update all

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-ARG BASEIMAGE=mcr.microsoft.com/devcontainers/typescript-node:22@sha256:a20b8a3538313487ac9266875bbf733e544c1aa2091df2bb99ab592a6d4f7399
+ARG BASEIMAGE=mcr.microsoft.com/devcontainers/typescript-node:22@sha256:b0b88ef6a5abf21194343d2c5b2829dddd9be1142f65f6a5e4390a51d5a70dd8
 FROM ${BASEIMAGE}
 
 # Flutter SDK

.github/.nvmrc

@@ -1 +1 @@
-22.15.0
+22.14.0

.github/actions/image-build/action.yml

@@ -1,118 +0,0 @@
-name: 'Single arch image build'
-description: 'Build single-arch image on platform appropriate runner'
-inputs:
-  image:
-    description: 'Name of the image to build'
-    required: true
-  ghcr-token:
-    description: 'GitHub Container Registry token'
-    required: true
-  platform:
-    description: 'Platform to build for'
-    required: true
-  artifact-key-base:
-    description: 'Base key for artifact name'
-    required: true
-  context:
-    description: 'Path to build context'
-    required: true
-  dockerfile:
-    description: 'Path to Dockerfile'
-    required: true
-  build-args:
-    description: 'Docker build arguments'
-    required: false
-runs:
-  using: 'composite'
-  steps:
-    - name: Prepare
-      id: prepare
-      shell: bash
-      env:
-        PLATFORM: ${{ inputs.platform }}
-      run: |
-        echo "platform-pair=${PLATFORM//\//-}" >> $GITHUB_OUTPUT
-
-    - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
-
-    - name: Login to GitHub Container Registry
-      uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
-      if: ${{ !github.event.pull_request.head.repo.fork }}
-      with:
-        registry: ghcr.io
-        username: ${{ github.repository_owner }}
-        password: ${{ inputs.ghcr-token }}
-
-    - name: Generate cache key suffix
-      id: cache-key-suffix
-      shell: bash
-      env:
-        REF: ${{ github.ref_name }}
-      run: |
-        if [[ "${{ github.event_name }}" == "pull_request" ]]; then
-          echo "cache-key-suffix=pr-${{ github.event.number }}" >> $GITHUB_OUTPUT
-        else
-          SUFFIX=$(echo "${REF}" | sed 's/[^a-zA-Z0-9]/-/g')
-          echo "suffix=${SUFFIX}" >> $GITHUB_OUTPUT
-        fi
-
-    - name: Generate cache target
-      id: cache-target
-      shell: bash
-      env:
-        BUILD_ARGS: ${{ inputs.build-args }}
-        IMAGE: ${{ inputs.image }}
-        SUFFIX: ${{ steps.cache-key-suffix.outputs.suffix }}
-        PLATFORM_PAIR: ${{ steps.prepare.outputs.platform-pair }}
-      run: |
-        HASH=$(sha256sum <<< "${BUILD_ARGS}" | cut -d' ' -f1)
-        CACHE_KEY="${PLATFORM_PAIR}-${HASH}"
-        echo "cache-key-base=${CACHE_KEY}" >> $GITHUB_OUTPUT
-        if [[ "${{ github.event.pull_request.head.repo.fork }}" == "true" ]]; then
-          # Essentially just ignore the cache output (forks can't write to registry cache)
-          echo "cache-to=type=local,dest=/tmp/discard,ignore-error=true" >> $GITHUB_OUTPUT
-        else
-          echo "cache-to=type=registry,ref=${IMAGE}-build-cache:${CACHE_KEY}-${SUFFIX},mode=max,compression=zstd" >> $GITHUB_OUTPUT
-        fi
-
-    - name: Generate docker image tags
-      id: meta
-      uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5
-      env:
-        DOCKER_METADATA_PR_HEAD_SHA: 'true'
-
-    - name: Build and push image
-      id: build
-      uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
-      with:
-        context: ${{ inputs.context }}
-        file: ${{ inputs.dockerfile }}
-        platforms: ${{ inputs.platform }}
-        labels: ${{ steps.meta.outputs.labels }}
-        cache-to: ${{ steps.cache-target.outputs.cache-to }}
-        cache-from: |
-          type=registry,ref=${{ inputs.image }}-build-cache:${{ steps.cache-target.outputs.cache-key-base }}-${{ steps.cache-key-suffix.outputs.suffix }}
-          type=registry,ref=${{ inputs.image }}-build-cache:${{ steps.cache-target.outputs.cache-key-base }}-main
-        outputs: type=image,"name=${{ inputs.image }}",push-by-digest=true,name-canonical=true,push=${{ !github.event.pull_request.head.repo.fork }}
-        build-args: |
-          BUILD_ID=${{ github.run_id }}
-          BUILD_IMAGE=${{ github.event_name == 'release' && github.ref_name || steps.meta.outputs.tags }}
-          BUILD_SOURCE_REF=${{ github.ref_name }}
-          BUILD_SOURCE_COMMIT=${{ github.sha }}
-          ${{ inputs.build-args }}
-
-    - name: Export digest
-      shell: bash
-      run: | # zizmor: ignore[template-injection]
-        mkdir -p ${{ runner.temp }}/digests
-        digest="${{ steps.build.outputs.digest }}"
-        touch "${{ runner.temp }}/digests/${digest#sha256:}"
-
-    - name: Upload digest
-      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-      with:
-        name: ${{ inputs.artifact-key-base }}-${{ steps.cache-target.outputs.cache-key-base }}
-        path: ${{ runner.temp }}/digests/*
-        if-no-files-found: error
-        retention-days: 1

.github/workflows/build-mobile.yml

@@ -7,15 +7,6 @@ on:
       ref:
         required: false
         type: string
-    secrets:
-      KEY_JKS:
-        required: true
-      ALIAS:
-        required: true
-      ANDROID_KEY_PASSWORD:
-        required: true
-      ANDROID_STORE_PASSWORD:
-        required: true
   pull_request:
   push:
     branches: [main]
@@ -24,23 +15,16 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions: {}
-
 jobs:
   pre-job:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     outputs:
       should_run: ${{ steps.found_paths.outputs.mobile == 'true' || steps.should_force.outputs.should_force == 'true' }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - id: found_paths
-        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
         with:
           filters: |
             mobile:
@@ -54,26 +38,31 @@ jobs:
   build-sign-android:
     name: Build and sign Android
     needs: pre-job
-    permissions:
-      contents: read
     # Skip when PR from a fork
     if: ${{ !github.event.pull_request.head.repo.fork && github.actor != 'dependabot[bot]' && needs.pre-job.outputs.should_run == 'true' }}
     runs-on: macos-14
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          ref: ${{ inputs.ref || github.sha }}
-          persist-credentials: false
+      - name: Determine ref
+        id: get-ref
+        run: |
+          input_ref="${{ inputs.ref }}"
+          github_ref="${{ github.sha }}"
+          ref="${input_ref:-$github_ref}"
+          echo "ref=$ref" >> $GITHUB_OUTPUT
 
-      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          ref: ${{ steps.get-ref.outputs.ref }}
+
+      - uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4
         with:
           distribution: 'zulu'
           java-version: '17'
           cache: 'gradle'
 
       - name: Setup Flutter SDK
-        uses: subosito/flutter-action@e938fdf56512cc96ef2f93601a5a40bde3801046 # v2.19.0
+        uses: subosito/flutter-action@e938fdf56512cc96ef2f93601a5a40bde3801046 # v2
         with:
           channel: 'stable'
           flutter-version-file: ./mobile/pubspec.yaml
@@ -89,10 +78,6 @@ jobs:
         working-directory: ./mobile
         run: flutter pub get
 
-      - name: Generate translation file
-        run: make translation
-        working-directory: ./mobile
-
       - name: Build Android App Bundle
         working-directory: ./mobile
         env:
@@ -104,7 +89,7 @@ jobs:
           flutter build apk --release --split-per-abi --target-platform android-arm,android-arm64,android-x64
 
       - name: Publish Android Artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: release-apk-signed
           path: mobile/build/app/outputs/flutter-apk/*.apk

.github/workflows/cache-cleanup.yml

@@ -8,38 +8,31 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions: {}
-
 jobs:
   cleanup:
     name: Cleanup
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      actions: write
     steps:
       - name: Check out code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Cleanup
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          REF: ${{ github.ref }}
         run: |
           gh extension install actions/gh-actions-cache
 
           REPO=${{ github.repository }}
+          BRANCH=${{ github.ref }}
 
           echo "Fetching list of cache keys"
-          cacheKeysForPR=$(gh actions-cache list -R $REPO -B ${REF} -L 100 | cut -f 1 )
+          cacheKeysForPR=$(gh actions-cache list -R $REPO -B $BRANCH -L 100 | cut -f 1 )
 
           ## Setting this to not fail the workflow while deleting cache keys.
           set +e
           echo "Deleting caches..."
           for cacheKey in $cacheKeysForPR
           do
-              gh actions-cache delete $cacheKey -R "$REPO" -B "${REF}" --confirm
+              gh actions-cache delete $cacheKey -R $REPO -B $BRANCH --confirm
           done
           echo "Done"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/cli.yml

@@ -16,25 +16,21 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions: {}
+permissions:
+  packages: write
 
 jobs:
   publish:
     name: CLI Publish
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     defaults:
       run:
         working-directory: ./cli
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       # Setup .npmrc file to publish to npm
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+      - uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
         with:
           node-version-file: './cli/.nvmrc'
           registry-url: 'https://registry.npmjs.org'
@@ -52,16 +48,11 @@ jobs:
   docker:
     name: Docker
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
     needs: publish
 
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
@@ -70,7 +61,7 @@ jobs:
         uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
         if: ${{ !github.event.pull_request.head.repo.fork }}
         with:
           registry: ghcr.io
@@ -85,7 +76,7 @@ jobs:
 
       - name: Generate docker image tags
         id: metadata
-        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5
         with:
           flavor: |
             latest=false
@@ -96,7 +87,7 @@ jobs:
             type=raw,value=latest,enable=${{ github.event_name == 'release' }}
 
       - name: Build and push image
-        uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6.16.0
+        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
         with:
           file: cli/Dockerfile
           platforms: linux/amd64,linux/arm64

.github/workflows/codeql-analysis.yml

@@ -24,8 +24,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions: {}
-
 jobs:
   analyze:
     name: Analyze
@@ -44,13 +42,11 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@60168efe1c415ce0f5521ea06d5c2062adbeed1b # v3.28.17
+        uses: github/codeql-action/init@45775bd8235c68ba998cffa5171334d58593da47 # v3
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -63,7 +59,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@60168efe1c415ce0f5521ea06d5c2062adbeed1b # v3.28.17
+        uses: github/codeql-action/autobuild@45775bd8235c68ba998cffa5171334d58593da47 # v3
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -76,6 +72,6 @@ jobs:
       #   ./location_of_script_within_repo/buildscript.sh
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@60168efe1c415ce0f5521ea06d5c2062adbeed1b # v3.28.17
+        uses: github/codeql-action/analyze@45775bd8235c68ba998cffa5171334d58593da47 # v3
         with:
           category: '/language:${{matrix.language}}'

.github/workflows/docker.yml

@@ -12,23 +12,20 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions: {}
+permissions:
+  packages: write
 
 jobs:
   pre-job:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     outputs:
       should_run_server: ${{ steps.found_paths.outputs.server == 'true' || steps.should_force.outputs.should_force == 'true' }}
       should_run_ml: ${{ steps.found_paths.outputs.machine-learning == 'true' || steps.should_force.outputs.should_force == 'true' }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - id: found_paths
-        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
         with:
           filters: |
             server:
@@ -40,8 +37,6 @@ jobs:
               - 'machine-learning/**'
             workflow:
               - '.github/workflows/docker.yml'
-              - '.github/workflows/multi-runner-build.yml'
-              - '.github/actions/image-build'
 
       - name: Check if we should force jobs to run
         id: should_force
@@ -50,9 +45,6 @@ jobs:
   retag_ml:
     name: Re-Tag ML
     needs: pre-job
-    permissions:
-      contents: read
-      packages: write
     if: ${{ needs.pre-job.outputs.should_run_ml == 'false' && !github.event.pull_request.head.repo.fork }}
     runs-on: ubuntu-latest
     strategy:
@@ -60,28 +52,24 @@ jobs:
         suffix: ['', '-cuda', '-rocm', '-openvino', '-armnn', '-rknn']
     steps:
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Re-tag image
-        env:
-          REGISTRY_NAME: 'ghcr.io'
-          REPOSITORY: ${{ github.repository_owner }}/immich-machine-learning
-          TAG_OLD: main${{ matrix.suffix }}
-          TAG_PR: ${{ github.event.number == 0 && github.ref_name || format('pr-{0}', github.event.number) }}${{ matrix.suffix }}
-          TAG_COMMIT: commit-${{ github.event_name != 'pull_request' && github.sha || github.event.pull_request.head.sha }}${{ matrix.suffix }}
         run: |
-          docker buildx imagetools create -t "${REGISTRY_NAME}/${REPOSITORY}:${TAG_PR}" "${REGISTRY_NAME}/${REPOSITORY}:${TAG_OLD}"
-          docker buildx imagetools create -t "${REGISTRY_NAME}/${REPOSITORY}:${TAG_COMMIT}" "${REGISTRY_NAME}/${REPOSITORY}:${TAG_OLD}"
+          REGISTRY_NAME="ghcr.io"
+          REPOSITORY=${{ github.repository_owner }}/immich-machine-learning
+          TAG_OLD=main${{ matrix.suffix }}
+          TAG_PR=${{ github.event.number == 0 && github.ref_name ||  format('pr-{0}', github.event.number)  }}${{ matrix.suffix }}
+          TAG_COMMIT=commit-${{ github.event_name != 'pull_request' && github.sha || github.event.pull_request.head.sha }}${{ matrix.suffix }}
+          docker buildx imagetools create -t $REGISTRY_NAME/$REPOSITORY:$TAG_PR $REGISTRY_NAME/$REPOSITORY:$TAG_OLD
+          docker buildx imagetools create -t $REGISTRY_NAME/$REPOSITORY:$TAG_COMMIT $REGISTRY_NAME/$REPOSITORY:$TAG_OLD
 
   retag_server:
     name: Re-Tag Server
     needs: pre-job
-    permissions:
-      contents: read
-      packages: write
     if: ${{ needs.pre-job.outputs.should_run_server == 'false' && !github.event.pull_request.head.repo.fork }}
     runs-on: ubuntu-latest
     strategy:
@@ -89,91 +77,376 @@ jobs:
         suffix: ['']
     steps:
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Re-tag image
-        env:
-          REGISTRY_NAME: 'ghcr.io'
-          REPOSITORY: ${{ github.repository_owner }}/immich-server
-          TAG_OLD: main${{ matrix.suffix }}
-          TAG_PR: ${{ github.event.number == 0 && github.ref_name || format('pr-{0}', github.event.number) }}${{ matrix.suffix }}
-          TAG_COMMIT: commit-${{ github.event_name != 'pull_request' && github.sha || github.event.pull_request.head.sha }}${{ matrix.suffix }}
         run: |
-          docker buildx imagetools create -t "${REGISTRY_NAME}/${REPOSITORY}:${TAG_PR}" "${REGISTRY_NAME}/${REPOSITORY}:${TAG_OLD}"
-          docker buildx imagetools create -t "${REGISTRY_NAME}/${REPOSITORY}:${TAG_COMMIT}" "${REGISTRY_NAME}/${REPOSITORY}:${TAG_OLD}"
+          REGISTRY_NAME="ghcr.io"
+          REPOSITORY=${{ github.repository_owner }}/immich-server
+          TAG_OLD=main${{ matrix.suffix }}
+          TAG_PR=${{ github.event.number == 0 && github.ref_name ||  format('pr-{0}', github.event.number)  }}${{ matrix.suffix }}
+          TAG_COMMIT=commit-${{ github.event_name != 'pull_request' && github.sha || github.event.pull_request.head.sha }}${{ matrix.suffix }}
+          docker buildx imagetools create -t $REGISTRY_NAME/$REPOSITORY:$TAG_PR $REGISTRY_NAME/$REPOSITORY:$TAG_OLD
+          docker buildx imagetools create -t $REGISTRY_NAME/$REPOSITORY:$TAG_COMMIT $REGISTRY_NAME/$REPOSITORY:$TAG_OLD
 
-  machine-learning:
+  build_and_push_ml:
     name: Build and Push ML
     needs: pre-job
     if: ${{ needs.pre-job.outputs.should_run_ml == 'true' }}
+    runs-on: ${{ matrix.runner }}
+    env:
+      image: immich-machine-learning
+      context: machine-learning
+      file: machine-learning/Dockerfile
+      GHCR_REPO: ghcr.io/${{ github.repository_owner }}/immich-machine-learning
+    strategy:
+      # Prevent a failure in one image from stopping the other builds
+      fail-fast: false
+      matrix:
+        include:
+          - platform: linux/amd64
+            runner: ubuntu-latest
+            device: cpu
+
+          - platform: linux/arm64
+            runner: ubuntu-24.04-arm
+            device: cpu
+
+          - platform: linux/amd64
+            runner: ubuntu-latest
+            device: cuda
+            suffix: -cuda
+
+          - platform: linux/amd64
+            runner: mich
+            device: rocm
+            suffix: -rocm
+
+          - platform: linux/amd64
+            runner: ubuntu-latest
+            device: openvino
+            suffix: -openvino
+
+          - platform: linux/arm64
+            runner: ubuntu-24.04-arm
+            device: armnn
+            suffix: -armnn
+
+          - platform: linux/arm64
+            runner: ubuntu-24.04-arm
+            device: rknn
+            suffix: -rknn
+
+    steps:
+      - name: Prepare
+        run: |
+          platform=${{ matrix.platform }}
+          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
+
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
+        if: ${{ !github.event.pull_request.head.repo.fork }}
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Generate cache key suffix
+        run: |
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            echo "CACHE_KEY_SUFFIX=pr-${{ github.event.number }}" >> $GITHUB_ENV
+          else
+            echo "CACHE_KEY_SUFFIX=$(echo ${{ github.ref_name }} | sed 's/[^a-zA-Z0-9]/-/g')" >> $GITHUB_ENV
+          fi
+
+      - name: Generate cache target
+        id: cache-target
+        run: |
+          if [[ "${{ github.event.pull_request.head.repo.fork }}" == "true" ]]; then
+            # Essentially just ignore the cache output (forks can't write to registry cache)
+            echo "cache-to=type=local,dest=/tmp/discard,ignore-error=true" >> $GITHUB_OUTPUT
+          else
+            echo "cache-to=type=registry,ref=${{ env.GHCR_REPO }}-build-cache:${{ env.PLATFORM_PAIR }}-${{ matrix.device }}-${{ env.CACHE_KEY_SUFFIX }},mode=max,compression=zstd" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Build and push image
+        id: build
+        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
+        with:
+          context: ${{ env.context }}
+          file: ${{ env.file }}
+          platforms: ${{ matrix.platforms }}
+          labels: ${{ steps.metadata.outputs.labels }}
+          cache-to: ${{ steps.cache-target.outputs.cache-to }}
+          cache-from: |
+            type=registry,ref=${{ env.GHCR_REPO }}-build-cache:${{ env.PLATFORM_PAIR }}-${{ matrix.device }}-${{ env.CACHE_KEY_SUFFIX }}
+            type=registry,ref=${{ env.GHCR_REPO }}-build-cache:${{ env.PLATFORM_PAIR }}-${{ matrix.device }}-main
+          outputs: type=image,"name=${{ env.GHCR_REPO }}",push-by-digest=true,name-canonical=true,push=${{ !github.event.pull_request.head.repo.fork }}
+          build-args: |
+            DEVICE=${{ matrix.device }}
+            BUILD_ID=${{ github.run_id }}
+            BUILD_IMAGE=${{ github.event_name == 'release' && github.ref_name || steps.metadata.outputs.tags }}
+            BUILD_SOURCE_REF=${{ github.ref_name }}
+            BUILD_SOURCE_COMMIT=${{ github.sha }}
+
+      - name: Export digest
+        run: |
+          mkdir -p ${{ runner.temp }}/digests
+          digest="${{ steps.build.outputs.digest }}"
+          touch "${{ runner.temp }}/digests/${digest#sha256:}"
+
+      - name: Upload digest
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: ml-digests-${{ matrix.device }}-${{ env.PLATFORM_PAIR }}
+          path: ${{ runner.temp }}/digests/*
+          if-no-files-found: error
+          retention-days: 1
+
+  merge_ml:
+    name: Merge & Push ML
+    runs-on: ubuntu-latest
+    if: ${{ needs.pre-job.outputs.should_run_ml == 'true' && !github.event.pull_request.head.repo.fork }}
+    env:
+      GHCR_REPO: ghcr.io/${{ github.repository_owner }}/immich-machine-learning
+      DOCKER_REPO: altran1502/immich-machine-learning
+    strategy:
+      matrix:
+        include:
+          - device: cpu
+          - device: cuda
+            suffix: -cuda
+          - device: rocm
+            suffix: -rocm
+          - device: openvino
+            suffix: -openvino
+          - device: armnn
+            suffix: -armnn
+          - device: rknn
+            suffix: -rknn
+    needs:
+      - build_and_push_ml
+    steps:
+      - name: Download digests
+        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4
+        with:
+          path: ${{ runner.temp }}/digests
+          pattern: ml-digests-${{ matrix.device }}-*
+          merge-multiple: true
+
+      - name: Login to Docker Hub
+        if: ${{ github.event_name == 'release' }}
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Login to GHCR
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3
+
+      - name: Generate docker image tags
+        id: meta
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5
+        env:
+          DOCKER_METADATA_PR_HEAD_SHA: 'true'
+        with:
+          flavor: |
+            # Disable latest tag
+            latest=false
+            suffix=${{ matrix.suffix }}
+          images: |
+            name=${{ env.GHCR_REPO }}
+            name=${{ env.DOCKER_REPO }},enable=${{ github.event_name == 'release' }}
+          tags: |
+            # Tag with branch name
+            type=ref,event=branch
+            # Tag with pr-number
+            type=ref,event=pr
+            # Tag with long commit sha hash
+            type=sha,format=long,prefix=commit-
+            # Tag with git tag on release
+            type=ref,event=tag
+            type=raw,value=release,enable=${{ github.event_name == 'release' }}
+
+      - name: Create manifest list and push
+        working-directory: ${{ runner.temp }}/digests
+        run: |
+          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+            $(printf '${{ env.GHCR_REPO }}@sha256:%s ' *)
+
+  build_and_push_server:
+    name: Build and Push Server
+    runs-on: ${{ matrix.runner }}
+    needs: pre-job
+    if: ${{ needs.pre-job.outputs.should_run_server == 'true' }}
+    env:
+      image: immich-server
+      context: .
+      file: server/Dockerfile
+      GHCR_REPO: ghcr.io/${{ github.repository_owner }}/immich-server
     strategy:
       fail-fast: false
       matrix:
         include:
-          - device: cpu
-            tag-suffix: ''
-          - device: cuda
-            tag-suffix: '-cuda'
-            platforms: linux/amd64
-          - device: openvino
-            tag-suffix: '-openvino'
-            platforms: linux/amd64
-          - device: armnn
-            tag-suffix: '-armnn'
-            platforms: linux/arm64
-          - device: rknn
-            tag-suffix: '-rknn'
-            platforms: linux/arm64
-          - device: rocm
-            tag-suffix: '-rocm'
-            platforms: linux/amd64
-            runner-mapping: '{"linux/amd64": "mich"}'
-    uses: ./.github/workflows/multi-runner-build.yml
-    permissions:
-      contents: read
-      actions: read
-      packages: write
-    secrets:
-      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
-      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
-    with:
-      image: immich-machine-learning
-      context: machine-learning
-      dockerfile: machine-learning/Dockerfile
-      platforms: ${{ matrix.platforms }}
-      runner-mapping: ${{ matrix.runner-mapping }}
-      tag-suffix: ${{ matrix.tag-suffix }}
-      dockerhub-push: ${{ github.event_name == 'release' }}
-      build-args: |
-        DEVICE=${{ matrix.device }}
+          - platform: linux/amd64
+            runner: ubuntu-latest
+          - platform: linux/arm64
+            runner: ubuntu-24.04-arm
+    steps:
+      - name: Prepare
+        run: |
+          platform=${{ matrix.platform }}
+          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
 
-  server:
-    name: Build and Push Server
-    needs: pre-job
-    if: ${{ needs.pre-job.outputs.should_run_server == 'true' }}
-    uses: ./.github/workflows/multi-runner-build.yml
-    permissions:
-      contents: read
-      actions: read
-      packages: write
-    secrets:
-      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
-      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
-    with:
-      image: immich-server
-      context: .
-      dockerfile: server/Dockerfile
-      dockerhub-push: ${{ github.event_name == 'release' }}
-      build-args: |
-        DEVICE=cpu
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
+        if: ${{ !github.event.pull_request.head.repo.fork }}
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Generate cache key suffix
+        run: |
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            echo "CACHE_KEY_SUFFIX=pr-${{ github.event.number }}" >> $GITHUB_ENV
+          else
+            echo "CACHE_KEY_SUFFIX=$(echo ${{ github.ref_name }} | sed 's/[^a-zA-Z0-9]/-/g')" >> $GITHUB_ENV
+          fi
+
+      - name: Generate cache target
+        id: cache-target
+        run: |
+          if [[ "${{ github.event.pull_request.head.repo.fork }}" == "true" ]]; then
+            # Essentially just ignore the cache output (forks can't write to registry cache)
+            echo "cache-to=type=local,dest=/tmp/discard,ignore-error=true" >> $GITHUB_OUTPUT
+          else
+            echo "cache-to=type=registry,ref=${{ env.GHCR_REPO }}-build-cache:${{ env.PLATFORM_PAIR }}-${{ matrix.device }}-${{ env.CACHE_KEY_SUFFIX }},mode=max,compression=zstd" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Build and push image
+        id: build
+        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
+        with:
+          context: ${{ env.context }}
+          file: ${{ env.file }}
+          platforms: ${{ matrix.platform }}
+          labels: ${{ steps.metadata.outputs.labels }}
+          cache-to: ${{ steps.cache-target.outputs.cache-to }}
+          cache-from: |
+            type=registry,ref=${{ env.GHCR_REPO }}-build-cache:${{ env.PLATFORM_PAIR }}-${{ env.CACHE_KEY_SUFFIX }}
+            type=registry,ref=${{ env.GHCR_REPO }}-build-cache:${{ env.PLATFORM_PAIR }}-main
+          outputs: type=image,"name=${{ env.GHCR_REPO }}",push-by-digest=true,name-canonical=true,push=${{ !github.event.pull_request.head.repo.fork }}
+          build-args: |
+            DEVICE=cpu
+            BUILD_ID=${{ github.run_id }}
+            BUILD_IMAGE=${{ github.event_name == 'release' && github.ref_name || steps.metadata.outputs.tags }}
+            BUILD_SOURCE_REF=${{ github.ref_name }}
+            BUILD_SOURCE_COMMIT=${{ github.sha }}
+
+      - name: Export digest
+        run: |
+          mkdir -p ${{ runner.temp }}/digests
+          digest="${{ steps.build.outputs.digest }}"
+          touch "${{ runner.temp }}/digests/${digest#sha256:}"
+
+      - name: Upload digest
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: server-digests-${{ env.PLATFORM_PAIR }}
+          path: ${{ runner.temp }}/digests/*
+          if-no-files-found: error
+          retention-days: 1
+
+  merge_server:
+    name: Merge & Push Server
+    runs-on: ubuntu-latest
+    if: ${{ needs.pre-job.outputs.should_run_server == 'true' && !github.event.pull_request.head.repo.fork }}
+    env:
+      GHCR_REPO: ghcr.io/${{ github.repository_owner }}/immich-server
+      DOCKER_REPO: altran1502/immich-server
+    needs:
+      - build_and_push_server
+    steps:
+      - name: Download digests
+        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4
+        with:
+          path: ${{ runner.temp }}/digests
+          pattern: server-digests-*
+          merge-multiple: true
+
+      - name: Login to Docker Hub
+        if: ${{ github.event_name == 'release' }}
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Login to GHCR
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3
+
+      - name: Generate docker image tags
+        id: meta
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5
+        env:
+          DOCKER_METADATA_PR_HEAD_SHA: 'true'
+        with:
+          flavor: |
+            # Disable latest tag
+            latest=false
+            suffix=${{ matrix.suffix }}
+          images: |
+            name=${{ env.GHCR_REPO }}
+            name=${{ env.DOCKER_REPO }},enable=${{ github.event_name == 'release' }}
+          tags: |
+            # Tag with branch name
+            type=ref,event=branch
+            # Tag with pr-number
+            type=ref,event=pr
+            # Tag with long commit sha hash
+            type=sha,format=long,prefix=commit-
+            # Tag with git tag on release
+            type=ref,event=tag
+            type=raw,value=release,enable=${{ github.event_name == 'release' }}
+
+      - name: Create manifest list and push
+        working-directory: ${{ runner.temp }}/digests
+        run: |
+          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+            $(printf '${{ env.GHCR_REPO }}@sha256:%s ' *)
 
   success-check-server:
     name: Docker Build & Push Server Success
-    needs: [server, retag_server]
-    permissions: {}
+    needs: [merge_server, retag_server]
     runs-on: ubuntu-latest
     if: always()
     steps:
@@ -182,13 +455,11 @@ jobs:
         run: exit 1
       - name: All jobs passed or skipped
         if: ${{ !(contains(needs.*.result, 'failure')) }}
-        # zizmor: ignore[template-injection]
         run: echo "All jobs passed or skipped" && echo "${{ toJSON(needs.*.result) }}"
 
   success-check-ml:
     name: Docker Build & Push ML Success
-    needs: [machine-learning, retag_ml]
-    permissions: {}
+    needs: [merge_ml, retag_ml]
     runs-on: ubuntu-latest
     if: always()
     steps:
@@ -197,5 +468,4 @@ jobs:
         run: exit 1
       - name: All jobs passed or skipped
         if: ${{ !(contains(needs.*.result, 'failure')) }}
-        # zizmor: ignore[template-injection]
         run: echo "All jobs passed or skipped" && echo "${{ toJSON(needs.*.result) }}"

.github/workflows/docs-build.yml

@@ -10,22 +10,16 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions: {}
-
 jobs:
   pre-job:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     outputs:
       should_run: ${{ steps.found_paths.outputs.docs == 'true' ||  steps.should_force.outputs.should_force == 'true' }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - id: found_paths
-        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
         with:
           filters: |
             docs:
@@ -39,8 +33,6 @@ jobs:
   build:
     name: Docs Build
     needs: pre-job
-    permissions:
-      contents: read
     if: ${{ needs.pre-job.outputs.should_run == 'true' }}
     runs-on: ubuntu-latest
     defaults:
@@ -49,12 +41,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Setup Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
         with:
           node-version-file: './docs/.nvmrc'
 
@@ -68,9 +58,8 @@ jobs:
         run: npm run build
 
       - name: Upload build output
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: docs-build-output
           path: docs/build/
-          include-hidden-files: true
           retention-days: 1

.github/workflows/docs-deploy.yml

@@ -1,6 +1,6 @@
 name: Docs deploy
 on:
-  workflow_run: # zizmor: ignore[dangerous-triggers] no attacker inputs are used here
+  workflow_run:
     workflows: ['Docs build']
     types:
       - completed
@@ -9,9 +9,6 @@ jobs:
   checks:
     name: Docs Deploy Checks
     runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      pull-requests: read
     outputs:
       parameters: ${{ steps.parameters.outputs.result }}
       artifact: ${{ steps.get-artifact.outputs.result }}
@@ -20,7 +17,7 @@ jobs:
         run: echo 'The triggering workflow did not succeed' && exit 1
       - name: Get artifact
         id: get-artifact
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
         with:
           script: |
             let allArtifacts = await github.rest.actions.listWorkflowRunArtifacts({
@@ -38,9 +35,7 @@ jobs:
             return { found: true, id: matchArtifact.id };
       - name: Determine deploy parameters
         id: parameters
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
-        env:
-          HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
         with:
           script: |
             const eventType = context.payload.workflow_run.event;
@@ -62,8 +57,7 @@ jobs:
             } else if (eventType == "pull_request") {
               let pull_number = context.payload.workflow_run.pull_requests[0]?.number;
               if(!pull_number) {
-                const {HEAD_SHA} = process.env;
-                const response = await github.rest.search.issuesAndPullRequests({q: `repo:${{ github.repository }} is:pr sha:${HEAD_SHA}`,per_page: 1,})
+                const response = await github.rest.search.issuesAndPullRequests({q: 'repo:${{ github.repository }} is:pr sha:${{ github.event.workflow_run.head_sha }}',per_page: 1,})
                 const items = response.data.items
                 if (items.length < 1) {
                   throw new Error("No pull request found for the commit")
@@ -101,36 +95,30 @@ jobs:
     name: Docs Deploy
     runs-on: ubuntu-latest
     needs: checks
-    permissions:
-      contents: read
-      actions: read
-      pull-requests: write
     if: ${{ fromJson(needs.checks.outputs.artifact).found && fromJson(needs.checks.outputs.parameters).shouldDeploy }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Load parameters
         id: parameters
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
-        env:
-          PARAM_JSON: ${{ needs.checks.outputs.parameters }}
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
         with:
           script: |
-            const parameters = JSON.parse(process.env.PARAM_JSON);
+            const json = `${{ needs.checks.outputs.parameters }}`;
+            const parameters = JSON.parse(json);
             core.setOutput("event", parameters.event);
             core.setOutput("name", parameters.name);
             core.setOutput("shouldDeploy", parameters.shouldDeploy);
 
+      - run: |
+          echo "Starting docs deployment for ${{ steps.parameters.outputs.event }} ${{ steps.parameters.outputs.name }}"
+
       - name: Download artifact
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
-        env:
-          ARTIFACT_JSON: ${{ needs.checks.outputs.artifact }}
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
         with:
           script: |
-            let artifact = JSON.parse(process.env.ARTIFACT_JSON);
+            let artifact = ${{ needs.checks.outputs.artifact }};
             let download = await github.rest.actions.downloadArtifact({
                owner: context.repo.owner,
                repo: context.repo.repo,
@@ -150,7 +138,7 @@ jobs:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
           TF_STATE_POSTGRES_CONN_STR: ${{ secrets.TF_STATE_POSTGRES_CONN_STR }}
-        uses: gruntwork-io/terragrunt-action@9559e51d05873b0ea467c42bbabcb5c067642ccc # v2.1.5
+        uses: gruntwork-io/terragrunt-action@9559e51d05873b0ea467c42bbabcb5c067642ccc # v2
         with:
           tg_version: '0.58.12'
           tofu_version: '1.7.1'
@@ -165,7 +153,7 @@ jobs:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
           TF_STATE_POSTGRES_CONN_STR: ${{ secrets.TF_STATE_POSTGRES_CONN_STR }}
-        uses: gruntwork-io/terragrunt-action@9559e51d05873b0ea467c42bbabcb5c067642ccc # v2.1.5
+        uses: gruntwork-io/terragrunt-action@9559e51d05873b0ea467c42bbabcb5c067642ccc # v2
         with:
           tg_version: '0.58.12'
           tofu_version: '1.7.1'
@@ -174,15 +162,12 @@ jobs:
 
       - name: Output Cleaning
         id: clean
-        env:
-          TG_OUTPUT: ${{ steps.docs-output.outputs.tg_action_output }}
         run: |
-          CLEANED=$(echo "$TG_OUTPUT" | sed 's|%0A|\n|g ; s|%3C|<|g' | jq -c .)
-          echo "output=$CLEANED" >> $GITHUB_OUTPUT
+          TG_OUT=$(echo '${{ steps.docs-output.outputs.tg_action_output }}' | sed 's|%0A|\n|g ; s|%3C|<|g' | jq -c .)
+          echo "output=$TG_OUT" >> $GITHUB_OUTPUT
 
       - name: Publish to Cloudflare Pages
-        # TODO: Action is deprecated
-        uses: cloudflare/pages-action@f0a1cd58cd66095dee69bfa18fa5efd1dde93bca # v1.5.0
+        uses: cloudflare/pages-action@f0a1cd58cd66095dee69bfa18fa5efd1dde93bca # v1
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN_PAGES_UPLOAD }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
@@ -199,7 +184,7 @@ jobs:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
           TF_STATE_POSTGRES_CONN_STR: ${{ secrets.TF_STATE_POSTGRES_CONN_STR }}
-        uses: gruntwork-io/terragrunt-action@9559e51d05873b0ea467c42bbabcb5c067642ccc # v2.1.5
+        uses: gruntwork-io/terragrunt-action@9559e51d05873b0ea467c42bbabcb5c067642ccc # v2
         with:
           tg_version: '0.58.12'
           tofu_version: '1.7.1'
@@ -207,7 +192,7 @@ jobs:
           tg_command: 'apply'
 
       - name: Comment
-        uses: actions-cool/maintain-one-comment@4b2dbf086015f892dcb5e8c1106f5fccd6c1476b # v3.2.0
+        uses: actions-cool/maintain-one-comment@4b2dbf086015f892dcb5e8c1106f5fccd6c1476b # v3
         if: ${{ steps.parameters.outputs.event == 'pr' }}
         with:
           number: ${{ fromJson(needs.checks.outputs.parameters).pr_number }}

.github/workflows/docs-destroy.yml

@@ -1,22 +1,15 @@
 name: Docs destroy
 on:
-  pull_request_target: # zizmor: ignore[dangerous-triggers] no attacker inputs are used here
+  pull_request_target:
     types: [closed]
 
-permissions: {}
-
 jobs:
   deploy:
     name: Docs Destroy
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Destroy Docs Subdomain
         env:
@@ -25,7 +18,7 @@ jobs:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
           TF_STATE_POSTGRES_CONN_STR: ${{ secrets.TF_STATE_POSTGRES_CONN_STR }}
-        uses: gruntwork-io/terragrunt-action@9559e51d05873b0ea467c42bbabcb5c067642ccc # v2.1.5
+        uses: gruntwork-io/terragrunt-action@9559e51d05873b0ea467c42bbabcb5c067642ccc # v2
         with:
           tg_version: '0.58.12'
           tofu_version: '1.7.1'
@@ -33,7 +26,7 @@ jobs:
           tg_command: 'destroy -refresh=false'
 
       - name: Comment
-        uses: actions-cool/maintain-one-comment@4b2dbf086015f892dcb5e8c1106f5fccd6c1476b # v3.2.0
+        uses: actions-cool/maintain-one-comment@4b2dbf086015f892dcb5e8c1106f5fccd6c1476b # v3
         with:
           number: ${{ github.event.number }}
           delete: true

.github/workflows/fix-format.yml

@@ -4,32 +4,28 @@ on:
   pull_request:
     types: [labeled]
 
-permissions: {}
-
 jobs:
   fix-formatting:
     runs-on: ubuntu-latest
     if: ${{ github.event.label.name == 'fix:formatting' }}
     permissions:
-      contents: write
       pull-requests: write
     steps:
       - name: Generate a token
         id: generate-token
-        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
+        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1
         with:
           app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
 
       - name: 'Checkout'
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           ref: ${{ github.event.pull_request.head.ref }}
           token: ${{ steps.generate-token.outputs.token }}
-          persist-credentials: true
 
       - name: Setup Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
         with:
           node-version-file: './server/.nvmrc'
 
@@ -37,13 +33,13 @@ jobs:
         run: make install-all && make format-all
 
       - name: Commit and push
-        uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9.1.4
+        uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9
         with:
           default_author: github_actions
           message: 'chore: fix formatting'
 
       - name: Remove label
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
         if: always()
         with:
           script: |

.github/workflows/multi-runner-build.yml

@@ -1,185 +0,0 @@
-name: 'Multi-runner container image build'
-on:
-  workflow_call:
-    inputs:
-      image:
-        description: 'Name of the image'
-        type: string
-        required: true
-      context:
-        description: 'Path to build context'
-        type: string
-        required: true
-      dockerfile:
-        description: 'Path to Dockerfile'
-        type: string
-        required: true
-      tag-suffix:
-        description: 'Suffix to append to the image tag'
-        type: string
-        default: ''
-      dockerhub-push:
-        description: 'Push to Docker Hub'
-        type: boolean
-        default: false
-      build-args:
-        description: 'Docker build arguments'
-        type: string
-        required: false
-      platforms:
-        description: 'Platforms to build for'
-        type: string
-      runner-mapping:
-        description: 'Mapping from platforms to runners'
-        type: string
-    secrets:
-      DOCKERHUB_USERNAME:
-        required: false
-      DOCKERHUB_TOKEN:
-        required: false
-
-env:
-  GHCR_IMAGE: ghcr.io/${{ github.repository_owner }}/${{ inputs.image }}
-  DOCKERHUB_IMAGE: altran1502/${{ inputs.image }}
-
-jobs:
-  matrix:
-    name: 'Generate matrix'
-    runs-on: ubuntu-latest
-    outputs:
-      matrix: ${{ steps.matrix.outputs.matrix }}
-      key: ${{ steps.artifact-key.outputs.base }}
-    steps:
-      - name: Generate build matrix
-        id: matrix
-        shell: bash
-        env:
-          PLATFORMS: ${{ inputs.platforms || 'linux/amd64,linux/arm64' }}
-          RUNNER_MAPPING: ${{ inputs.runner-mapping || '{"linux/amd64":"ubuntu-latest","linux/arm64":"ubuntu-24.04-arm"}' }}
-        run: |
-          matrix=$(jq -R -c \
-            --argjson runner_mapping "${RUNNER_MAPPING}" \
-            'split(",") | map({platform: ., runner: $runner_mapping[.]})' \
-            <<< "${PLATFORMS}")
-          echo "${matrix}"
-          echo "matrix=${matrix}" >> $GITHUB_OUTPUT
-
-      - name: Determine artifact key
-        id: artifact-key
-        shell: bash
-        env:
-          IMAGE: ${{ inputs.image }}
-          SUFFIX: ${{ inputs.tag-suffix }}
-        run: |
-          if [[ -n "${SUFFIX}" ]]; then
-              base="${IMAGE}${SUFFIX}-digests"
-          else
-              base="${IMAGE}-digests"
-          fi
-          echo "${base}"
-          echo "base=${base}" >> $GITHUB_OUTPUT
-
-  build:
-    needs: matrix
-    runs-on: ${{ matrix.runner }}
-    permissions:
-      contents: read
-      packages: write
-    strategy:
-      fail-fast: false
-      matrix:
-        include: ${{ fromJson(needs.matrix.outputs.matrix) }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-        with:
-          persist-credentials: false
-
-      - uses: ./.github/actions/image-build
-        with:
-          context: ${{ inputs.context }}
-          dockerfile: ${{ inputs.dockerfile }}
-          image: ${{ env.GHCR_IMAGE }}
-          ghcr-token: ${{ secrets.GITHUB_TOKEN }}
-          platform: ${{ matrix.platform }}
-          artifact-key-base: ${{ needs.matrix.outputs.key }}
-          build-args: ${{ inputs.build-args }}
-
-  merge:
-    needs: [matrix, build]
-    runs-on: ubuntu-latest
-    if: ${{ !github.event.pull_request.head.repo.fork }}
-    permissions:
-      contents: read
-      actions: read
-      packages: write
-    steps:
-      - name: Download digests
-        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4
-        with:
-          path: ${{ runner.temp }}/digests
-          pattern: ${{ needs.matrix.outputs.key }}-*
-          merge-multiple: true
-
-      - name: Login to Docker Hub
-        if: ${{ inputs.dockerhub-push }}
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Login to GHCR
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3
-
-      - name: Generate docker image tags
-        id: meta
-        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5
-        env:
-          DOCKER_METADATA_PR_HEAD_SHA: 'true'
-        with:
-          flavor: |
-            # Disable latest tag
-            latest=false
-            suffix=${{ inputs.tag-suffix }}
-          images: |
-            name=${{ env.GHCR_IMAGE }}
-            name=${{ env.DOCKERHUB_IMAGE }},enable=${{ inputs.dockerhub-push }}
-          tags: |
-            # Tag with branch name
-            type=ref,event=branch
-            # Tag with pr-number
-            type=ref,event=pr
-            # Tag with long commit sha hash
-            type=sha,format=long,prefix=commit-
-            # Tag with git tag on release
-            type=ref,event=tag
-            type=raw,value=release,enable=${{ github.event_name == 'release' }}
-
-      - name: Create manifest list and push
-        working-directory: ${{ runner.temp }}/digests
-        run: |
-          # Process annotations
-          declare -a ANNOTATIONS=()
-          if [[ -n "$DOCKER_METADATA_OUTPUT_JSON" ]]; then
-            while IFS= read -r annotation; do
-              # Extract key and value by removing the manifest: prefix
-              if [[ "$annotation" =~ ^manifest:(.+)=(.+)$ ]]; then
-                key="${BASH_REMATCH[1]}"
-                value="${BASH_REMATCH[2]}"
-                # Use array to properly handle arguments with spaces
-                ANNOTATIONS+=(--annotation "index:$key=$value")
-              fi
-            done < <(jq -r '.annotations[]' <<< "$DOCKER_METADATA_OUTPUT_JSON")
-          fi
-
-          TAGS=$(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
-          SOURCE_ARGS=$(printf "${GHCR_IMAGE}@sha256:%s " *)
-
-          docker buildx imagetools create $TAGS "${ANNOTATIONS[@]}" $SOURCE_ARGS

.github/workflows/pr-label-validation.yml

@@ -1,11 +1,9 @@
 name: PR Label Validation
 
 on:
-  pull_request_target: # zizmor: ignore[dangerous-triggers] no attacker inputs are used here
+  pull_request_target:
     types: [opened, labeled, unlabeled, synchronize]
 
-permissions: {}
-
 jobs:
   validate-release-label:
     runs-on: ubuntu-latest
@@ -14,7 +12,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Require PR to have a changelog label
-        uses: mheap/github-action-required-labels@388fd6af37b34cdfe5a23b37060e763217e58b03 # v5.5.0
+        uses: mheap/github-action-required-labels@388fd6af37b34cdfe5a23b37060e763217e58b03 # v5
         with:
           mode: exactly
           count: 1

.github/workflows/pr-labeler.yml

@@ -1,8 +1,6 @@
 name: 'Pull Request Labeler'
 on:
-  - pull_request_target # zizmor: ignore[dangerous-triggers] no attacker inputs are used here
-
-permissions: {}
+  - pull_request_target
 
 jobs:
   labeler:
@@ -11,4 +9,4 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
+      - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5

.github/workflows/pr-require-conventional-commit.yml

@@ -4,13 +4,9 @@ on:
   pull_request:
     types: [opened, synchronize, reopened, edited]
 
-permissions: {}
-
 jobs:
   validate-pr-title:
     runs-on: ubuntu-latest
-    permissions:
-      pull-requests: write
     steps:
       - name: PR Conventional Commit Validation
         uses: ytanikin/PRConventionalCommits@b628c5a234cc32513014b7bfdd1e47b532124d98 # 1.3.0

.github/workflows/prepare-release.yml

@@ -21,40 +21,35 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}-root
   cancel-in-progress: true
 
-permissions: {}
-
 jobs:
   bump_version:
     runs-on: ubuntu-latest
+
     outputs:
       ref: ${{ steps.push-tag.outputs.commit_long_sha }}
-    permissions: {} # No job-level permissions are needed because it uses the app-token
+
     steps:
       - name: Generate a token
         id: generate-token
-        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
+        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1
         with:
           app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
 
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           token: ${{ steps.generate-token.outputs.token }}
-          persist-credentials: true
 
       - name: Install uv
-        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
+        uses: astral-sh/setup-uv@0c5e2b8115b80b4c7c5ddf6ffdd634974642d182 # v5
 
       - name: Bump version
-        env:
-          SERVER_BUMP: ${{ inputs.serverBump }}
-          MOBILE_BUMP: ${{ inputs.mobileBump }}
-        run: misc/release/pump-version.sh -s "${SERVER_BUMP}" -m "${MOBILE_BUMP}"
+        run: misc/release/pump-version.sh -s "${{ inputs.serverBump }}" -m "${{ inputs.mobileBump }}"
 
       - name: Commit and tag
         id: push-tag
-        uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9.1.4
+        uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9
         with:
           default_author: github_actions
           message: 'chore: version ${{ env.IMMICH_VERSION }}'
@@ -64,47 +59,37 @@ jobs:
   build_mobile:
     uses: ./.github/workflows/build-mobile.yml
     needs: bump_version
-    permissions:
-      contents: read
-    secrets:
-      KEY_JKS: ${{ secrets.KEY_JKS }}
-      ALIAS: ${{ secrets.ALIAS }}
-      ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
-      ANDROID_STORE_PASSWORD: ${{ secrets.ANDROID_STORE_PASSWORD }}
+    secrets: inherit
     with:
       ref: ${{ needs.bump_version.outputs.ref }}
 
   prepare_release:
     runs-on: ubuntu-latest
     needs: build_mobile
-    permissions:
-      actions: read # To download the app artifact
-      # No content permissions are needed because it uses the app-token
+
     steps:
       - name: Generate a token
         id: generate-token
-        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
+        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1
         with:
           app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
 
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           token: ${{ steps.generate-token.outputs.token }}
-          persist-credentials: false
 
       - name: Download APK
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4
         with:
           name: release-apk-signed
 
       - name: Create draft release
-        uses: softprops/action-gh-release@da05d552573ad5aba039eaac05058a918a7bf631 # v2.2.2
+        uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda # v2
         with:
           draft: true
           tag_name: ${{ env.IMMICH_VERSION }}
-          token: ${{ steps.generate-token.outputs.token }}
           generate_release_notes: true
           body_path: misc/release/notes.tmpl
           files: |

.github/workflows/preview-label.yaml

@@ -4,8 +4,6 @@ on:
   pull_request:
     types: [labeled, closed]
 
-permissions: {}
-
 jobs:
   comment-status:
     runs-on: ubuntu-latest
@@ -13,7 +11,7 @@ jobs:
     permissions:
       pull-requests: write
     steps:
-      - uses: mshick/add-pr-comment@b8f338c590a895d50bcbfa6c5859251edc8952fc # v2.8.2
+      - uses: mshick/add-pr-comment@b8f338c590a895d50bcbfa6c5859251edc8952fc # v2
         with:
           message-id: 'preview-status'
           message: 'Deploying preview environment to https://pr-${{ github.event.pull_request.number }}.preview.internal.immich.cloud/'
@@ -24,7 +22,7 @@ jobs:
     permissions:
       pull-requests: write
     steps:
-      - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+      - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
         with:
           script: |
             github.rest.issues.removeLabel({

.github/workflows/sdk.yml

@@ -4,24 +4,20 @@ on:
   release:
     types: [published]
 
-permissions: {}
+permissions:
+  packages: write
 
 jobs:
   publish:
     name: Publish `@immich/sdk`
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     defaults:
       run:
         working-directory: ./open-api/typescript-sdk
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       # Setup .npmrc file to publish to npm
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+      - uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
         with:
           node-version-file: './open-api/typescript-sdk/.nvmrc'
           registry-url: 'https://registry.npmjs.org'

.github/workflows/static_analysis.yml

@@ -9,22 +9,16 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions: {}
-
 jobs:
   pre-job:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     outputs:
       should_run: ${{ steps.found_paths.outputs.mobile == 'true' || steps.should_force.outputs.should_force == 'true' }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - id: found_paths
-        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
         with:
           filters: |
             mobile:
@@ -39,17 +33,15 @@ jobs:
     name: Run Dart Code Analysis
     needs: pre-job
     if: ${{ needs.pre-job.outputs.should_run == 'true' }}
+
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
+
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Setup Flutter SDK
-        uses: subosito/flutter-action@e938fdf56512cc96ef2f93601a5a40bde3801046 # v2.19.0
+        uses: subosito/flutter-action@e938fdf56512cc96ef2f93601a5a40bde3801046 # v2
         with:
           channel: 'stable'
           flutter-version-file: ./mobile/pubspec.yaml
@@ -58,16 +50,12 @@ jobs:
         run: dart pub get
         working-directory: ./mobile
 
-      - name: Generate translation file
-        run: make translation; dart format lib/generated/codegen_loader.g.dart
-        working-directory: ./mobile
-
       - name: Run Build Runner
         run: make build
         working-directory: ./mobile
 
       - name: Find file changes
-        uses: tj-actions/verify-changed-files@a1c6acee9df209257a246f2cc6ae8cb6581c1edf # v20.0.4
+        uses: tj-actions/verify-changed-files@a1c6acee9df209257a246f2cc6ae8cb6581c1edf # v20
         id: verify-changed-files
         with:
           files: |
@@ -77,11 +65,9 @@ jobs:
 
       - name: Verify files have not changed
         if: steps.verify-changed-files.outputs.files_changed == 'true'
-        env:
-          CHANGED_FILES: ${{ steps.verify-changed-files.outputs.changed_files }}
         run: |
           echo "ERROR: Generated files not up to date! Run make_build inside the mobile directory"
-          echo "Changed files: ${CHANGED_FILES}"
+          echo "Changed files: ${{ steps.verify-changed-files.outputs.changed_files }}"
           exit 1
 
       - name: Run dart analyze
@@ -95,30 +81,3 @@ jobs:
       - name: Run dart custom_lint
         run: dart run custom_lint
         working-directory: ./mobile
-
-  zizmor:
-    name: zizmor
-    runs-on: ubuntu-latest
-    permissions:
-      security-events: write
-      contents: read
-      actions: read
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
-      - name: Install the latest version of uv
-        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
-
-      - name: Run zizmor 🌈
-        run: uvx zizmor --format=sarif . > results.sarif
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Upload SARIF file
-        uses: github/codeql-action/upload-sarif@60168efe1c415ce0f5521ea06d5c2062adbeed1b # v3.28.17
-        with:
-          sarif_file: results.sarif
-          category: zizmor

.github/workflows/test.yml

@@ -9,15 +9,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions: {}
-
 jobs:
   pre-job:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     outputs:
-      should_run_i18n: ${{ steps.found_paths.outputs.i18n == 'true' || steps.should_force.outputs.should_force == 'true' }}
       should_run_web: ${{ steps.found_paths.outputs.web == 'true' || steps.should_force.outputs.should_force == 'true' }}
       should_run_server: ${{ steps.found_paths.outputs.server == 'true' || steps.should_force.outputs.should_force == 'true' }}
       should_run_cli: ${{ steps.found_paths.outputs.cli == 'true' || steps.should_force.outputs.should_force == 'true' }}
@@ -29,16 +24,11 @@ jobs:
       should_run_.github: ${{ steps.found_paths.outputs['.github'] == 'true' || steps.should_force.outputs.should_force == 'true' }} # redundant to have should_force but if someone changes the trigger then this won't have to be changed
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - id: found_paths
-        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
         with:
           filters: |
-            i18n:
-              - 'i18n/**'
             web:
               - 'web/**'
               - 'i18n/**'
@@ -68,20 +58,16 @@ jobs:
     needs: pre-job
     if: ${{ needs.pre-job.outputs.should_run_server == 'true' }}
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     defaults:
       run:
         working-directory: ./server
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Setup Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
         with:
           node-version-file: './server/.nvmrc'
 
@@ -109,20 +95,16 @@ jobs:
     needs: pre-job
     if: ${{ needs.pre-job.outputs.should_run_cli == 'true' }}
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     defaults:
       run:
         working-directory: ./cli
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Setup Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
         with:
           node-version-file: './cli/.nvmrc'
 
@@ -154,20 +136,16 @@ jobs:
     needs: pre-job
     if: ${{ needs.pre-job.outputs.should_run_cli == 'true' }}
     runs-on: windows-latest
-    permissions:
-      contents: read
     defaults:
       run:
         working-directory: ./cli
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Setup Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
         with:
           node-version-file: './cli/.nvmrc'
 
@@ -187,25 +165,21 @@ jobs:
         run: npm run test:cov
         if: ${{ !cancelled() }}
 
-  web-lint:
-    name: Lint Web
+  web-unit-tests:
+    name: Test & Lint Web
     needs: pre-job
     if: ${{ needs.pre-job.outputs.should_run_web == 'true' }}
-    runs-on: mich
-    permissions:
-      contents: read
+    runs-on: ubuntu-latest
     defaults:
       run:
         working-directory: ./web
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Setup Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
         with:
           node-version-file: './web/.nvmrc'
 
@@ -217,7 +191,7 @@ jobs:
         run: npm ci
 
       - name: Run linter
-        run: npm run lint:p
+        run: npm run lint
         if: ${{ !cancelled() }}
 
       - name: Run formatter
@@ -228,35 +202,6 @@ jobs:
         run: npm run check:svelte
         if: ${{ !cancelled() }}
 
-  web-unit-tests:
-    name: Test Web
-    needs: pre-job
-    if: ${{ needs.pre-job.outputs.should_run_web == 'true' }}
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    defaults:
-      run:
-        working-directory: ./web
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
-      - name: Setup Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
-        with:
-          node-version-file: './web/.nvmrc'
-
-      - name: Run setup typescript-sdk
-        run: npm ci && npm run build
-        working-directory: ./open-api/typescript-sdk
-
-      - name: Run npm install
-        run: npm ci
-
       - name: Run tsc
         run: npm run check:typescript
         if: ${{ !cancelled() }}
@@ -265,65 +210,21 @@ jobs:
         run: npm run test:cov
         if: ${{ !cancelled() }}
 
-  i18n-tests:
-    name: Test i18n
-    needs: pre-job
-    if: ${{ needs.pre-job.outputs.should_run_i18n == 'true' }}
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
-      - name: Setup Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
-        with:
-          node-version-file: './web/.nvmrc'
-
-      - name: Install dependencies
-        run: npm --prefix=web ci
-
-      - name: Format
-        run: npm --prefix=web run format:i18n
-
-      - name: Find file changes
-        uses: tj-actions/verify-changed-files@a1c6acee9df209257a246f2cc6ae8cb6581c1edf # v20.0.4
-        id: verify-changed-files
-        with:
-          files: |
-            i18n/**
-
-      - name: Verify files have not changed
-        if: steps.verify-changed-files.outputs.files_changed == 'true'
-        env:
-          CHANGED_FILES: ${{ steps.verify-changed-files.outputs.changed_files }}
-        run: |
-          echo "ERROR: i18n files not up to date!"
-          echo "Changed files: ${CHANGED_FILES}"
-          exit 1
-
   e2e-tests-lint:
     name: End-to-End Lint
     needs: pre-job
     if: ${{ needs.pre-job.outputs.should_run_e2e == 'true' }}
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     defaults:
       run:
         working-directory: ./e2e
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Setup Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
         with:
           node-version-file: './e2e/.nvmrc'
 
@@ -353,20 +254,16 @@ jobs:
     needs: pre-job
     if: ${{ needs.pre-job.outputs.should_run_server == 'true' }}
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     defaults:
       run:
         working-directory: ./server
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Setup Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
         with:
           node-version-file: './server/.nvmrc'
 
@@ -381,25 +278,19 @@ jobs:
     name: End-to-End Tests (Server & CLI)
     needs: pre-job
     if: ${{ needs.pre-job.outputs.should_run_e2e_server_cli == 'true' }}
-    runs-on: ${{ matrix.runner }}
-    permissions:
-      contents: read
+    runs-on: mich
     defaults:
       run:
         working-directory: ./e2e
-    strategy:
-      matrix:
-        runner: [ubuntu-latest, ubuntu-24.04-arm]
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
-          persist-credentials: false
           submodules: 'recursive'
 
       - name: Setup Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
         with:
           node-version-file: './e2e/.nvmrc'
 
@@ -429,25 +320,19 @@ jobs:
     name: End-to-End Tests (Web)
     needs: pre-job
     if: ${{ needs.pre-job.outputs.should_run_e2e_web == 'true' }}
-    runs-on: ${{ matrix.runner }}
-    permissions:
-      contents: read
+    runs-on: mich
     defaults:
       run:
         working-directory: ./e2e
-    strategy:
-      matrix:
-        runner: [ubuntu-latest, ubuntu-24.04-arm]
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
-          persist-credentials: false
           submodules: 'recursive'
 
       - name: Setup Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
         with:
           node-version-file: './e2e/.nvmrc'
 
@@ -472,35 +357,15 @@ jobs:
         run: npx playwright test
         if: ${{ !cancelled() }}
 
-  success-check-e2e:
-    name: End-to-End Tests Success
-    needs: [e2e-tests-server-cli, e2e-tests-web]
-    permissions: {}
-    runs-on: ubuntu-latest
-    if: always()
-    steps:
-      - name: Any jobs failed?
-        if: ${{ contains(needs.*.result, 'failure') }}
-        run: exit 1
-      - name: All jobs passed or skipped
-        if: ${{ !(contains(needs.*.result, 'failure')) }}
-        # zizmor: ignore[template-injection]
-        run: echo "All jobs passed or skipped" && echo "${{ toJSON(needs.*.result) }}"
-
   mobile-unit-tests:
     name: Unit Test Mobile
     needs: pre-job
     if: ${{ needs.pre-job.outputs.should_run_mobile == 'true' }}
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - name: Setup Flutter SDK
-        uses: subosito/flutter-action@e938fdf56512cc96ef2f93601a5a40bde3801046 # v2.19.0
+        uses: subosito/flutter-action@e938fdf56512cc96ef2f93601a5a40bde3801046 # v2
         with:
           channel: 'stable'
           flutter-version-file: ./mobile/pubspec.yaml
@@ -513,19 +378,14 @@ jobs:
     needs: pre-job
     if: ${{ needs.pre-job.outputs.should_run_ml == 'true' }}
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     defaults:
       run:
         working-directory: ./machine-learning
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - name: Install uv
-        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        uses: astral-sh/setup-uv@0c5e2b8115b80b4c7c5ddf6ffdd634974642d182 # v5
+      - uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5
         # TODO: add caching when supported (https://github.com/actions/setup-python/pull/818)
         # with:
         #   python-version: 3.11
@@ -551,20 +411,16 @@ jobs:
     needs: pre-job
     if: ${{ needs.pre-job.outputs['should_run_.github'] == 'true' }}
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     defaults:
       run:
         working-directory: ./.github
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Setup Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
         with:
           node-version-file: './.github/.nvmrc'
 
@@ -578,34 +434,25 @@ jobs:
   shellcheck:
     name: ShellCheck
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - name: Run ShellCheck
         uses: ludeeus/action-shellcheck@master
         with:
           ignore_paths: >-
             **/open-api/**
-            **/openapi**
+            **/openapi/**
             **/node_modules/**
 
   generated-api-up-to-date:
     name: OpenAPI Clients
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Setup Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
         with:
           node-version-file: './server/.nvmrc'
 
@@ -619,7 +466,7 @@ jobs:
         run: make open-api
 
       - name: Find file changes
-        uses: tj-actions/verify-changed-files@a1c6acee9df209257a246f2cc6ae8cb6581c1edf # v20.0.4
+        uses: tj-actions/verify-changed-files@a1c6acee9df209257a246f2cc6ae8cb6581c1edf # v20
         id: verify-changed-files
         with:
           files: |
@@ -629,18 +476,14 @@ jobs:
 
       - name: Verify files have not changed
         if: steps.verify-changed-files.outputs.files_changed == 'true'
-        env:
-          CHANGED_FILES: ${{ steps.verify-changed-files.outputs.changed_files }}
         run: |
           echo "ERROR: Generated files not up to date!"
-          echo "Changed files: ${CHANGED_FILES}"
+          echo "Changed files: ${{ steps.verify-changed-files.outputs.changed_files }}"
           exit 1
 
-  sql-schema-up-to-date:
-    name: SQL Schema Checks
+  generated-typeorm-migrations-up-to-date:
+    name: TypeORM Checks
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     services:
       postgres:
         image: tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:739cdd626151ff1f796dc95a6591b55a714f341c737e27f045019ceabf8e8c52
@@ -661,12 +504,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Setup Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
         with:
           node-version-file: './server/.nvmrc'
 
@@ -680,25 +521,23 @@ jobs:
         run: npm run migrations:run
 
       - name: Test npm run schema:reset command works
-        run: npm run schema:reset
+        run: npm run typeorm:schema:reset
 
       - name: Generate new migrations
         continue-on-error: true
-        run: npm run migrations:generate src/TestMigration
+        run: npm run migrations:generate TestMigration
 
       - name: Find file changes
-        uses: tj-actions/verify-changed-files@a1c6acee9df209257a246f2cc6ae8cb6581c1edf # v20.0.4
+        uses: tj-actions/verify-changed-files@a1c6acee9df209257a246f2cc6ae8cb6581c1edf # v20
         id: verify-changed-files
         with:
           files: |
             server/src
       - name: Verify migration files have not changed
         if: steps.verify-changed-files.outputs.files_changed == 'true'
-        env:
-          CHANGED_FILES: ${{ steps.verify-changed-files.outputs.changed_files }}
         run: |
           echo "ERROR: Generated migration files not up to date!"
-          echo "Changed files: ${CHANGED_FILES}"
+          echo "Changed files: ${{ steps.verify-changed-files.outputs.changed_files }}"
           cat ./src/*-TestMigration.ts
           exit 1
 
@@ -708,7 +547,7 @@ jobs:
           DB_URL: postgres://postgres:postgres@localhost:5432/immich
 
       - name: Find file changes
-        uses: tj-actions/verify-changed-files@a1c6acee9df209257a246f2cc6ae8cb6581c1edf # v20.0.4
+        uses: tj-actions/verify-changed-files@a1c6acee9df209257a246f2cc6ae8cb6581c1edf # v20
         id: verify-changed-sql-files
         with:
           files: |
@@ -716,11 +555,9 @@ jobs:
 
       - name: Verify SQL files have not changed
         if: steps.verify-changed-sql-files.outputs.files_changed == 'true'
-        env:
-          CHANGED_FILES: ${{ steps.verify-changed-sql-files.outputs.changed_files }}
         run: |
           echo "ERROR: Generated SQL files not up to date!"
-          echo "Changed files: ${CHANGED_FILES}"
+          echo "Changed files: ${{ steps.verify-changed-sql-files.outputs.changed_files }}"
           exit 1
 
   # mobile-integration-tests:

.github/workflows/weblate-lock.yml

@@ -4,32 +4,30 @@ on:
   pull_request:
     branches: [main]
 
-permissions: {}
-
 jobs:
   pre-job:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     outputs:
       should_run: ${{ steps.found_paths.outputs.i18n == 'true' && github.head_ref != 'chore/translations'}}
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - id: found_paths
-        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
         with:
           filters: |
             i18n:
               - 'i18n/!(en)**\.json'
+      - name: Debug
+        run: |
+          echo "Should run: ${{ steps.found_paths.outputs.i18n == 'true' && github.head_ref != 'chore/translations'}}"
+          echo "Found i18n paths: ${{ steps.found_paths.outputs.i18n }}"
+          echo "Head ref: ${{ github.head_ref }}"
 
   enforce-lock:
     name: Check Weblate Lock
     needs: [pre-job]
     runs-on: ubuntu-latest
-    permissions: {}
     if: ${{ needs.pre-job.outputs.should_run == 'true' }}
     steps:
       - name: Check weblate lock
@@ -38,7 +36,7 @@ jobs:
             exit 1
           fi
       - name: Find Pull Request
-        uses: juliangruber/find-pull-request-action@48b6133aa6c826f267ebd33aa2d29470f9d9e7d0 # v1.9.0
+        uses: juliangruber/find-pull-request-action@48b6133aa6c826f267ebd33aa2d29470f9d9e7d0 # v1
         id: find-pr
         with:
           branch: chore/translations
@@ -49,7 +47,6 @@ jobs:
     name: Weblate Lock Check Success
     needs: [enforce-lock]
     runs-on: ubuntu-latest
-    permissions: {}
     if: always()
     steps:
       - name: Any jobs failed?
@@ -57,5 +54,4 @@ jobs:
         run: exit 1
       - name: All jobs passed or skipped
         if: ${{ !(contains(needs.*.result, 'failure')) }}
-        # zizmor: ignore[template-injection]
         run: echo "All jobs passed or skipped" && echo "${{ toJSON(needs.*.result) }}"

.vscode/settings.json

@@ -1,63 +1,45 @@
 {
+  "editor.formatOnSave": true,
+  "[javascript]": {
+    "editor.defaultFormatter": "esbenp.prettier-vscode",
+    "editor.tabSize": 2,
+    "editor.formatOnSave": true
+  },
+  "[typescript]": {
+    "editor.defaultFormatter": "esbenp.prettier-vscode",
+    "editor.tabSize": 2,
+    "editor.formatOnSave": true
+  },
   "[css]": {
     "editor.defaultFormatter": "esbenp.prettier-vscode",
-    "editor.formatOnSave": true,
+    "editor.tabSize": 2,
+    "editor.formatOnSave": true
+  },
+  "[svelte]": {
+    "editor.defaultFormatter": "svelte.svelte-vscode",
     "editor.tabSize": 2
   },
+  "svelte.enable-ts-plugin": true,
+  "eslint.validate": [
+    "javascript",
+    "svelte"
+  ],
+  "typescript.preferences.importModuleSpecifier": "non-relative",
   "[dart]": {
-    "editor.defaultFormatter": "Dart-Code.dart-code",
     "editor.formatOnSave": true,
     "editor.selectionHighlight": false,
     "editor.suggest.snippetsPreventQuickSuggestions": false,
     "editor.suggestSelection": "first",
     "editor.tabCompletion": "onlySnippets",
-    "editor.wordBasedSuggestions": "off"
+    "editor.wordBasedSuggestions": "off",
+    "editor.defaultFormatter": "Dart-Code.dart-code"
   },
-  "[javascript]": {
-    "editor.codeActionsOnSave": {
-      "source.organizeImports": "explicit",
-      "source.removeUnusedImports": "explicit"
-    },
-    "editor.defaultFormatter": "esbenp.prettier-vscode",
-    "editor.formatOnSave": true,
-    "editor.tabSize": 2
-  },
-  "[json]": {
-    "editor.defaultFormatter": "esbenp.prettier-vscode",
-    "editor.formatOnSave": true,
-    "editor.tabSize": 2
-  },
-  "[jsonc]": {
-    "editor.defaultFormatter": "esbenp.prettier-vscode",
-    "editor.formatOnSave": true,
-    "editor.tabSize": 2
-  },
-  "[svelte]": {
-    "editor.codeActionsOnSave": {
-      "source.organizeImports": "explicit",
-      "source.removeUnusedImports": "explicit"
-    },
-    "editor.defaultFormatter": "svelte.svelte-vscode",
-    "editor.formatOnSave": true,
-    "editor.tabSize": 2
-  },
-  "[typescript]": {
-    "editor.codeActionsOnSave": {
-      "source.organizeImports": "explicit",
-      "source.removeUnusedImports": "explicit"
-    },
-    "editor.defaultFormatter": "esbenp.prettier-vscode",
-    "editor.formatOnSave": true,
-    "editor.tabSize": 2
-  },
-  "cSpell.words": ["immich"],
-  "editor.formatOnSave": true,
-  "eslint.validate": ["javascript", "svelte"],
+  "cSpell.words": [
+    "immich"
+  ],
   "explorer.fileNesting.enabled": true,
   "explorer.fileNesting.patterns": {
-    "*.dart": "${capture}.g.dart,${capture}.gr.dart,${capture}.drift.dart",
-    "*.ts": "${capture}.spec.ts,${capture}.mock.ts"
-  },
-  "svelte.enable-ts-plugin": true,
-  "typescript.preferences.importModuleSpecifier": "non-relative"
-}
+    "*.ts": "${capture}.spec.ts,${capture}.mock.ts",
+    "*.dart": "${capture}.g.dart,${capture}.gr.dart,${capture}.drift.dart"
+  }
+}

Makefile

@@ -17,9 +17,6 @@ e2e:
 prod:
 	docker compose -f ./docker/docker-compose.prod.yml up --build -V --remove-orphans
 
-prod-down:
-	docker compose -f ./docker/docker-compose.prod.yml down --remove-orphans
-
 prod-scale:
 	docker compose -f ./docker/docker-compose.prod.yml up --build -V --scale immich-server=3 --scale immich-microservices=3 --remove-orphans
 

cli/.nvmrc

@@ -1 +1 @@
-22.15.0
+22.14.0

cli/Dockerfile

@@ -1,4 +1,4 @@
-FROM node:22.15.0-alpine3.20@sha256:686b8892b69879ef5bfd6047589666933508f9a5451c67320df3070ba0e9807b AS core
+FROM node:22.14.0-alpine3.20@sha256:40be979442621049f40b1d51a26b55e281246b5de4e5f51a18da7beb6e17e3f9 AS core
 
 WORKDIR /usr/src/open-api/typescript-sdk
 COPY open-api/typescript-sdk/package*.json open-api/typescript-sdk/tsconfig*.json ./

cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@immich/cli",
-  "version": "2.2.65",
+  "version": "2.2.61",
   "description": "Command Line Interface (CLI) for Immich",
   "type": "module",
   "exports": "./dist/index.js",
@@ -21,7 +21,7 @@
     "@types/lodash-es": "^4.17.12",
     "@types/micromatch": "^4.0.9",
     "@types/mock-fs": "^4.13.1",
-    "@types/node": "^22.15.16",
+    "@types/node": "^22.14.0",
     "@vitest/coverage-v8": "^3.0.0",
     "byte-size": "^9.0.0",
     "cli-progress": "^3.12.0",
@@ -69,6 +69,6 @@
     "micromatch": "^4.0.8"
   },
   "volta": {
-    "node": "22.15.0"
+    "node": "22.14.0"
   }
 }

docker/docker-compose.dev.yml

@@ -116,7 +116,7 @@ services:
 
   redis:
     container_name: immich_redis
-    image: docker.io/valkey/valkey:8-bookworm@sha256:ff21bc0f8194dc9c105b769aeabf9585fea6a8ed649c0781caeac5cb3c247884
+    image: docker.io/valkey/valkey:8-bookworm@sha256:42cba146593a5ea9a622002c1b7cba5da7be248650cbb64ecb9c6c33d29794b1
     healthcheck:
       test: redis-cli ping || exit 1
 

docker/docker-compose.prod.yml

@@ -56,7 +56,7 @@ services:
 
   redis:
     container_name: immich_redis
-    image: docker.io/valkey/valkey:8-bookworm@sha256:ff21bc0f8194dc9c105b769aeabf9585fea6a8ed649c0781caeac5cb3c247884
+    image: docker.io/valkey/valkey:8-bookworm@sha256:42cba146593a5ea9a622002c1b7cba5da7be248650cbb64ecb9c6c33d29794b1
     healthcheck:
       test: redis-cli ping || exit 1
     restart: always
@@ -90,7 +90,7 @@ services:
     container_name: immich_prometheus
     ports:
       - 9090:9090
-    image: prom/prometheus@sha256:e2b8aa62b64855956e3ec1e18b4f9387fb6203174a4471936f4662f437f04405
+    image: prom/prometheus@sha256:502ad90314c7485892ce696cb14a99fceab9fc27af29f4b427f41bd39701a199
     volumes:
       - ./prometheus.yml:/etc/prometheus/prometheus.yml
       - prometheus-data:/prometheus
@@ -102,7 +102,7 @@ services:
     command: [ './run.sh', '-disable-reporting' ]
     ports:
       - 3000:3000
-    image: grafana/grafana:11.6.1-ubuntu@sha256:6fc273288470ef499dd3c6b36aeade093170d4f608f864c5dd3a7fabeae77b50
+    image: grafana/grafana:11.6.0-ubuntu@sha256:fd8fa48213c624e1a95122f1d93abbf1cf1cbe85fc73212c1e599dbd76c63ff8
     volumes:
       - grafana-data:/var/lib/grafana
 

docker/docker-compose.yml

@@ -49,7 +49,7 @@ services:
 
   redis:
     container_name: immich_redis
-    image: docker.io/valkey/valkey:8-bookworm@sha256:ff21bc0f8194dc9c105b769aeabf9585fea6a8ed649c0781caeac5cb3c247884
+    image: docker.io/valkey/valkey:8-bookworm@sha256:42cba146593a5ea9a622002c1b7cba5da7be248650cbb64ecb9c6c33d29794b1
     healthcheck:
       test: redis-cli ping || exit 1
     restart: always

docs/.nvmrc

@@ -1 +1 @@
-22.15.0
+22.14.0

docs/docs/administration/backup-and-restore.md

@@ -23,32 +23,23 @@ Refer to the official [postgres documentation](https://www.postgresql.org/docs/c
 It is not recommended to directly backup the `DB_DATA_LOCATION` folder. Doing so while the database is running can lead to a corrupted backup that cannot be restored.
 :::
 
-### Automatic Database Dumps
+### Automatic Database Backups
 
-:::warning
-The automatic database dumps can be used to restore the database in the event of damage to the Postgres database files.
-There is no monitoring for these dumps and you will not be notified if they are unsuccessful.
-:::
+For convenience, Immich will automatically create database backups by default. The backups are stored in `UPLOAD_LOCATION/backups`.  
+As mentioned above, you should make your own backup of these together with the asset folders as noted below.  
+You can adjust the schedule and amount of kept backups in the [admin settings](http://my.immich.app/admin/system-settings?isOpen=backup).  
+By default, Immich will keep the last 14 backups and create a new backup every day at 2:00 AM.
 
-:::caution
-The database dumps do **NOT** contain any pictures or videos, only metadata. They are only usable with a copy of the other files in `UPLOAD_LOCATION` as outlined below.
-:::
+#### Trigger Backup
 
-For disaster-recovery purposes, Immich will automatically create database dumps. The dumps are stored in `UPLOAD_LOCATION/backups`.
-Please be sure to make your own, independent backup of the database together with the asset folders as noted below.
-You can adjust the schedule and amount of kept database dumps in the [admin settings](http://my.immich.app/admin/system-settings?isOpen=backup).
-By default, Immich will keep the last 14 database dumps and create a new dump every day at 2:00 AM.
-
-#### Trigger Dump
-
-You are able to trigger a database dump in the [admin job status page](http://my.immich.app/admin/jobs-status).
-Visit the page, open the "Create job" modal from the top right, select "Create Database Dump" and click "Confirm".
-A job will run and trigger a dump, you can verify this worked correctly by checking the logs or the `backups/` folder.
-This dumps will count towards the last `X` dumps that will be kept based on your settings.
+You are able to trigger a backup in the [admin job status page](http://my.immich.app/admin/jobs-status).
+Visit the page, open the "Create job" modal from the top right, select "Backup Database" and click "Confirm".
+A job will run and trigger a backup, you can verify this worked correctly by checking the logs or the backup folder.
+This backup will count towards the last X backups that will be kept based on your settings.
 
 #### Restoring
 
-We hope to make restoring simpler in future versions, for now you can find the database dumps in the `UPLOAD_LOCATION/backups` folder on your host.
+We hope to make restoring simpler in future versions, for now you can find the backups in the `UPLOAD_LOCATION/backups` folder on your host.  
 Then please follow the steps in the following section for restoring the database.
 
 ### Manual Backup and Restore

docs/docs/administration/reverse-proxy.md

@@ -22,7 +22,7 @@ server {
     client_max_body_size 50000M;
 
     # Set headers
-    proxy_set_header Host              $host;
+    proxy_set_header Host              $http_host;
     proxy_set_header X-Real-IP         $remote_addr;
     proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
     proxy_set_header X-Forwarded-Proto $scheme;

docs/docs/developer/database-migrations.md

@@ -1,14 +1,14 @@
 # Database Migrations
 
-After making any changes in the `server/src/schema`, a database migration need to run in order to register the changes in the database. Follow the steps below to create a new migration.
+After making any changes in the `server/src/entities`, a database migration need to run in order to register the changes in the database. Follow the steps below to create a new migration.
 
 1. Run the command
 
 ```bash
-npm run migrations:generate <migration-name>
+npm run typeorm:migrations:generate <migration-name>
 ```
 
 2. Check if the migration file makes sense.
-3. Move the migration file to folder `./server/src/schema/migrations` in your code editor.
+3. Move the migration file to folder `./server/src/migrations` in your code editor.
 
 The server will automatically detect `*.ts` file changes and restart. Part of the server start-up process includes running any new migrations, so it will be applied immediately.

docs/docs/developer/setup.md

@@ -83,20 +83,9 @@ To see local changes to `@immich/ui` in Immich, do the following:
 
 ### Mobile app
 
-#### Setup
+The mobile app `(/mobile)` will required Flutter toolchain 3.13.x and FVM to be installed on your system.
 
-1. Setup Flutter toolchain using FVM.
-2. Run `flutter pub get` to install the dependencies.
-3. Run `make translation` to generate the translation file.
-4. Run `fvm flutter run` to start the app.
-
-#### Translation
-
-To add a new translation text, enter the key-value pair in the `i18n/en.json` in the root of the immich project. Then, from the `mobile/` directory, run
-
-```bash
-make translation
-```
+Please refer to the [Flutter's official documentation](https://flutter.dev/docs/get-started/install) for more information on setting up the toolchain on your machine.
 
 The mobile app asks you what backend to connect to. You can utilize the demo backend (https://demo.immich.app/) if you don't need to change server code or upload photos. Alternatively, you can run the server yourself per the instructions above.
 

docs/docs/features/command-line-interface.md

@@ -42,12 +42,6 @@ docker run -it -v "$(pwd)":/import:ro -e IMMICH_INSTANCE_URL=https://your-immich
 
 Please modify the `IMMICH_INSTANCE_URL` and `IMMICH_API_KEY` environment variables as suitable. You can also use a Docker env file to store your sensitive API key.
 
-This `docker run` command will directly run the command `immich` inside the container. You can directly append the desired parameters (see under "usage") to the commandline like this:
-
-```bash
-docker run -it -v "$(pwd)":/import:ro -e IMMICH_INSTANCE_URL=https://your-immich-instance/api -e IMMICH_API_KEY=your-api-key ghcr.io/immich-app/immich-cli:latest upload -a -c 5 --recursive directory/
-```
-
 ## Usage
 
 <details>

docs/docs/features/hardware-transcoding.md

@@ -121,6 +121,6 @@ Once this is done, you can continue to step 3 of "Basic Setup".
 
 [hw-file]: https://github.com/immich-app/immich/releases/latest/download/hwaccel.transcoding.yml
 [nvct]: https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/latest/install-guide.html
-[jellyfin-lp]: https://jellyfin.org/docs/general/post-install/transcoding/hardware-acceleration/intel#low-power-encoding
-[jellyfin-kernel-bug]: https://jellyfin.org/docs/general/post-install/transcoding/hardware-acceleration/intel#known-issues-and-limitations-on-linux
+[jellyfin-lp]: https://jellyfin.org/docs/general/administration/hardware-acceleration/intel/#configure-and-verify-lp-mode-on-linux
+[jellyfin-kernel-bug]: https://jellyfin.org/docs/general/administration/hardware-acceleration/intel/#known-issues-and-limitations
 [libmali-rockchip]: https://github.com/tsukumijima/libmali-rockchip/releases

docs/docs/features/libraries.md

@@ -72,7 +72,7 @@ In rare cases, the library watcher can hang, preventing Immich from starting up.
 
 ### Nightly job
 
-There is an automatic scan job that is scheduled to run once a day. This job also cleans up any libraries stuck in deletion. It is possible to trigger the cleanup by clicking "Scan all libraries" in the library management page.
+There is an automatic scan job that is scheduled to run once a day. This job also cleans up any libraries stuck in deletion. It is possible to trigger the cleanup by clicking "Scan all libraries" in the library managment page.
 
 ## Usage
 

docs/docs/features/ml-hardware-acceleration.md

@@ -42,7 +42,7 @@ You do not need to redo any machine learning jobs after enabling hardware accele
 
 - The GPU must have compute capability 5.2 or greater.
 - The server must have the official NVIDIA driver installed.
-- The installed driver must be >= 545 (it must support CUDA 12.3).
+- The installed driver must be >= 535 (it must support CUDA 12.2).
 - On Linux (except for WSL2), you also need to have [NVIDIA Container Toolkit][nvct] installed.
 
 #### ROCm

docs/docs/features/searching.md

@@ -92,7 +92,7 @@ Memory and execution time estimates were obtained without acceleration on a 7800
 
 **Execution Time (ms)**: After warming up the model with one pass, the mean execution time of 100 passes with the same input.
 
-**Memory (MiB)**: The peak RSS usage of the process after performing the above timing benchmark. Does not include image decoding, concurrent processing, the web server, etc., which are relatively constant factors.
+**Memory (MiB)**: The peak RSS usage of the process afer performing the above timing benchmark. Does not include image decoding, concurrent processing, the web server, etc., which are relatively constant factors.
 
 **Recall (%)**: Evaluated on Crossmodal-3600, the average of the recall@1, recall@5 and recall@10 results for zeroshot image retrieval. Chinese (Simplified), English, French, German, Italian, Japanese, Korean, Polish, Russian, Spanish and Turkish are additionally tested on XTD-10. Chinese (Simplified) and English are additionally tested on Flickr30k. The recall metrics are the average across all tested datasets.
 

docs/docs/guides/custom-map-styles.md

@@ -14,14 +14,14 @@ online generators you can use.
 2. Paste the link to your JSON style in either the **Light Style** or **Dark Style**. (You can add different styles which will help make the map style more appropriate depending on whether you set **Immich** to Light or Dark mode.)
 3. Save your selections. Reload the map, and enjoy your custom map style!
 
-## Use MapTiler to build a custom style
+## Use Maptiler to build a custom style
 
-Customizing the map style can be done easily using MapTiler, if you do not want to write an entire JSON document by hand.
+Customizing the map style can be done easily using Maptiler, if you do not want to write an entire JSON document by hand.
 
 1. Create a free account at https://cloud.maptiler.com
 2. Once logged in, you can either create a brand new map by clicking on **New Map**, selecting a starter map, and then clicking **Customize**, OR by selecting a **Standard Map** and customizing it from there.
 3. The **editor** interface is self-explanatory. You can change colors, remove visible layers, or add optional layers (e.g., administrative, topo, hydro, etc.) in the composer.
 4. Once you have your map composed, click on **Save** at the top right. Give it a unique name to save it to your account.
-5. Next, **Publish** your style using the **Publish** button at the top right. This will deploy it to production, which means it is able to be exposed over the Internet. MapTiler will present an interactive side-by-side map with the original and your changes prior to publication.<br/>![MapTiler Publication Settings](img/immich_map_styles_publish.webp)
-6. MapTiler will warn you that changing the map will change it across all apps using the map. Since no apps are using the map yet, this is okay.
-7. Clicking on the name of your new map at the top left will bring you to the item's **details** page. From here, copy the link to the JSON style under **Use vector style**. This link will automatically contain your personal API key to MapTiler.
+5. Next, **Publish** your style using the **Publish** button at the top right. This will deploy it to production, which means it is able to be exposed over the Internet. Maptiler will present an interactive side-by-side map with the original and your changes prior to publication.<br/>![Maptiler Publication Settings](img/immich_map_styles_publish.webp)
+6. Maptiler will warn you that changing the map will change it across all apps using the map. Since no apps are using the map yet, this is okay.
+7. Clicking on the name of your new map at the top left will bring you to the item's **details** page. From here, copy the link to the JSON style under **Use vector style**. This link will automatically contain your personal API key to Maptiler.

docs/docs/guides/database-queries.md

@@ -1,7 +1,7 @@
 # Database Queries
 
 :::danger
-Keep in mind that mucking around in the database might set the Moon on fire. Avoid modifying the database directly when possible, and always have current backups.
+Keep in mind that mucking around in the database might set the moon on fire. Avoid modifying the database directly when possible, and always have current backups.
 :::
 
 :::tip

docs/docs/install/docker-compose.mdx

@@ -2,13 +2,53 @@
 sidebar_position: 30
 ---
 
+import CodeBlock from '@theme/CodeBlock';
+import ExampleEnv from '!!raw-loader!../../../docker/example.env';
+
 # Docker Compose [Recommended]
 
 Docker Compose is the recommended method to run Immich in production. Below are the steps to deploy Immich with Docker Compose.
 
-import DockerComposeSteps from '/docs/partials/_docker-compose-install-steps.mdx';
+## Step 1 - Download the required files
 
-<DockerComposeSteps />
+Create a directory of your choice (e.g. `./immich-app`) to hold the `docker-compose.yml` and `.env` files.
+
+```bash title="Move to the directory you created"
+mkdir ./immich-app
+cd ./immich-app
+```
+
+Download [`docker-compose.yml`][compose-file] and [`example.env`][env-file] by running the following commands:
+
+```bash title="Get docker-compose.yml file"
+wget -O docker-compose.yml https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml
+```
+
+```bash title="Get .env file"
+wget -O .env https://github.com/immich-app/immich/releases/latest/download/example.env
+```
+
+You can alternatively download these two files from your browser and move them to the directory that you created, in which case ensure that you rename `example.env` to `.env`.
+
+## Step 2 - Populate the .env file with custom values
+
+<CodeBlock language="bash" title="Default environmental variable content">
+  {ExampleEnv}
+</CodeBlock>
+
+- Populate `UPLOAD_LOCATION` with your preferred location for storing backup assets. It should be a new directory on the server with enough free space.
+- Consider changing `DB_PASSWORD` to a custom value. Postgres is not publicly exposed, so this password is only used for local authentication.
+  To avoid issues with Docker parsing this value, it is best to use only the characters `A-Za-z0-9`. `pwgen` is a handy utility for this.
+- Set your timezone by uncommenting the `TZ=` line.
+- Populate custom database information if necessary.
+
+## Step 3 - Start the containers
+
+From the directory you created in Step 1 (which should now contain your customized `docker-compose.yml` and `.env` files), run the following command to start Immich as a background service:
+
+```bash title="Start the containers"
+docker compose up -d
+```
 
 :::info Docker version
 If you get an error such as `unknown shorthand flag: 'd' in -d` or `open <location of your .env file>: permission denied`, you are probably running the wrong Docker version. (This happens, for example, with the docker.io package in Ubuntu 22.04.3 LTS.) You can correct the problem by following the complete [Docker Engine install](https://docs.docker.com/engine/install/) procedure for your distribution, crucially the "Uninstall old versions" and "Install using the apt/rpm repository" sections. These replace the distro's Docker packages with Docker's official ones.
@@ -30,3 +70,6 @@ If you get an error `can't set healthcheck.start_interval as feature require Doc
 ## Next Steps
 
 Read the [Post Installation](/docs/install/post-install.mdx) steps and [upgrade instructions](/docs/install/upgrading.md).
+
+[compose-file]: https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml
+[env-file]: https://github.com/immich-app/immich/releases/latest/download/example.env

docs/docs/install/environment-variables.md

@@ -80,7 +80,6 @@ Information on the current workers can be found [here](/docs/administration/jobs
 | `DB_USERNAME`                       | Database user                                                            |  `postgres`  | server, database<sup>\*1</sup> |
 | `DB_PASSWORD`                       | Database password                                                        |  `postgres`  | server, database<sup>\*1</sup> |
 | `DB_DATABASE_NAME`                  | Database name                                                            |   `immich`   | server, database<sup>\*1</sup> |
-| `DB_SSL_MODE`                       | Database SSL mode                                                        |              | server                         |
 | `DB_VECTOR_EXTENSION`<sup>\*2</sup> | Database vector extension (one of [`pgvector`, `pgvecto.rs`])            | `pgvecto.rs` | server                         |
 | `DB_SKIP_MIGRATIONS`                | Whether to skip running migrations on startup (one of [`true`, `false`]) |   `false`    | server                         |
 

docs/docs/install/synology.md

@@ -29,7 +29,7 @@ Download [`docker-compose.yml`](https://github.com/immich-app/immich/releases/la
 
 ## Step 2 - Populate the .env file with custom values
 
-Follow [Step 2 in Docker Compose](/docs/install/docker-compose#step-2---populate-the-env-file-with-custom-values) for instructions on customizing the `.env` file, and then return back to this guide to continue.
+Follow [Step 2 in Docker Compose](./docker-compose#step-2---populate-the-env-file-with-custom-values) for instructions on customizing the `.env` file, and then return back to this guide to continue.
 
 ## Step 3 - Create a new project in Container Manager
 

docs/docs/install/truenas.md

@@ -2,7 +2,7 @@
 sidebar_position: 80
 ---
 
-# TrueNAS [Community]
+# TrueNAS SCALE [Community]
 
 :::note
 This is a community contribution and not officially supported by the Immich team, but included here for convenience.
@@ -12,17 +12,17 @@ Community support can be found in the dedicated channel on the [Discord Server](
 **Please report app issues to the corresponding [Github Repository](https://github.com/truenas/charts/tree/master/community/immich).**
 :::
 
-Immich can easily be installed on TrueNAS Community Edition via the **Community** train application.
-Consider reviewing the TrueNAS [Apps resources](https://apps.truenas.com/getting-started/) if you have not previously configured applications on your system.
+Immich can easily be installed on TrueNAS SCALE via the **Community** train application.
+Consider reviewing the TrueNAS [Apps tutorial](https://www.truenas.com/docs/scale/scaletutorials/apps/) if you have not previously configured applications on your system.
 
-TrueNAS Community Edition makes installing and updating Immich easy, but you must use the Immich web portal and mobile app to configure accounts and access libraries.
+TrueNAS SCALE makes installing and updating Immich easy, but you must use the Immich web portal and mobile app to configure accounts and access libraries.
 
 ## First Steps
 
-The Immich app in TrueNAS Community Edition installs, completes the initial configuration, then starts the Immich web portal.
-When updates become available, TrueNAS alerts and provides easy updates.
+The Immich app in TrueNAS SCALE installs, completes the initial configuration, then starts the Immich web portal.
+When updates become available, SCALE alerts and provides easy updates.
 
-Before installing the Immich app in TrueNAS, review the [Environment Variables](#environment-variables) documentation to see if you want to configure any during installation.
+Before installing the Immich app in SCALE, review the [Environment Variables](#environment-variables) documentation to see if you want to configure any during installation.
 You may also configure environment variables at any time after deploying the application.
 
 ### Setting up Storage Datasets
@@ -126,9 +126,9 @@ className="border rounded-xl"
 
 Accept the default port `30041` in **WebUI Port** or enter a custom port number.
 :::info Allowed Port Numbers
-Only numbers within the range 9000-65535 may be used on TrueNAS versions below TrueNAS Community Edition 24.10 Electric Eel.
+Only numbers within the range 9000-65535 may be used on SCALE versions below TrueNAS Scale 24.10 Electric Eel.
 
-Regardless of version, to avoid port conflicts, don't use [ports on this list](https://www.truenas.com/docs/solutions/optimizations/security/#truenas-default-ports).
+Regardless of version, to avoid port conflicts, don't use [ports on this list](https://www.truenas.com/docs/references/defaultports/).
 :::
 
 ### Storage Configuration
@@ -173,7 +173,7 @@ className="border rounded-xl"
 
 You may configure [External Libraries](/docs/features/libraries) by mounting them using **Additional Storage**.
 The **Mount Path** is the location you will need to copy and paste into the External Library settings within Immich.
-The **Host Path** is the location on the TrueNAS Community Edition server where your external library is located.
+The **Host Path** is the location on the TrueNAS SCALE server where your external library is located.
 
 <!-- A section for Labels would go here but I don't know what they do. -->
 
@@ -188,17 +188,17 @@ className="border rounded-xl"
 
 Accept the default **CPU** limit of `2` threads or specify the number of threads (CPUs with Multi-/Hyper-threading have 2 threads per core).
 
-Specify the **Memory** limit in MB of RAM. Immich recommends at least 6000 MB (6GB). If you selected **Enable Machine Learning** in **Immich Configuration**, you should probably set this above 8000 MB.
+Accept the default **Memory** limit of `4096` MB or specify the number of MB of RAM. If you're using Machine Learning you should probably set this above 8000 MB.
 
-:::info Older TrueNAS Versions
-Before TrueNAS Community Edition version 24.10 Electric Eel:
+:::info Older SCALE Versions
+Before TrueNAS SCALE version 24.10 Electric Eel:
 
 The **CPU** value was specified in a different format with a default of `4000m` which is 4 threads.
 
 The **Memory** value was specified in a different format with a default of `8Gi` which is 8 GiB of RAM. The value was specified in bytes or a number with a measurement suffix. Examples: `129M`, `123Mi`, `1000000000`
 :::
 
-Enable **GPU Configuration** options if you have a GPU that you will use for [Hardware Transcoding](/docs/features/hardware-transcoding) and/or [Hardware-Accelerated Machine Learning](/docs/features/ml-hardware-acceleration.md). More info: [GPU Passthrough Docs for TrueNAS Apps](https://apps.truenas.com/managing-apps/installing-apps/#gpu-passthrough)
+Enable **GPU Configuration** options if you have a GPU that you will use for [Hardware Transcoding](/docs/features/hardware-transcoding) and/or [Hardware-Accelerated Machine Learning](/docs/features/ml-hardware-acceleration.md). More info: [GPU Passthrough Docs for TrueNAS Apps](https://www.truenas.com/docs/truenasapps/#gpu-passthrough)
 
 ### Install
 
@@ -240,7 +240,7 @@ className="border rounded-xl"
 />
 
 :::info
-Some Environment Variables are not available for the TrueNAS Community Edition app. This is mainly because they can be configured through GUI options in the [Edit Immich screen](#edit-app-settings).
+Some Environment Variables are not available for the TrueNAS SCALE app. This is mainly because they can be configured through GUI options in the [Edit Immich screen](#edit-app-settings).
 
 Some examples are: `IMMICH_VERSION`, `UPLOAD_LOCATION`, `DB_DATA_LOCATION`, `TZ`, `IMMICH_LOG_LEVEL`, `DB_PASSWORD`, `REDIS_PASSWORD`.
 :::
@@ -251,7 +251,7 @@ Some examples are: `IMMICH_VERSION`, `UPLOAD_LOCATION`, `DB_DATA_LOCATION`, `TZ`
 Make sure to read the general [upgrade instructions](/docs/install/upgrading.md).
 :::
 
-When updates become available, TrueNAS alerts and provides easy updates.
+When updates become available, SCALE alerts and provides easy updates.
 To update the app to the latest version:
 
 - Go to the **Installed Applications** screen and select Immich from the list of installed applications.

docs/docs/overview/comparison.md

@@ -1,5 +1,5 @@
 ---
-sidebar_position: 3
+sidebar_position: 2
 ---
 
 # Comparison

docs/docs/overview/introduction.mdx

@@ -2,13 +2,9 @@
 sidebar_position: 1
 ---
 
-# Welcome to Immich
+# Introduction
 
-<img
-  src={require('./img/social-preview-light.webp').default}
-  alt="Immich - Self-hosted photos and videos backup tool"
-  data-theme="light"
-/>
+<img src={require('./img/feature-panel.webp').default} alt="Immich - Self-hosted photos and videos backup tool" />
 
 ## Welcome!
 

docs/docs/overview/quick-start.mdx

@@ -1,5 +1,5 @@
 ---
-sidebar_position: 2
+sidebar_position: 3
 ---
 
 # Quick start
@@ -10,20 +10,11 @@ to install and use it.
 
 ## Requirements
 
-- A system with at least 4GB of RAM and 2 CPU cores.
-- [Docker](https://docs.docker.com/engine/install/)
-
-> For a more detailed list of requirements, see the [requirements page](/docs/install/requirements).
-
----
+Check the [requirements page](/docs/install/requirements) to get started.
 
 ## Set up the server
 
-import DockerComposeSteps from '/docs/partials/_docker-compose-install-steps.mdx';
-
-<DockerComposeSteps />
-
----
+Follow the [Docker Compose (Recommended)](/docs/install/docker-compose) instructions to install the server.
 
 ## Try the web app
 
@@ -35,8 +26,6 @@ Try uploading a picture from your browser.
 
 <img src={require('./img/upload-button.webp').default} title="Upload button" />
 
----
-
 ## Try the mobile app
 
 ### Download the Mobile App
@@ -67,8 +56,6 @@ You can select the **Jobs** tab to see Immich processing your photos.
 
 <img src={require('/docs/guides/img/jobs-tab.webp').default} title="Jobs tab" width={300} />
 
----
-
 ## Review the database backup and restore process
 
 Immich has built-in database backups. You can refer to the
@@ -78,8 +65,6 @@ Immich has built-in database backups. You can refer to the
 The database only contains metadata and user information. You must setup manual backups of the images and videos stored in `UPLOAD_LOCATION`.
 :::
 
----
-
 ## Where to go from here?
 
 You may decide you'd like to install the server a different way; the Install category on the left menu provides many options.

docs/docs/partials/_docker-compose-install-steps.mdx

@@ -1,43 +0,0 @@
-import CodeBlock from '@theme/CodeBlock';
-import ExampleEnv from '!!raw-loader!../../../docker/example.env';
-
-### Step 1 - Download the required files
-
-Create a directory of your choice (e.g. `./immich-app`) to hold the `docker-compose.yml` and `.env` files.
-
-```bash title="Move to the directory you created"
-mkdir ./immich-app
-cd ./immich-app
-```
-
-Download [`docker-compose.yml`](https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml) and [`example.env`](https://github.com/immich-app/immich/releases/latest/download/example.env) by running the following commands:
-
-```bash title="Get docker-compose.yml file"
-wget -O docker-compose.yml https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml
-```
-
-```bash title="Get .env file"
-wget -O .env https://github.com/immich-app/immich/releases/latest/download/example.env
-```
-
-You can alternatively download these two files from your browser and move them to the directory that you created, in which case ensure that you rename `example.env` to `.env`.
-
-### Step 2 - Populate the .env file with custom values
-
-<CodeBlock language="bash" title="Default environmental variable content">
-  {ExampleEnv}
-</CodeBlock>
-
-- Populate `UPLOAD_LOCATION` with your preferred location for storing backup assets. It should be a new directory on the server with enough free space.
-- Consider changing `DB_PASSWORD` to a custom value. Postgres is not publicly exposed, so this password is only used for local authentication.
-  To avoid issues with Docker parsing this value, it is best to use only the characters `A-Za-z0-9`. `pwgen` is a handy utility for this.
-- Set your timezone by uncommenting the `TZ=` line.
-- Populate custom database information if necessary.
-
-### Step 3 - Start the containers
-
-From the directory you created in Step 1 (which should now contain your customized `docker-compose.yml` and `.env` files), run the following command to start Immich as a background service:
-
-```bash title="Start the containers"
-docker compose up -d
-```

docs/docusaurus.config.js

@@ -95,7 +95,7 @@ const config = {
             position: 'right',
           },
           {
-            to: '/docs/overview/welcome',
+            to: '/docs/overview/introduction',
             position: 'right',
             label: 'Docs',
           },
@@ -124,12 +124,6 @@ const config = {
             label: 'Discord',
             position: 'right',
           },
-          {
-            type: 'html',
-            position: 'right',
-            value:
-              '<a href="https://buy.immich.app" target="_blank" class="no-underline hover:no-underline"><button class="buy-button bg-immich-primary dark:bg-immich-dark-primary text-white dark:text-black rounded-xl">Buy Immich</button></a>',
-          },
         ],
       },
       footer: {
@@ -140,7 +134,7 @@ const config = {
             items: [
               {
                 label: 'Welcome',
-                to: '/docs/overview/welcome',
+                to: '/docs/overview/introduction',
               },
               {
                 label: 'Installation',

docs/package.json

@@ -57,6 +57,6 @@
     "node": ">=20"
   },
   "volta": {
-    "node": "22.15.0"
+    "node": "22.14.0"
   }
 }

docs/src/components/community-projects.tsx

@@ -40,9 +40,8 @@ const projects: CommunityProjectProps[] = [
   },
   {
     title: 'Lightroom Immich Plugin: lrc-immich-plugin',
-    description:
-      'Lightroom plugin to publish, export photos from Lightroom to Immich. Import from Immich to Lightroom is also supported.',
-    url: 'https://blog.fokuspunk.de/lrc-immich-plugin/',
+    description: 'Another Lightroom plugin to publish or export photos from Lightroom to Immich.',
+    url: 'https://github.com/bmachek/lrc-immich-plugin',
   },
   {
     title: 'Immich Duplicate Finder',

docs/src/css/custom.css

@@ -7,22 +7,14 @@
 @tailwind components;
 @tailwind utilities;
 
-@font-face {
-  font-family: 'Overpass';
-  src: url('/fonts/overpass/Overpass.ttf') format('truetype-variations');
-  font-weight: 1 999;
-  font-style: normal;
-  ascent-override: 106.25%;
-  size-adjust: 106.25%;
-}
+@import url('https://fonts.googleapis.com/css2?family=Be+Vietnam+Pro:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap');
 
-@font-face {
-  font-family: 'Overpass Mono';
-  src: url('/fonts/overpass/OverpassMono.ttf') format('truetype-variations');
-  font-weight: 1 999;
-  font-style: normal;
+body {
+  font-family: 'Be Vietnam Pro', serif;
+  font-optical-sizing: auto;
+  /* font-size: 1.125rem;
   ascent-override: 106.25%;
-  size-adjust: 106.25%;
+  size-adjust: 106.25%; */
 }
 
 .breadcrumbs__link {
@@ -37,7 +29,6 @@ img {
 
 /* You can override the default Infima variables here. */
 :root {
-  font-family: 'Overpass', sans-serif;
   --ifm-color-primary: #4250af;
   --ifm-color-primary-dark: #4250af;
   --ifm-color-primary-darker: #4250af;
@@ -68,12 +59,14 @@ div[class^='announcementBar_'] {
 }
 
 .menu__link {
-  padding: 10px 10px 10px 16px;
+  padding: 10px;
+  padding-left: 16px;
   border-radius: 24px;
   margin-right: 16px;
 }
 
 .menu__list-item-collapsible {
+  border-radius: 10px;
   margin-right: 16px;
   border-radius: 24px;
 }
@@ -90,12 +83,3 @@ div[class*='navbar__items'] > li:has(a[class*='version-switcher-34ab39']) {
 code {
   font-weight: 600;
 }
-
-.buy-button {
-  padding: 8px 14px;
-  border: 1px solid transparent;
-  font-family: 'Overpass', sans-serif;
-  font-weight: 500;
-  cursor: pointer;
-  box-shadow: 0 0 5px 2px rgba(181, 206, 254, 0.4);
-}

docs/src/pages/cursed-knowledge.tsx

@@ -2,7 +2,6 @@ import {
   mdiBug,
   mdiCalendarToday,
   mdiCrosshairsOff,
-  mdiCrop,
   mdiDatabase,
   mdiLeadPencil,
   mdiLockOff,
@@ -23,18 +22,6 @@ const withLanguage = (date: Date) => (language: string) => date.toLocaleDateStri
 type Item = Omit<TimelineItem, 'done' | 'getDateLabel'> & { date: Date };
 
 const items: Item[] = [
-  {
-    icon: mdiCrop,
-    iconColor: 'tomato',
-    title: 'Image dimensions in EXIF metadata are cursed',
-    description:
-      'The dimensions in EXIF metadata can be different from the actual dimensions of the image, causing issues with cropping and resizing.',
-    link: {
-      url: 'https://github.com/immich-app/immich/pull/17974',
-      text: '#17974',
-    },
-    date: new Date(2025, 5, 5),
-  },
   {
     icon: mdiMicrosoftWindows,
     iconColor: '#357EC7',

docs/src/pages/errors.md

@@ -1,5 +0,0 @@
-# Errors
-
-## TypeORM Upgrade
-
-The upgrade to Immich `v2.x.x` has a required upgrade path to `v1.132.0+`. This means it is required to start up the application at least once on version `1.132.0` (or later). Doing so will complete database schema upgrades that are required for `v2.0.0`. After Immich has successfully booted on this version, shut the system down and try the `v2.x.x` upgrade again.

docs/src/pages/index.tsx

@@ -4,7 +4,6 @@ import Layout from '@theme/Layout';
 import { discordPath, discordViewBox } from '@site/src/components/svg-paths';
 import ThemedImage from '@theme/ThemedImage';
 import Icon from '@mdi/react';
-
 function HomepageHeader() {
   return (
     <header>
@@ -13,14 +12,11 @@ function HomepageHeader() {
         <div className="w-full h-[120vh] absolute left-0 top-0 backdrop-blur-3xl bg-immich-bg/40 dark:bg-transparent"></div>
       </div>
       <section className="text-center pt-12 sm:pt-24 bg-immich-bg/50 dark:bg-immich-dark-bg/80">
-        <a href="https://futo.org" target="_blank" rel="noopener noreferrer">
-          <ThemedImage
-            sources={{ dark: 'img/logomark-dark-with-futo.svg', light: 'img/logomark-light-with-futo.svg' }}
-            className="h-[125px] w-[125px] mb-2 antialiased rounded-none"
-            alt="Immich logo"
-          />
-        </a>
-
+        <ThemedImage
+          sources={{ dark: 'img/logomark-dark.svg', light: 'img/logomark-light.svg' }}
+          className="h-[115px] w-[115px] mb-2 antialiased rounded-none"
+          alt="Immich logo"
+        />
         <div className="mt-8">
           <p className="text-3xl md:text-5xl sm:leading-tight mb-1 font-extrabold text-black/90 dark:text-white px-4">
             Self-hosted{' '}
@@ -31,7 +27,7 @@ function HomepageHeader() {
             solution<span className="block"></span>
           </p>
 
-          <p className="max-w-1/4 m-auto mt-4 px-4 text-lg text-gray-700 dark:text-gray-100">
+          <p className="max-w-1/4 m-auto mt-4 px-4">
             Easily back up, organize, and manage your photos on your own server. Immich helps you
             <span className="sm:block"></span> browse, search and organize your photos and videos with ease, without
             sacrificing your privacy.
@@ -39,21 +35,27 @@ function HomepageHeader() {
         </div>
         <div className="flex flex-col sm:flex-row place-items-center place-content-center mt-9 gap-4 ">
           <Link
-            className="flex place-items-center place-content-center py-3 px-8 border bg-immich-primary dark:bg-immich-dark-primary rounded-xl no-underline hover:no-underline text-white hover:text-gray-50 dark:text-immich-dark-bg font-bold"
-            to="docs/overview/quick-start"
+            className="flex place-items-center place-content-center py-3 px-8 border bg-immich-primary dark:bg-immich-dark-primary rounded-xl no-underline hover:no-underline text-white hover:text-gray-50 dark:text-immich-dark-bg font-bold uppercase"
+            to="docs/overview/introduction"
           >
-            Get Started
+            Get started
           </Link>
 
           <Link
-            className="flex place-items-center place-content-center py-3 px-8 border bg-white/90 dark:bg-gray-300  rounded-xl hover:no-underline text-immich-primary dark:text-immich-dark-bg font-bold"
+            className="flex place-items-center place-content-center py-3 px-8 border bg-immich-primary/10 dark:bg-gray-300  rounded-xl hover:no-underline text-immich-primary dark:text-immich-dark-bg font-bold uppercase"
             to="https://demo.immich.app/"
           >
-            Open Demo
+            Demo
+          </Link>
+
+          <Link
+            className="flex place-items-center place-content-center py-3 px-8 border bg-immich-primary/10 dark:bg-gray-300  rounded-xl hover:no-underline text-immich-primary dark:text-immich-dark-bg font-bold uppercase"
+            to="https://immich.store"
+          >
+            Buy Merch
           </Link>
         </div>
-
-        <div className="my-8 flex gap-1 font-medium place-items-center place-content-center text-immich-primary dark:text-immich-dark-primary">
+        <div className="my-12 flex gap-1 font-medium place-items-center place-content-center text-immich-primary dark:text-immich-dark-primary">
           <Icon
             path={discordPath}
             viewBox={discordViewBox} /* viewBox may show an error in your IDE but it is normal. */
@@ -86,18 +88,11 @@ function HomepageHeader() {
               <img className="h-24" alt="Get it on Google Play" src="/img/google-play-badge.png" />
             </a>
           </div>
-
           <div className="h-24">
             <a href="https://apps.apple.com/sg/app/immich/id1613945652">
               <img className="h-24 sm:p-3.5 p-3" alt="Download on the App Store" src="/img/ios-app-store-badge.svg" />
             </a>
           </div>
-
-          <div className="h-24">
-            <a href="https://github.com/immich-app/immich/releases/latest">
-              <img className="h-24 sm:p-3.5 p-3" alt="Download APK" src="/img/download-apk-github.svg" />
-            </a>
-          </div>
         </div>
         <ThemedImage
           sources={{ dark: '/img/app-qr-code-dark.svg', light: '/img/app-qr-code-light.svg' }}
@@ -116,7 +111,7 @@ export default function Home(): JSX.Element {
       <HomepageHeader />
       <div className="flex flex-col place-items-center text-center place-content-center dark:bg-immich-dark-bg py-8">
         <p>This project is available under GNU AGPL v3 license.</p>
-        <p className="text-sm">Privacy should not be a luxury</p>
+        <p className="text-xs">Privacy should not be a luxury</p>
       </div>
     </Layout>
   );

docs/src/pages/privacy-policy.tsx

@@ -1,4 +1,5 @@
 import React from 'react';
+import Link from '@docusaurus/Link';
 import Layout from '@theme/Layout';
 function HomepageHeader() {
   return (

docs/src/pages/roadmap.tsx

@@ -76,7 +76,6 @@ import {
   mdiWeb,
   mdiDatabaseOutline,
   mdiLinkEdit,
-  mdiTagFaces,
   mdiMovieOpenPlayOutline,
 } from '@mdi/js';
 import Layout from '@theme/Layout';
@@ -84,8 +83,6 @@ import React from 'react';
 import { Item, Timeline } from '../components/timeline';
 
 const releases = {
-  'v1.130.0': new Date(2025, 2, 25),
-  'v1.127.0': new Date(2025, 1, 26),
   'v1.122.0': new Date(2024, 11, 5),
   'v1.120.0': new Date(2024, 10, 6),
   'v1.114.0': new Date(2024, 8, 6),
@@ -245,13 +242,6 @@ const roadmap: Item[] = [
 ];
 
 const milestones: Item[] = [
-  withRelease({
-    icon: mdiFolderMultiple,
-    iconColor: 'brown',
-    title: 'Folders view in the mobile app',
-    description: 'Browse your photos and videos in their folder structure inside the mobile app',
-    release: 'v1.130.0',
-  }),
   {
     icon: mdiStar,
     iconColor: 'gold',
@@ -259,14 +249,6 @@ const milestones: Item[] = [
     description: 'Reached 60K Stars on GitHub!',
     getDateLabel: withLanguage(new Date(2025, 2, 4)),
   },
-  withRelease({
-    icon: mdiTagFaces,
-    iconColor: 'teal',
-    title: 'Manual face tagging',
-    description:
-      'Manually tag or remove faces in photos and videos, even when automatic detection misses or misidentifies them.',
-    release: 'v1.127.0',
-  }),
   withRelease({
     icon: mdiLinkEdit,
     iconColor: 'crimson',
@@ -284,8 +266,8 @@ const milestones: Item[] = [
   withRelease({
     icon: mdiDatabaseOutline,
     iconColor: 'brown',
-    title: 'Automatic database dumps',
-    description: 'Database dumps are now integrated into the Immich server',
+    title: 'Automatic database backups',
+    description: 'Database backups are now integrated into the Immich server',
     release: 'v1.120.0',
   }),
   {
@@ -318,7 +300,7 @@ const milestones: Item[] = [
   withRelease({
     icon: mdiFolderMultiple,
     iconColor: 'brown',
-    title: 'Folders view',
+    title: 'Folders',
     description: 'Browse your photos and videos in their folder structure',
     release: 'v1.113.0',
   }),

docs/static/.well-known/security.txt

@@ -1,5 +0,0 @@
-Policy: https://github.com/immich-app/immich/blob/main/SECURITY.md
-Contact: mailto:security@immich.app
-Preferred-Languages: en
-Expires: 2026-05-01T23:59:00.000Z
-Canonical: https://immich.app/.well-known/security.txt

docs/static/_redirects

@@ -30,4 +30,3 @@
 /docs/guides/api-album-sync /docs/community-projects 307
 /docs/guides/remove-offline-files /docs/community-projects 307
 /milestones /roadmap 307
-/docs/overview/introduction /docs/overview/welcome 307

docs/static/archived-versions.json

@@ -1,16 +1,36 @@
 [
-  {
-    "label": "v1.132.3",
-    "url": "https://v1.132.3.archive.immich.app"
-  },
   {
     "label": "v1.131.3",
     "url": "https://v1.131.3.archive.immich.app"
   },
+  {
+    "label": "v1.131.2",
+    "url": "https://v1.131.2.archive.immich.app"
+  },
+  {
+    "label": "v1.131.1",
+    "url": "https://v1.131.1.archive.immich.app"
+  },
+  {
+    "label": "v1.131.0",
+    "url": "https://v1.131.0.archive.immich.app"
+  },
   {
     "label": "v1.130.3",
     "url": "https://v1.130.3.archive.immich.app"
   },
+  {
+    "label": "v1.130.2",
+    "url": "https://v1.130.2.archive.immich.app"
+  },
+  {
+    "label": "v1.130.1",
+    "url": "https://v1.130.1.archive.immich.app"
+  },
+  {
+    "label": "v1.130.0",
+    "url": "https://v1.130.0.archive.immich.app"
+  },
   {
     "label": "v1.129.0",
     "url": "https://v1.129.0.archive.immich.app"
@@ -27,14 +47,46 @@
     "label": "v1.126.1",
     "url": "https://v1.126.1.archive.immich.app"
   },
+  {
+    "label": "v1.126.0",
+    "url": "https://v1.126.0.archive.immich.app"
+  },
   {
     "label": "v1.125.7",
     "url": "https://v1.125.7.archive.immich.app"
   },
+  {
+    "label": "v1.125.6",
+    "url": "https://v1.125.6.archive.immich.app"
+  },
+  {
+    "label": "v1.125.5",
+    "url": "https://v1.125.5.archive.immich.app"
+  },
+  {
+    "label": "v1.125.3",
+    "url": "https://v1.125.3.archive.immich.app"
+  },
+  {
+    "label": "v1.125.2",
+    "url": "https://v1.125.2.archive.immich.app"
+  },
+  {
+    "label": "v1.125.1",
+    "url": "https://v1.125.1.archive.immich.app"
+  },
   {
     "label": "v1.124.2",
     "url": "https://v1.124.2.archive.immich.app"
   },
+  {
+    "label": "v1.124.1",
+    "url": "https://v1.124.1.archive.immich.app"
+  },
+  {
+    "label": "v1.124.0",
+    "url": "https://v1.124.0.archive.immich.app"
+  },
   {
     "label": "v1.123.0",
     "url": "https://v1.123.0.archive.immich.app"
@@ -43,6 +95,18 @@
     "label": "v1.122.3",
     "url": "https://v1.122.3.archive.immich.app"
   },
+  {
+    "label": "v1.122.2",
+    "url": "https://v1.122.2.archive.immich.app"
+  },
+  {
+    "label": "v1.122.1",
+    "url": "https://v1.122.1.archive.immich.app"
+  },
+  {
+    "label": "v1.122.0",
+    "url": "https://v1.122.0.archive.immich.app"
+  },
   {
     "label": "v1.121.0",
     "url": "https://v1.121.0.archive.immich.app"
@@ -51,14 +115,34 @@
     "label": "v1.120.2",
     "url": "https://v1.120.2.archive.immich.app"
   },
+  {
+    "label": "v1.120.1",
+    "url": "https://v1.120.1.archive.immich.app"
+  },
+  {
+    "label": "v1.120.0",
+    "url": "https://v1.120.0.archive.immich.app"
+  },
   {
     "label": "v1.119.1",
     "url": "https://v1.119.1.archive.immich.app"
   },
+  {
+    "label": "v1.119.0",
+    "url": "https://v1.119.0.archive.immich.app"
+  },
   {
     "label": "v1.118.2",
     "url": "https://v1.118.2.archive.immich.app"
   },
+  {
+    "label": "v1.118.1",
+    "url": "https://v1.118.1.archive.immich.app"
+  },
+  {
+    "label": "v1.118.0",
+    "url": "https://v1.118.0.archive.immich.app"
+  },
   {
     "label": "v1.117.0",
     "url": "https://v1.117.0.archive.immich.app"
@@ -67,6 +151,14 @@
     "label": "v1.116.2",
     "url": "https://v1.116.2.archive.immich.app"
   },
+  {
+    "label": "v1.116.1",
+    "url": "https://v1.116.1.archive.immich.app"
+  },
+  {
+    "label": "v1.116.0",
+    "url": "https://v1.116.0.archive.immich.app"
+  },
   {
     "label": "v1.115.0",
     "url": "https://v1.115.0.archive.immich.app"
@@ -79,10 +171,18 @@
     "label": "v1.113.1",
     "url": "https://v1.113.1.archive.immich.app"
   },
+  {
+    "label": "v1.113.0",
+    "url": "https://v1.113.0.archive.immich.app"
+  },
   {
     "label": "v1.112.1",
     "url": "https://v1.112.1.archive.immich.app"
   },
+  {
+    "label": "v1.112.0",
+    "url": "https://v1.112.0.archive.immich.app"
+  },
   {
     "label": "v1.111.0",
     "url": "https://v1.111.0.archive.immich.app"
@@ -95,6 +195,14 @@
     "label": "v1.109.2",
     "url": "https://v1.109.2.archive.immich.app"
   },
+  {
+    "label": "v1.109.1",
+    "url": "https://v1.109.1.archive.immich.app"
+  },
+  {
+    "label": "v1.109.0",
+    "url": "https://v1.109.0.archive.immich.app"
+  },
   {
     "label": "v1.108.0",
     "url": "https://v1.108.0.archive.immich.app"
@@ -103,14 +211,38 @@
     "label": "v1.107.2",
     "url": "https://v1.107.2.archive.immich.app"
   },
+  {
+    "label": "v1.107.1",
+    "url": "https://v1.107.1.archive.immich.app"
+  },
+  {
+    "label": "v1.107.0",
+    "url": "https://v1.107.0.archive.immich.app"
+  },
   {
     "label": "v1.106.4",
     "url": "https://v1.106.4.archive.immich.app"
   },
+  {
+    "label": "v1.106.3",
+    "url": "https://v1.106.3.archive.immich.app"
+  },
+  {
+    "label": "v1.106.2",
+    "url": "https://v1.106.2.archive.immich.app"
+  },
+  {
+    "label": "v1.106.1",
+    "url": "https://v1.106.1.archive.immich.app"
+  },
   {
     "label": "v1.105.1",
     "url": "https://v1.105.1.archive.immich.app"
   },
+  {
+    "label": "v1.105.0",
+    "url": "https://v1.105.0.archive.immich.app"
+  },
   {
     "label": "v1.104.0",
     "url": "https://v1.104.0.archive.immich.app"
@@ -119,10 +251,26 @@
     "label": "v1.103.1",
     "url": "https://v1.103.1.archive.immich.app"
   },
+  {
+    "label": "v1.103.0",
+    "url": "https://v1.103.0.archive.immich.app"
+  },
   {
     "label": "v1.102.3",
     "url": "https://v1.102.3.archive.immich.app"
   },
+  {
+    "label": "v1.102.2",
+    "url": "https://v1.102.2.archive.immich.app"
+  },
+  {
+    "label": "v1.102.1",
+    "url": "https://v1.102.1.archive.immich.app"
+  },
+  {
+    "label": "v1.102.0",
+    "url": "https://v1.102.0.archive.immich.app"
+  },
   {
     "label": "v1.101.0",
     "url": "https://v1.101.0.archive.immich.app"

e2e/.nvmrc

@@ -1 +1 @@
-22.15.0
+22.14.0

e2e/docker-compose.yml

@@ -34,7 +34,7 @@ services:
       - 2285:2285
 
   redis:
-    image: redis:6.2-alpine@sha256:3211c33a618c457e5d241922c975dbc4f446d0bdb2dc75694f5573ef8e2d01fa
+    image: redis:6.2-alpine@sha256:148bb5411c184abd288d9aaed139c98123eeb8824c5d3fce03cf721db58066d8
 
   database:
     image: tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:739cdd626151ff1f796dc95a6591b55a714f341c737e27f045019ceabf8e8c52

e2e/package.json

@@ -1,6 +1,6 @@
 {
   "name": "immich-e2e",
-  "version": "1.132.3",
+  "version": "1.131.3",
   "description": "",
   "main": "index.js",
   "type": "module",
@@ -25,9 +25,9 @@
     "@immich/sdk": "file:../open-api/typescript-sdk",
     "@playwright/test": "^1.44.1",
     "@types/luxon": "^3.4.2",
-    "@types/node": "^22.15.16",
+    "@types/node": "^22.14.0",
     "@types/oidc-provider": "^8.5.1",
-    "@types/pg": "^8.15.1",
+    "@types/pg": "^8.11.0",
     "@types/pngjs": "^6.0.4",
     "@types/supertest": "^6.0.2",
     "@vitest/coverage-v8": "^3.0.0",
@@ -52,6 +52,6 @@
     "vitest": "^3.0.0"
   },
   "volta": {
-    "node": "22.15.0"
+    "node": "22.14.0"
   }
 }

e2e/src/api/specs/activity.e2e-spec.ts

@@ -46,6 +46,38 @@ describe('/activities', () => {
   });
 
   describe('GET /activities', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).get('/activities');
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
+    it('should require an albumId', async () => {
+      const { status, body } = await request(app)
+        .get('/activities')
+        .set('Authorization', `Bearer ${admin.accessToken}`);
+      expect(status).toEqual(400);
+      expect(body).toEqual(errorDto.badRequest(expect.arrayContaining(['albumId must be a UUID'])));
+    });
+
+    it('should reject an invalid albumId', async () => {
+      const { status, body } = await request(app)
+        .get('/activities')
+        .query({ albumId: uuidDto.invalid })
+        .set('Authorization', `Bearer ${admin.accessToken}`);
+      expect(status).toEqual(400);
+      expect(body).toEqual(errorDto.badRequest(expect.arrayContaining(['albumId must be a UUID'])));
+    });
+
+    it('should reject an invalid assetId', async () => {
+      const { status, body } = await request(app)
+        .get('/activities')
+        .query({ albumId: uuidDto.notFound, assetId: uuidDto.invalid })
+        .set('Authorization', `Bearer ${admin.accessToken}`);
+      expect(status).toEqual(400);
+      expect(body).toEqual(errorDto.badRequest(expect.arrayContaining(['assetId must be a UUID'])));
+    });
+
     it('should start off empty', async () => {
       const { status, body } = await request(app)
         .get('/activities')
@@ -160,6 +192,30 @@ describe('/activities', () => {
   });
 
   describe('POST /activities', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).post('/activities');
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
+    it('should require an albumId', async () => {
+      const { status, body } = await request(app)
+        .post('/activities')
+        .set('Authorization', `Bearer ${admin.accessToken}`)
+        .send({ albumId: uuidDto.invalid });
+      expect(status).toEqual(400);
+      expect(body).toEqual(errorDto.badRequest(expect.arrayContaining(['albumId must be a UUID'])));
+    });
+
+    it('should require a comment when type is comment', async () => {
+      const { status, body } = await request(app)
+        .post('/activities')
+        .set('Authorization', `Bearer ${admin.accessToken}`)
+        .send({ albumId: uuidDto.notFound, type: 'comment', comment: null });
+      expect(status).toEqual(400);
+      expect(body).toEqual(errorDto.badRequest(['comment must be a string', 'comment should not be empty']));
+    });
+
     it('should add a comment to an album', async () => {
       const { status, body } = await request(app)
         .post('/activities')
@@ -274,6 +330,20 @@ describe('/activities', () => {
   });
 
   describe('DELETE /activities/:id', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).delete(`/activities/${uuidDto.notFound}`);
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
+    it('should require a valid uuid', async () => {
+      const { status, body } = await request(app)
+        .delete(`/activities/${uuidDto.invalid}`)
+        .set('Authorization', `Bearer ${admin.accessToken}`);
+      expect(status).toBe(400);
+      expect(body).toEqual(errorDto.badRequest(['id must be a UUID']));
+    });
+
     it('should remove a comment from an album', async () => {
       const reaction = await createActivity({
         albumId: album.id,

e2e/src/api/specs/album.e2e-spec.ts

@@ -9,7 +9,7 @@ import {
   LoginResponseDto,
   SharedLinkType,
 } from '@immich/sdk';
-import { createUserDto } from 'src/fixtures';
+import { createUserDto, uuidDto } from 'src/fixtures';
 import { errorDto } from 'src/responses';
 import { app, asBearerAuth, utils } from 'src/utils';
 import request from 'supertest';
@@ -128,6 +128,28 @@ describe('/albums', () => {
   });
 
   describe('GET /albums', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).get('/albums');
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
+    it('should reject an invalid shared param', async () => {
+      const { status, body } = await request(app)
+        .get('/albums?shared=invalid')
+        .set('Authorization', `Bearer ${user1.accessToken}`);
+      expect(status).toEqual(400);
+      expect(body).toEqual(errorDto.badRequest(['shared must be a boolean value']));
+    });
+
+    it('should reject an invalid assetId param', async () => {
+      const { status, body } = await request(app)
+        .get('/albums?assetId=invalid')
+        .set('Authorization', `Bearer ${user1.accessToken}`);
+      expect(status).toEqual(400);
+      expect(body).toEqual(errorDto.badRequest(['assetId must be a UUID']));
+    });
+
     it("should not show other users' favorites", async () => {
       const { status, body } = await request(app)
         .get(`/albums/${user1Albums[0].id}?withoutAssets=false`)
@@ -301,6 +323,12 @@ describe('/albums', () => {
   });
 
   describe('GET /albums/:id', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).get(`/albums/${user1Albums[0].id}`);
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
     it('should return album info for own album', async () => {
       const { status, body } = await request(app)
         .get(`/albums/${user1Albums[0].id}?withoutAssets=false`)
@@ -393,6 +421,12 @@ describe('/albums', () => {
   });
 
   describe('GET /albums/statistics', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).get('/albums/statistics');
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
     it('should return total count of albums the user has access to', async () => {
       const { status, body } = await request(app)
         .get('/albums/statistics')
@@ -404,6 +438,12 @@ describe('/albums', () => {
   });
 
   describe('POST /albums', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).post('/albums').send({ albumName: 'New album' });
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
     it('should create an album', async () => {
       const { status, body } = await request(app)
         .post('/albums')
@@ -431,6 +471,12 @@ describe('/albums', () => {
   });
 
   describe('PUT /albums/:id/assets', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).put(`/albums/${user1Albums[0].id}/assets`);
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
     it('should be able to add own asset to own album', async () => {
       const asset = await utils.createAsset(user1.accessToken);
       const { status, body } = await request(app)
@@ -480,6 +526,14 @@ describe('/albums', () => {
   });
 
   describe('PATCH /albums/:id', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app)
+        .patch(`/albums/${uuidDto.notFound}`)
+        .send({ albumName: 'New album name' });
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
     it('should update an album', async () => {
       const album = await utils.createAlbum(user1.accessToken, {
         albumName: 'New album',
@@ -522,6 +576,15 @@ describe('/albums', () => {
   });
 
   describe('DELETE /albums/:id/assets', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app)
+        .delete(`/albums/${user1Albums[0].id}/assets`)
+        .send({ ids: [user1Asset1.id] });
+
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
     it('should require authorization', async () => {
       const { status, body } = await request(app)
         .delete(`/albums/${user1Albums[1].id}/assets`)
@@ -616,6 +679,13 @@ describe('/albums', () => {
       });
     });
 
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).put(`/albums/${user1Albums[0].id}/users`).send({ sharedUserIds: [] });
+
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
     it('should be able to add user to own album', async () => {
       const { status, body } = await request(app)
         .put(`/albums/${album.id}/users`)

e2e/src/api/specs/api-key.e2e-spec.ts

@@ -1,5 +1,5 @@
 import { LoginResponseDto, Permission, createApiKey } from '@immich/sdk';
-import { createUserDto } from 'src/fixtures';
+import { createUserDto, uuidDto } from 'src/fixtures';
 import { errorDto } from 'src/responses';
 import { app, asBearerAuth, utils } from 'src/utils';
 import request from 'supertest';
@@ -24,6 +24,12 @@ describe('/api-keys', () => {
   });
 
   describe('POST /api-keys', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).post('/api-keys').send({ name: 'API Key' });
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
     it('should not work without permission', async () => {
       const { secret } = await create(user.accessToken, [Permission.ApiKeyRead]);
       const { status, body } = await request(app).post('/api-keys').set('x-api-key', secret).send({ name: 'API Key' });
@@ -93,6 +99,12 @@ describe('/api-keys', () => {
   });
 
   describe('GET /api-keys', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).get('/api-keys');
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
     it('should start off empty', async () => {
       const { status, body } = await request(app).get('/api-keys').set('Authorization', `Bearer ${admin.accessToken}`);
       expect(body).toEqual([]);
@@ -113,6 +125,12 @@ describe('/api-keys', () => {
   });
 
   describe('GET /api-keys/:id', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).get(`/api-keys/${uuidDto.notFound}`);
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
     it('should require authorization', async () => {
       const { apiKey } = await create(user.accessToken, [Permission.All]);
       const { status, body } = await request(app)
@@ -122,6 +140,14 @@ describe('/api-keys', () => {
       expect(body).toEqual(errorDto.badRequest('API Key not found'));
     });
 
+    it('should require a valid uuid', async () => {
+      const { status, body } = await request(app)
+        .get(`/api-keys/${uuidDto.invalid}`)
+        .set('Authorization', `Bearer ${admin.accessToken}`);
+      expect(status).toBe(400);
+      expect(body).toEqual(errorDto.badRequest(['id must be a UUID']));
+    });
+
     it('should get api key details', async () => {
       const { apiKey } = await create(user.accessToken, [Permission.All]);
       const { status, body } = await request(app)
@@ -139,6 +165,12 @@ describe('/api-keys', () => {
   });
 
   describe('PUT /api-keys/:id', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).put(`/api-keys/${uuidDto.notFound}`).send({ name: 'new name' });
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
     it('should require authorization', async () => {
       const { apiKey } = await create(user.accessToken, [Permission.All]);
       const { status, body } = await request(app)
@@ -149,6 +181,15 @@ describe('/api-keys', () => {
       expect(body).toEqual(errorDto.badRequest('API Key not found'));
     });
 
+    it('should require a valid uuid', async () => {
+      const { status, body } = await request(app)
+        .put(`/api-keys/${uuidDto.invalid}`)
+        .send({ name: 'new name' })
+        .set('Authorization', `Bearer ${admin.accessToken}`);
+      expect(status).toBe(400);
+      expect(body).toEqual(errorDto.badRequest(['id must be a UUID']));
+    });
+
     it('should update api key details', async () => {
       const { apiKey } = await create(user.accessToken, [Permission.All]);
       const { status, body } = await request(app)
@@ -167,6 +208,12 @@ describe('/api-keys', () => {
   });
 
   describe('DELETE /api-keys/:id', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).delete(`/api-keys/${uuidDto.notFound}`);
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
     it('should require authorization', async () => {
       const { apiKey } = await create(user.accessToken, [Permission.All]);
       const { status, body } = await request(app)
@@ -176,6 +223,14 @@ describe('/api-keys', () => {
       expect(body).toEqual(errorDto.badRequest('API Key not found'));
     });
 
+    it('should require a valid uuid', async () => {
+      const { status, body } = await request(app)
+        .delete(`/api-keys/${uuidDto.invalid}`)
+        .set('Authorization', `Bearer ${admin.accessToken}`);
+      expect(status).toBe(400);
+      expect(body).toEqual(errorDto.badRequest(['id must be a UUID']));
+    });
+
     it('should delete an api key', async () => {
       const { apiKey } = await create(user.accessToken, [Permission.All]);
       const { status } = await request(app)

e2e/src/api/specs/asset.e2e-spec.ts

@@ -3,7 +3,6 @@ import {
   AssetMediaStatus,
   AssetResponseDto,
   AssetTypeEnum,
-  AssetVisibility,
   getAssetInfo,
   getMyUser,
   LoginResponseDto,
@@ -23,9 +22,27 @@ import { app, asBearerAuth, tempDir, TEN_TIMES, testAssetDir, utils } from 'src/
 import request from 'supertest';
 import { afterAll, beforeAll, describe, expect, it } from 'vitest';
 
+const makeUploadDto = (options?: { omit: string }): Record<string, any> => {
+  const dto: Record<string, any> = {
+    deviceAssetId: 'example-image',
+    deviceId: 'TEST',
+    fileCreatedAt: new Date().toISOString(),
+    fileModifiedAt: new Date().toISOString(),
+    isFavorite: 'testing',
+    duration: '0:00:00.000000',
+  };
+
+  const omit = options?.omit;
+  if (omit) {
+    delete dto[omit];
+  }
+
+  return dto;
+};
+
 const locationAssetFilepath = `${testAssetDir}/metadata/gps-position/thompson-springs.jpg`;
 const ratingAssetFilepath = `${testAssetDir}/metadata/rating/mongolels.jpg`;
-const facesAssetDir = `${testAssetDir}/metadata/faces`;
+const facesAssetFilepath = `${testAssetDir}/metadata/faces/portrait.jpg`;
 
 const readTags = async (bytes: Buffer, filename: string) => {
   const filepath = join(tempDir, filename);
@@ -120,9 +137,9 @@ describe('/asset', () => {
       // stats
       utils.createAsset(statsUser.accessToken),
       utils.createAsset(statsUser.accessToken, { isFavorite: true }),
-      utils.createAsset(statsUser.accessToken, { visibility: AssetVisibility.Archive }),
+      utils.createAsset(statsUser.accessToken, { isArchived: true }),
       utils.createAsset(statsUser.accessToken, {
-        visibility: AssetVisibility.Archive,
+        isArchived: true,
         isFavorite: true,
         assetData: { filename: 'example.mp4' },
       }),
@@ -143,6 +160,13 @@ describe('/asset', () => {
   });
 
   describe('GET /assets/:id/original', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).get(`/assets/${uuidDto.notFound}/original`);
+
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
     it('should download the file', async () => {
       const response = await request(app)
         .get(`/assets/${user1Assets[0].id}/original`)
@@ -154,6 +178,20 @@ describe('/asset', () => {
   });
 
   describe('GET /assets/:id', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).get(`/assets/${uuidDto.notFound}`);
+      expect(body).toEqual(errorDto.unauthorized);
+      expect(status).toBe(401);
+    });
+
+    it('should require a valid id', async () => {
+      const { status, body } = await request(app)
+        .get(`/assets/${uuidDto.invalid}`)
+        .set('Authorization', `Bearer ${user1.accessToken}`);
+      expect(status).toBe(400);
+      expect(body).toEqual(errorDto.badRequest(['id must be a UUID']));
+    });
+
     it('should require access', async () => {
       const { status, body } = await request(app)
         .get(`/assets/${user2Assets[0].id}`)
@@ -186,22 +224,31 @@ describe('/asset', () => {
       });
     });
 
-    describe('faces', () => {
-      const metadataFaceTests = [
-        {
-          description: 'without orientation',
+    it('should get the asset faces', async () => {
+      const config = await utils.getSystemConfig(admin.accessToken);
+      config.metadata.faces.import = true;
+      await updateConfig({ systemConfigDto: config }, { headers: asBearerAuth(admin.accessToken) });
+
+      // asset faces
+      const facesAsset = await utils.createAsset(admin.accessToken, {
+        assetData: {
           filename: 'portrait.jpg',
+          bytes: await readFile(facesAssetFilepath),
         },
-        {
-          description: 'adjusting face regions to orientation',
-          filename: 'portrait-orientation-6.jpg',
-        },
-      ];
-      // should produce same resulting face region coordinates for any orientation
-      const expectedFaces = [
+      });
+
+      await utils.waitForWebsocketEvent({ event: 'assetUpload', id: facesAsset.id });
+
+      const { status, body } = await request(app)
+        .get(`/assets/${facesAsset.id}`)
+        .set('Authorization', `Bearer ${admin.accessToken}`);
+      expect(status).toBe(200);
+      expect(body.id).toEqual(facesAsset.id);
+      expect(body.people).toMatchObject([
         {
           name: 'Marie Curie',
           birthDate: null,
+          thumbnailPath: '',
           isHidden: false,
           faces: [
             {
@@ -218,6 +265,7 @@ describe('/asset', () => {
         {
           name: 'Pierre Curie',
           birthDate: null,
+          thumbnailPath: '',
           isHidden: false,
           faces: [
             {
@@ -231,30 +279,7 @@ describe('/asset', () => {
             },
           ],
         },
-      ];
-
-      it.each(metadataFaceTests)('should get the asset faces from $filename $description', async ({ filename }) => {
-        const config = await utils.getSystemConfig(admin.accessToken);
-        config.metadata.faces.import = true;
-        await updateConfig({ systemConfigDto: config }, { headers: asBearerAuth(admin.accessToken) });
-
-        const facesAsset = await utils.createAsset(admin.accessToken, {
-          assetData: {
-            filename,
-            bytes: await readFile(`${facesAssetDir}/${filename}`),
-          },
-        });
-
-        await utils.waitForWebsocketEvent({ event: 'assetUpload', id: facesAsset.id });
-
-        const { status, body } = await request(app)
-          .get(`/assets/${facesAsset.id}`)
-          .set('Authorization', `Bearer ${admin.accessToken}`);
-
-        expect(status).toBe(200);
-        expect(body.id).toEqual(facesAsset.id);
-        expect(body.people).toMatchObject(expectedFaces);
-      });
+      ]);
     });
 
     it('should work with a shared link', async () => {
@@ -308,7 +333,7 @@ describe('/asset', () => {
       });
 
       it('disallows viewing archived assets', async () => {
-        const asset = await utils.createAsset(user1.accessToken, { visibility: AssetVisibility.Archive });
+        const asset = await utils.createAsset(user1.accessToken, { isArchived: true });
 
         const { status } = await request(app)
           .get(`/assets/${asset.id}`)
@@ -329,6 +354,13 @@ describe('/asset', () => {
   });
 
   describe('GET /assets/statistics', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).get('/assets/statistics');
+
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
     it('should return stats of all assets', async () => {
       const { status, body } = await request(app)
         .get('/assets/statistics')
@@ -352,7 +384,7 @@ describe('/asset', () => {
       const { status, body } = await request(app)
         .get('/assets/statistics')
         .set('Authorization', `Bearer ${statsUser.accessToken}`)
-        .query({ visibility: AssetVisibility.Archive });
+        .query({ isArchived: true });
 
       expect(status).toBe(200);
       expect(body).toEqual({ images: 1, videos: 1, total: 2 });
@@ -362,7 +394,7 @@ describe('/asset', () => {
       const { status, body } = await request(app)
         .get('/assets/statistics')
         .set('Authorization', `Bearer ${statsUser.accessToken}`)
-        .query({ isFavorite: true, visibility: AssetVisibility.Archive });
+        .query({ isFavorite: true, isArchived: true });
 
       expect(status).toBe(200);
       expect(body).toEqual({ images: 0, videos: 1, total: 1 });
@@ -372,7 +404,7 @@ describe('/asset', () => {
       const { status, body } = await request(app)
         .get('/assets/statistics')
         .set('Authorization', `Bearer ${statsUser.accessToken}`)
-        .query({ isFavorite: false, visibility: AssetVisibility.Timeline });
+        .query({ isFavorite: false, isArchived: false });
 
       expect(status).toBe(200);
       expect(body).toEqual({ images: 1, videos: 0, total: 1 });
@@ -393,6 +425,13 @@ describe('/asset', () => {
       await utils.waitForQueueFinish(admin.accessToken, 'thumbnailGeneration');
     });
 
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).get('/assets/random');
+
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
     it.each(TEN_TIMES)('should return 1 random assets', async () => {
       const { status, body } = await request(app)
         .get('/assets/random')
@@ -428,9 +467,31 @@ describe('/asset', () => {
       expect(status).toBe(200);
       expect(body).toEqual([expect.objectContaining({ id: user2Assets[0].id })]);
     });
+
+    it('should return error', async () => {
+      const { status } = await request(app)
+        .get('/assets/random?count=ABC')
+        .set('Authorization', `Bearer ${user1.accessToken}`);
+
+      expect(status).toBe(400);
+    });
   });
 
   describe('PUT /assets/:id', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).put(`/assets/:${uuidDto.notFound}`);
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
+    it('should require a valid id', async () => {
+      const { status, body } = await request(app)
+        .put(`/assets/${uuidDto.invalid}`)
+        .set('Authorization', `Bearer ${user1.accessToken}`);
+      expect(status).toBe(400);
+      expect(body).toEqual(errorDto.badRequest(['id must be a UUID']));
+    });
+
     it('should require access', async () => {
       const { status, body } = await request(app)
         .put(`/assets/${user2Assets[0].id}`)
@@ -458,7 +519,7 @@ describe('/asset', () => {
       const { status, body } = await request(app)
         .put(`/assets/${user1Assets[0].id}`)
         .set('Authorization', `Bearer ${user1.accessToken}`)
-        .send({ visibility: AssetVisibility.Archive });
+        .send({ isArchived: true });
       expect(body).toMatchObject({ id: user1Assets[0].id, isArchived: true });
       expect(status).toEqual(200);
     });
@@ -558,6 +619,28 @@ describe('/asset', () => {
       expect(status).toEqual(200);
     });
 
+    it('should reject invalid gps coordinates', async () => {
+      for (const test of [
+        { latitude: 12 },
+        { longitude: 12 },
+        { latitude: 12, longitude: 'abc' },
+        { latitude: 'abc', longitude: 12 },
+        { latitude: null, longitude: 12 },
+        { latitude: 12, longitude: null },
+        { latitude: 91, longitude: 12 },
+        { latitude: -91, longitude: 12 },
+        { latitude: 12, longitude: -181 },
+        { latitude: 12, longitude: 181 },
+      ]) {
+        const { status, body } = await request(app)
+          .put(`/assets/${user1Assets[0].id}`)
+          .send(test)
+          .set('Authorization', `Bearer ${user1.accessToken}`);
+        expect(status).toBe(400);
+        expect(body).toEqual(errorDto.badRequest());
+      }
+    });
+
     it('should update gps data', async () => {
       const { status, body } = await request(app)
         .put(`/assets/${user1Assets[0].id}`)
@@ -629,6 +712,17 @@ describe('/asset', () => {
       expect(status).toEqual(200);
     });
 
+    it('should reject invalid rating', async () => {
+      for (const test of [{ rating: 7 }, { rating: 3.5 }, { rating: null }]) {
+        const { status, body } = await request(app)
+          .put(`/assets/${user1Assets[0].id}`)
+          .send(test)
+          .set('Authorization', `Bearer ${user1.accessToken}`);
+        expect(status).toBe(400);
+        expect(body).toEqual(errorDto.badRequest());
+      }
+    });
+
     it('should return tagged people', async () => {
       const { status, body } = await request(app)
         .put(`/assets/${user1Assets[0].id}`)
@@ -652,6 +746,25 @@ describe('/asset', () => {
   });
 
   describe('DELETE /assets', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app)
+        .delete(`/assets`)
+        .send({ ids: [uuidDto.notFound] });
+
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
+    it('should require a valid uuid', async () => {
+      const { status, body } = await request(app)
+        .delete(`/assets`)
+        .send({ ids: [uuidDto.invalid] })
+        .set('Authorization', `Bearer ${admin.accessToken}`);
+
+      expect(status).toBe(400);
+      expect(body).toEqual(errorDto.badRequest(['each value in ids must be a UUID']));
+    });
+
     it('should throw an error when the id is not found', async () => {
       const { status, body } = await request(app)
         .delete(`/assets`)
@@ -764,6 +877,13 @@ describe('/asset', () => {
   });
 
   describe('GET /assets/:id/thumbnail', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).get(`/assets/${locationAsset.id}/thumbnail`);
+
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
     it('should not include gps data for webp thumbnails', async () => {
       await utils.waitForWebsocketEvent({
         event: 'assetUpload',
@@ -799,6 +919,13 @@ describe('/asset', () => {
   });
 
   describe('GET /assets/:id/original', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).get(`/assets/${locationAsset.id}/original`);
+
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
     it('should download the original', async () => {
       const { status, body, type } = await request(app)
         .get(`/assets/${locationAsset.id}/original`)
@@ -819,9 +946,43 @@ describe('/asset', () => {
     });
   });
 
+  describe('PUT /assets', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).put('/assets');
+
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+  });
+
   describe('POST /assets', () => {
     beforeAll(setupTests, 30_000);
 
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).post(`/assets`);
+      expect(body).toEqual(errorDto.unauthorized);
+      expect(status).toBe(401);
+    });
+
+    it.each([
+      { should: 'require `deviceAssetId`', dto: { ...makeUploadDto({ omit: 'deviceAssetId' }) } },
+      { should: 'require `deviceId`', dto: { ...makeUploadDto({ omit: 'deviceId' }) } },
+      { should: 'require `fileCreatedAt`', dto: { ...makeUploadDto({ omit: 'fileCreatedAt' }) } },
+      { should: 'require `fileModifiedAt`', dto: { ...makeUploadDto({ omit: 'fileModifiedAt' }) } },
+      { should: 'require `duration`', dto: { ...makeUploadDto({ omit: 'duration' }) } },
+      { should: 'throw if `isFavorite` is not a boolean', dto: { ...makeUploadDto(), isFavorite: 'not-a-boolean' } },
+      { should: 'throw if `isVisible` is not a boolean', dto: { ...makeUploadDto(), isVisible: 'not-a-boolean' } },
+      { should: 'throw if `isArchived` is not a boolean', dto: { ...makeUploadDto(), isArchived: 'not-a-boolean' } },
+    ])('should $should', async ({ dto }) => {
+      const { status, body } = await request(app)
+        .post('/assets')
+        .set('Authorization', `Bearer ${user1.accessToken}`)
+        .attach('assetData', makeRandomImage(), 'example.png')
+        .field(dto);
+      expect(status).toBe(400);
+      expect(body).toEqual(errorDto.badRequest());
+    });
+
     const tests = [
       {
         input: 'formats/avif/8bit-sRGB.avif',
@@ -1083,21 +1244,31 @@ describe('/asset', () => {
       },
     ];
 
-    it.each(tests)(`should upload and generate a thumbnail for different file types`, async ({ input, expected }) => {
-      const filepath = join(testAssetDir, input);
-      const response = await utils.createAsset(admin.accessToken, {
-        assetData: { bytes: await readFile(filepath), filename: basename(filepath) },
-      });
+    it(`should upload and generate a thumbnail for different file types`, async () => {
+      // upload in parallel
+      const assets = await Promise.all(
+        tests.map(async ({ input }) => {
+          const filepath = join(testAssetDir, input);
+          return utils.createAsset(admin.accessToken, {
+            assetData: { bytes: await readFile(filepath), filename: basename(filepath) },
+          });
+        }),
+      );
 
-      expect(response.status).toBe(AssetMediaStatus.Created);
-      const id = response.id;
-      // longer timeout as the thumbnail generation from full-size raw files can take a while
-      await utils.waitForWebsocketEvent({ event: 'assetUpload', id });
+      for (const { id, status } of assets) {
+        expect(status).toBe(AssetMediaStatus.Created);
+        // longer timeout as the thumbnail generation from full-size raw files can take a while
+        await utils.waitForWebsocketEvent({ event: 'assetUpload', id });
+      }
 
-      const asset = await utils.getAssetInfo(admin.accessToken, id);
-      expect(asset.exifInfo).toBeDefined();
-      expect(asset.exifInfo).toMatchObject(expected.exifInfo);
-      expect(asset).toMatchObject(expected);
+      for (const [i, { id }] of assets.entries()) {
+        const { expected } = tests[i];
+        const asset = await utils.getAssetInfo(admin.accessToken, id);
+
+        expect(asset.exifInfo).toBeDefined();
+        expect(asset.exifInfo).toMatchObject(expected.exifInfo);
+        expect(asset).toMatchObject(expected);
+      }
     });
 
     it('should handle a duplicate', async () => {

e2e/src/api/specs/audit.e2e-spec.ts

@@ -0,0 +1,43 @@
+import { deleteAssets, getAuditFiles, updateAsset, type LoginResponseDto } from '@immich/sdk';
+import { asBearerAuth, utils } from 'src/utils';
+import { beforeAll, describe, expect, it } from 'vitest';
+
+describe('/audits', () => {
+  let admin: LoginResponseDto;
+
+  beforeAll(async () => {
+    await utils.resetDatabase();
+    await utils.resetFilesystem();
+
+    admin = await utils.adminSetup();
+  });
+
+  // TODO: Enable these tests again once #7436 is resolved as these were flaky
+  describe.skip('GET :/file-report', () => {
+    it('excludes assets without issues from report', async () => {
+      const [trashedAsset, archivedAsset] = await Promise.all([
+        utils.createAsset(admin.accessToken),
+        utils.createAsset(admin.accessToken),
+        utils.createAsset(admin.accessToken),
+      ]);
+
+      await Promise.all([
+        deleteAssets({ assetBulkDeleteDto: { ids: [trashedAsset.id] } }, { headers: asBearerAuth(admin.accessToken) }),
+        updateAsset(
+          {
+            id: archivedAsset.id,
+            updateAssetDto: { isArchived: true },
+          },
+          { headers: asBearerAuth(admin.accessToken) },
+        ),
+      ]);
+
+      const body = await getAuditFiles({
+        headers: asBearerAuth(admin.accessToken),
+      });
+
+      expect(body.orphans).toHaveLength(0);
+      expect(body.extras).toHaveLength(0);
+    });
+  });
+});

e2e/src/api/specs/auth.e2e-spec.ts

@@ -5,7 +5,7 @@ import { app, utils } from 'src/utils';
 import request from 'supertest';
 import { beforeEach, describe, expect, it } from 'vitest';
 
-const { email, password } = signupDto.admin;
+const { name, email, password } = signupDto.admin;
 
 describe(`/auth/admin-sign-up`, () => {
   beforeEach(async () => {
@@ -13,12 +13,58 @@ describe(`/auth/admin-sign-up`, () => {
   });
 
   describe('POST /auth/admin-sign-up', () => {
+    const invalid = [
+      {
+        should: 'require an email address',
+        data: { name, password },
+      },
+      {
+        should: 'require a password',
+        data: { name, email },
+      },
+      {
+        should: 'require a name',
+        data: { email, password },
+      },
+      {
+        should: 'require a valid email',
+        data: { name, email: 'immich', password },
+      },
+    ];
+
+    for (const { should, data } of invalid) {
+      it(`should ${should}`, async () => {
+        const { status, body } = await request(app).post('/auth/admin-sign-up').send(data);
+        expect(status).toEqual(400);
+        expect(body).toEqual(errorDto.badRequest());
+      });
+    }
+
     it(`should sign up the admin`, async () => {
       const { status, body } = await request(app).post('/auth/admin-sign-up').send(signupDto.admin);
       expect(status).toBe(201);
       expect(body).toEqual(signupResponseDto.admin);
     });
 
+    it('should sign up the admin with a local domain', async () => {
+      const { status, body } = await request(app)
+        .post('/auth/admin-sign-up')
+        .send({ ...signupDto.admin, email: 'admin@local' });
+      expect(status).toEqual(201);
+      expect(body).toEqual({
+        ...signupResponseDto.admin,
+        email: 'admin@local',
+      });
+    });
+
+    it('should transform email to lower case', async () => {
+      const { status, body } = await request(app)
+        .post('/auth/admin-sign-up')
+        .send({ ...signupDto.admin, email: 'aDmIn@IMMICH.cloud' });
+      expect(status).toEqual(201);
+      expect(body).toEqual(signupResponseDto.admin);
+    });
+
     it('should not allow a second admin to sign up', async () => {
       await signUpAdmin({ signUpDto: signupDto.admin });
 
@@ -46,6 +92,22 @@ describe('/auth/*', () => {
       expect(body).toEqual(errorDto.incorrectLogin);
     });
 
+    for (const key of Object.keys(loginDto.admin)) {
+      it(`should not allow null ${key}`, async () => {
+        const { status, body } = await request(app)
+          .post('/auth/login')
+          .send({ ...loginDto.admin, [key]: null });
+        expect(status).toBe(400);
+        expect(body).toEqual(errorDto.badRequest());
+      });
+
+      it('should reject an invalid email', async () => {
+        const { status, body } = await request(app).post('/auth/login').send({ email: [], password });
+        expect(status).toBe(400);
+        expect(body).toEqual(errorDto.invalidEmail);
+      });
+    }
+
     it('should accept a correct password', async () => {
       const { status, body, headers } = await request(app).post('/auth/login').send({ email, password });
       expect(status).toBe(201);
@@ -100,6 +162,14 @@ describe('/auth/*', () => {
   });
 
   describe('POST /auth/change-password', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app)
+        .post(`/auth/change-password`)
+        .send({ password, newPassword: 'Password1234' });
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
     it('should require the current password', async () => {
       const { status, body } = await request(app)
         .post(`/auth/change-password`)

e2e/src/api/specs/download.e2e-spec.ts

@@ -1,5 +1,6 @@
 import { AssetMediaResponseDto, LoginResponseDto } from '@immich/sdk';
 import { readFile, writeFile } from 'node:fs/promises';
+import { errorDto } from 'src/responses';
 import { app, tempDir, utils } from 'src/utils';
 import request from 'supertest';
 import { beforeAll, describe, expect, it } from 'vitest';
@@ -16,6 +17,15 @@ describe('/download', () => {
   });
 
   describe('POST /download/info', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app)
+        .post(`/download/info`)
+        .send({ assetIds: [asset1.id] });
+
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
     it('should download info', async () => {
       const { status, body } = await request(app)
         .post('/download/info')
@@ -32,6 +42,15 @@ describe('/download', () => {
   });
 
   describe('POST /download/archive', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app)
+        .post(`/download/archive`)
+        .send({ assetIds: [asset1.id, asset2.id] });
+
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
     it('should download an archive', async () => {
       const { status, body } = await request(app)
         .post('/download/archive')

e2e/src/api/specs/map.e2e-spec.ts

@@ -1,4 +1,4 @@
-import { AssetVisibility, LoginResponseDto } from '@immich/sdk';
+import { LoginResponseDto } from '@immich/sdk';
 import { readFile } from 'node:fs/promises';
 import { basename, join } from 'node:path';
 import { Socket } from 'socket.io-client';
@@ -44,7 +44,7 @@ describe('/map', () => {
     it('should get map markers for all non-archived assets', async () => {
       const { status, body } = await request(app)
         .get('/map/markers')
-        .query({ visibility: AssetVisibility.Timeline })
+        .query({ isArchived: false })
         .set('Authorization', `Bearer ${admin.accessToken}`);
 
       expect(status).toBe(200);

e2e/src/api/specs/oauth.e2e-spec.ts

@@ -6,7 +6,6 @@ import {
   startOAuth,
   updateConfig,
 } from '@immich/sdk';
-import { createHash, randomBytes } from 'node:crypto';
 import { errorDto } from 'src/responses';
 import { OAuthClient, OAuthUser } from 'src/setup/auth-server';
 import { app, asBearerAuth, baseUrl, utils } from 'src/utils';
@@ -22,30 +21,18 @@ const mobileOverrideRedirectUri = 'https://photos.immich.app/oauth/mobile-redire
 
 const redirect = async (url: string, cookies?: string[]) => {
   const { headers } = await request(url)
-    .get('')
+    .get('/')
     .set('Cookie', cookies || []);
   return { cookies: (headers['set-cookie'] as unknown as string[]) || [], location: headers.location };
 };
 
-// Function to generate a code challenge from the verifier
-const generateCodeChallenge = async (codeVerifier: string): Promise<string> => {
-  const hashed = createHash('sha256').update(codeVerifier).digest();
-  return hashed.toString('base64url');
-};
-
 const loginWithOAuth = async (sub: OAuthUser | string, redirectUri?: string) => {
-  const state = randomBytes(16).toString('base64url');
-  const codeVerifier = randomBytes(64).toString('base64url');
-  const codeChallenge = await generateCodeChallenge(codeVerifier);
-
-  const { url } = await startOAuth({
-    oAuthConfigDto: { redirectUri: redirectUri ?? `${baseUrl}/auth/login`, state, codeChallenge },
-  });
+  const { url } = await startOAuth({ oAuthConfigDto: { redirectUri: redirectUri ?? `${baseUrl}/auth/login` } });
 
   // login
   const response1 = await redirect(url.replace(authServer.internal, authServer.external));
   const response2 = await request(authServer.external + response1.location)
-    .post('')
+    .post('/')
     .set('Cookie', response1.cookies)
     .type('form')
     .send({ prompt: 'login', login: sub, password: 'password' });
@@ -53,7 +40,7 @@ const loginWithOAuth = async (sub: OAuthUser | string, redirectUri?: string) =>
   // approve
   const response3 = await redirect(response2.header.location, response1.cookies);
   const response4 = await request(authServer.external + response3.location)
-    .post('')
+    .post('/')
     .type('form')
     .set('Cookie', response3.cookies)
     .send({ prompt: 'consent' });
@@ -64,9 +51,9 @@ const loginWithOAuth = async (sub: OAuthUser | string, redirectUri?: string) =>
   expect(redirectUrl).toBeDefined();
   const params = new URL(redirectUrl).searchParams;
   expect(params.get('code')).toBeDefined();
-  expect(params.get('state')).toBe(state);
+  expect(params.get('state')).toBeDefined();
 
-  return { url: redirectUrl, state, codeVerifier };
+  return redirectUrl;
 };
 
 const setupOAuth = async (token: string, dto: Partial<SystemConfigOAuthDto>) => {
@@ -132,42 +119,9 @@ describe(`/oauth`, () => {
       expect(body).toEqual(errorDto.badRequest(['url should not be empty']));
     });
 
-    it(`should throw an error if the state is not provided`, async () => {
-      const { url } = await loginWithOAuth('oauth-auto-register');
-      const { status, body } = await request(app).post('/oauth/callback').send({ url });
-      expect(status).toBe(400);
-      expect(body).toEqual(errorDto.badRequest('OAuth state is missing'));
-    });
-
-    it(`should throw an error if the state mismatches`, async () => {
-      const callbackParams = await loginWithOAuth('oauth-auto-register');
-      const { state } = await loginWithOAuth('oauth-auto-register');
-      const { status } = await request(app)
-        .post('/oauth/callback')
-        .send({ ...callbackParams, state });
-      expect(status).toBeGreaterThanOrEqual(400);
-    });
-
-    it(`should throw an error if the codeVerifier is not provided`, async () => {
-      const { url, state } = await loginWithOAuth('oauth-auto-register');
-      const { status, body } = await request(app).post('/oauth/callback').send({ url, state });
-      expect(status).toBe(400);
-      expect(body).toEqual(errorDto.badRequest('OAuth code verifier is missing'));
-    });
-
-    it(`should throw an error if the codeVerifier doesn't match the challenge`, async () => {
-      const callbackParams = await loginWithOAuth('oauth-auto-register');
-      const { codeVerifier } = await loginWithOAuth('oauth-auto-register');
-      const { status, body } = await request(app)
-        .post('/oauth/callback')
-        .send({ ...callbackParams, codeVerifier });
-      console.log(body);
-      expect(status).toBeGreaterThanOrEqual(400);
-    });
-
     it('should auto register the user by default', async () => {
-      const callbackParams = await loginWithOAuth('oauth-auto-register');
-      const { status, body } = await request(app).post('/oauth/callback').send(callbackParams);
+      const url = await loginWithOAuth('oauth-auto-register');
+      const { status, body } = await request(app).post('/oauth/callback').send({ url });
       expect(status).toBe(201);
       expect(body).toMatchObject({
         accessToken: expect.any(String),
@@ -178,30 +132,16 @@ describe(`/oauth`, () => {
       });
     });
 
-    it('should allow passing state and codeVerifier via cookies', async () => {
-      const { url, state, codeVerifier } = await loginWithOAuth('oauth-auto-register');
-      const { status, body } = await request(app)
-        .post('/oauth/callback')
-        .set('Cookie', [`immich_oauth_state=${state}`, `immich_oauth_code_verifier=${codeVerifier}`])
-        .send({ url });
-      expect(status).toBe(201);
-      expect(body).toMatchObject({
-        accessToken: expect.any(String),
-        userId: expect.any(String),
-        userEmail: 'oauth-auto-register@immich.app',
-      });
-    });
-
     it('should handle a user without an email', async () => {
-      const callbackParams = await loginWithOAuth(OAuthUser.NO_EMAIL);
-      const { status, body } = await request(app).post('/oauth/callback').send(callbackParams);
+      const url = await loginWithOAuth(OAuthUser.NO_EMAIL);
+      const { status, body } = await request(app).post('/oauth/callback').send({ url });
       expect(status).toBe(400);
       expect(body).toEqual(errorDto.badRequest('OAuth profile does not have an email address'));
     });
 
     it('should set the quota from a claim', async () => {
-      const callbackParams = await loginWithOAuth(OAuthUser.WITH_QUOTA);
-      const { status, body } = await request(app).post('/oauth/callback').send(callbackParams);
+      const url = await loginWithOAuth(OAuthUser.WITH_QUOTA);
+      const { status, body } = await request(app).post('/oauth/callback').send({ url });
       expect(status).toBe(201);
       expect(body).toMatchObject({
         accessToken: expect.any(String),
@@ -214,8 +154,8 @@ describe(`/oauth`, () => {
     });
 
     it('should set the storage label from a claim', async () => {
-      const callbackParams = await loginWithOAuth(OAuthUser.WITH_USERNAME);
-      const { status, body } = await request(app).post('/oauth/callback').send(callbackParams);
+      const url = await loginWithOAuth(OAuthUser.WITH_USERNAME);
+      const { status, body } = await request(app).post('/oauth/callback').send({ url });
       expect(status).toBe(201);
       expect(body).toMatchObject({
         accessToken: expect.any(String),
@@ -236,8 +176,8 @@ describe(`/oauth`, () => {
         buttonText: 'Login with Immich',
         signingAlgorithm: 'RS256',
       });
-      const callbackParams = await loginWithOAuth('oauth-RS256-token');
-      const { status, body } = await request(app).post('/oauth/callback').send(callbackParams);
+      const url = await loginWithOAuth('oauth-RS256-token');
+      const { status, body } = await request(app).post('/oauth/callback').send({ url });
       expect(status).toBe(201);
       expect(body).toMatchObject({
         accessToken: expect.any(String),
@@ -256,8 +196,8 @@ describe(`/oauth`, () => {
         buttonText: 'Login with Immich',
         profileSigningAlgorithm: 'RS256',
       });
-      const callbackParams = await loginWithOAuth('oauth-signed-profile');
-      const { status, body } = await request(app).post('/oauth/callback').send(callbackParams);
+      const url = await loginWithOAuth('oauth-signed-profile');
+      const { status, body } = await request(app).post('/oauth/callback').send({ url });
       expect(status).toBe(201);
       expect(body).toMatchObject({
         userId: expect.any(String),
@@ -273,8 +213,8 @@ describe(`/oauth`, () => {
         buttonText: 'Login with Immich',
         signingAlgorithm: 'something-that-does-not-work',
       });
-      const callbackParams = await loginWithOAuth('oauth-signed-bad');
-      const { status, body } = await request(app).post('/oauth/callback').send(callbackParams);
+      const url = await loginWithOAuth('oauth-signed-bad');
+      const { status, body } = await request(app).post('/oauth/callback').send({ url });
       expect(status).toBe(500);
       expect(body).toMatchObject({
         error: 'Internal Server Error',
@@ -295,8 +235,8 @@ describe(`/oauth`, () => {
       });
 
       it('should not auto register the user', async () => {
-        const callbackParams = await loginWithOAuth('oauth-no-auto-register');
-        const { status, body } = await request(app).post('/oauth/callback').send(callbackParams);
+        const url = await loginWithOAuth('oauth-no-auto-register');
+        const { status, body } = await request(app).post('/oauth/callback').send({ url });
         expect(status).toBe(400);
         expect(body).toEqual(errorDto.badRequest('User does not exist and auto registering is disabled.'));
       });
@@ -307,8 +247,8 @@ describe(`/oauth`, () => {
           email: 'oauth-user3@immich.app',
           password: 'password',
         });
-        const callbackParams = await loginWithOAuth('oauth-user3');
-        const { status, body } = await request(app).post('/oauth/callback').send(callbackParams);
+        const url = await loginWithOAuth('oauth-user3');
+        const { status, body } = await request(app).post('/oauth/callback').send({ url });
         expect(status).toBe(201);
         expect(body).toMatchObject({
           userId,
@@ -346,15 +286,13 @@ describe(`/oauth`, () => {
     });
 
     it('should auto register the user by default', async () => {
-      const callbackParams = await loginWithOAuth('oauth-mobile-override', 'app.immich:///oauth-callback');
-      expect(callbackParams.url).toEqual(expect.stringContaining(mobileOverrideRedirectUri));
+      const url = await loginWithOAuth('oauth-mobile-override', 'app.immich:///oauth-callback');
+      expect(url).toEqual(expect.stringContaining(mobileOverrideRedirectUri));
 
       // simulate redirecting back to mobile app
-      const url = callbackParams.url.replace(mobileOverrideRedirectUri, 'app.immich:///oauth-callback');
+      const redirectUri = url.replace(mobileOverrideRedirectUri, 'app.immich:///oauth-callback');
 
-      const { status, body } = await request(app)
-        .post('/oauth/callback')
-        .send({ ...callbackParams, url });
+      const { status, body } = await request(app).post('/oauth/callback').send({ url: redirectUri });
       expect(status).toBe(201);
       expect(body).toMatchObject({
         accessToken: expect.any(String),

e2e/src/api/specs/person.e2e-spec.ts

@@ -5,6 +5,22 @@ import { app, asBearerAuth, utils } from 'src/utils';
 import request from 'supertest';
 import { beforeAll, beforeEach, describe, expect, it } from 'vitest';
 
+const invalidBirthday = [
+  {
+    birthDate: 'false',
+    response: ['birthDate must be a string in the format yyyy-MM-dd', 'Birth date cannot be in the future'],
+  },
+  {
+    birthDate: '123567',
+    response: ['birthDate must be a string in the format yyyy-MM-dd', 'Birth date cannot be in the future'],
+  },
+  {
+    birthDate: 123_567,
+    response: ['birthDate must be a string in the format yyyy-MM-dd', 'Birth date cannot be in the future'],
+  },
+  { birthDate: '9999-01-01', response: ['Birth date cannot be in the future'] },
+];
+
 describe('/people', () => {
   let admin: LoginResponseDto;
   let visiblePerson: PersonResponseDto;
@@ -42,6 +58,14 @@ describe('/people', () => {
 
   describe('GET /people', () => {
     beforeEach(async () => {});
+
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).get('/people');
+
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
     it('should return all people (including hidden)', async () => {
       const { status, body } = await request(app)
         .get('/people')
@@ -93,6 +117,13 @@ describe('/people', () => {
   });
 
   describe('GET /people/:id', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).get(`/people/${uuidDto.notFound}`);
+
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
     it('should throw error if person with id does not exist', async () => {
       const { status, body } = await request(app)
         .get(`/people/${uuidDto.notFound}`)
@@ -113,6 +144,13 @@ describe('/people', () => {
   });
 
   describe('GET /people/:id/statistics', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).get(`/people/${multipleAssetsPerson.id}/statistics`);
+
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
     it('should throw error if person with id does not exist', async () => {
       const { status, body } = await request(app)
         .get(`/people/${uuidDto.notFound}/statistics`)
@@ -133,6 +171,23 @@ describe('/people', () => {
   });
 
   describe('POST /people', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).post(`/people`);
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
+    for (const { birthDate, response } of invalidBirthday) {
+      it(`should not accept an invalid birth date [${birthDate}]`, async () => {
+        const { status, body } = await request(app)
+          .post(`/people`)
+          .set('Authorization', `Bearer ${admin.accessToken}`)
+          .send({ birthDate });
+        expect(status).toBe(400);
+        expect(body).toEqual(errorDto.badRequest(response));
+      });
+    }
+
     it('should create a person', async () => {
       const { status, body } = await request(app)
         .post(`/people`)
@@ -168,6 +223,39 @@ describe('/people', () => {
   });
 
   describe('PUT /people/:id', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).put(`/people/${uuidDto.notFound}`);
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
+    for (const { key, type } of [
+      { key: 'name', type: 'string' },
+      { key: 'featureFaceAssetId', type: 'string' },
+      { key: 'isHidden', type: 'boolean value' },
+      { key: 'isFavorite', type: 'boolean value' },
+    ]) {
+      it(`should not allow null ${key}`, async () => {
+        const { status, body } = await request(app)
+          .put(`/people/${visiblePerson.id}`)
+          .set('Authorization', `Bearer ${admin.accessToken}`)
+          .send({ [key]: null });
+        expect(status).toBe(400);
+        expect(body).toEqual(errorDto.badRequest([`${key} must be a ${type}`]));
+      });
+    }
+
+    for (const { birthDate, response } of invalidBirthday) {
+      it(`should not accept an invalid birth date [${birthDate}]`, async () => {
+        const { status, body } = await request(app)
+          .put(`/people/${visiblePerson.id}`)
+          .set('Authorization', `Bearer ${admin.accessToken}`)
+          .send({ birthDate });
+        expect(status).toBe(400);
+        expect(body).toEqual(errorDto.badRequest(response));
+      });
+    }
+
     it('should update a date of birth', async () => {
       const { status, body } = await request(app)
         .put(`/people/${visiblePerson.id}`)
@@ -224,6 +312,12 @@ describe('/people', () => {
   });
 
   describe('POST /people/:id/merge', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).post(`/people/${uuidDto.notFound}/merge`);
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
     it('should not supporting merging a person into themselves', async () => {
       const { status, body } = await request(app)
         .post(`/people/${visiblePerson.id}/merge`)

e2e/src/api/specs/search.e2e-spec.ts

@@ -1,15 +1,9 @@
-import {
-  AssetMediaResponseDto,
-  AssetResponseDto,
-  AssetVisibility,
-  deleteAssets,
-  LoginResponseDto,
-  updateAsset,
-} from '@immich/sdk';
+import { AssetMediaResponseDto, AssetResponseDto, deleteAssets, LoginResponseDto, updateAsset } from '@immich/sdk';
 import { DateTime } from 'luxon';
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { Socket } from 'socket.io-client';
+import { errorDto } from 'src/responses';
 import { app, asBearerAuth, TEN_TIMES, testAssetDir, utils } from 'src/utils';
 import request from 'supertest';
 import { afterAll, beforeAll, describe, expect, it } from 'vitest';
@@ -56,7 +50,7 @@ describe('/search', () => {
       { filename: '/formats/motionphoto/samsung-one-ui-6.heic' },
       { filename: '/formats/motionphoto/samsung-one-ui-5.jpg' },
 
-      { filename: '/metadata/gps-position/thompson-springs.jpg', dto: { visibility: AssetVisibility.Archive } },
+      { filename: '/metadata/gps-position/thompson-springs.jpg', dto: { isArchived: true } },
 
       // used for search suggestions
       { filename: '/formats/png/density_plot.png' },
@@ -147,6 +141,65 @@ describe('/search', () => {
   });
 
   describe('POST /search/metadata', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).post('/search/metadata');
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
+    const badTests = [
+      {
+        should: 'should reject page as a string',
+        dto: { page: 'abc' },
+        expected: ['page must not be less than 1', 'page must be an integer number'],
+      },
+      {
+        should: 'should reject page as a decimal',
+        dto: { page: 1.5 },
+        expected: ['page must be an integer number'],
+      },
+      {
+        should: 'should reject page as a negative number',
+        dto: { page: -10 },
+        expected: ['page must not be less than 1'],
+      },
+      {
+        should: 'should reject page as 0',
+        dto: { page: 0 },
+        expected: ['page must not be less than 1'],
+      },
+      {
+        should: 'should reject size as a string',
+        dto: { size: 'abc' },
+        expected: [
+          'size must not be greater than 1000',
+          'size must not be less than 1',
+          'size must be an integer number',
+        ],
+      },
+      {
+        should: 'should reject an invalid size',
+        dto: { size: -1.5 },
+        expected: ['size must not be less than 1', 'size must be an integer number'],
+      },
+      ...['isArchived', 'isFavorite', 'isEncoded', 'isOffline', 'isMotion', 'isVisible'].map((value) => ({
+        should: `should reject ${value} not a boolean`,
+        dto: { [value]: 'immich' },
+        expected: [`${value} must be a boolean value`],
+      })),
+    ];
+
+    for (const { should, dto, expected } of badTests) {
+      it(should, async () => {
+        const { status, body } = await request(app)
+          .post('/search/metadata')
+          .set('Authorization', `Bearer ${admin.accessToken}`)
+          .send(dto);
+        expect(status).toBe(400);
+        expect(body).toEqual(errorDto.badRequest(expected));
+      });
+    }
+
     const searchTests = [
       {
         should: 'should get my assets',
@@ -178,12 +231,12 @@ describe('/search', () => {
         deferred: () => ({ dto: { size: 1, isFavorite: false }, assets: [assetLast] }),
       },
       {
-        should: 'should search by visibility (AssetVisibility.Archive)',
-        deferred: () => ({ dto: { visibility: AssetVisibility.Archive }, assets: [assetSprings] }),
+        should: 'should search by isArchived (true)',
+        deferred: () => ({ dto: { isArchived: true }, assets: [assetSprings] }),
       },
       {
-        should: 'should search by visibility (AssetVisibility.Timeline)',
-        deferred: () => ({ dto: { size: 1, visibility: AssetVisibility.Timeline }, assets: [assetLast] }),
+        should: 'should search by isArchived (false)',
+        deferred: () => ({ dto: { size: 1, isArchived: false }, assets: [assetLast] }),
       },
       {
         should: 'should search by type (image)',
@@ -192,7 +245,7 @@ describe('/search', () => {
       {
         should: 'should search by type (video)',
         deferred: () => ({
-          dto: { type: 'VIDEO', visibility: AssetVisibility.Hidden },
+          dto: { type: 'VIDEO' },
           assets: [
             // the three live motion photos
             { id: expect.any(String) },
@@ -236,6 +289,13 @@ describe('/search', () => {
         should: 'should search by takenAfter (no results)',
         deferred: () => ({ dto: { takenAfter: today.plus({ hour: 1 }).toJSDate() }, assets: [] }),
       },
+      //   {
+      //     should: 'should search by originalPath',
+      //     deferred: () => ({
+      //       dto: { originalPath: asset1.originalPath },
+      //       assets: [asset1],
+      //     }),
+      //   },
       {
         should: 'should search by originalFilename',
         deferred: () => ({
@@ -265,7 +325,7 @@ describe('/search', () => {
         deferred: () => ({
           dto: {
             city: '',
-            visibility: AssetVisibility.Timeline,
+            isVisible: true,
             includeNull: true,
           },
           assets: [assetLast],
@@ -276,7 +336,7 @@ describe('/search', () => {
         deferred: () => ({
           dto: {
             city: null,
-            visibility: AssetVisibility.Timeline,
+            isVisible: true,
             includeNull: true,
           },
           assets: [assetLast],
@@ -297,7 +357,7 @@ describe('/search', () => {
         deferred: () => ({
           dto: {
             state: '',
-            visibility: AssetVisibility.Timeline,
+            isVisible: true,
             withExif: true,
             includeNull: true,
           },
@@ -309,7 +369,7 @@ describe('/search', () => {
         deferred: () => ({
           dto: {
             state: null,
-            visibility: AssetVisibility.Timeline,
+            isVisible: true,
             includeNull: true,
           },
           assets: [assetLast, assetNotocactus],
@@ -330,7 +390,7 @@ describe('/search', () => {
         deferred: () => ({
           dto: {
             country: '',
-            visibility: AssetVisibility.Timeline,
+            isVisible: true,
             includeNull: true,
           },
           assets: [assetLast],
@@ -341,7 +401,7 @@ describe('/search', () => {
         deferred: () => ({
           dto: {
             country: null,
-            visibility: AssetVisibility.Timeline,
+            isVisible: true,
             includeNull: true,
           },
           assets: [assetLast],
@@ -394,6 +454,14 @@ describe('/search', () => {
     }
   });
 
+  describe('POST /search/smart', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).post('/search/smart');
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+  });
+
   describe('POST /search/random', () => {
     beforeAll(async () => {
       await Promise.all([
@@ -408,6 +476,13 @@ describe('/search', () => {
       await utils.waitForQueueFinish(admin.accessToken, 'thumbnailGeneration');
     });
 
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).post('/search/random').send({ size: 1 });
+
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
     it.each(TEN_TIMES)('should return 1 random assets', async () => {
       const { status, body } = await request(app)
         .post('/search/random')
@@ -437,6 +512,12 @@ describe('/search', () => {
   });
 
   describe('GET /search/explore', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).get('/search/explore');
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
     it('should get explore data', async () => {
       const { status, body } = await request(app)
         .get('/search/explore')
@@ -447,6 +528,12 @@ describe('/search', () => {
   });
 
   describe('GET /search/places', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).get('/search/places');
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
     it('should get relevant places', async () => {
       const name = 'Paris';
 
@@ -465,6 +552,12 @@ describe('/search', () => {
   });
 
   describe('GET /search/cities', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).get('/search/cities');
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
     it('should get all cities', async () => {
       const { status, body } = await request(app)
         .get('/search/cities')
@@ -483,6 +576,12 @@ describe('/search', () => {
   });
 
   describe('GET /search/suggestions', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).get('/search/suggestions');
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
     it('should get suggestions for country (including null)', async () => {
       const { status, body } = await request(app)
         .get('/search/suggestions?type=country&includeNull=true')

e2e/src/api/specs/timeline.e2e-spec.ts

@@ -1,4 +1,4 @@
-import { AssetMediaResponseDto, AssetVisibility, LoginResponseDto, SharedLinkType, TimeBucketSize } from '@immich/sdk';
+import { AssetMediaResponseDto, LoginResponseDto, SharedLinkType, TimeBucketSize } from '@immich/sdk';
 import { DateTime } from 'luxon';
 import { createUserDto } from 'src/fixtures';
 import { errorDto } from 'src/responses';
@@ -104,7 +104,7 @@ describe('/timeline', () => {
       const req1 = await request(app)
         .get('/timeline/buckets')
         .set('Authorization', `Bearer ${timeBucketUser.accessToken}`)
-        .query({ size: TimeBucketSize.Month, withPartners: true, visibility: AssetVisibility.Archive });
+        .query({ size: TimeBucketSize.Month, withPartners: true, isArchived: true });
 
       expect(req1.status).toBe(400);
       expect(req1.body).toEqual(errorDto.badRequest());
@@ -112,7 +112,7 @@ describe('/timeline', () => {
       const req2 = await request(app)
         .get('/timeline/buckets')
         .set('Authorization', `Bearer ${user.accessToken}`)
-        .query({ size: TimeBucketSize.Month, withPartners: true, visibility: undefined });
+        .query({ size: TimeBucketSize.Month, withPartners: true, isArchived: undefined });
 
       expect(req2.status).toBe(400);
       expect(req2.body).toEqual(errorDto.badRequest());

e2e/src/api/specs/user-admin.e2e-spec.ts

@@ -215,19 +215,6 @@ describe('/admin/users', () => {
       const user = await getMyUser({ headers: asBearerAuth(token.accessToken) });
       expect(user).toMatchObject({ email: nonAdmin.userEmail });
     });
-
-    it('should update the avatar color', async () => {
-      const { status, body } = await request(app)
-        .put(`/admin/users/${admin.userId}`)
-        .send({ avatarColor: 'orange' })
-        .set('Authorization', `Bearer ${admin.accessToken}`);
-
-      expect(status).toBe(200);
-      expect(body).toMatchObject({ avatarColor: 'orange' });
-
-      const after = await getUserAdmin({ id: admin.userId }, { headers: asBearerAuth(admin.accessToken) });
-      expect(after).toMatchObject({ avatarColor: 'orange' });
-    });
   });
 
   describe('PUT /admin/users/:id/preferences', () => {
@@ -253,6 +240,19 @@ describe('/admin/users', () => {
       expect(after).toMatchObject({ memories: { enabled: false } });
     });
 
+    it('should update the avatar color', async () => {
+      const { status, body } = await request(app)
+        .put(`/admin/users/${admin.userId}/preferences`)
+        .send({ avatar: { color: 'orange' } })
+        .set('Authorization', `Bearer ${admin.accessToken}`);
+
+      expect(status).toBe(200);
+      expect(body).toMatchObject({ avatar: { color: 'orange' } });
+
+      const after = await getUserPreferencesAdmin({ id: admin.userId }, { headers: asBearerAuth(admin.accessToken) });
+      expect(after).toMatchObject({ avatar: { color: 'orange' } });
+    });
+
     it('should update download archive size', async () => {
       const { status, body } = await request(app)
         .put(`/admin/users/${admin.userId}/preferences`)

e2e/src/api/specs/user.e2e-spec.ts

@@ -31,7 +31,33 @@ describe('/users', () => {
     );
   });
 
+  describe('GET /users', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).get('/users');
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
+    it('should get users', async () => {
+      const { status, body } = await request(app).get('/users').set('Authorization', `Bearer ${admin.accessToken}`);
+      expect(status).toEqual(200);
+      expect(body).toHaveLength(2);
+      expect(body).toEqual(
+        expect.arrayContaining([
+          expect.objectContaining({ email: 'admin@immich.cloud' }),
+          expect.objectContaining({ email: 'user2@immich.cloud' }),
+        ]),
+      );
+    });
+  });
+
   describe('GET /users/me', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).get(`/users/me`);
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
     it('should not work for shared links', async () => {
       const album = await utils.createAlbum(admin.accessToken, { albumName: 'Album' });
       const sharedLink = await utils.createSharedLink(admin.accessToken, {
@@ -73,6 +99,24 @@ describe('/users', () => {
   });
 
   describe('PUT /users/me', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).put(`/users/me`);
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
+    for (const key of ['email', 'name']) {
+      it(`should not allow null ${key}`, async () => {
+        const dto = { [key]: null };
+        const { status, body } = await request(app)
+          .put(`/users/me`)
+          .set('Authorization', `Bearer ${admin.accessToken}`)
+          .send(dto);
+        expect(status).toBe(400);
+        expect(body).toEqual(errorDto.badRequest());
+      });
+    }
+
     it('should update first and last name', async () => {
       const before = await getMyUser({ headers: asBearerAuth(admin.accessToken) });
 
@@ -139,19 +183,6 @@ describe('/users', () => {
         profileChangedAt: expect.anything(),
       });
     });
-
-    it('should update avatar color', async () => {
-      const { status, body } = await request(app)
-        .put(`/users/me`)
-        .send({ avatarColor: 'blue' })
-        .set('Authorization', `Bearer ${admin.accessToken}`);
-
-      expect(status).toBe(200);
-      expect(body).toMatchObject({ avatarColor: 'blue' });
-
-      const after = await getMyUser({ headers: asBearerAuth(admin.accessToken) });
-      expect(after).toMatchObject({ avatarColor: 'blue' });
-    });
   });
 
   describe('PUT /users/me/preferences', () => {
@@ -171,6 +202,19 @@ describe('/users', () => {
       expect(after).toMatchObject({ memories: { enabled: false } });
     });
 
+    it('should update avatar color', async () => {
+      const { status, body } = await request(app)
+        .put(`/users/me/preferences`)
+        .send({ avatar: { color: 'blue' } })
+        .set('Authorization', `Bearer ${admin.accessToken}`);
+
+      expect(status).toBe(200);
+      expect(body).toMatchObject({ avatar: { color: 'blue' } });
+
+      const after = await getMyPreferences({ headers: asBearerAuth(admin.accessToken) });
+      expect(after).toMatchObject({ avatar: { color: 'blue' } });
+    });
+
     it('should require an integer for download archive size', async () => {
       const { status, body } = await request(app)
         .put(`/users/me/preferences`)
@@ -225,6 +269,11 @@ describe('/users', () => {
   });
 
   describe('GET /users/:id', () => {
+    it('should require authentication', async () => {
+      const { status } = await request(app).get(`/users/${admin.userId}`);
+      expect(status).toEqual(401);
+    });
+
     it('should get the user', async () => {
       const { status, body } = await request(app)
         .get(`/users/${admin.userId}`)
@@ -243,6 +292,12 @@ describe('/users', () => {
   });
 
   describe('GET /server/license', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).get('/users/me/license');
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
     it('should return the user license', async () => {
       await request(app)
         .put('/users/me/license')
@@ -260,6 +315,11 @@ describe('/users', () => {
   });
 
   describe('PUT /users/me/license', () => {
+    it('should require authentication', async () => {
+      const { status } = await request(app).put(`/users/me/license`);
+      expect(status).toEqual(401);
+    });
+
     it('should set the user license', async () => {
       const { status, body } = await request(app)
         .put(`/users/me/license`)

e2e/src/utils.ts

@@ -3,7 +3,6 @@ import {
   AssetMediaCreateDto,
   AssetMediaResponseDto,
   AssetResponseDto,
-  AssetVisibility,
   CheckExistingAssetsDto,
   CreateAlbumDto,
   CreateLibraryDto,
@@ -430,10 +429,7 @@ export const utils = {
   },
 
   archiveAssets: (accessToken: string, ids: string[]) =>
-    updateAssets(
-      { assetBulkUpdateDto: { ids, visibility: AssetVisibility.Archive } },
-      { headers: asBearerAuth(accessToken) },
-    ),
+    updateAssets({ assetBulkUpdateDto: { ids, isArchived: true } }, { headers: asBearerAuth(accessToken) }),
 
   deleteAssets: (accessToken: string, ids: string[]) =>
     deleteAssets({ assetBulkDeleteDto: { ids } }, { headers: asBearerAuth(accessToken) }),

e2e/src/web/specs/auth.e2e-spec.ts

@@ -25,7 +25,7 @@ test.describe('Registration', () => {
 
     // login
     await expect(page).toHaveTitle(/Login/);
-    await page.goto('/auth/login?autoLaunch=0');
+    await page.goto('/auth/login');
     await page.getByLabel('Email').fill('admin@immich.app');
     await page.getByLabel('Password').fill('password');
     await page.getByRole('button', { name: 'Login' }).click();
@@ -59,7 +59,7 @@ test.describe('Registration', () => {
     await context.clearCookies();
 
     // login
-    await page.goto('/auth/login?autoLaunch=0');
+    await page.goto('/auth/login');
     await page.getByLabel('Email').fill('user@immich.cloud');
     await page.getByLabel('Password').fill('password');
     await page.getByRole('button', { name: 'Login' }).click();
@@ -72,7 +72,7 @@ test.describe('Registration', () => {
     await page.getByRole('button', { name: 'Change password' }).click();
 
     // login with new password
-    await expect(page).toHaveURL('/auth/login?autoLaunch=0');
+    await expect(page).toHaveURL('/auth/login');
     await page.getByLabel('Email').fill('user@immich.cloud');
     await page.getByLabel('Password').fill('new-password');
     await page.getByRole('button', { name: 'Login' }).click();

e2e/src/web/specs/photo-viewer.e2e-spec.ts

@@ -21,9 +21,23 @@ test.describe('Photo Viewer', () => {
   test.beforeEach(async ({ context, page }) => {
     // before each test, login as user
     await utils.setAuthCookies(context, admin.accessToken);
+    await page.goto('/photos');
     await page.waitForLoadState('networkidle');
   });
 
+  test('initially shows a loading spinner', async ({ page }) => {
+    await page.route(`/api/assets/${asset.id}/thumbnail**`, async (route) => {
+      // slow down the request for thumbnail, so spinner has chance to show up
+      await new Promise((f) => setTimeout(f, 2000));
+      await route.continue();
+    });
+    await page.goto(`/photos/${asset.id}`);
+    await page.waitForLoadState('load');
+    // this is the spinner
+    await page.waitForSelector('svg[role=status]');
+    await expect(page.getByTestId('loading-spinner')).toBeVisible();
+  });
+
   test('loads original photo when zoomed', async ({ page }) => {
     await page.goto(`/photos/${asset.id}`);
     await expect.poll(async () => await imageLocator(page).getAttribute('src')).toContain('thumbnail');

e2e/src/web/specs/shared-link.e2e-spec.ts

@@ -47,13 +47,16 @@ test.describe('Shared Links', () => {
     await page.locator(`[data-asset-id="${asset.id}"]`).hover();
     await page.waitForSelector('[data-group] svg');
     await page.getByRole('checkbox').click();
-    await Promise.all([page.waitForEvent('download'), page.getByRole('button', { name: 'Download' }).click()]);
+    await page.getByRole('button', { name: 'Download' }).click();
+    await page.waitForEvent('download');
   });
 
   test('download all from shared link', async ({ page }) => {
     await page.goto(`/share/${sharedLink.key}`);
     await page.getByRole('heading', { name: 'Test Album' }).waitFor();
-    await Promise.all([page.waitForEvent('download'), page.getByRole('button', { name: 'Download' }).click()]);
+    await page.getByRole('button', { name: 'Download' }).click();
+    await page.getByText('DOWNLOADING', { exact: true }).waitFor();
+    await page.waitForEvent('download');
   });
 
   test('enter password for a shared link', async ({ page }) => {

i18n/ar.json

@@ -4,6 +4,12 @@
   "account_settings": "إعدادات الحساب",
   "acknowledge": "أُدرك ذلك",
   "action": "التحكم",
+  "action_common_back": "خلف",
+  "action_common_cancel": "يلغي",
+  "action_common_clear": "مسح",
+  "action_common_confirm": "تأكيد",
+  "action_common_save": "Save",
+  "action_common_select": "Select",
   "action_common_update": "تحديث",
   "actions": "العمليات",
   "active": "نشط",
@@ -166,6 +172,7 @@
     "no_pattern_added": "لم يتم إضافة أي أنماط",
     "note_apply_storage_label_previous_assets": "ملاحظة: لتطبيق تسمية التخزين على المحتويات التي تم رفعها سابقًا، قم بتشغيل",
     "note_cannot_be_changed_later": "ملاحظة: لا يمكن تغيير هذا لاحقًا!",
+    "note_unlimited_quota": "ملاحظة: أدخل 0 للحصول على حصة غير محدودة",
     "notification_email_from_address": "عنوان المرسل",
     "notification_email_from_address_description": "عنوان البريد الإلكتروني للمرسل، على سبيل المثال: \"Immich Photo Server noreply@example.com\"",
     "notification_email_host_description": "مضيف خادم البريد الإلكتروني (مثلًا: smtp.immich.app)",
@@ -187,13 +194,20 @@
     "oauth_auto_register": "التسجيل التلقائي",
     "oauth_auto_register_description": "التسجيل التلقائي للمستخدمين الجدد بعد تسجيل الدخول باستخدام OAuth",
     "oauth_button_text": "نص الزر",
+    "oauth_client_id": "معرف العميل",
+    "oauth_client_secret": "الرمز السري للعميل",
     "oauth_enable_description": "تسجيل الدخول باستخدام OAuth",
+    "oauth_issuer_url": "عنوان URL الخاص بجهة الإصدار",
     "oauth_mobile_redirect_uri": "عنوان URI لإعادة التوجيه على الهاتف",
     "oauth_mobile_redirect_uri_override": "تجاوز عنوان URI لإعادة التوجيه على الهاتف",
     "oauth_mobile_redirect_uri_override_description": "قم بتفعيله عندما لا يسمح موفر OAuth بمعرف URI للجوال، مثل '{callback}'",
+    "oauth_profile_signing_algorithm": "خوارزمية توقيع الملف الشخصي",
+    "oauth_profile_signing_algorithm_description": "الخوارزمية المستخدمة للتوقيع على ملف تعريف المستخدم.",
+    "oauth_scope": "النطاق",
     "oauth_settings": "OAuth",
     "oauth_settings_description": "إدارة إعدادات تسجيل الدخول OAuth",
     "oauth_settings_more_details": "لمزيد من التفاصيل حول هذه الميزة، يرجى الرجوع إلى <link>الوثائق</link>.",
+    "oauth_signing_algorithm": "خوارزمية التوقيع",
     "oauth_storage_label_claim": "المطالبة بتصنيف التخزين",
     "oauth_storage_label_claim_description": "قم تلقائيًا بتعيين تصنيف التخزين الخاص بالمستخدم على قيمة هذه المطالبة.",
     "oauth_storage_quota_claim": "المطالبة بحصة التخزين",
@@ -367,6 +381,7 @@
   "advanced_settings_self_signed_ssl_subtitle": "Skips SSL certificate verification for the server endpoint. Required for self-signed certificates.",
   "advanced_settings_self_signed_ssl_title": "السماح بشهادات SSL الموقعة ذاتيًا",
   "advanced_settings_tile_subtitle": "إعدادات المستخدم المتقدمة",
+  "advanced_settings_tile_title": "متقدم",
   "advanced_settings_troubleshooting_subtitle": "تمكين الميزات الإضافية لاستكشاف الأخطاء وإصلاحها",
   "advanced_settings_troubleshooting_title": "استكشاف الأخطاء وإصلاحها",
   "age_months": "عمر {months, plural, one {# شهر} other {# أشهر}}",
@@ -377,8 +392,10 @@
   "album_cover_updated": "تم تحديث غلاف الألبوم",
   "album_delete_confirmation": "هل أنت متأكد أنك تريد حذف الألبوم {album}؟",
   "album_delete_confirmation_description": "إذا تمت مشاركة هذا الألبوم، فلن يتمكن المستخدمون الآخرون من الوصول إليه بعد الآن.",
+  "album_info": "{} items",
   "album_info_card_backup_album_excluded": "مستبعد",
   "album_info_card_backup_album_included": "متضمنة",
+  "album_info_shared": "{} items · Shared",
   "album_info_updated": "تم تحديث معلومات الألبوم",
   "album_leave": "هل تريد مغادرة الألبوم؟",
   "album_leave_confirmation": "هل أنت متأكد أنك تريد مغادرة {album}؟",
@@ -390,17 +407,21 @@
   "album_thumbnail_card_item": "عنصر واحد",
   "album_thumbnail_card_items": "{} items",
   "album_thumbnail_card_shared": " · . مشترك",
+  "album_thumbnail_owned": "مملوكة",
   "album_thumbnail_shared_by": "Shared by {}",
+  "album_thumbnails": "Library page thumbnails ({} assets)",
   "album_updated": "تم تحديث الألبوم",
   "album_updated_setting_description": "تلقي إشعارًا عبر البريد الإلكتروني عندما يحتوي الألبوم المشترك على محتويات جديدة",
   "album_user_left": "تم ترك {album}",
   "album_user_removed": "تم إزالة {user}",
   "album_viewer_appbar_delete_confirm": "هل أنت متأكد أنك تريد حذف هذا الألبوم من حسابك؟",
+  "album_viewer_appbar_share_delete": "حذف الألبوم",
   "album_viewer_appbar_share_err_delete": "فشل في حذف الألبوم",
   "album_viewer_appbar_share_err_leave": "فشل في ترك الألبوم",
   "album_viewer_appbar_share_err_remove": "هناك مشاكل في إزالة الأصول من الألبوم",
   "album_viewer_appbar_share_err_title": "فشل في تغيير عنوان الألبوم",
   "album_viewer_appbar_share_leave": "ترك الألبوم",
+  "album_viewer_appbar_share_remove": "إزالة من الألبوم",
   "album_viewer_appbar_share_to": "حصة ل",
   "album_viewer_page_share_add_users": "اضافة مستخدمين",
   "album_with_link_access": "السماح لأي شخص لديه الرابط برؤية الصور والأشخاص الموجودين في هذا الألبوم.",
@@ -409,7 +430,9 @@
   "all": "الكل",
   "all_albums": "جميع الألبومات",
   "all_people": "جميع الأشخاص",
+  "all_people_page_title": "الناس",
   "all_videos": "جميع الفيديوهات",
+  "all_videos_page_title": "أشرطة فيديو",
   "allow_dark_mode": "السماح بالوضع المعتم",
   "allow_edits": "إسمح بالتعديل",
   "allow_public_user_to_download": "السماح لأي مستخدم عام بالتنزيل",
@@ -424,6 +447,15 @@
   "app_bar_signout_dialog_ok": "نعم",
   "app_bar_signout_dialog_title": "خروج",
   "app_settings": "إعدادات التطبيق",
+  "appbar_delete_confirm": "هل أنت متأكد أنك تريد حذف هذا الألبوم من حسابك؟",
+  "appbar_share_delete": "حذف الألبوم",
+  "appbar_share_err_delete": "فشل في حذف الألبوم",
+  "appbar_share_err_leave": "فشل في ترك الألبوم",
+  "appbar_share_err_remove": "هناك مشاكل في إزالة الأصول من الألبوم",
+  "appbar_share_err_title": "فشل في تغيير عنوان الألبوم",
+  "appbar_share_leave": "ترك الألبوم",
+  "appbar_share_remove": "إزالة من الألبوم",
+  "appbar_share_to": "حصة ل",
   "appears_in": "يظهر في",
   "archive": "الأرشيف",
   "archive_or_unarchive_photo": "أرشفة الصورة أو إلغاء أرشفتها",
@@ -447,10 +479,13 @@
   "asset_list_layout_settings_dynamic_layout_title": "تخطيط ديناميكي",
   "asset_list_layout_settings_group_automatically": "تلقائي",
   "asset_list_layout_settings_group_by": "مجموعة الأصول حسب",
+  "asset_list_layout_settings_group_by_month": "شهر",
   "asset_list_layout_settings_group_by_month_day": "شهر + يوم",
   "asset_list_layout_sub_title": "تصميم",
   "asset_list_settings_subtitle": "إعدادات تخطيط شبكة الصور",
   "asset_list_settings_title": "شبكة الصور",
+  "asset_list_storage_indicator_title": "عرض مؤشر التخزين على بلاط الأصول",
+  "asset_list_tiles_per_row_title": "Number of assets per row ({})",
   "asset_offline": "المحتوى غير اتصال",
   "asset_offline_description": "لم يعد هذا الأصل الخارجي موجودًا على القرص. يرجى الاتصال بمسؤول Immich للحصول على المساعدة.",
   "asset_restored_successfully": "Asset restored successfully",
@@ -483,8 +518,27 @@
   "automatic_endpoint_switching_title": "Automatic URL switching",
   "back": "خلف",
   "back_close_deselect": "الرجوع أو الإغلاق أو إلغاء التحديد",
+  "background_app_refresh_disabled_content": "قم بتمكين تحديث تطبيق الخلفية في الإعدادات > عام > تحديث تطبيق الخلفية لاستخدام النسخ الاحتياطي في الخلفية.",
+  "background_app_refresh_disabled_title": "تم تعطيل تحديث التطبيق في الخلفية",
+  "background_app_refresh_enable_button_text": "اذهب للاعدادات",
+  "background_battery_info_link": "أرني كيف",
+  "background_battery_info_message": "للحصول على أفضل تجربة نسخ احتياطي في الخلفية، يرجى تعطيل أي تحسينات للبطارية تقيد نشاط الخلفية لـ تطبيق.\n\nنظرًا لأن هذا خاص بالجهاز، يرجى البحث عن المعلومات المطلوبة للشركة المصنعة لجهازك.",
+  "background_battery_info_ok": "نعم",
+  "background_battery_info_title": "تحسين البطارية",
+  "background_charging": "فقط أثناء الشحن",
+  "background_configure_error": "فشل في تكوين خدمة الخلفية",
+  "background_delay": "Delay new assets backup: {}",
+  "background_description": "قم بتشغيل خدمة الخلفية لإجراء نسخ احتياطي لأي أصول جديدة تلقائيًا دون الحاجة إلى فتح التطبيق",
+  "background_is_off": "تم إيقاف النسخ الاحتياطي التلقائي للخلفية",
+  "background_is_on": "النسخ الاحتياطي التلقائي للخلفية قيد التشغيل",
   "background_location_permission": "Background location permission",
   "background_location_permission_content": "In order to switch networks when running in the background, Immich must *always* have precise location access so the app can read the Wi-Fi network's name",
+  "background_turn_off": "قم بإيقاف تشغيل خدمة الخلفية",
+  "background_turn_on": "قم بتشغيل خدمة الخلفية",
+  "background_wifi": "فقط على واي فاي",
+  "backup": "دعم",
+  "backup_album_excluded": "مستبعد",
+  "backup_album_included": "متضمنة",
   "backup_album_selection_page_albums_device": "Albums on device ({})",
   "backup_album_selection_page_albums_tap": "انقر للتضمين، وانقر نقرًا مزدوجًا للاستثناء",
   "backup_album_selection_page_assets_scatter": "يمكن أن تنتشر الأصول عبر ألبومات متعددة. وبالتالي، يمكن تضمين الألبومات أو استبعادها أثناء عملية النسخ الاحتياطي.",
@@ -519,6 +573,7 @@
   "backup_controller_page_backup": "دعم",
   "backup_controller_page_backup_selected": "المحدد: ",
   "backup_controller_page_backup_sub": "النسخ الاحتياطي للصور ومقاطع الفيديو",
+  "backup_controller_page_cancel": "يلغي",
   "backup_controller_page_created": "Created on: {}",
   "backup_controller_page_desc_backup": "قم بتشغيل النسخ الاحتياطي الأمامي لتحميل الأصول الجديدة تلقائيًا إلى الخادم عند فتح التطبيق.",
   "backup_controller_page_excluded": "مستبعد: ",
@@ -529,12 +584,14 @@
   "backup_controller_page_none_selected": "لم يتم التحديد",
   "backup_controller_page_remainder": "بقية",
   "backup_controller_page_remainder_sub": "الصور ومقاطع الفيديو المتبقية للنسخ الاحتياطي من التحديد",
+  "backup_controller_page_select": "يختار",
   "backup_controller_page_server_storage": "ذاكرة الجهاز",
   "backup_controller_page_start_backup": "بدء النسخ الاحتياطي",
   "backup_controller_page_status_off": "النسخة الاحتياطية التلقائية غير فعالة",
   "backup_controller_page_status_on": "النسخة الاحتياطية التلقائية فعالة",
   "backup_controller_page_storage_format": "{} of {} used",
   "backup_controller_page_to_backup": "الألبومات  الاحتياطية",
+  "backup_controller_page_total": "المجموع",
   "backup_controller_page_total_sub": "جميع الصور ومقاطع الفيديو الفريدة من ألبومات مختارة",
   "backup_controller_page_turn_off": "قم بإيقاف تشغيل النسخ الاحتياطي المقدمة",
   "backup_controller_page_turn_on": "قم بتشغيل النسخ الاحتياطي المقدمة",
@@ -542,11 +599,14 @@
   "backup_err_only_album": "لا يمكن إزالة الألبوم الوحيد",
   "backup_info_card_assets": "أصول",
   "backup_manual_cancelled": "ملغي",
+  "backup_manual_failed": "فشل",
   "backup_manual_in_progress": "قيد التحميل حاول مره اخرى",
   "backup_manual_success": "نجاح",
   "backup_manual_title": "حالة التحميل",
   "backup_options_page_title": "خيارات النسخ الاحتياطي",
+  "backup_selected": "المحدد: ",
   "backup_setting_subtitle": "Manage background and foreground upload settings",
+  "backup_sub": "النسخ الاحتياطي للصور ومقاطع الفيديو",
   "backward": "الى الوراء",
   "birthdate_saved": "تم حفظ تاريخ الميلاد بنجاح",
   "birthdate_set_description": "يتم استخدام تاريخ الميلاد لحساب عمر هذا الشخص وقت التقاط الصورة.",
@@ -585,6 +645,7 @@
   "cannot_merge_people": "لا يمكن دمج الأشخاص",
   "cannot_undo_this_action": "لا يمكنك التراجع عن هذا الإجراء!",
   "cannot_update_the_description": "لا يمكن تحديث الوصف",
+  "categories": "فئات",
   "change_date": "غيّر التاريخ",
   "change_display_order": "Change display order",
   "change_expiration_time": "تغيير وقت انتهاء الصلاحية",
@@ -598,7 +659,6 @@
   "change_password_form_new_password": "كلمة المرور الجديدة",
   "change_password_form_password_mismatch": "كلمة المرور غير مطابقة",
   "change_password_form_reenter_new_password": "أعد إدخال كلمة مرور جديدة",
-  "change_pin_code": "تغيير الرقم السري",
   "change_your_password": "غير كلمة المرور الخاصة بك",
   "changed_visibility_successfully": "تم تغيير الرؤية بنجاح",
   "check_all": "تحقق من الكل",
@@ -611,6 +671,8 @@
   "clear": "إخلاء",
   "clear_all": "إخلاء الكل",
   "clear_all_recent_searches": "مسح جميع عمليات البحث الأخيرة",
+  "clear_cache_button": "مسح ذاكرة التخزين المؤقت",
+  "clear_cache_button_title": "يقوم بمسح ذاكرة التخزين المؤقت للتطبيق.سيؤثر هذا بشكل كبير على أداء التطبيق حتى إعادة بناء ذاكرة التخزين المؤقت.",
   "clear_message": "إخلاء الرسالة",
   "clear_value": "إخلاء القيمة",
   "client_cert_dialog_msg_confirm": "OK",
@@ -618,6 +680,7 @@
   "client_cert_import": "Import",
   "client_cert_import_success_msg": "Client certificate is imported",
   "client_cert_invalid_msg": "Invalid certificate file or wrong password",
+  "client_cert_remove": "Remove",
   "client_cert_remove_msg": "Client certificate is removed",
   "client_cert_subtitle": "Supports PKCS12 (.p12, .pfx) format only. Certificate Import/Remove is available only before login",
   "client_cert_title": "SSL Client Certificate",
@@ -627,32 +690,49 @@
   "collapse_all": "طيّ الكل",
   "color": "اللون",
   "color_theme": "نمط الألوان",
+  "colorful_interface_subtitle": "Apply primary color to background surfaces.",
+  "colorful_interface_title": "Colorful interface",
   "comment_deleted": "تم حذف التعليق",
   "comment_options": "خيارات التعليق",
   "comments_and_likes": "التعليقات والإعجابات",
   "comments_are_disabled": "التعليقات معطلة",
+  "common_add_to_album": "أضف إلى الألبوم",
+  "common_change_password": "تغيير كلمة المرور",
   "common_create_new_album": "إنشاء ألبوم جديد",
   "common_server_error": "يرجى التحقق من اتصال الشبكة الخاص بك ، والتأكد من أن الجهاز قابل للوصول وإصدارات التطبيق/الجهاز متوافقة.",
+  "common_shared": "مشترك",
   "completed": "Completed",
   "confirm": "تأكيد",
   "confirm_admin_password": "تأكيد كلمة مرور المسؤول",
   "confirm_delete_face": "هل أنت متأكد من حذف وجه {name} من الأصول؟",
   "confirm_delete_shared_link": "هل أنت متأكد أنك تريد حذف هذا الرابط المشترك؟",
   "confirm_keep_this_delete_others": "سيتم حذف جميع الأصول الأخرى في المجموعة باستثناء هذا الأصل. هل أنت متأكد من أنك تريد المتابعة؟",
-  "confirm_new_pin_code": "ثبت الرقم السري الجديد",
   "confirm_password": "تأكيد كلمة المرور",
   "contain": "محتواة",
   "context": "السياق",
+  "contextual_search": "Sunrise on the beach",
   "continue": "متابعة",
+  "control_bottom_app_bar_add_to_album": "أضف إلى الألبوم",
+  "control_bottom_app_bar_album_info": "{} items",
   "control_bottom_app_bar_album_info_shared": "{} items · Shared",
+  "control_bottom_app_bar_archive": "أرشيف",
   "control_bottom_app_bar_create_new_album": "إنشاء ألبوم جديد",
+  "control_bottom_app_bar_delete": "يمسح",
   "control_bottom_app_bar_delete_from_immich": " حذف منال تطبيق",
   "control_bottom_app_bar_delete_from_local": "حذف من الجهاز",
+  "control_bottom_app_bar_download": "Download",
+  "control_bottom_app_bar_edit": "Edit",
   "control_bottom_app_bar_edit_location": "تحديد الوجهة",
   "control_bottom_app_bar_edit_time": "تحرير التاريخ والوقت",
+  "control_bottom_app_bar_favorite": "مفضل",
+  "control_bottom_app_bar_share": "يشارك",
   "control_bottom_app_bar_share_link": "Share Link",
   "control_bottom_app_bar_share_to": "مشاركة إلى",
+  "control_bottom_app_bar_stack": "تجميع",
   "control_bottom_app_bar_trash_from_immich": "حذفه ونقله في سله المهملات",
+  "control_bottom_app_bar_unarchive": "غير محفوظ في الارشيف",
+  "control_bottom_app_bar_unfavorite": "غير مفضل",
+  "control_bottom_app_bar_upload": "رفع وتحميل",
   "copied_image_to_clipboard": "تم نسخ الصورة إلى الحافظة.",
   "copied_to_clipboard": "نسخ إلى الحافظة!",
   "copy_error": "نسخ الخطأ",
@@ -673,9 +753,12 @@
   "create_link_to_share": "إنشاء رابط للمشاركة",
   "create_link_to_share_description": "السماح لأي شخص لديه الرابط بمشاهدة الصورة (الصور) المحددة",
   "create_new": "CREATE NEW",
+  "create_new_album": "إنشاء ألبوم جديد",
   "create_new_person": "إنشاء شخص جديد",
   "create_new_person_hint": "تعيين المحتويات المحددة لشخص جديد",
   "create_new_user": "إنشاء مستخدم جديد",
+  "create_shared_album_page_create": "انشاء",
+  "create_shared_album_page_share": "يشارك",
   "create_shared_album_page_share_add_assets": "إضافة الأصول",
   "create_shared_album_page_share_select_photos": "حدد الصور",
   "create_tag": "إنشاء علامة",
@@ -683,15 +766,16 @@
   "create_user": "إنشاء مستخدم",
   "created": "تم الإنشاء",
   "crop": "Crop",
+  "curated_location_page_title": "أماكن",
   "curated_object_page_title": "أشياء",
   "current_device": "الجهاز الحالي",
-  "current_pin_code": "الرقم السري الحالي",
   "current_server_address": "Current server address",
   "custom_locale": "لغة مخصصة",
   "custom_locale_description": "تنسيق التواريخ والأرقام بناءً على اللغة والمنطقة",
   "daily_title_text_date": "E ، MMM DD",
   "daily_title_text_date_year": "E ، MMM DD ، yyyy",
   "dark": "معتم",
+  "dark_mode_switch": "الوضع المظلم",
   "date_after": "التارخ بعد",
   "date_and_time": "التاريخ و الوقت",
   "date_before": "التاريخ قبل",
@@ -713,10 +797,14 @@
   "delete_dialog_alert_local": " العناصر التي تم حذفها من جهازك ولكنها موجوده في تطبيق",
   "delete_dialog_alert_local_non_backed_up": "بعض العناصر التي سيتم حذفها بشكل دائم ولا يوجد لها نسخه احتياطيه في تطبيق ",
   "delete_dialog_alert_remote": "العناصر التي سيتم حذفها بشكل دائم من تطبيق",
+  "delete_dialog_cancel": "يلغي",
+  "delete_dialog_ok": "يمسح",
   "delete_dialog_ok_force": "احذف على أي حال",
   "delete_dialog_title": "الحذف بشكل نهائي",
   "delete_duplicates_confirmation": "هل أنت متأكد أنك تريد حذف هذه التكرارات نهائيًا؟",
   "delete_face": "حذف الوجه",
+  "delete_from_immich": " حذف منال تطبيق",
+  "delete_from_local": "حذف من الجهاز",
   "delete_key": "حذف المفتاح",
   "delete_library": "حذف المكتبة",
   "delete_link": "حذف الرابط",
@@ -724,15 +812,18 @@
   "delete_local_dialog_ok_force": "احذف على أي حال",
   "delete_others": "حذف الأخرى",
   "delete_shared_link": "حذف الرابط المشترك",
+  "delete_shared_link_dialog_content": "هل أنت متأكد من أنك تريد حذف هذا الرابط المشترك؟",
   "delete_shared_link_dialog_title": "حذف الرابط المشترك",
   "delete_tag": "حذف العلامة",
   "delete_tag_confirmation_prompt": "هل أنت متأكد أنك تريد حذف العلامة {tagName}؟",
   "delete_user": "حذف المستخدم",
   "deleted_shared_link": "تم حذف الرابط المشارك",
   "deletes_missing_assets": "حذف الأصول المفقودة من القرص",
+  "desc_backup": "قم بتشغيل النسخ الاحتياطي الأمامي لتحميل الأصول الجديدة تلقائيًا إلى الخادم عند فتح التطبيق.",
   "description": "وصف",
   "description_input_hint_text": "اضف وصفا...",
   "description_input_submit_error": "خطأ تحديث الوصف ، تحقق من السجل لمزيد من التفاصيل",
+  "description_search": "Hiking day in Sapa",
   "details": "تفاصيل",
   "direction": "الإتجاه",
   "disabled": "معطل",
@@ -770,6 +861,9 @@
   "downloading_asset_filename": "{filename} قيد التنزيل",
   "downloading_media": "Downloading media",
   "drop_files_to_upload": "قم بإسقاط الملفات في أي مكان لرفعها",
+  "duplicated_assets_clear_button": "واضح",
+  "duplicated_assets_subtitle": "الصور ومقاطع الفيديو اللتي تم تجاهلها المدرجة في التطبيق",
+  "duplicated_assets_title": "Duplicated Assets ({})",
   "duplicates": "التكرارات",
   "duplicates_description": "قم بحل كل مجموعة من خلال الإشارة إلى التكرارات، إن وجدت",
   "duration": "المدة",
@@ -778,8 +872,12 @@
   "edit_avatar": "تعديل الصورة الشخصية",
   "edit_date": "تعديل التاريخ",
   "edit_date_and_time": "تعديل التاريخ والوقت",
+  "edit_date_time_dialog_date_time": "التاريخ و الوقت",
+  "edit_date_time_dialog_search_timezone": "Search timezone...",
+  "edit_date_time_dialog_timezone": "وحدة زمنية",
   "edit_exclusion_pattern": "تعديل نمط الاستبعاد",
   "edit_faces": "تعديل الوجوه",
+  "edit_image_title": "Edit",
   "edit_import_path": "تعديل مسار الاستيراد",
   "edit_import_paths": "تعديل مسارات الاستيراد",
   "edit_key": "تعديل المفتاح",
@@ -789,6 +887,7 @@
   "edit_name": "تعديل الاسم",
   "edit_people": "تعديل الأشخاص",
   "edit_tag": "تعديل العلامة",
+  "edit_time": "تحرير التاريخ والوقت",
   "edit_title": "تعديل العنوان",
   "edit_user": "تعديل المستخدم",
   "edited": "تم التعديل",
@@ -938,10 +1037,12 @@
     "unable_to_update_user": "غير قادر على تحديث المستخدم",
     "unable_to_upload_file": "تعذر رفع الملف"
   },
+  "excluded": "مستبعد: ",
   "exif": "Exif (صيغة ملف صوري قابل للتبادل)",
   "exif_bottom_sheet_description": "اضف وصفا...",
   "exif_bottom_sheet_details": "تفاصيل",
   "exif_bottom_sheet_location": "موقع",
+  "exif_bottom_sheet_location_add": "إضافة موقع",
   "exif_bottom_sheet_people": "الناس",
   "exif_bottom_sheet_person_add_person": "اضف اسما",
   "exif_bottom_sheet_person_age": "Age {}",
@@ -974,12 +1075,14 @@
   "favorite_or_unfavorite_photo": "تفضيل أو إلغاء تفضيل الصورة",
   "favorites": "المفضلة",
   "favorites_page_no_favorites": "لم يتم العثور على الأصول المفضلة",
+  "favorites_page_title": "المفضلة",
   "feature_photo_updated": "تم تحديث الصورة المميزة",
   "features": "الميزات",
   "features_setting_description": "إدارة ميزات التطبيق",
   "file_name": "إسم الملف",
   "file_name_or_extension": "اسم الملف أو امتداده",
   "filename": "اسم الملف",
+  "filename_search": "File name or extension",
   "filetype": "نوع الملف",
   "filter": "Filter",
   "filter_people": "تصفية الاشخاص",
@@ -999,6 +1102,7 @@
   "go_to_search": "اذهب إلى البحث",
   "grant_permission": "Grant permission",
   "group_albums_by": "تجميع الألبومات حسب...",
+  "group_by_sub_title": "تنظيم بواسطة",
   "group_country": "مجموعة البلد",
   "group_no": "بدون تجميع",
   "group_owner": "تجميع حسب المالك",
@@ -1011,6 +1115,7 @@
   "header_settings_field_validator_msg": "Value cannot be empty",
   "header_settings_header_name_input": "Header name",
   "header_settings_header_value_input": "Header value",
+  "header_settings_page_title": "Proxy Headers",
   "headers_settings_tile_subtitle": "Define proxy headers the app should send with each network request",
   "headers_settings_tile_title": "Custom proxy headers",
   "hi_user": "مرحبا {name} ({email})",
@@ -1036,6 +1141,7 @@
   "home_page_upload_err_limit": "لا يمكن إلا تحميل 30 أحد الأصول في وقت واحد ، سوف يتخطى",
   "host": "المضيف",
   "hour": "ساعة",
+  "id": "ID: {}",
   "ignore_icloud_photos": "Ignore iCloud photos",
   "ignore_icloud_photos_description": "Photos that are stored on iCloud will not be uploaded to the Immich server",
   "image": "صورة",
@@ -1049,10 +1155,14 @@
   "image_alt_text_date_place_2_people": "{isVideo, select, true {Video} other {Image}} تم التقاطها في {city}، {country} مع {person1} و{person2} في {date}",
   "image_alt_text_date_place_3_people": "{isVideo, select, true {Video} other {Image}} تم التقاطها في {city}، {country} مع {person1}، {person2}، و{person3} في {date}",
   "image_alt_text_date_place_4_or_more_people": "{isVideo, select, true {Video} other {Image}} تم التقاطها في {city}, {country} with {person1}, {person2}, مع {additionalCount, number} آخرين في {date}",
+  "image_cache_size": "Image cache size ({} assets)",
   "image_saved_successfully": "Image saved",
+  "image_viewer_page_state_provider_download_error": "خطا في التحميل",
   "image_viewer_page_state_provider_download_started": "بدأ التنزيل",
   "image_viewer_page_state_provider_download_success": "تم التنزيل بنجاح",
   "image_viewer_page_state_provider_share_error": "خطأ في المشاركة",
+  "image_viewer_quality_subtitle": "اضبط جودة عارض الصورة التفصيلية",
+  "image_viewer_quality_title": "جودة عارض الصورة",
   "immich_logo": "شعار immich",
   "immich_web_interface": "واجهة ويب immich",
   "import_from_json": "استيراد من JSON",
@@ -1087,17 +1197,29 @@
   "last_seen": "اخر ظهور",
   "latest_version": "احدث اصدار",
   "latitude": "خط العرض",
+  "layout_settings_dynamic_layout_title": "تخطيط ديناميكي",
+  "layout_settings_group_automatically": "تلقائي",
+  "layout_settings_group_by": "مجموعة الأصول حسب",
+  "layout_settings_group_by_month": "شهر",
+  "layout_settings_group_by_month_day": "شهر + يوم",
+  "layout_sub_title": "تصميم",
   "leave": "مغادرة",
   "lens_model": "نموذج العدسات",
   "let_others_respond": "دع الآخرين يستجيبون",
   "level": "المستوى",
   "library": "مكتبة",
   "library_options": "خيارات المكتبة",
+  "library_page_albums": "ألبومات",
+  "library_page_archive": "أرشيف",
   "library_page_device_albums": "ألبومات على الجهاز",
+  "library_page_favorites": "المفضلة",
   "library_page_new_album": "البوم جديد",
+  "library_page_sharing": "مشاركة",
   "library_page_sort_asset_count": "عدد الأصول",
   "library_page_sort_created": "تاريخ الإنشاء",
   "library_page_sort_last_modified": "آخر تعديل",
+  "library_page_sort_most_oldest_photo": "أقدم صورة",
+  "library_page_sort_most_recent_photo": "أحدث الصور",
   "library_page_sort_title": "عنوان الألبوم",
   "light": "المضيئ",
   "like_deleted": "تم حذف الإعجاب",
@@ -1113,8 +1235,10 @@
   "location_permission": "Location permission",
   "location_permission_content": "In order to use the auto-switching feature, Immich needs precise location permission so it can read the current WiFi network's name",
   "location_picker_choose_on_map": "اختر على الخريطة",
+  "location_picker_latitude": "خط العرض",
   "location_picker_latitude_error": "أدخل خط عرض صالح",
   "location_picker_latitude_hint": "أدخل خط العرض الخاص بك هنا",
+  "location_picker_longitude": "خط الطول",
   "location_picker_longitude_error": "أدخل خط الطول الصحيح",
   "location_picker_longitude_hint": "أدخل خط الطول هنا",
   "log_out": "تسجيل خروج",
@@ -1125,6 +1249,7 @@
   "login_disabled": "تم تعطيل تسجيل الدخول",
   "login_form_api_exception": " استثناء برمجة التطبيقات. يرجى التحقق من عنوان الخادم والمحاولة مرة أخرى ",
   "login_form_back_button_text": "الرجوع للخلف",
+  "login_form_button_text": "تسجيل الدخول",
   "login_form_email_hint": "yoursemail@email.com",
   "login_form_endpoint_hint": "http://your-server-ip:port",
   "login_form_endpoint_url": "url نقطة نهاية الخادم",
@@ -1137,6 +1262,9 @@
   "login_form_failed_get_oauth_server_disable": "ميزة OAuth غير متوفرة على هذا الخادم",
   "login_form_failed_login": "خطأ في تسجيل الدخول ، تحقق من عنوان URL للخادم والبريد الإلكتروني وكلمة المرور",
   "login_form_handshake_exception": "كان هناك استثناء مصافحة مع الخادم.تمكين دعم الشهادة الموقعة ذاتيا في الإعدادات إذا كنت تستخدم شهادة موقعة ذاتيا.",
+  "login_form_label_email": "بريد إلكتروني",
+  "login_form_label_password": "كلمة المرور",
+  "login_form_next_button": "التالي",
   "login_form_password_hint": "كلمة المرور",
   "login_form_save_login": "ابق متصلا",
   "login_form_server_empty": "أدخل عنوان URL الخادم.",
@@ -1163,6 +1291,7 @@
   "map_assets_in_bound": "{} photo",
   "map_assets_in_bounds": "{} photos",
   "map_cannot_get_user_location": "لا يمكن الحصول على موقع المستخدم",
+  "map_location_dialog_cancel": "يلغي",
   "map_location_dialog_yes": "نعم",
   "map_location_picker_page_use_location": "استخدم هذا الموقع",
   "map_location_service_disabled_content": "يجب تمكين خدمة الموقع لعرض الأصول من موقعك الحالي.هل تريد تمكينه الآن؟",
@@ -1174,13 +1303,17 @@
   "map_no_location_permission_title": "تم رفض إذن الموقع",
   "map_settings": "إعدادات الخريطة",
   "map_settings_dark_mode": "الوضع المظلم",
+  "map_settings_date_range_option_all": "الجميع",
   "map_settings_date_range_option_day": "24 ساعة الماضية",
   "map_settings_date_range_option_days": "Past {} days",
   "map_settings_date_range_option_year": "السنة الفائتة",
   "map_settings_date_range_option_years": "Past {} years",
+  "map_settings_dialog_cancel": "يلغي",
+  "map_settings_dialog_save": "يحفظ",
   "map_settings_dialog_title": "إعدادات الخريطة",
   "map_settings_include_show_archived": "تشمل الأرشفة",
   "map_settings_include_show_partners": "تضمين الشركاء",
+  "map_settings_only_relative_range": "نطاق الموعد",
   "map_settings_only_show_favorites": "اظهار المفضلة فقط",
   "map_settings_theme_settings": "مظهر الخريطة",
   "map_zoom_to_see_photos": "قم بتصغيرها لرؤية الصور",
@@ -1210,6 +1343,8 @@
   "month": "شهر",
   "monthly_title_text_date_format": "ط ط ط",
   "more": "المزيد",
+  "motion_photos": "الصور المتحركه",
+  "motion_photos_page_title": "الصور المتحركة",
   "moved_to_trash": "تم النقل إلى سلة المهملات",
   "multiselect_grid_edit_date_time_err_read_only": "لا يمكن تعديل تاريخ الأصول (المواد) للقراءة فقط، سوف يتخطى",
   "multiselect_grid_edit_gps_err_read_only": "لا يمكن تعديل موقع الأصول (المواد) للقراءة فقط، سوف يتخطى",
@@ -1224,7 +1359,6 @@
   "new_api_key": "مفتاح API جديد",
   "new_password": "كلمة المرور الجديدة",
   "new_person": "شخص جديد",
-  "new_pin_code": "الرقم السري الجديد",
   "new_user_created": "تم إنشاء مستخدم جديد",
   "new_version_available": "إصدار جديد متاح",
   "newest_first": "الأحدث أولاً",
@@ -1243,15 +1377,20 @@
   "no_favorites_message": "أضف المفضلة للعثور بسرعة على أفضل الصور ومقاطع الفيديو",
   "no_libraries_message": "إنشاء مكتبة خارجية لعرض الصور ومقاطع الفيديو الخاصة بك",
   "no_name": "لا اسم",
+  "no_objects": "لا توجد معلومات عن أشياء متاحة",
   "no_places": "لا أماكن",
   "no_results": "لا يوجد نتائج",
   "no_results_description": "جرب كلمة رئيسية مرادفة أو أكثر عمومية",
   "no_shared_albums_message": "قم بإنشاء ألبوم لمشاركة الصور ومقاطع الفيديو مع الأشخاص في شبكتك",
+  "none_selected": "لم يتم التحديد",
   "not_in_any_album": "ليست في أي ألبوم",
   "not_selected": "Not selected",
   "note_apply_storage_label_to_previously_uploaded assets": "ملاحظة: لتطبيق تسمية التخزين على المحتويات التي تم رفعها مسبقًا، قم بتشغيل",
+  "note_unlimited_quota": "ملاحظة: أدخل 0 للحصة غير المحدودة",
   "notes": "ملاحظات",
+  "notification_permission_dialog_cancel": "يلغي",
   "notification_permission_dialog_content": "لتمكين الإخطارات ، انتقل إلى الإعدادات و اختار السماح.",
+  "notification_permission_dialog_settings": "إعدادات",
   "notification_permission_list_tile_content": "منح إذن لتمكين الإخطارات.",
   "notification_permission_list_tile_enable_button": "تمكين الإخطارات",
   "notification_permission_list_tile_title": "إذن الإخطار",
@@ -1285,18 +1424,22 @@
   "other_variables": "متغيرات أخرى",
   "owned": "مملوكة",
   "owner": "المالك",
+  "page_share_add_users": "اضافة مستخدمين",
   "partner": "شريك",
   "partner_can_access": "يستطيع {partner} الوصول",
   "partner_can_access_assets": "جميع الصور ومقاطع الفيديو الخاصة بك باستثناء تلك الموجودة في المؤرشفة والمحذوفة",
   "partner_can_access_location": "الموقع الذي تم التقاط صورك فيه",
   "partner_list_user_photos": "{user}'s photos",
   "partner_list_view_all": "عرض الكل",
+  "partner_page_add_partner": "أضف شريكًا",
   "partner_page_empty_message": "لم يتم مشاركة صورك بعد مع أي شريك.",
   "partner_page_no_more_users": "لا مزيد من المستخدمين لإضافة",
   "partner_page_partner_add_failed": "فشل في إضافة شريك",
   "partner_page_select_partner": "حدد شريكًا",
   "partner_page_shared_to_title": "مشترك ل",
   "partner_page_stop_sharing_content": "{} will no longer be able to access your photos.",
+  "partner_page_stop_sharing_title": "توقف عن مشاركة صورك؟",
+  "partner_page_title": "شريك",
   "partner_sharing": "مشاركة الشركاء",
   "partners": "الشركاء",
   "password": "كلمة المرور",
@@ -1329,12 +1472,21 @@
   "permission_onboarding_continue_anyway": "تواصل على أي حال",
   "permission_onboarding_get_started": "البدء",
   "permission_onboarding_go_to_settings": "اذهب للاعدادات",
+  "permission_onboarding_grant_permission": "يعطي الأذن",
+  "permission_onboarding_log_out": "تسجيل خروج",
   "permission_onboarding_permission_denied": "تم رفض الإذن. لاستخدام التطبيق، قم بمنح أذونات الصور والفيديو في الإعدادات ",
   "permission_onboarding_permission_granted": "تم تأمين التصريح! وضعك تمام.",
   "permission_onboarding_permission_limited": "إذن محدود. للسماح بالنسخ الاحتياطي للتطبيق وإدارة مجموعة المعرض بالكامل، امنح أذونات الصور والفيديو في الإعدادات.",
   "permission_onboarding_request": "يتطلب التطبيق إذنًا لعرض الصور ومقاطع الفيديو الخاصة بك",
   "person": "شخص",
+  "person_add_name_dialog_cancel": "يلغي",
+  "person_add_name_dialog_hint": "اسم",
+  "person_add_name_dialog_save": "يحفظ",
+  "person_add_name_dialog_title": "أضف اسمًا",
+  "person_add_name_subtitle": "ابحث عنهم سريعًا بالاسم مع البحث",
+  "person_add_name_title": "أضف اسمًا",
   "person_birthdate": "تاريخ الميلاد {التاريخ}",
+  "person_edit_name": "تعديل الاسم",
   "person_hidden": "{name}{hidden, select, true { (مخفي)} other {}}",
   "photo_shared_all_users": "يبدو أنك شاركت صورك مع جميع المستخدمين أو ليس لديك أي مستخدم للمشاركة معه.",
   "photos": "الصور",
@@ -1342,9 +1494,6 @@
   "photos_count": "{count, plural, one {{count, number} صورة} other {{count, number} صور}}",
   "photos_from_previous_years": "صور من السنوات السابقة",
   "pick_a_location": "اختر موقعًا",
-  "pin_code_changed_successfully": "تم تغير الرقم السري",
-  "pin_code_reset_successfully": "تم اعادة تعيين الرقم السري",
-  "pin_code_setup_successfully": "تم انشاء رقم سري",
   "place": "مكان",
   "places": "الأماكن",
   "places_count": "{count, plural, one {{count, number} مكان} other {{count, number} أماكن}}",
@@ -1361,21 +1510,27 @@
   "previous_memory": "الذكرى السابقة",
   "previous_or_next_photo": "الصورة السابقة أو التالية",
   "primary": "أساسي",
+  "primary_color_subtitle": "Pick a color for primary actions and accents.",
+  "primary_color_title": "Primary color",
   "privacy": "الخصوصية",
   "profile_drawer_app_logs": "السجلات",
   "profile_drawer_client_out_of_date_major": "تطبيق الهاتف المحمول قديم.يرجى التحديث إلى أحدث إصدار رئيسي.",
   "profile_drawer_client_out_of_date_minor": "تطبيق الهاتف المحمول قديم.يرجى التحديث إلى أحدث إصدار صغير.",
   "profile_drawer_client_server_up_to_date": "العميل والخادم محدثان",
+  "profile_drawer_documentation": "توثيق",
   "profile_drawer_github": "Github",
   "profile_drawer_server_out_of_date_major": "الخادم قديم.يرجى التحديث إلى أحدث إصدار رئيسي.",
   "profile_drawer_server_out_of_date_minor": "الخادم قديم.يرجى التحديث إلى أحدث إصدار صغير.",
+  "profile_drawer_settings": "إعدادات",
+  "profile_drawer_sign_out": "خروج",
+  "profile_drawer_trash": "نفايات",
   "profile_image_of_user": "صورة الملف الشخصي لـ {user}",
   "profile_picture_set": "مجموعة الصور الشخصية.",
   "public_album": "الألبوم العام",
   "public_share": "مشاركة عامة",
   "purchase_account_info": "داعم",
   "purchase_activated_subtitle": "شكرًا لك على دعمك لـ Immich والبرمجيات مفتوحة المصدر",
-  "purchase_activated_time": "تم التفعيل في {date}",
+  "purchase_activated_time": "تم التفعيل في {date, date}",
   "purchase_activated_title": "لقد تم تفعيل مفتاحك بنجاح",
   "purchase_button_activate": "تنشيط",
   "purchase_button_buy": "شراء",
@@ -1418,7 +1573,7 @@
   "recent": "حديث",
   "recent-albums": "ألبومات الحديثة",
   "recent_searches": "عمليات البحث الأخيرة",
-  "recently_added": "Recently added",
+  "recently_added": "أضيف مؤخرا",
   "recently_added_page_title": "أضيف مؤخرا",
   "refresh": "تحديث",
   "refresh_encoded_videos": "تحديث مقاطع الفيديو المشفرة",
@@ -1431,6 +1586,8 @@
   "refreshing_faces": "جاري تحديث الوجوه",
   "refreshing_metadata": "جارٍ تحديث البيانات الوصفية",
   "regenerating_thumbnails": "جارٍ تجديد الصور المصغرة",
+  "remainder": "بقية",
+  "remainder_sub": "الصور ومقاطع الفيديو المتبقية للنسخ الاحتياطي من التحديد",
   "remove": "إزالة",
   "remove_assets_album_confirmation": "هل أنت متأكد أنك تريد إزالة {count, plural, one {# المحتوى} other {# المحتويات}} من الألبوم ؟",
   "remove_assets_shared_link_confirmation": "هل أنت متأكد أنك تريد إزالة {count, plural, one {# المحتوى} other {# المحتويات}} من رابط المشاركة هذا؟",
@@ -1486,8 +1643,10 @@
   "scan_library": "مسح",
   "scan_settings": "إعدادات الفحص",
   "scanning_for_album": "جارٍ الفحص عن ألبوم...",
+  "screenshots": "لقطات الشاشة",
   "search": "البحث",
   "search_albums": "البحث في الألبومات",
+  "search_bar_hint": "ابحث عن صورك",
   "search_by_context": "البحث حسب السياق",
   "search_by_description": "البحث حسب الوصف",
   "search_by_description_example": "يوم المشي لمسافات طويلة في سابا",
@@ -1498,17 +1657,33 @@
   "search_city": "البحث حسب المدينة...",
   "search_country": "البحث حسب الدولة...",
   "search_filter_apply": "اختار الفلتر ",
+  "search_filter_camera": "Camera",
+  "search_filter_camera_make": "صنع",
+  "search_filter_camera_model": "نموذج",
   "search_filter_camera_title": "Select camera type",
+  "search_filter_contextual": "Search by context",
   "search_filter_date": "Date",
   "search_filter_date_interval": "{start} to {end}",
   "search_filter_date_title": "Select a date range",
+  "search_filter_description": "Search by description",
+  "search_filter_display_option_archive": "أرشيف",
+  "search_filter_display_option_favorite": "مفضل",
   "search_filter_display_option_not_in_album": "ليس في الألبوم",
   "search_filter_display_options": "Display Options",
+  "search_filter_display_options_title": "Display options",
   "search_filter_filename": "Search by file name",
   "search_filter_location": "Location",
+  "search_filter_location_city": "مدينة",
+  "search_filter_location_country": "دولة",
+  "search_filter_location_state": "ولاية",
   "search_filter_location_title": "Select location",
   "search_filter_media_type": "Media Type",
+  "search_filter_media_type_all": "الجميع",
+  "search_filter_media_type_image": "صورة",
   "search_filter_media_type_title": "Select media type",
+  "search_filter_media_type_video": "شريط فيديو",
+  "search_filter_people": "People",
+  "search_filter_people_hint": "Filter people",
   "search_filter_people_title": "Select people",
   "search_for": "البحث عن",
   "search_for_existing_person": "البحث عن شخص موجود",
@@ -1518,17 +1693,30 @@
   "search_no_result": "No results found, try a different search term or combination",
   "search_options": "خيارات البحث",
   "search_page_categories": "فئات",
+  "search_page_favorites": "المفضلة",
   "search_page_motion_photos": "الصور المتحركه",
   "search_page_no_objects": "لا توجد معلومات عن أشياء متاحة",
   "search_page_no_places": "لا توجد معلومات متوفرة للأماكن",
+  "search_page_people": "الناس",
+  "search_page_person_add_name_dialog_cancel": "يلغي",
+  "search_page_person_add_name_dialog_hint": "اسم",
+  "search_page_person_add_name_dialog_save": "يحفظ",
+  "search_page_person_add_name_dialog_title": "أضف اسمًا",
+  "search_page_person_add_name_subtitle": "ابحث عنهم سريعًا بالاسم مع البحث",
+  "search_page_person_add_name_title": "أضف اسمًا",
+  "search_page_person_edit_name": "تعديل الاسم",
+  "search_page_places": "أماكن",
+  "search_page_recently_added": "أضيف مؤخرا",
   "search_page_screenshots": "لقطات الشاشة",
   "search_page_search_photos_videos": "Search for your photos and videos",
   "search_page_selfies": " صور ذاتيه",
   "search_page_things": "أشياء",
+  "search_page_videos": "أشرطة فيديو",
   "search_page_view_all_button": "عرض الكل",
   "search_page_your_activity": "نشاطك",
   "search_page_your_map": "خريطتك",
   "search_people": "البحث عن الأشخاص",
+  "search_photos_videos": "Search for your photos and videos",
   "search_places": "البحث عن الأماكن",
   "search_rating": "البحث حسب التقييم...",
   "search_result_page_new_search_hint": "بحث جديد",
@@ -1544,6 +1732,7 @@
   "second": "ثانية",
   "see_all_people": "عرض جميع الأشخاص",
   "select": "إختر",
+  "select_additional_user_for_sharing_page_suggestions": "اقتراحات",
   "select_album_cover": "تحديد غلاف الألبوم",
   "select_all": "تحديد الكل",
   "select_all_duplicates": "تحديد جميع النسخ المكررة",
@@ -1557,16 +1746,21 @@
   "select_photos": "تحديد الصور",
   "select_trash_all": "تحديد حذف الكلِ",
   "select_user_for_sharing_page_err_album": "فشل في إنشاء ألبوم",
+  "select_user_for_sharing_page_share_suggestions": "اقتراحات",
   "selected": "التحديد",
   "selected_count": "{count, plural, other {# محددة }}",
+  "selfies": " صور ذاتيه",
   "send_message": "‏إرسال رسالة",
   "send_welcome_email": "إرسال بريدًا إلكترونيًا ترحيبيًا",
   "server_endpoint": "Server Endpoint",
   "server_info_box_app_version": "نسخة التطبيق",
+  "server_info_box_latest_release": "احدث اصدار",
   "server_info_box_server_url": "عنوان URL الخادم",
+  "server_info_box_server_version": "إصدار الخادم",
   "server_offline": "الخادم غير متصل",
   "server_online": "الخادم متصل",
   "server_stats": "إحصائيات الخادم",
+  "server_storage": "ذاكرة الجهاز",
   "server_version": "إصدار الخادم",
   "set": "‏تحديد",
   "set_as_album_cover": "تحديد كغلاف للألبوم",
@@ -1593,26 +1787,42 @@
   "setting_notifications_single_progress_subtitle": "معلومات التقدم التفصيلية تحميل لكل أصل",
   "setting_notifications_single_progress_title": "إظهار تقدم التفاصيل الاحتياطية الخلفية",
   "setting_notifications_subtitle": "اضبط تفضيلات الإخطار",
+  "setting_notifications_title": "إشعارات",
   "setting_notifications_total_progress_subtitle": "التقدم التحميل العام (تم القيام به/إجمالي الأصول)",
   "setting_notifications_total_progress_title": "إظهار النسخ الاحتياطي الخلفية التقدم المحرز",
+  "setting_pages_app_bar_settings": "إعدادات",
+  "setting_video_viewer_looping_subtitle": "تمكين تكرار مقطع فيديو تلقائيًا في عارض التفاصيل.",
   "setting_video_viewer_looping_title": "تكرار مقطع فيديو تلقائيًا",
   "setting_video_viewer_original_video_subtitle": "When streaming a video from the server, play the original even when a transcode is available. May lead to buffering. Videos available locally are played in original quality regardless of this setting.",
   "setting_video_viewer_original_video_title": "Force original video",
+  "setting_video_viewer_title": "أشرطة فيديو",
   "settings": "الإعدادات",
   "settings_require_restart": "يرجى إعادة تشغيل لتطبيق هذا الإعداد",
   "settings_saved": "تم حفظ الإعدادات",
-  "setup_pin_code": "تحديد رقم سري",
+  "settings_subtitle": "إعدادات تخطيط شبكة الصور",
+  "settings_title": "شبكة الصور",
   "share": "مشاركة",
+  "share_add": "يضيف",
   "share_add_photos": "إضافة الصور",
+  "share_add_title": "إضافة عنوان",
   "share_assets_selected": "{} selected",
+  "share_create_album": "إنشاء ألبوم",
   "share_dialog_preparing": "تحضير...",
+  "share_done": "منتهي",
+  "share_invite": "دعوة إلى الألبوم",
+  "share_link": "Share Link",
+  "share_to": "مشاركة إلى",
   "shared": "مُشتَرك",
   "shared_album_activities_input_disable": "التعليق معطل",
+  "shared_album_activities_input_hint": "قل شيئا",
   "shared_album_activity_remove_content": "هل تريد حذف هذا النشاط؟",
   "shared_album_activity_remove_title": "حذف النشاط",
+  "shared_album_activity_setting_subtitle": "دع الآخرين يستجيبون",
+  "shared_album_activity_setting_title": "التعليقات والأحب",
   "shared_album_section_people_action_error": "خطأ ترك/إزالة من الألبوم",
   "shared_album_section_people_action_leave": "إزالة المستخدم من الألبوم",
   "shared_album_section_people_action_remove_user": "إزالة المستخدم من الألبوم",
+  "shared_album_section_people_owner_label": "مالك",
   "shared_album_section_people_title": "الناس",
   "shared_by": "تمت مشاركته بواسطة",
   "shared_by_user": "تمت المشاركة بواسطة {user}",
@@ -1622,8 +1832,17 @@
   "shared_link_app_bar_title": "روابط مشتركة",
   "shared_link_clipboard_copied_massage": "نسخ إلى الحافظة",
   "shared_link_clipboard_text": "Link: {}\nPassword: {}",
+  "shared_link_create_app_bar_title": "إنشاء رابط للمشاركة",
   "shared_link_create_error": "خطأ أثناء إنشاء رابط مشترك",
+  "shared_link_create_info": "دع أي شخص لديه الرابط يرى الصور المحددة)",
+  "shared_link_create_submit_button": "إنشاء رابط",
+  "shared_link_edit_allow_download": "السماح للمستخدم العام بالتنزيل",
+  "shared_link_edit_allow_upload": "السماح للمستخدم العام بالتحميل",
+  "shared_link_edit_app_bar_title": "تغيير الرابط",
+  "shared_link_edit_change_expiry": "تغيير وقت انتهاء الصلاحية",
+  "shared_link_edit_description": "وصف",
   "shared_link_edit_description_hint": "أدخل وصف المشاركة",
+  "shared_link_edit_expire_after": "تنتهي بعد",
   "shared_link_edit_expire_after_option_day": "يوم 1",
   "shared_link_edit_expire_after_option_days": "{} days",
   "shared_link_edit_expire_after_option_hour": "1 ساعة",
@@ -1631,10 +1850,15 @@
   "shared_link_edit_expire_after_option_minute": "1 دقيقة",
   "shared_link_edit_expire_after_option_minutes": "{} minutes",
   "shared_link_edit_expire_after_option_months": "{} months",
+  "shared_link_edit_expire_after_option_never": "أبداً",
   "shared_link_edit_expire_after_option_year": "{} year",
+  "shared_link_edit_password": "كلمة المرور",
   "shared_link_edit_password_hint": "أدخل كلمة مرور المشاركة",
+  "shared_link_edit_show_meta": "عرض البيانات الوصفية",
   "shared_link_edit_submit_button": "تحديث الرابط",
+  "shared_link_empty": "ليس لديك أي روابط مشتركة",
   "shared_link_error_server_url_fetch": "لا يمكن جلب عنوان الخادم",
+  "shared_link_expired": "منتهي الصلاحية",
   "shared_link_expires_day": "Expires in {} day",
   "shared_link_expires_days": "Expires in {} days",
   "shared_link_expires_hour": "Expires in {} hour",
@@ -1645,9 +1869,12 @@
   "shared_link_expires_second": "Expires in {} second",
   "shared_link_expires_seconds": "Expires in {} seconds",
   "shared_link_individual_shared": "Individual shared",
+  "shared_link_info_chip_download": "تحميل",
   "shared_link_info_chip_metadata": "EXIF",
+  "shared_link_info_chip_upload": "رفع",
   "shared_link_manage_links": "إدارة الروابط المشتركة",
   "shared_link_options": "خيارات الرابط المشترك",
+  "shared_link_public_album": "الألبوم العام",
   "shared_links": "روابط مشتركة",
   "shared_links_description": "وصف الروابط المشتركة",
   "shared_photos_and_videos_count": "{assetCount, plural, other {# الصور ومقاطع الفيديو المُشارَكة.}}",
@@ -1661,6 +1888,7 @@
   "sharing_sidebar_description": "اعرض رابطًا للمشاركة في الشريط الجانبي",
   "sharing_silver_appbar_create_shared_album": "ألبوم مشترك جديد",
   "sharing_silver_appbar_share_partner": "شارك مع الشريك",
+  "sharing_silver_appbar_shared_links": "روابط مشتركة",
   "shift_to_permanent_delete": "اضغط على ⇧ لحذف المحتوى نهائيًا",
   "show_album_options": "إظهار خيارات الألبوم",
   "show_albums": "إظهار الألبومات",
@@ -1709,17 +1937,28 @@
   "stacked_assets_count": "تم تكديس {count, plural, one {# المحتوى} other {# المحتويات}}",
   "stacktrace": "تتّبُع التكديس",
   "start": "ابدأ",
+  "start_backup": "بدء النسخ الاحتياطي",
   "start_date": "تاريخ البدء",
   "state": "الولاية",
+  "statistics_album": "مكتبه الصور المصغره",
+  "statistics_assets": "{} assets ({})",
+  "statistics_full": "صور كاملة",
+  "statistics_shared": "صورة ألبوم مشتركة",
+  "statistics_thumbnail": "الصورة المصغرة",
+  "statistics_title": "استخدام ذاكرة التخزين المؤقت",
   "status": "الحالة",
+  "status_off": "النسخة الاحتياطية التلقائية غير فعالة",
+  "status_on": "النسخة الاحتياطية التلقائية فعالة",
   "stop_motion_photo": "إيقاف حركة الصورة",
   "stop_photo_sharing": "توقف عن مشاركة صورك؟",
   "stop_photo_sharing_description": "لن يتمكن {partner} من الوصول إلى صورك بعد الآن.",
   "stop_sharing_photos_with_user": "توقف عن مشاركة صورك مع هذا المستخدم",
   "storage": "مساحة التخزين",
+  "storage_format": "{} of {} used",
   "storage_label": "تسمية التخزين",
   "storage_usage": "{used} من {available} مُستخْدم",
   "submit": "إرسال",
+  "subtitle": "تحكم في سلوك التخزين المؤقت لتطبيق الجوال.",
   "suggestions": "اقتراحات",
   "sunrise_on_the_beach": "شروق الشمس على الشاطئ",
   "support": "الدعم",
@@ -1730,6 +1969,12 @@
   "sync_albums": "Sync albums",
   "sync_albums_manual_subtitle": "Sync all uploaded videos and photos to the selected backup albums",
   "sync_upload_album_setting_subtitle": "Create and upload your photos and videos to the selected albums on Immich",
+  "system_primary_color_title": "Use system color",
+  "system_theme_switch": "تلقائي (اتبع إعداد النظام)",
+  "tab_controller_nav_library": "مكتبة",
+  "tab_controller_nav_photos": "الصور",
+  "tab_controller_nav_search": "يبحث",
+  "tab_controller_nav_sharing": "مشاركة",
   "tag": "العلامة",
   "tag_assets": "أصول العلامة",
   "tag_created": "تم إنشاء العلامة: {tag}",
@@ -1747,6 +1992,7 @@
   "theme_setting_asset_list_tiles_per_row_title": "Number of assets per row ({})",
   "theme_setting_colorful_interface_subtitle": "Apply primary color to background surfaces.",
   "theme_setting_colorful_interface_title": "Colorful interface",
+  "theme_setting_dark_mode_switch": "الوضع المظلم",
   "theme_setting_image_viewer_quality_subtitle": "اضبط جودة عارض الصورة التفصيلية",
   "theme_setting_image_viewer_quality_title": "جودة عارض الصورة",
   "theme_setting_primary_color_subtitle": "Pick a color for primary actions and accents.",
@@ -1754,14 +2000,25 @@
   "theme_setting_system_primary_color_title": "Use system color",
   "theme_setting_system_theme_switch": "تلقائي (اتبع إعداد النظام)",
   "theme_setting_theme_subtitle": "اختر إعدادات مظهر التطبيق",
+  "theme_setting_theme_title": "مظهر",
   "theme_setting_three_stage_loading_subtitle": "قد يزيد التحميل من ثلاث مراحل من أداء التحميل ولكنه يسبب تحميل شبكة أعلى بكثير",
   "theme_setting_three_stage_loading_title": "تمكين تحميل ثلاث مراحل",
+  "theme_subtitle": "اختر إعدادات مظهر التطبيق",
+  "theme_title": "مظهر",
   "they_will_be_merged_together": "سيتم دمجهم معًا",
+  "things": "أشياء",
   "third_party_resources": "موارد الطرف الثالث",
+  "three_stage_loading_subtitle": "قد يزيد التحميل من ثلاث مراحل من أداء التحميل ولكنه يسبب تحميل شبكة أعلى بكثير",
+  "three_stage_loading_title": "تمكين تحميل ثلاث مراحل",
+  "thumbnail_size": "Thumbnail cache size ({} assets)",
+  "tile_subtitle": "التحكم في سلوك التخزين المحلي",
+  "tile_title": "التخزين المحلي",
   "time_based_memories": "ذكريات استنادًا للوقت",
   "timeline": "الخط الزمني",
   "timezone": "المنطقة الزمنية",
+  "title": "إعدادات التخزين المؤقت",
   "to_archive": "أرشفة",
+  "to_backup": "الألبومات  الاحتياطية",
   "to_change_password": "تغيير كلمة المرور",
   "to_favorite": "تفضيل",
   "to_login": "تسجيل الدخول",
@@ -1770,24 +2027,32 @@
   "toggle_settings": "الإعدادات",
   "toggle_theme": "تبديل المظهر الداكن",
   "total": "الإجمالي",
+  "total_sub": "جميع الصور ومقاطع الفيديو الفريدة من ألبومات مختارة",
   "total_usage": "الاستخدام الإجمالي",
+  "translated_text_options": "خيارات",
   "trash": "المهملات",
   "trash_all": "نقل الكل إلى سلة المهملات",
   "trash_count": "سلة المحملات {count, number}",
   "trash_delete_asset": "حذف/نقل المحتوى إلى سلة المهملات",
   "trash_emptied": "Emptied trash",
+  "trash_from_immich": "حذفه ونقله في سله المهملات",
   "trash_no_results_message": "ستظهر هنا الصور ومقاطع الفيديو المحذوفة.",
+  "trash_page_delete": "مسح",
   "trash_page_delete_all": "حذف الكل",
+  "trash_page_empty_trash_btn": "افرغ سله المهملات ",
   "trash_page_empty_trash_dialog_content": "هل تريد تفريغ أصولك المهملة؟ ستتم إزالة هذه العناصر نهائيًا من التطبيق",
+  "trash_page_empty_trash_dialog_ok": "نعم",
   "trash_page_info": "Trashed items will be permanently deleted after {} days",
   "trash_page_no_assets": "لا توجد اصول في سله المهملات",
+  "trash_page_restore": "الترجيع من سله المهملات",
   "trash_page_restore_all": "استعادة الكل",
   "trash_page_select_assets_btn": "اختر الأصول ",
+  "trash_page_select_btn": "يختار",
   "trash_page_title": "Trash ({})",
   "trashed_items_will_be_permanently_deleted_after": "سيتم حذفُ العناصر المحذوفة نِهائيًا بعد {days, plural, one {# يوم} other {# أيام }}.",
+  "turn_off": "قم بإيقاف تشغيل النسخ الاحتياطي المقدمة",
+  "turn_on": "قم بتشغيل النسخ الاحتياطي المقدمة",
   "type": "النوع",
-  "unable_to_change_pin_code": "تفيير الرقم السري غير ممكن",
-  "unable_to_setup_pin_code": "انشاء الرقم السري غير ممكن",
   "unarchive": "أخرج من الأرشيف",
   "unarchived_count": "{count, plural, other {غير مؤرشفة #}}",
   "unfavorite": "أزل التفضيل",
@@ -1811,10 +2076,13 @@
   "untracked_files": "الملفات التي لم يتم تعقبها",
   "untracked_files_decription": "لا يتم تعقب هذه الملفات بواسطة التطبيق. يمكن أن تكون نتيجةً لعمليات نقل فاشلة، أو عمليات رفع متقطعة، أو يتم تركها في الخلف بسبب خللاً ما",
   "up_next": "التالي",
+  "update": "تحديث",
   "updated_password": "تم تحديث كلمة المرور",
   "upload": "رفع",
   "upload_concurrency": "الرفع المتزامن",
+  "upload_dialog_cancel": "يلغي",
   "upload_dialog_info": "هل تريد النسخ الاحتياطي للأصول (الأصول) المحددة إلى الخادم؟",
+  "upload_dialog_ok": "رفع",
   "upload_dialog_title": "تحميل الأصول",
   "upload_errors": "إكتمل الرفع مع {count, plural, one {# خطأ} other {# أخطاء}}, قم بتحديث الصفحة لرؤية المحتويات الجديدة التي تم رفعها.",
   "upload_progress": "متبقية {remaining, number} - معالجة {processed, number}/{total, number}",
@@ -1825,6 +2093,7 @@
   "upload_success": "تم الرفع بنجاح، قم بتحديث الصفحة لرؤية المحتويات المرفوعة الجديدة.",
   "upload_to_immich": "Upload to Immich ({})",
   "uploading": "Uploading",
+  "uploading_file_info": "تحميل معلومات الملف",
   "url": "عنوان URL",
   "usage": "الاستخدام",
   "use_current_connection": "use current connection",
@@ -1832,8 +2101,6 @@
   "user": "مستخدم",
   "user_id": "معرف المستخدم",
   "user_liked": "قام {user} بالإعجاب {type, select, photo {بهذه الصورة} video {بهذا الفيديو} asset {بهذا المحتوى} other {بها}}",
-  "user_pin_code_settings": "الرقم السري",
-  "user_pin_code_settings_description": "تغير الرقم السري",
   "user_purchase_settings": "الشراء",
   "user_purchase_settings_description": "إدارة عملية الشراء الخاصة بك",
   "user_role_set": "قم بتعيين {user} كـ {role}",
@@ -1849,6 +2116,7 @@
   "version": "الإصدار",
   "version_announcement_closing": "صديقك، أليكس",
   "version_announcement_message": "مرحبًا! يتوفر إصدار جديد من Immich. يُرجى تخصيص بعض الوقت لقراءة <link>ملاحظات الإصدار</link> للتأكد من تحديث إعداداتك لمنع أي أخطاء في التكوين، خاصة إذا كنت تستخدم WatchTower أو أي آلية تتولى تحديث مثيل Immich الخاص بك تلقائيًا.",
+  "version_announcement_overlay_ack": "يُقرّ",
   "version_announcement_overlay_release_notes": "ملاحظات الإصدار",
   "version_announcement_overlay_text_1": "مرحبًا يا صديقي ، هناك إصدار جديد",
   "version_announcement_overlay_text_2": "من فضلك خذ وقتك لزيارة",
@@ -1864,6 +2132,7 @@
   "view": "عرض",
   "view_album": "عرض الألبوم",
   "view_all": "عرض الكل",
+  "view_all_button": "عرض الكل",
   "view_all_users": "عرض كافة المستخدمين",
   "view_in_timeline": "عرض في الجدول الزمني",
   "view_link": "عرض الرابط",
@@ -1886,6 +2155,8 @@
   "years_ago": "منذ {years, plural, one {# سنة} other {# سنوات}}",
   "yes": "نعم",
   "you_dont_have_any_shared_links": "ليس لديك أي روابط مشتركة",
+  "your_activity": "نشاطك",
+  "your_map": "خريطتك",
   "your_wifi_name": "Your WiFi name",
   "zoom_image": "تكبير الصورة"
-}
+}

i18n/be.json

@@ -4,7 +4,6 @@
   "account_settings": "Налады ўліковага запісу",
   "acknowledge": "Пацвердзіць",
   "action": "Дзеянне",
-  "action_common_update": "Абнавіць",
   "actions": "Дзеянні",
   "active": "Актыўны",
   "activity": "Актыўнасць",
@@ -14,7 +13,6 @@
   "add_a_location": "Дадаць месца",
   "add_a_name": "Дадаць імя",
   "add_a_title": "Дадаць загаловак",
-  "add_endpoint": "Дадаць кропку доступу",
   "add_exclusion_pattern": "Дадаць шаблон выключэння",
   "add_import_path": "Дадаць шлях імпарту",
   "add_location": "Дадайце месца",
@@ -22,10 +20,8 @@
   "add_partner": "Дадаць партнёра",
   "add_path": "Дадаць шлях",
   "add_photos": "Дадаць фота",
-  "add_to": "Дадаць у…",
+  "add_to": "Дадаць у...",
   "add_to_album": "Дадаць у альбом",
-  "add_to_album_bottom_sheet_added": "Дададзена да {album}",
-  "add_to_album_bottom_sheet_already_exists": "Ужо знаходзіцца ў {album}",
   "add_to_shared_album": "Дадаць у агульны альбом",
   "add_url": "Дадаць URL",
   "added_to_archive": "Дададзена ў архіў",
@@ -43,9 +39,8 @@
     "backup_database_enable_description": "Уключыць рэзерваванне базы даных",
     "backup_keep_last_amount": "Колькасць папярэдніх рэзервовых копій для захавання",
     "backup_settings": "Налады рэзервовага капіявання",
-    "backup_settings_description": "Кіраванне наладамі дампа базы дадзеных. Заўвага: гэтыя задачы не кантралююцца, і ў выпадку няўдачы паведамленне адпраўлена не будзе.",
+    "backup_settings_description": "Кіраванне наладкамі рэзервовага капіявання базы даных",
     "check_all": "Праверыць усе",
-    "cleanup": "Ачыстка",
     "cleared_jobs": "Ачышчаны заданні для: {job}",
     "config_set_by_file": "Канфігурацыя ў зараз усталявана праз файл канфігурацыі",
     "confirm_delete_library": "Вы ўпэўнены што жадаеце выдаліць {library} бібліятэку?",
@@ -63,18 +58,8 @@
     "external_library_created_at": "Знешняя бібліятэка (створана {date})",
     "external_library_management": "Кіраванне знешняй бібліятэкай",
     "face_detection": "Выяўленне твараў",
-    "face_detection_description": "Выяўляць твары на фотаздымках і відэа з дапамогай машыннага навучання. Для відэа ўлічваецца толькі мініяцюра. \"Абнавіць\" (пера)апрацоўвае ўсе медыя. \"Скінуць\" дадаткова ачышчае ўсе бягучыя дадзеныя пра твары. \"Адсутнічае\" ставіць у чаргу медыя, якія яшчэ не былі апрацаваныя. Выяўленыя твары будуць пастаўлены ў чаргу для распазнавання асоб пасля завяршэння выяўлення твараў, з групаваннем іх па існуючых або новых людзях.",
-    "facial_recognition_job_description": "Групаваць выяўленыя твары па асобах. Гэты этап выконваецца пасля завяршэння выяўлення твараў. \"Скінуць\" (паўторна) перагрупоўвае ўсе твары. \"Адсутнічае\" ставіць у чаргу твары, якія яшчэ не прыпісаныя да якой-небудзь асобы.",
-    "failed_job_command": "Каманда {command} не выканалася для задання: {job}",
     "force_delete_user_warning": "ПАПЯРЭДЖАННЕ: Гэта дзеянне неадкладна выдаліць карыстальніка і ўсе аб'екты. Гэта дзеянне не можа быць адроблена і файлы немагчыма будзе аднавіць.",
-    "forcing_refresh_library_files": "Прымусовае абнаўленне ўсіх файлаў бібліятэкі",
     "image_format": "Фармат",
-    "image_format_description": "WebP стварае меншыя файлы, чым JPEG, але павольней кадуе.",
-    "image_fullsize_description": "Выява ў поўным памеры без метаданых, выкарыстоўваецца пры павелічэнні",
-    "image_fullsize_enabled": "Уключыць стварэнне выявы ў поўным памеры",
-    "image_fullsize_enabled_description": "Ствараць выяву ў поўным памеры для фарматаў, што не прыдатныя для вэб. Калі ўключана опцыя \"Аддаваць перавагу ўбудаванай праяве\", прагляды выкарыстоўваюцца непасрэдна без канвертацыі. Не ўплывае на вэб-прыдатныя фарматы, такія як JPEG.",
-    "image_fullsize_quality_description": "Якасць выявы ў поўным памеры ад 1 да 100. Больш высокае значэнне лепшае, але прыводзіць да павелічэння памеру файла.",
-    "image_fullsize_title": "Налады выявы ў поўным памеры",
     "image_preview_title": "Налады папярэдняга прагляду",
     "image_quality": "Якасць",
     "image_resolution": "Раздзяляльнасць",

i18n/bg.json

@@ -162,6 +162,7 @@
     "no_pattern_added": "Няма добавен модел",
     "note_apply_storage_label_previous_assets": "Забележка: За да приложите етикета за съхранение към предварително качени файлове, стартирайте",
     "note_cannot_be_changed_later": "ВНИМАНИЕ: Това не може да бъде променено по-късно!",
+    "note_unlimited_quota": "Бележка: Въведете 0 за да нямате лимит на квотата",
     "notification_email_from_address": "От адрес",
     "notification_email_from_address_description": "Електронна поща на изпращача, например: \"Immich Photo Server <noreply@example.com>\"",
     "notification_email_host_description": "Хост на сървъра за електронна поща (например: smtp.immich.app)",
@@ -183,13 +184,20 @@
     "oauth_auto_register": "Автоматична регистрация",
     "oauth_auto_register_description": "Автоматично регистриране на нови потребители след влизане с OAuth",
     "oauth_button_text": "Текст на бутона",
+    "oauth_client_id": "Клиентски ID",
+    "oauth_client_secret": "Клиентска тайна",
     "oauth_enable_description": "Влизане с OAuth",
+    "oauth_issuer_url": "URL на издателя",
     "oauth_mobile_redirect_uri": "URI за мобилно пренасочване",
     "oauth_mobile_redirect_uri_override": "URI пренасочване за мобилни устройства",
     "oauth_mobile_redirect_uri_override_description": "Разреши когато доставчика за OAuth удостоверяване не позволява за мобилни URI идентификатори, като '{callback}'",
+    "oauth_profile_signing_algorithm": "Алгоритъм за създаване на профили",
+    "oauth_profile_signing_algorithm_description": "Алгоритъм използван за вписване на потребителски профил.",
+    "oauth_scope": "Област/обхват на приложение",
     "oauth_settings": "OAuth",
     "oauth_settings_description": "Управление на настройките за вход с OAuth",
     "oauth_settings_more_details": "За повече информация за функционалността, се потърсете в <link>docs</link>.",
+    "oauth_signing_algorithm": "Алгоритъм за вписване",
     "oauth_storage_label_claim": "Заявка за етикет за съхранение",
     "oauth_storage_label_claim_description": "Автоматично задайте етикета за съхранение на потребителя със стойността от тази заявка.",
     "oauth_storage_quota_claim": "Заявка за квота за съхранение",
@@ -915,6 +923,7 @@
   "no_shared_albums_message": "Създайте албум, за да споделяте снимки и видеоклипове с хората в мрежата си",
   "not_in_any_album": "Не е в никой албум",
   "note_apply_storage_label_to_previously_uploaded assets": "Забележка: За да приложите етикета за съхранение към предварително качени активи, стартирайте",
+  "note_unlimited_quota": "Забележка: Въведете 0 за неограничена квота",
   "notes": "Бележки",
   "notification_toggle_setting_description": "Активиране на имейл известия",
   "notifications": "Известия",
@@ -1006,7 +1015,7 @@
   "public_share": "Публично споделяне",
   "purchase_account_info": "Поддръжник",
   "purchase_activated_subtitle": "Благодарим ви, че подкрепяте Immich и софтуера с отворен код",
-  "purchase_activated_time": "Активиран на {date}",
+  "purchase_activated_time": "Активиран на {date, date}",
   "purchase_activated_title": "Вашият ключ беше успешно активиран",
   "purchase_button_activate": "Активирай",
   "purchase_button_buy": "Купи",

i18n/bi.json

@@ -118,6 +118,7 @@
     "no_pattern_added": "",
     "note_apply_storage_label_previous_assets": "",
     "note_cannot_be_changed_later": "",
+    "note_unlimited_quota": "",
     "notification_email_from_address": "",
     "notification_email_from_address_description": "",
     "notification_email_host_description": "",
@@ -138,12 +139,17 @@
     "oauth_auto_register": "",
     "oauth_auto_register_description": "",
     "oauth_button_text": "",
+    "oauth_client_id": "",
+    "oauth_client_secret": "",
     "oauth_enable_description": "",
+    "oauth_issuer_url": "",
     "oauth_mobile_redirect_uri": "",
     "oauth_mobile_redirect_uri_override": "",
     "oauth_mobile_redirect_uri_override_description": "",
+    "oauth_scope": "",
     "oauth_settings": "",
     "oauth_settings_description": "",
+    "oauth_signing_algorithm": "",
     "oauth_storage_label_claim": "",
     "oauth_storage_label_claim_description": "",
     "oauth_storage_quota_claim": "",
@@ -608,6 +614,7 @@
   "no_shared_albums_message": "",
   "not_in_any_album": "",
   "note_apply_storage_label_to_previously_uploaded assets": "",
+  "note_unlimited_quota": "",
   "notes": "",
   "notification_toggle_setting_description": "",
   "notifications": "",

i18n/bn.json

@@ -1,17 +1 @@
-{
-  "about": "সম্পর্কে",
-  "account": "অ্যাকাউন্ট",
-  "account_settings": "অ্যাকাউন্ট সেটিংস",
-  "acknowledge": "স্বীকৃতি",
-  "action": "কার্য",
-  "action_common_update": "আপডেট",
-  "actions": "কর্ম",
-  "active": "সচল",
-  "activity": "কার্যকলাপ",
-  "add": "যোগ করুন",
-  "add_a_description": "একটি বিবরণ যোগ করুন",
-  "add_a_location": "একটি অবস্থান যোগ করুন",
-  "add_a_name": "একটি নাম যোগ করুন",
-  "add_a_title": "একটি শিরোনাম যোগ করুন",
-  "add_endpoint": "এন্ডপয়েন্ট যোগ করুন"
-}
+{}