login_form_save_login": "Stay logged in",
   "login_form_server_empty": "Enter a server URL.",
@@ -359,7 +355,6 @@
   "map_assets_in_bound": "{} photo",
   "map_assets_in_bounds": "{} photos",
   "map_cannot_get_user_location": "Cannot get user's location",
-  "map_location_dialog_cancel": "Cancel",
   "map_location_dialog_yes": "Yes",
   "map_location_picker_page_use_location": "Use this location",
   "map_location_service_disabled_content": "Location service needs to be enabled to display assets from your current location. Do you want to enable it now?",
@@ -368,17 +363,13 @@
   "map_no_location_permission_content": "Location permission is needed to display assets from your current location. Do you want to allow it now?",
   "map_no_location_permission_title": "Location Permission denied",
   "map_settings_dark_mode": "Dark mode",
-  "map_settings_date_range_option_all": "All",
   "map_settings_date_range_option_day": "Past 24 hours",
   "map_settings_date_range_option_days": "Past {} days",
   "map_settings_date_range_option_year": "Past year",
   "map_settings_date_range_option_years": "Past {} years",
-  "map_settings_dialog_cancel": "Cancel",
-  "map_settings_dialog_save": "Save",
   "map_settings_dialog_title": "Map Settings",
   "map_settings_include_show_archived": "Include Archived",
   "map_settings_include_show_partners": "Include Partners",
-  "map_settings_only_relative_range": "Date range",
   "map_settings_only_show_favorites": "Show Favorite Only",
   "map_settings_theme_settings": "Map Theme",
   "map_zoom_to_see_photos": "Zoom out to see photos",
@@ -389,7 +380,6 @@
   "memories_year_ago": "A year ago",
   "memories_years_ago": "{} years ago",
   "monthly_title_text_date_format": "MMMM y",
-  "motion_photos_page_title": "Motion Photos",
   "multiselect_grid_edit_date_time_err_read_only": "Cannot edit date of read only asset(s), skipping",
   "multiselect_grid_edit_gps_err_read_only": "Cannot edit location of read only asset(s), skipping",
   "my_albums": "My albums",
@@ -397,25 +387,20 @@
   "networking_subtitle": "Manage the server endpoint settings",
   "no_assets_to_show": "No assets to show",
   "no_name": "No name",
-  "notification_permission_dialog_cancel": "Cancel",
+  "not_selected": "Not selected",
   "notification_permission_dialog_content": "To enable notifications, go to Settings and select allow.",
-  "notification_permission_dialog_settings": "Settings",
   "notification_permission_list_tile_content": "Grant permission to enable notifications.",
   "notification_permission_list_tile_enable_button": "Enable Notifications",
   "notification_permission_list_tile_title": "Notification Permission",
-  "not_selected": "Not selected",
   "on_this_device": "On this device",
   "partner_list_user_photos": "{user}'s photos",
   "partner_list_view_all": "View all",
-  "partner_page_add_partner": "Add partner",
   "partner_page_empty_message": "Your photos are not yet shared with any partner.",
   "partner_page_no_more_users": "No more users to add",
   "partner_page_partner_add_failed": "Failed to add partner",
   "partner_page_select_partner": "Select partner",
   "partner_page_shared_to_title": "Shared to",
   "partner_page_stop_sharing_content": "{} will no longer be able to access your photos.",
-  "partner_page_stop_sharing_title": "Stop sharing your photos?",
-  "partner_page_title": "Partner",
   "partners": "Partners",
   "paused": "Paused",
   "people": "People",
@@ -423,8 +408,6 @@
   "permission_onboarding_continue_anyway": "Continue anyway",
   "permission_onboarding_get_started": "Get started",
   "permission_onboarding_go_to_settings": "Go to settings",
-  "permission_onboarding_grant_permission": "Grant permission",
-  "permission_onboarding_log_out": "Log out",
   "permission_onboarding_permission_denied": "Permission denied. To use Immich, grant photo and video permissions in Settings.",
   "permission_onboarding_permission_granted": "Permission granted! You are all set.",
   "permission_onboarding_permission_limited": "Permission limited. To let Immich backup and manage your entire gallery collection, grant photo and video permissions in Settings.",
@@ -436,79 +419,45 @@
   "profile_drawer_client_out_of_date_major": "Mobile App is out of date. Please update to the latest major version.",
   "profile_drawer_client_out_of_date_minor": "Mobile App is out of date. Please update to the latest minor version.",
   "profile_drawer_client_server_up_to_date": "Client and Server are up-to-date",
-  "profile_drawer_documentation": "Documentation",
   "profile_drawer_github": "GitHub",
   "profile_drawer_server_out_of_date_major": "Server is out of date. Please update to the latest major version.",
   "profile_drawer_server_out_of_date_minor": "Server is out of date. Please update to the latest minor version.",
-  "profile_drawer_settings": "Settings",
-  "profile_drawer_sign_out": "Sign Out",
-  "profile_drawer_trash": "Trash",
   "recently_added": "Recently added",
   "recently_added_page_title": "Recently Added",
   "save": "Save",
   "save_to_gallery": "Save to gallery",
   "scaffold_body_error_occurred": "Error occurred",
   "search_albums": "Search albums",
-  "search_bar_hint": "Search your photos",
   "search_filter_apply": "Apply filter",
-  "search_filter_camera": "Camera",
-  "search_filter_camera_make": "Make",
-  "search_filter_camera_model": "Model",
   "search_filter_camera_title": "Select camera type",
   "search_filter_date": "Date",
   "search_filter_date_interval": "{start} to {end}",
   "search_filter_date_title": "Select a date range",
-  "search_filter_display_option_archive": "Archive",
-  "search_filter_display_option_favorite": "Favorite",
   "search_filter_display_option_not_in_album": "Not in album",
   "search_filter_display_options": "Display Options",
-  "search_filter_display_options_title": "Display options",
   "search_filter_location": "Location",
-  "search_filter_location_city": "City",
-  "search_filter_location_country": "Country",
-  "search_filter_location_state": "State",
   "search_filter_location_title": "Select location",
   "search_filter_media_type": "Media Type",
-  "search_filter_media_type_all": "All",
-  "search_filter_media_type_image": "Image",
   "search_filter_media_type_title": "Select media type",
-  "search_filter_media_type_video": "Video",
-  "search_filter_people": "People",
   "search_filter_people_title": "Select people",
   "search_page_categories": "Categories",
-  "search_page_favorites": "Favorites",
   "search_page_motion_photos": "Motion Photos",
   "search_page_no_objects": "No Objects Info Available",
   "search_page_no_places": "No Places Info Available",
-  "search_page_people": "People",
-  "search_page_person_add_name_dialog_cancel": "Cancel",
-  "search_page_person_add_name_dialog_hint": "Name",
-  "search_page_person_add_name_dialog_save": "Save",
-  "search_page_person_add_name_dialog_title": "Add a name",
-  "search_page_person_add_name_subtitle": "Find them fast by name with search",
-  "search_page_person_add_name_title": "Add a name",
-  "search_page_person_edit_name": "Edit name",
-  "search_page_places": "Places",
-  "search_page_recently_added": "Recently added",
   "search_page_screenshots": "Screenshots",
   "search_page_search_photos_videos": "Search for your photos and videos",
   "search_page_selfies": "Selfies",
   "search_page_things": "Things",
-  "search_page_videos": "Videos",
   "search_page_view_all_button": "View all",
   "search_page_your_activity": "Your activity",
   "search_page_your_map": "Your Map",
   "search_result_page_new_search_hint": "New Search",
   "search_suggestion_list_smart_search_hint_1": "Smart search is enabled by default, to search for metadata use the syntax ",
   "search_suggestion_list_smart_search_hint_2": "m:your-search-term",
-  "select_additional_user_for_sharing_page_suggestions": "Suggestions",
   "select_user_for_sharing_page_err_album": "Failed to create album",
-  "select_user_for_sharing_page_share_suggestions": "Suggestions",
   "server_endpoint": "Server Endpoint",
   "server_info_box_app_version": "App Version",
-  "server_info_box_latest_release": "Latest Version",
   "server_info_box_server_url": "Server URL",
-  "server_info_box_server_version": "Server Version",
   "setting_image_viewer_help": "The detail viewer loads the small thumbnail first, then loads the medium-size preview (if enabled), finally loads the original (if enabled).",
   "setting_image_viewer_original_subtitle": "Enable to load the original full-resolution image (large!). Disable to reduce data usage (both network and on device cache).",
   "setting_image_viewer_original_title": "Load original image",
@@ -527,48 +476,28 @@
   "setting_notifications_single_progress_subtitle": "Detailed upload progress information per asset",
   "setting_notifications_single_progress_title": "Show background backup detail progress",
   "setting_notifications_subtitle": "Adjust your notification preferences",
-  "setting_notifications_title": "Notifications",
   "setting_notifications_total_progress_subtitle": "Overall upload progress (done/total assets)",
   "setting_notifications_total_progress_title": "Show background backup total progress",
-  "setting_pages_app_bar_settings": "Settings",
-  "settings_require_restart": "Please restart Immich to apply this setting",
-  "setting_video_viewer_looping_subtitle": "Enable to automatically loop a video in the detail viewer.",
   "setting_video_viewer_looping_title": "Looping",
   "setting_video_viewer_original_video_subtitle": "When streaming a video from the server, play the original even when a transcode is available. May lead to buffering. Videos available locally are played in original quality regardless of this setting.",
   "setting_video_viewer_original_video_title": "Force original video",
-  "setting_video_viewer_title": "Videos",
+  "settings_require_restart": "Please restart Immich to apply this setting",
-  "share_add": "Add",
   "share_add_photos": "Add photos",
-  "share_add_title": "Add a title",
   "share_assets_selected": "{} selected",
-  "share_create_album": "Create album",
+  "share_dialog_preparing": "Preparing...",
   "shared_album_activities_input_disable": "Comment is disabled",
-  "shared_album_activities_input_hint": "Say something",
   "shared_album_activity_remove_content": "Do you want to delete this activity?",
   "shared_album_activity_remove_title": "Delete Activity",
-  "shared_album_activity_setting_subtitle": "Let others respond",
-  "shared_album_activity_setting_title": "Comments & likes",
   "shared_album_section_people_action_error": "Error leaving/removing from album",
   "shared_album_section_people_action_leave": "Remove user from album",
   "shared_album_section_people_action_remove_user": "Remove user from album",
-  "shared_album_section_people_owner_label": "Owner",
   "shared_album_section_people_title": "PEOPLE",
-  "share_dialog_preparing": "Preparing...",
   "shared_intent_upload_button_progress_text": "{} / {} Uploaded",
   "shared_link_app_bar_title": "Shared Links",
   "shared_link_clipboard_copied_massage": "Copied to clipboard",
   "shared_link_clipboard_text": "Link: {}\nPassword: {}",
-  "shared_link_create_app_bar_title": "Create link to share",
   "shared_link_create_error": "Error while creating shared link",
-  "shared_link_create_info": "Let anyone with the link see the selected photo(s)",
-  "shared_link_create_submit_button": "Create link",
-  "shared_link_edit_allow_download": "Allow public user to download",
-  "shared_link_edit_allow_upload": "Allow public user to upload",
-  "shared_link_edit_app_bar_title": "Edit link",
-  "shared_link_edit_change_expiry": "Change expiration time",
-  "shared_link_edit_description": "Description",
   "shared_link_edit_description_hint": "Enter the share description",
-  "shared_link_edit_expire_after": "Expire after",
   "shared_link_edit_expire_after_option_day": "1 day",
   "shared_link_edit_expire_after_option_days": "{} days",
   "shared_link_edit_expire_after_option_hour": "1 hour",
@@ -576,15 +505,10 @@
   "shared_link_edit_expire_after_option_minute": "1 minute",
   "shared_link_edit_expire_after_option_minutes": "{} minutes",
   "shared_link_edit_expire_after_option_months": "{} months",
-  "shared_link_edit_expire_after_option_never": "Never",
   "shared_link_edit_expire_after_option_year": "{} year",
-  "shared_link_edit_password": "Password",
   "shared_link_edit_password_hint": "Enter the share password",
-  "shared_link_edit_show_meta": "Show metadata",
   "shared_link_edit_submit_button": "Update link",
-  "shared_link_empty": "You don't have any shared links",
   "shared_link_error_server_url_fetch": "Cannot fetch the server url",
-  "shared_link_expired": "Expired",
   "shared_link_expires_day": "Expires in {} day",
   "shared_link_expires_days": "Expires in {} days",
   "shared_link_expires_hour": "Expires in {} hour",
@@ -595,35 +519,24 @@
   "shared_link_expires_second": "Expires in {} second",
   "shared_link_expires_seconds": "Expires in {} seconds",
   "shared_link_individual_shared": "Individual shared",
-  "shared_link_info_chip_download": "Download",
   "shared_link_info_chip_metadata": "EXIF",
-  "shared_link_info_chip_upload": "Upload",
   "shared_link_manage_links": "Manage Shared links",
-  "shared_link_public_album": "Public album",
   "shared_links": "Shared links",
-  "share_done": "Done",
   "shared_with_me": "Shared with me",
-  "share_invite": "Invite to album",
   "sharing_page_album": "Shared albums",
   "sharing_page_description": "Create shared albums to share photos and videos with people in your network.",
   "sharing_page_empty_list": "EMPTY LIST",
   "sharing_silver_appbar_create_shared_album": "New shared album",
-  "sharing_silver_appbar_shared_links": "Shared links",
   "sharing_silver_appbar_share_partner": "Share with partner",
   "start_date": "Start date",
   "sync": "Sync",
   "sync_albums": "Sync albums",
   "sync_albums_manual_subtitle": "Sync all uploaded videos and photos to the selected backup albums",
   "sync_upload_album_setting_subtitle": "Create and upload your photos and videos to the selected albums on Immich",
-  "tab_controller_nav_library": "Library",
-  "tab_controller_nav_photos": "Photos",
-  "tab_controller_nav_search": "Search",
-  "tab_controller_nav_sharing": "Sharing",
   "theme_setting_asset_list_storage_indicator_title": "Show storage indicator on asset tiles",
   "theme_setting_asset_list_tiles_per_row_title": "Number of assets per row ({})",
   "theme_setting_colorful_interface_subtitle": "Apply primary color to background surfaces.",
   "theme_setting_colorful_interface_title": "Colorful interface",
-  "theme_setting_dark_mode_switch": "Dark mode",
   "theme_setting_image_viewer_quality_subtitle": "Adjust the quality of the detail image viewer",
   "theme_setting_image_viewer_quality_title": "Image viewer quality",
   "theme_setting_primary_color_subtitle": "Pick a color for primary actions and accents.",
@@ -631,43 +544,36 @@
   "theme_setting_system_primary_color_title": "Use system color",
   "theme_setting_system_theme_switch": "Automatic (Follow system setting)",
   "theme_setting_theme_subtitle": "Choose the app's theme setting",
-  "theme_setting_theme_title": "Theme",
   "theme_setting_three_stage_loading_subtitle": "Three-stage loading might increase the loading performance but causes significantly higher network load",
   "theme_setting_three_stage_loading_title": "Enable three-stage loading",
-  "translated_text_options": "Options",
   "trash": "Trash",
   "trash_emptied": "Emptied trash",
-  "trash_page_delete": "Delete",
   "trash_page_delete_all": "Delete All",
-  "trash_page_empty_trash_btn": "Empty trash",
   "trash_page_empty_trash_dialog_content": "Do you want to empty your trashed assets? These items will be permanently removed from Immich",
-  "trash_page_empty_trash_dialog_ok": "Ok",
   "trash_page_info": "Trashed items will be permanently deleted after {} days",
   "trash_page_no_assets": "No trashed assets",
-  "trash_page_restore": "Restore",
   "trash_page_restore_all": "Restore All",
   "trash_page_select_assets_btn": "Select assets",
-  "trash_page_select_btn": "Select",
   "trash_page_title": "Trash ({})",
   "upload": "Upload",
-  "upload_dialog_cancel": "Cancel",
   "upload_dialog_info": "Do you want to backup the selected Asset(s) to the server?",
-  "upload_dialog_ok": "Upload",
   "upload_dialog_title": "Upload Asset",
-  "uploading": "Uploading",
   "upload_to_immich": "Upload to Immich ({})",
+  "uploading": "Uploading",
   "use_current_connection": "use current connection",
   "validate_endpoint_error": "Please enter a valid URL",
-  "version_announcement_overlay_ack": "Acknowledge",
   "version_announcement_overlay_release_notes": "release notes",
   "version_announcement_overlay_text_1": "Hi friend, there is a new release of",
   "version_announcement_overlay_text_2": "please take your time to visit the ",
   "version_announcement_overlay_text_3": " and ensure your docker-compose and .env setup is up-to-date to prevent any misconfigurations, especially if you use WatchTower or any mechanism that handles updating your server application automatically.",
-  "version_announcement_overlay_title": "New Server Version Available \uD83C\uDF89",
+  "version_announcement_overlay_title": "New Server Version Available 🎉",
   "videos": "Videos",
   "viewer_remove_from_stack": "Remove from Stack",
   "viewer_stack_use_as_main_asset": "Use as Main Asset",
   "viewer_unstack": "Un-Stack",
   "wifi_name": "WiFi Name",
-  "your_wifi_name": "Your WiFi name"
+  "year": "Ano",
+  "yes": "Si",
+  "your_wifi_name": "Your WiFi name",
+  "zoom_image": "Acercar imaxe"
 }