chore: more dart lints (#30665)

The lints are regrouped and sorted. Also, added the following new lints:
- unnecessary_ignore
- parameter_assignments
- avoid_unused_constructor_parameters
- tighten_type_of_initializing_formals
- only_throw_errors
- deprecated_consistency
- unnecessary_statements

Co-authored-by: shenlong-tanwen <139912620+shalong-tanwen@users.noreply.github.com>

.devcontainer/devcontainer.json

@@ -83,7 +83,7 @@
     }
   },
   "features": {
-    "ghcr.io/devcontainers/features/docker-in-docker:2": {
+    "ghcr.io/devcontainers/features/docker-in-docker:4": {
       // https://github.com/devcontainers/features/issues/1466
       "moby": false
     }

.gitattributes

@@ -1,29 +1,15 @@
-mobile/openapi/**/*.md -diff -merge
-mobile/openapi/**/*.md linguist-generated=true
-mobile/openapi/**/*.dart -diff -merge
-mobile/openapi/**/*.dart linguist-generated=true
-
-mobile/lib/**/*.g.dart -diff -merge
-mobile/lib/**/*.g.dart linguist-generated=true
-
 mobile/android/**/*.g.kt -diff -merge
 mobile/android/**/*.g.kt linguist-generated=true
 
 mobile/ios/**/*.g.swift -diff -merge
 mobile/ios/**/*.g.swift linguist-generated=true
 
-mobile/lib/**/*.drift.dart -diff -merge
-mobile/lib/**/*.drift.dart linguist-generated=true
-
 mobile/drift_schemas/main/drift_schema_*.json -diff -merge
 mobile/drift_schemas/main/drift_schema_*.json linguist-generated=true
 
 mobile/lib/infrastructure/repositories/db.repository.steps.dart -diff -merge
 mobile/lib/infrastructure/repositories/db.repository.steps.dart linguist-generated=true
 
-mobile/test/drift/main/generated/** -diff -merge
-mobile/test/drift/main/generated/** linguist-generated=true
-
 packages/sdk/fetch-client.ts -diff -merge
 packages/sdk/fetch-client.ts linguist-generated=true
 

.github/workflows/auto-close.yml

@@ -15,7 +15,7 @@ jobs:
     outputs:
       uses_template: ${{ steps.check.outputs.uses_template }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           sparse-checkout: .github/pull_request_template.md
           sparse-checkout-cone-mode: false

.github/workflows/build-mobile.yml

@@ -12,6 +12,10 @@ on:
         default: 'development'
         type: string
     secrets:
+      PUSH_O_MATIC_APP_CLIENT_ID:
+        required: true
+      PUSH_O_MATIC_APP_KEY:
+        required: true
       KEY_JKS:
         required: true
       ALIAS:
@@ -51,14 +55,15 @@ jobs:
       should_run: ${{ steps.check.outputs.should_run }}
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: read
 
       - name: Check what should run
         id: check
-        uses: immich-app/devtools/actions/pre-job@91f342bb4477c4bc10c576ae739da875d85aa164 # pre-job-action-v2.0.4
+        uses: immich-app/devtools/actions/pre-job@03514eceb4a27cd714976a866b350df5ce175720 # pre-job-action-v2.1.0
         with:
           github-token: ${{ steps.token.outputs.token }}
           filters: |
@@ -79,19 +84,21 @@ jobs:
 
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: read
+          permission-pull-requests: write
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.ref }}
           persist-credentials: false
           token: ${{ steps.token.outputs.token }}
 
       - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@3bca63ca3c15020293b36b51737a3ee2c773340b # use-mise-action-v3.1.0
+        uses: immich-app/devtools/actions/use-mise@06a9ef925332c91be647d6256642b86b398592c8 # use-mise-action-v3.2.1
         with:
           github_token: ${{ steps.token.outputs.token }}
           working_directory: ./mobile
@@ -103,14 +110,14 @@ jobs:
         working-directory: ./mobile
         run: printf "%s" $KEY_JKS | base64 -d > android/key.jks
 
-      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           distribution: 'zulu'
           java-version: '17'
 
       - name: Restore Gradle Cache
         id: cache-gradle-restore
-        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.gradle/caches
@@ -124,16 +131,11 @@ jobs:
         with:
           packages: ''
 
-      - name: Get Packages
-        working-directory: ./mobile
-        run: flutter pub get
+      - name: Install dependencies
+        run: mise //mobile:install:ci
 
-      - name: Generate translation file
-        run: mise //mobile:codegen:translation
-
-      - name: Generate platform APIs
-        run: mise //mobile:codegen:pigeon
-        working-directory: ./mobile
+      - name: Perform codegen
+        run: mise //mobile:codegen
 
       - name: Build Android App Bundle
         working-directory: ./mobile
@@ -181,7 +183,7 @@ jobs:
 
       - name: Save Gradle Cache
         id: cache-gradle-save
-        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         if: github.ref == 'refs/heads/main'
         with:
           path: |
@@ -198,55 +200,47 @@ jobs:
       contents: read
     # Run on main branch or workflow_dispatch, or on PRs/other branches (build only, no upload)
     if: ${{ !github.event.pull_request.head.repo.fork && fromJSON(needs.pre-job.outputs.should_run).mobile == true }}
-    runs-on: macos-15
+    runs-on: macos-26
 
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: read
 
       - name: Select Xcode 26
         run: sudo xcode-select -s /Applications/Xcode_26.2.app/Contents/Developer
 
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.ref || github.sha }}
           persist-credentials: false
 
       - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@3bca63ca3c15020293b36b51737a3ee2c773340b # use-mise-action-v3.1.0
+        uses: immich-app/devtools/actions/use-mise@06a9ef925332c91be647d6256642b86b398592c8 # use-mise-action-v3.2.1
         with:
           github_token: ${{ steps.token.outputs.token }}
           working_directory: ./mobile
 
-      - name: Install Flutter dependencies
-        working-directory: ./mobile
-        run: flutter pub get
-
-      - name: Generate translation files
-        run: mise //mobile:codegen:translation
-
-      - name: Generate platform APIs
-        run: mise //mobile:codegen:pigeon
-
-      - name: Resolve iOS Swift Packages
-        working-directory: ./mobile
-        run: flutter build ios --config-only --no-codesign
-
       - name: Setup Ruby
-        uses: ruby/setup-ruby@89f90524b88a01fe6e0b732220432cc6142926af # v1.313.0
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: '3.3'
           bundler-cache: true
           working-directory: ./mobile/ios
 
-      - name: Install CocoaPods dependencies
-        working-directory: ./mobile/ios
-        run: |
-          pod install
+      - name: Install dependencies
+        run: mise //mobile:install:ci
+
+      - name: Perform codegen
+        run: mise //mobile:codegen
+
+      - name: Resolve iOS Swift Packages
+        working-directory: ./mobile
+        run: flutter build ios --config-only --no-codesign
 
       - name: Create API Key
         env:

.github/workflows/cache-cleanup.yml

@@ -19,13 +19,15 @@ jobs:
       actions: write
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: read
+          permission-actions: write
 
       - name: Check out code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           token: ${{ steps.token.outputs.token }}

.github/workflows/check-openapi.yml

@@ -20,16 +20,17 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Check for breaking API changes
-        uses: oasdiff/oasdiff-action/breaking@3530478ec30f84adedbfeb28f0d9527a290f50a9 # v0.0.57
+        uses: oasdiff/oasdiff-action/breaking@b7c3adeb54330db1903d27c61db520e5661ad55b # v0.1.11
         with:
           base: https://raw.githubusercontent.com/${{ github.repository }}/main/open-api/immich-openapi-specs.json
           revision: open-api/immich-openapi-specs.json
           fail-on: ERR
+          review: false
 
   check-mobile-patches:
     runs-on: ubuntu-latest
@@ -37,19 +38,18 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@3bca63ca3c15020293b36b51737a3ee2c773340b # use-mise-action-v3.1.0
+        uses: immich-app/devtools/actions/use-mise@06a9ef925332c91be647d6256642b86b398592c8 # use-mise-action-v3.2.1
         with:
           github_token: ${{ github.token }}
           working_directory: ./mobile
 
-      - name: Get packages
-        working-directory: ./mobile
-        run: flutter pub get
+      - name: Install dependencies
+        run: mise //mobile:install:ci
 
       - name: Fetch base spec from main
         run: |

.github/workflows/cli.yml

@@ -31,19 +31,20 @@ jobs:
         working-directory: ./packages/cli
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: read
 
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           token: ${{ steps.token.outputs.token }}
 
       - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@3bca63ca3c15020293b36b51737a3ee2c773340b # use-mise-action-v3.1.0
+        uses: immich-app/devtools/actions/use-mise@06a9ef925332c91be647d6256642b86b398592c8 # use-mise-action-v3.2.1
         with:
           github_token: ${{ steps.token.outputs.token }}
 
@@ -63,25 +64,26 @@ jobs:
 
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: read
 
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           token: ${{ steps.token.outputs.token }}
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         if: ${{ !github.event.pull_request.head.repo.fork }}
         with:
           registry: ghcr.io
@@ -96,7 +98,7 @@ jobs:
 
       - name: Generate docker image tags
         id: metadata
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           flavor: |
             latest=false
@@ -107,7 +109,7 @@ jobs:
             type=raw,value=latest,enable=${{ github.event_name == 'release' && !github.event.release.prerelease }}
 
       - name: Build and push image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           file: packages/cli/Dockerfile
           platforms: linux/amd64,linux/arm64

.github/workflows/close-duplicates.yml

@@ -39,7 +39,7 @@ jobs:
     needs: [get_body, should_run]
     if: ${{ needs.should_run.outputs.should_run == 'true' }}
     container:
-      image: ghcr.io/immich-app/mdq:main@sha256:2a64c7f045cb7b580fbdf3614d7d1805f5775fec453e3d1023764180efa8c70b
+      image: ghcr.io/immich-app/mdq:main@sha256:74b93dfbf13f8ee73eb35d8d5195ff667f93f9bc55df5ae453dd43a461c821fa
     outputs:
       checked: ${{ steps.get_checkbox.outputs.checked }}
     steps:

.github/workflows/codeql-analysis.yml

@@ -44,20 +44,21 @@ jobs:
 
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: read
 
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           token: ${{ steps.token.outputs.token }}
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -70,7 +71,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/autobuild@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -83,6 +84,6 @@ jobs:
       #   ./location_of_script_within_repo/buildscript.sh
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           category: '/language:${{matrix.language}}'

.github/workflows/docker.yml

@@ -14,6 +14,10 @@ concurrency:
 
 permissions: {}
 
+env:
+  GHCR_NAMESPACE: ghcr.io/${{ github.repository_owner }}
+  DOCKERHUB_NAMESPACE: docker.io/altran1502
+
 jobs:
   pre-job:
     runs-on: ubuntu-latest
@@ -23,14 +27,15 @@ jobs:
       should_run: ${{ steps.check.outputs.should_run }}
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: read
 
       - name: Check what should run
         id: check
-        uses: immich-app/devtools/actions/pre-job@91f342bb4477c4bc10c576ae739da875d85aa164 # pre-job-action-v2.0.4
+        uses: immich-app/devtools/actions/pre-job@03514eceb4a27cd714976a866b350df5ce175720 # pre-job-action-v2.1.0
         with:
           github-token: ${{ steps.token.outputs.token }}
           filters: |
@@ -43,8 +48,6 @@ jobs:
               - 'machine-learning/**'
           force-filters: |
             - '.github/workflows/docker.yml'
-            - '.github/workflows/multi-runner-build.yml'
-            - '.github/actions/image-build'
           force-events: 'workflow_dispatch,release'
 
   retag_ml:
@@ -57,10 +60,33 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        suffix: ['', '-cuda', '-rocm', '-openvino', '-armnn', '-rknn']
+        include: &ml-variants
+          - image: immich-machine-learning
+            device: cpu
+          - image: immich-machine-learning
+            device: cuda
+            suffixes: '-cuda'
+            platforms: linux/amd64
+          - image: immich-machine-learning
+            device: openvino
+            suffixes: '-openvino'
+            platforms: linux/amd64
+          - image: immich-machine-learning
+            device: armnn
+            suffixes: '-armnn'
+            platforms: linux/arm64
+          - image: immich-machine-learning
+            device: rknn
+            suffixes: '-rknn'
+            platforms: linux/arm64
+          - image: immich-machine-learning
+            device: rocm
+            suffixes: '-rocm'
+            platforms: linux/amd64
+            runner-mapping: '{"linux/amd64": "pokedex-large"}'
     steps:
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -69,10 +95,10 @@ jobs:
       - name: Re-tag image
         env:
           REGISTRY_NAME: 'ghcr.io'
-          REPOSITORY: ${{ github.repository_owner }}/immich-machine-learning
-          TAG_OLD: main${{ matrix.suffix }}
-          TAG_PR: ${{ github.event.number == 0 && github.ref_name || format('pr-{0}', github.event.number) }}${{ matrix.suffix }}
-          TAG_COMMIT: commit-${{ github.event_name != 'pull_request' && github.sha || github.event.pull_request.head.sha }}${{ matrix.suffix }}
+          REPOSITORY: ${{ github.repository_owner }}/${{ matrix.image }}
+          TAG_OLD: main${{ matrix.suffixes }}
+          TAG_PR: ${{ github.event.number == 0 && github.ref_name || format('pr-{0}', github.event.number) }}${{ matrix.suffixes }}
+          TAG_COMMIT: commit-${{ github.event_name != 'pull_request' && github.sha || github.event.pull_request.head.sha }}${{ matrix.suffixes }}
         run: |
           docker buildx imagetools create -t "${REGISTRY_NAME}/${REPOSITORY}:${TAG_PR}" "${REGISTRY_NAME}/${REPOSITORY}:${TAG_OLD}"
           docker buildx imagetools create -t "${REGISTRY_NAME}/${REPOSITORY}:${TAG_COMMIT}" "${REGISTRY_NAME}/${REPOSITORY}:${TAG_OLD}"
@@ -85,12 +111,9 @@ jobs:
       packages: write
     if: ${{ fromJSON(needs.pre-job.outputs.should_run).server == false && !github.event.pull_request.head.repo.fork }}
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        suffix: ['']
     steps:
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -100,9 +123,9 @@ jobs:
         env:
           REGISTRY_NAME: 'ghcr.io'
           REPOSITORY: ${{ github.repository_owner }}/immich-server
-          TAG_OLD: main${{ matrix.suffix }}
-          TAG_PR: ${{ github.event.number == 0 && github.ref_name || format('pr-{0}', github.event.number) }}${{ matrix.suffix }}
-          TAG_COMMIT: commit-${{ github.event_name != 'pull_request' && github.sha || github.event.pull_request.head.sha }}${{ matrix.suffix }}
+          TAG_OLD: main
+          TAG_PR: ${{ github.event.number == 0 && github.ref_name || format('pr-{0}', github.event.number) }}
+          TAG_COMMIT: commit-${{ github.event_name != 'pull_request' && github.sha || github.event.pull_request.head.sha }}
         run: |
           docker buildx imagetools create -t "${REGISTRY_NAME}/${REPOSITORY}:${TAG_PR}" "${REGISTRY_NAME}/${REPOSITORY}:${TAG_OLD}"
           docker buildx imagetools create -t "${REGISTRY_NAME}/${REPOSITORY}:${TAG_COMMIT}" "${REGISTRY_NAME}/${REPOSITORY}:${TAG_OLD}"
@@ -114,40 +137,27 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        include:
-          - device: cpu
-          - device: cuda
-            suffixes: '-cuda'
-            platforms: linux/amd64
-          - device: openvino
-            suffixes: '-openvino'
-            platforms: linux/amd64
-          - device: armnn
-            suffixes: '-armnn'
-            platforms: linux/arm64
-          - device: rknn
-            suffixes: '-rknn'
-            platforms: linux/arm64
-          - device: rocm
-            suffixes: '-rocm'
-            platforms: linux/amd64
-            runner-mapping: '{"linux/amd64": "pokedex-large"}'
-    uses: immich-app/devtools/.github/workflows/multi-runner-build.yml@50dc3a14f0606ecd8fc28d78d3a3c655115ab695 # multi-runner-build-workflow-v3.1.0
+        include: *ml-variants
+    uses: immich-app/devtools/.github/workflows/multi-runner-build.yml@4d420cf8e5ea499f99b2c2849ff9a219d5f7b178 # multi-runner-build-workflow-v4.0.0
     permissions:
       contents: read
       actions: read
       packages: write
-    secrets:
-      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
-      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
     with:
-      image: immich-machine-learning
+      image: ${{ matrix.image }}
       context: machine-learning
       dockerfile: machine-learning/Dockerfile
       platforms: ${{ matrix.platforms }}
       runner-mapping: ${{ matrix.runner-mapping }}
       suffixes: ${{ matrix.suffixes }}
-      dockerhub-push: ${{ github.event_name == 'release' && !github.event.release.prerelease }}
+      tags: &tag-rules |
+        type=ref,event=branch
+        type=ref,event=pr
+        type=sha,format=long,prefix=commit-
+        type=semver,pattern={{version}},prefix=v
+        type=semver,pattern={{major}},prefix=v
+        type=match,pattern=v(\d+),group=1,prefix=v,suffix=-rc,enable=${{ github.event.release.prerelease == true }}
+        type=raw,value=release,enable=${{ github.event_name == 'release' && github.event.release.prerelease == false }}
       build-args: |
         DEVICE=${{ matrix.device }}
 
@@ -155,25 +165,72 @@ jobs:
     name: Build and Push Server
     needs: pre-job
     if: ${{ fromJSON(needs.pre-job.outputs.should_run).server == true }}
-    uses: immich-app/devtools/.github/workflows/multi-runner-build.yml@50dc3a14f0606ecd8fc28d78d3a3c655115ab695 # multi-runner-build-workflow-v3.1.0
+    uses: immich-app/devtools/.github/workflows/multi-runner-build.yml@4d420cf8e5ea499f99b2c2849ff9a219d5f7b178 # multi-runner-build-workflow-v4.0.0
     permissions:
       contents: read
       actions: read
       packages: write
-    secrets:
-      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
-      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
     with:
       image: immich-server
       context: .
       dockerfile: server/Dockerfile
-      dockerhub-push: ${{ github.event_name == 'release' && !github.event.release.prerelease }}
+      tags: *tag-rules
       build-args: |
         DEVICE=cpu
 
+  mirror:
+    name: Mirror to Docker Hub
+    needs: [machine-learning, server]
+    if: ${{ github.event_name == 'release' && github.event.release.prerelease == false }}
+    permissions:
+      packages: read
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        # Slightly hacky; we reuse the ml matrix but tack on immich-server too
+        image: [immich-server]
+        include: *ml-variants
+    env:
+      IMAGE: ${{ matrix.image }}
+      SUFFIX: ${{ matrix.suffixes }}
+    steps:
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Generate docker image tags
+        id: meta
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+        with:
+          flavor: |
+            latest=false
+          images: ${{ env.GHCR_NAMESPACE }}/${{ env.IMAGE }}
+          tags: *tag-rules
+
+      - name: Mirror tags to Docker Hub
+        env:
+          TAGS: ${{ steps.meta.outputs.tags }}
+        run: |
+          for tag in ${TAGS}; do
+            version="${tag##*:}"
+            docker buildx imagetools create \
+              -t "${DOCKERHUB_NAMESPACE}/${IMAGE}:${version}${SUFFIX}" \
+              "${GHCR_NAMESPACE}/${IMAGE}:${version}${SUFFIX}"
+          done
+
   success-check-server:
     name: Docker Build & Push Server Success
-    needs: [server, retag_server]
+    needs: [server, retag_server, mirror]
     permissions: {}
     runs-on: ubuntu-latest
     if: always()
@@ -184,7 +241,7 @@ jobs:
 
   success-check-ml:
     name: Docker Build & Push ML Success
-    needs: [machine-learning, retag_ml]
+    needs: [machine-learning, retag_ml, mirror]
     permissions: {}
     runs-on: ubuntu-latest
     if: always()

.github/workflows/docs-build.yml

@@ -21,14 +21,15 @@ jobs:
       should_run: ${{ steps.check.outputs.should_run }}
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: read
 
       - name: Check what should run
         id: check
-        uses: immich-app/devtools/actions/pre-job@91f342bb4477c4bc10c576ae739da875d85aa164 # pre-job-action-v2.0.4
+        uses: immich-app/devtools/actions/pre-job@03514eceb4a27cd714976a866b350df5ce175720 # pre-job-action-v2.1.0
         with:
           github-token: ${{ steps.token.outputs.token }}
           filters: |
@@ -54,19 +55,20 @@ jobs:
 
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: read
 
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           token: ${{ steps.token.outputs.token }}
 
       - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@3bca63ca3c15020293b36b51737a3ee2c773340b # use-mise-action-v3.1.0
+        uses: immich-app/devtools/actions/use-mise@06a9ef925332c91be647d6256642b86b398592c8 # use-mise-action-v3.2.1
         with:
           github_token: ${{ steps.token.outputs.token }}
 

.github/workflows/docs-deploy.yml

@@ -20,10 +20,12 @@ jobs:
       artifact: ${{ steps.get-artifact.outputs.result }}
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-actions: read
+          permission-pull-requests: read
 
       - if: ${{ github.event.workflow_run.conclusion != 'success' }}
         run: echo 'The triggering workflow did not succeed' && exit 1
@@ -126,19 +128,22 @@ jobs:
     if: ${{ fromJson(needs.checks.outputs.artifact).found && fromJson(needs.checks.outputs.parameters).shouldDeploy }}
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: read
+          permission-actions: read
+          permission-pull-requests: write
 
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           token: ${{ steps.token.outputs.token }}
 
       - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@3bca63ca3c15020293b36b51737a3ee2c773340b # use-mise-action-v3.1.0
+        uses: immich-app/devtools/actions/use-mise@06a9ef925332c91be647d6256642b86b398592c8 # use-mise-action-v3.2.1
         with:
           github_token: ${{ steps.token.outputs.token }}
 

.github/workflows/docs-destroy.yml

@@ -17,19 +17,21 @@ jobs:
       pull-requests: write
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: read
+          permission-pull-requests: write
 
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           token: ${{ steps.token.outputs.token }}
 
       - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@3bca63ca3c15020293b36b51737a3ee2c773340b # use-mise-action-v3.1.0
+        uses: immich-app/devtools/actions/use-mise@06a9ef925332c91be647d6256642b86b398592c8 # use-mise-action-v3.2.1
         with:
           github_token: ${{ steps.token.outputs.token }}
 

.github/workflows/fdroid.yml

@@ -0,0 +1,56 @@
+name: Update F-Droid Repo
+
+on:
+  release:
+    types: [published]
+
+permissions: {}
+
+jobs:
+  update-index:
+    runs-on: ubuntu-latest
+    if: ${{ !github.event.release.prerelease }}
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout pubspec for versionCode
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.release.tag_name }}
+          persist-credentials: false
+          sparse-checkout: mobile/pubspec.yaml
+          sparse-checkout-cone-mode: false
+
+      - name: Update F-Droid repo
+        env:
+          GITLAB_TOKEN: ${{ secrets.FDROID_REPO_TOKEN }}
+          RELEASE: ${{ toJSON(github.event.release) }}
+          TAG: ${{ github.event.release.tag_name }}
+        run: |
+          VERSION_CODE=$(yq '.version' mobile/pubspec.yaml | cut -d+ -f2)
+          export VERSION_CODE
+
+          NEW_ENTRY=$(yq -P '
+            [.assets[] | select(.name == "app-release.apk")] as $matches |
+            with(select($matches | length == 0); error("app-release.apk not found in release assets")) |
+            {
+              "url": $matches[0].browser_download_url,
+              "sha256sum": ($matches[0].digest | sub("^sha256:", "")),
+              "date": (.published_at | split("T") | .[0]),
+              "version-code": env(VERSION_CODE)
+            } | .date tag= "!!timestamp"
+          ' <<< "$RELEASE")
+          export NEW_ENTRY
+
+          git clone --depth 1 "https://oauth2:${GITLAB_TOKEN}@gitlab.futo.org/fdroid/repo-v2.git" fdroid-repo
+          cd fdroid-repo
+
+          yq -i '
+            with(select([.apks[] | select(."version-code" == env(VERSION_CODE))] | length > 0); error("version-code already in index")) |
+            .apks = [env(NEW_ENTRY)] + .apks
+          ' apps/Immich/index.yml
+
+          git config user.name "Immich Release Bot"
+          git config user.email "bot@immich.app"
+          git commit -am "Immich: add version-code ${VERSION_CODE} (${TAG})"
+          git push

.github/workflows/fix-format.yml

@@ -15,20 +15,22 @@ jobs:
       pull-requests: write
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
 
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.ref }}
           persist-credentials: true
           token: ${{ steps.token.outputs.token }}
 
       - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@3bca63ca3c15020293b36b51737a3ee2c773340b # use-mise-action-v3.1.0
+        uses: immich-app/devtools/actions/use-mise@06a9ef925332c91be647d6256642b86b398592c8 # use-mise-action-v3.2.1
         with:
           github_token: ${{ steps.token.outputs.token }}
 

.github/workflows/merge-translations.yml

@@ -35,6 +35,8 @@ jobs:
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
 
       - name: Find translation PR
         id: find_pr

.github/workflows/pr-label-validation.yml

@@ -14,13 +14,14 @@ jobs:
       pull-requests: write
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-pull-requests: write
 
       - name: Require PR to have a changelog label
-        uses: mheap/github-action-required-labels@0ac283b4e65c1fb28ce6079dea5546ceca98ccbe # v5.5.2
+        uses: mheap/github-action-required-labels@23e10fde7e062233401931a0eece796cd9bf3177 # v5.6.0
         with:
           token: ${{ steps.token.outputs.token }}
           mode: exactly

.github/workflows/pr-labeler.yml

@@ -12,11 +12,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: read
+          permission-pull-requests: write
 
-      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
+      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
         with:
           repo-token: ${{ steps.token.outputs.token }}

.github/workflows/prepare-release.yml

@@ -3,8 +3,8 @@ name: Prepare new release
 on:
   workflow_dispatch:
     inputs:
-      serverBump:
-        description: 'Bump server version'
+      releaseType:
+        description: 'Release type'
         required: true
         default: 'false'
         type: choice
@@ -17,10 +17,6 @@ on:
           - prepatch
           - prerelease
           - release
-      mobileBump:
-        description: 'Bump mobile build number'
-        required: false
-        type: boolean
       skipTranslations:
         description: 'Skip translations'
         required: false
@@ -54,32 +50,32 @@ jobs:
     permissions: {} # No job-level permissions are needed because it uses the app-token
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: write
 
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           token: ${{ steps.token.outputs.token }}
           persist-credentials: true
           ref: main
 
       - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@3bca63ca3c15020293b36b51737a3ee2c773340b # use-mise-action-v3.1.0
+        uses: immich-app/devtools/actions/use-mise@06a9ef925332c91be647d6256642b86b398592c8 # use-mise-action-v3.2.1
         with:
           github_token: ${{ steps.token.outputs.token }}
 
       # TODO move to mise
       - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Bump version
         env:
-          SERVER_BUMP: ${{ inputs.serverBump }}
-          MOBILE_BUMP: ${{ inputs.mobileBump }}
-        run: pnpm --silent release -s "${SERVER_BUMP}" -m "${MOBILE_BUMP}"
+          RELEASE_TYPE: ${{ inputs.releaseType }}
+        run: mise //:release --type "${RELEASE_TYPE}"
 
       - id: output
         run: |
@@ -106,6 +102,8 @@ jobs:
       contents: read
       pull-requests: write
     secrets:
+      PUSH_O_MATIC_APP_CLIENT_ID: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
+      PUSH_O_MATIC_APP_KEY: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
       KEY_JKS: ${{ secrets.KEY_JKS }}
       ALIAS: ${{ secrets.ALIAS }}
       ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
@@ -135,9 +133,11 @@ jobs:
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: write
+          permission-actions: read
 
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           token: ${{ steps.generate-token.outputs.token }}
           persist-credentials: false
@@ -149,19 +149,23 @@ jobs:
           github-token: ${{ steps.generate-token.outputs.token }}
 
       - name: Create draft release
-        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
-        with:
-          draft: true
-          prerelease: ${{ needs.bump_version.outputs.rc }}
-          tag_name: ${{ needs.bump_version.outputs.version }}
-          token: ${{ steps.generate-token.outputs.token }}
-          generate_release_notes: true
-          body_path: misc/release/notes.tmpl
-          files: |
-            docker/docker-compose.yml
-            docker/docker-compose.rootless.yml
-            docker/example.env
-            docker/hwaccel.ml.yml
-            docker/hwaccel.transcoding.yml
-            docker/prometheus.yml
+        env:
+          GH_TOKEN: ${{ steps.generate-token.outputs.token }}
+          REPO: ${{ github.repository }}
+          TAG: ${{ needs.bump_version.outputs.version }}
+          PRERELEASE: ${{ needs.bump_version.outputs.rc }}
+        run: |
+          gh release create "${TAG}" \
+            --repo "${REPO}" \
+            --draft \
+            --verify-tag \
+            --prerelease="${PRERELEASE}" \
+            --notes-file misc/release/notes.tmpl \
+            --generate-notes \
+            docker/docker-compose.yml \
+            docker/docker-compose.rootless.yml \
+            docker/example.env \
+            docker/hwaccel.ml.yml \
+            docker/hwaccel.transcoding.yml \
+            docker/prometheus.yml \
             *.apk

.github/workflows/preview-label.yaml

@@ -14,10 +14,11 @@ jobs:
       pull-requests: write
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-pull-requests: write
 
       - uses: immich-app/devtools/actions/sticky-comment@0135acd12ad9f3369b94a2aa3c0ae8c835a4e926 # sticky-comment-action-v1.0.0
         with:
@@ -32,10 +33,11 @@ jobs:
       pull-requests: write
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-pull-requests: write
 
       - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:

.github/workflows/sdk.yml

@@ -16,19 +16,20 @@ jobs:
       packages: write
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: read
 
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           token: ${{ steps.token.outputs.token }}
 
       - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@3bca63ca3c15020293b36b51737a3ee2c773340b # use-mise-action-v3.1.0
+        uses: immich-app/devtools/actions/use-mise@06a9ef925332c91be647d6256642b86b398592c8 # use-mise-action-v3.2.1
         with:
           github_token: ${{ steps.token.outputs.token }}
 

.github/workflows/static_analysis.yml

@@ -20,19 +20,21 @@ jobs:
       should_run: ${{ steps.check.outputs.should_run }}
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: read
 
       - name: Check what should run
         id: check
-        uses: immich-app/devtools/actions/pre-job@91f342bb4477c4bc10c576ae739da875d85aa164 # pre-job-action-v2.0.4
+        uses: immich-app/devtools/actions/pre-job@03514eceb4a27cd714976a866b350df5ce175720 # pre-job-action-v2.1.0
         with:
           github-token: ${{ steps.token.outputs.token }}
           filters: |
             mobile:
               - 'mobile/**'
+              - 'i18n/en.json'
           force-filters: |
             - '.github/workflows/static_analysis.yml'
           force-events: 'workflow_dispatch,release'
@@ -49,58 +51,33 @@ jobs:
         working-directory: ./mobile
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: read
 
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           token: ${{ steps.token.outputs.token }}
 
       - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@3bca63ca3c15020293b36b51737a3ee2c773340b # use-mise-action-v3.1.0
+        uses: immich-app/devtools/actions/use-mise@06a9ef925332c91be647d6256642b86b398592c8 # use-mise-action-v3.2.1
         with:
           github_token: ${{ steps.token.outputs.token }}
           working_directory: ./mobile
 
       - name: Install dependencies
-        run: flutter pub get
+        run: mise //mobile:install:ci
 
       - name: Install dependencies for UI package
-        run: flutter pub get
+        run: flutter pub get --enforce-lockfile
         working-directory: ./mobile/packages/ui
 
-      - name: Generate translation files
-        run: mise //mobile:codegen:translation
-
-      - name: Run Build Runner
-        run: mise //mobile:codegen:dart
-
-      - name: Generate platform API
-        run: mise //mobile:codegen:pigeon
-
-      - name: Find file changes
-        uses: tj-actions/verify-changed-files@a1c6acee9df209257a246f2cc6ae8cb6581c1edf # v20.0.4
-        id: verify-changed-files
-        with:
-          files: |
-            mobile/**/*.g.dart
-            mobile/**/*.gr.dart
-            mobile/**/*.drift.dart
-            mobile/**/*.g.swift
-            mobile/**/*.g.kt
-
-      - name: Verify files have not changed
-        if: steps.verify-changed-files.outputs.files_changed == 'true'
-        env:
-          CHANGED_FILES: ${{ steps.verify-changed-files.outputs.changed_files }}
-        run: |
-          echo "ERROR: Generated files not up to date! Run 'mise //mobile:codegen:dart' and 'mise //mobile:codegen:pigeon'"
-          echo "Changed files: ${CHANGED_FILES}"
-          exit 1
+      - name: Perform codegen
+        run: mise //mobile:codegen
 
       - name: Run analyze
         run: mise //mobile:analyze

.github/workflows/test.yml

@@ -17,19 +17,20 @@ jobs:
       should_run: ${{ steps.check.outputs.should_run }}
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: read
 
       - name: Check what should run
         id: check
-        uses: immich-app/devtools/actions/pre-job@91f342bb4477c4bc10c576ae739da875d85aa164 # pre-job-action-v2.0.4
+        uses: immich-app/devtools/actions/pre-job@03514eceb4a27cd714976a866b350df5ce175720 # pre-job-action-v2.1.0
         with:
           github-token: ${{ steps.token.outputs.token }}
           filters: |
-            root:
-              - 'misc/**'
+            scripts:
+              - 'packages/scripts/**'
               - 'pnpm-lock.yaml'
               - 'mise.toml'
             i18n:
@@ -45,6 +46,8 @@ jobs:
               - 'server/**'
               - 'pnpm-lock.yaml'
               - 'mise.toml'
+              - 'packages/plugin-core/**'
+              - 'packages/plugin-sdk/**'
             cli:
               - 'packages/cli/**'
               - 'packages/sdk/**'
@@ -66,33 +69,34 @@ jobs:
             - '.github/workflows/test.yml'
           force-events: 'workflow_dispatch'
 
-  root-unit-tests:
-    name: Test the root workspace
+  script-unit-tests:
+    name: Scripts unit tests
     needs: pre-job
-    if: ${{ fromJSON(needs.pre-job.outputs.should_run).root == true }}
+    if: ${{ fromJSON(needs.pre-job.outputs.should_run).scripts == true }}
     runs-on: ubuntu-latest
     permissions:
       contents: read
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: read
 
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           token: ${{ steps.token.outputs.token }}
 
       - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@3bca63ca3c15020293b36b51737a3ee2c773340b # use-mise-action-v3.1.0
+        uses: immich-app/devtools/actions/use-mise@06a9ef925332c91be647d6256642b86b398592c8 # use-mise-action-v3.2.1
         with:
           github_token: ${{ steps.token.outputs.token }}
 
       - name: Run unit tests
-        run: pnpm test
+        run: pnpm --filter @immich/scripts test
 
   server-unit-tests:
     name: Test & Lint Server
@@ -103,19 +107,20 @@ jobs:
       contents: read
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: read
 
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           token: ${{ steps.token.outputs.token }}
 
       - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@3bca63ca3c15020293b36b51737a3ee2c773340b # use-mise-action-v3.1.0
+        uses: immich-app/devtools/actions/use-mise@06a9ef925332c91be647d6256642b86b398592c8 # use-mise-action-v3.2.1
         with:
           github_token: ${{ steps.token.outputs.token }}
 
@@ -134,19 +139,20 @@ jobs:
         working-directory: ./packages/cli
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: read
 
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           token: ${{ steps.token.outputs.token }}
 
       - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@3bca63ca3c15020293b36b51737a3ee2c773340b # use-mise-action-v3.1.0
+        uses: immich-app/devtools/actions/use-mise@06a9ef925332c91be647d6256642b86b398592c8 # use-mise-action-v3.2.1
         with:
           github_token: ${{ steps.token.outputs.token }}
 
@@ -165,19 +171,20 @@ jobs:
         working-directory: ./packages/cli
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: read
 
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           token: ${{ steps.token.outputs.token }}
 
       - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@3bca63ca3c15020293b36b51737a3ee2c773340b # use-mise-action-v3.1.0
+        uses: immich-app/devtools/actions/use-mise@06a9ef925332c91be647d6256642b86b398592c8 # use-mise-action-v3.2.1
         with:
           github_token: ${{ steps.token.outputs.token }}
 
@@ -209,19 +216,20 @@ jobs:
         working-directory: ./web
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: read
 
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           token: ${{ steps.token.outputs.token }}
 
       - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@3bca63ca3c15020293b36b51737a3ee2c773340b # use-mise-action-v3.1.0
+        uses: immich-app/devtools/actions/use-mise@06a9ef925332c91be647d6256642b86b398592c8 # use-mise-action-v3.2.1
         with:
           github_token: ${{ steps.token.outputs.token }}
 
@@ -247,19 +255,20 @@ jobs:
         working-directory: ./web
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: read
 
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           token: ${{ steps.token.outputs.token }}
 
       - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@3bca63ca3c15020293b36b51737a3ee2c773340b # use-mise-action-v3.1.0
+        uses: immich-app/devtools/actions/use-mise@06a9ef925332c91be647d6256642b86b398592c8 # use-mise-action-v3.2.1
         with:
           github_token: ${{ steps.token.outputs.token }}
 
@@ -275,19 +284,20 @@ jobs:
       contents: read
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: read
 
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           token: ${{ steps.token.outputs.token }}
 
       - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@3bca63ca3c15020293b36b51737a3ee2c773340b # use-mise-action-v3.1.0
+        uses: immich-app/devtools/actions/use-mise@06a9ef925332c91be647d6256642b86b398592c8 # use-mise-action-v3.2.1
         with:
           github_token: ${{ steps.token.outputs.token }}
 
@@ -325,19 +335,20 @@ jobs:
         working-directory: ./e2e
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: read
 
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           token: ${{ steps.token.outputs.token }}
 
       - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@3bca63ca3c15020293b36b51737a3ee2c773340b # use-mise-action-v3.1.0
+        uses: immich-app/devtools/actions/use-mise@06a9ef925332c91be647d6256642b86b398592c8 # use-mise-action-v3.2.1
         with:
           github_token: ${{ steps.token.outputs.token }}
 
@@ -357,20 +368,21 @@ jobs:
         working-directory: ./server
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: read
 
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           submodules: 'recursive'
           token: ${{ steps.token.outputs.token }}
 
       - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@3bca63ca3c15020293b36b51737a3ee2c773340b # use-mise-action-v3.1.0
+        uses: immich-app/devtools/actions/use-mise@06a9ef925332c91be647d6256642b86b398592c8 # use-mise-action-v3.2.1
         with:
           github_token: ${{ steps.token.outputs.token }}
 
@@ -393,23 +405,24 @@ jobs:
         runner: [ubuntu-latest, ubuntu-24.04-arm]
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: read
 
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           submodules: 'recursive'
           token: ${{ steps.token.outputs.token }}
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: '.nvmrc'
           cache: 'pnpm'
@@ -428,6 +441,7 @@ jobs:
         if: ${{ !cancelled() }}
 
       - name: Start Docker Compose
+        id: docker
         run: docker compose up -d --build --renew-anon-volumes --force-recreate --remove-orphans --wait --wait-timeout 300
         if: ${{ !cancelled() }}
 
@@ -435,13 +449,13 @@ jobs:
         env:
           VITEST_DISABLE_DOCKER_SETUP: true
         run: pnpm test
-        if: ${{ !cancelled() }}
+        if: ${{ !cancelled() && steps.docker.outcome == 'success' }}
 
       - name: Run e2e tests (maintenance)
         env:
           VITEST_DISABLE_DOCKER_SETUP: true
         run: pnpm test:maintenance
-        if: ${{ !cancelled() }}
+        if: ${{ !cancelled() && steps.docker.outcome == 'success' }}
 
       - name: Capture Docker logs
         if: always()
@@ -470,23 +484,24 @@ jobs:
         runner: [ubuntu-latest, ubuntu-24.04-arm]
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: read
 
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           submodules: 'recursive'
           token: ${{ steps.token.outputs.token }}
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: '.nvmrc'
           cache: 'pnpm'
@@ -505,6 +520,7 @@ jobs:
         if: ${{ !cancelled() }}
 
       - name: Docker build
+        id: docker
         run: docker compose up -d --build --renew-anon-volumes --force-recreate --remove-orphans --wait --wait-timeout 300
         if: ${{ !cancelled() }}
 
@@ -512,7 +528,7 @@ jobs:
         env:
           PLAYWRIGHT_DISABLE_WEBSERVER: true
         run: pnpm test:web
-        if: ${{ !cancelled() }}
+        if: ${{ !cancelled() && steps.docker.outcome == 'success' }}
 
       - name: Archive e2e test (web) results
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -525,7 +541,7 @@ jobs:
         env:
           PLAYWRIGHT_DISABLE_WEBSERVER: true
         run: pnpm test:web:ui
-        if: ${{ !cancelled() }}
+        if: ${{ !cancelled() && steps.docker.outcome == 'success' }}
 
       - name: Archive ui test (web) results
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -538,7 +554,7 @@ jobs:
         env:
           PLAYWRIGHT_DISABLE_WEBSERVER: true
         run: pnpm test:web:maintenance
-        if: ${{ !cancelled() }}
+        if: ${{ !cancelled() && steps.docker.outcome == 'success' }}
 
       - name: Archive maintenance tests (web) results
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -578,28 +594,28 @@ jobs:
       contents: read
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: read
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           token: ${{ steps.token.outputs.token }}
 
       - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@3bca63ca3c15020293b36b51737a3ee2c773340b # use-mise-action-v3.1.0
+        uses: immich-app/devtools/actions/use-mise@06a9ef925332c91be647d6256642b86b398592c8 # use-mise-action-v3.2.1
         with:
           github_token: ${{ steps.token.outputs.token }}
           working_directory: ./mobile
 
       - name: Install dependencies
-        run: flutter pub get
-        working-directory: ./mobile
+        run: mise //mobile:install:ci
 
-      - name: Generate translation files
-        run: mise //mobile:codegen:translation
+      - name: Perform codegen
+        run: mise //mobile:codegen
 
       - name: Run tests
         run: mise //mobile:test
@@ -616,18 +632,19 @@ jobs:
         working-directory: ./machine-learning
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: read
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           token: ${{ steps.token.outputs.token }}
 
       - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@3bca63ca3c15020293b36b51737a3ee2c773340b # use-mise-action-v3.1.0
+        uses: immich-app/devtools/actions/use-mise@06a9ef925332c91be647d6256642b86b398592c8 # use-mise-action-v3.2.1
         with:
           github_token: ${{ steps.token.outputs.token }}
 
@@ -646,19 +663,20 @@ jobs:
         working-directory: ./.github
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: read
 
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           token: ${{ steps.token.outputs.token }}
 
       - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@3bca63ca3c15020293b36b51737a3ee2c773340b # use-mise-action-v3.1.0
+        uses: immich-app/devtools/actions/use-mise@06a9ef925332c91be647d6256642b86b398592c8 # use-mise-action-v3.2.1
         with:
           github_token: ${{ steps.token.outputs.token }}
 
@@ -676,12 +694,13 @@ jobs:
       contents: read
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: read
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           token: ${{ steps.token.outputs.token }}
@@ -697,19 +716,20 @@ jobs:
       contents: read
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: read
 
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           token: ${{ steps.token.outputs.token }}
 
       - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@3bca63ca3c15020293b36b51737a3ee2c773340b # use-mise-action-v3.1.0
+        uses: immich-app/devtools/actions/use-mise@06a9ef925332c91be647d6256642b86b398592c8 # use-mise-action-v3.2.1
         with:
           github_token: ${{ steps.token.outputs.token }}
 
@@ -724,7 +744,6 @@ jobs:
         id: verify-changed-files
         with:
           files: |
-            mobile/openapi
             packages/sdk
             open-api/immich-openapi-specs.json
 
@@ -755,19 +774,20 @@ jobs:
           - 5432:5432
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: read
 
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           token: ${{ steps.token.outputs.token }}
 
       - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@3bca63ca3c15020293b36b51737a3ee2c773340b # use-mise-action-v3.1.0
+        uses: immich-app/devtools/actions/use-mise@06a9ef925332c91be647d6256642b86b398592c8 # use-mise-action-v3.2.1
         with:
           github_token: ${{ steps.token.outputs.token }}
 
@@ -900,6 +920,6 @@ jobs:
 #           emulator-options: -no-snapshot-save -no-window -gpu swiftshader_indirect -noaudio -no-boot-anim -camera-back none
 #           disable-animations: true
 #           script: |
-#             flutter pub get
+#             flutter pub get --enforce-lockfile
 #             flutter test integration_test
 #         attempt_limit: 3

.github/workflows/weblate-lock.yml

@@ -24,14 +24,15 @@ jobs:
       should_run: ${{ steps.check.outputs.should_run }}
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-contents: read
 
       - name: Check what should run
         id: check
-        uses: immich-app/devtools/actions/pre-job@91f342bb4477c4bc10c576ae739da875d85aa164 # pre-job-action-v2.0.4
+        uses: immich-app/devtools/actions/pre-job@03514eceb4a27cd714976a866b350df5ce175720 # pre-job-action-v2.1.0
         with:
           github-token: ${{ steps.token.outputs.token }}
           filters: |
@@ -47,10 +48,11 @@ jobs:
     if: ${{ fromJSON(needs.pre-job.outputs.should_run).i18n == true }}
     steps:
       - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
+        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
           client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+          permission-pull-requests: read
 
       - name: Bot review status
         env:

.gitignore

@@ -11,13 +11,10 @@ docker/library
 uploads
 coverage
 
+mobile/generated
 mobile/gradle.properties
-mobile/openapi/pubspec.lock
 mobile/*.jks
 mobile/libisar.dylib
-mobile/openapi/test
-mobile/openapi/doc
-mobile/openapi/.openapi-generator/FILES
 mobile/ios/build
 
 packages/**/build

.vscode/extensions.json

@@ -12,6 +12,8 @@
     "editorconfig.editorconfig",
     "foxundermoon.shell-format",
     "timonwong.shellcheck",
-    "bluebrown.yamlfmt"
+    "bluebrown.yamlfmt",
+    // TODO TS 7 while it's still in preview
+    "typescriptteam.native-preview"
   ]
 }

.vscode/settings.json

@@ -29,9 +29,6 @@
     "editor.formatOnSave": true,
     "tailwindCSS.lint.suggestCanonicalClasses": "ignore"
   },
-  "svelte.plugin.svelte.compilerWarnings": {
-    "state_referenced_locally": "ignore"
-  },
   "[typescript]": {
     "editor.defaultFormatter": "esbenp.prettier-vscode",
     "editor.formatOnSave": true
@@ -43,37 +40,42 @@
   "eslint.useFlatConfig": true,
   "eslint.validate": ["javascript", "typescript", "svelte"],
   "eslint.workingDirectories": [
-    { "directory": "cli", "changeProcessCWD": true },
-    { "directory": "e2e", "changeProcessCWD": true },
-    { "directory": "server", "changeProcessCWD": true },
-    { "directory": "web", "changeProcessCWD": true }
+    { "changeProcessCWD": true, "directory": "cli" },
+    { "changeProcessCWD": true, "directory": "e2e" },
+    { "changeProcessCWD": true, "directory": "server" },
+    { "changeProcessCWD": true, "directory": "web" }
   ],
-  "files.watcherExclude": {
-    "**/.jj/**": true,
-    "**/.git/**": true,
-    "**/node_modules/**": true,
-    "**/build/**": true,
-    "**/dist/**": true,
-    "**/.svelte-kit/**": true
-  },
   "explorer.fileNesting.enabled": true,
   "explorer.fileNesting.patterns": {
     "*.dart": "${capture}.g.dart,${capture}.gr.dart,${capture}.drift.dart",
-    "*.ts": "${capture}.spec.ts,${capture}.mock.ts",
     "*.js": "${capture}.spec.js,${capture}.mock.js",
+    "*.ts": "${capture}.spec.ts,${capture}.mock.ts",
     "package.json": "package-lock.json, yarn.lock, pnpm-lock.yaml, bun.lockb, bun.lock, pnpm-workspace.yaml, .pnpmfile.cjs"
   },
+  "files.watcherExclude": {
+    "**/.git/**": true,
+    "**/.jj/**": true,
+    "**/.svelte-kit/**": true,
+    "**/build/**": true,
+    "**/dist/**": true,
+    "**/node_modules/**": true
+  },
+  // TODO remove once the ts7 extension is stable
+  "js/ts.experimental.useTsgo": true,
+  "js/ts.preferences.importModuleSpecifier": "non-relative",
   "search.exclude": {
-    "**/node_modules": true,
+    "**/.svelte-kit": true,
     "**/build": true,
     "**/dist": true,
-    "**/.svelte-kit": true,
+    "**/node_modules": true,
     "**/open-api/typescript-sdk/src": true
   },
   "svelte.enable-ts-plugin": true,
+  "svelte.plugin.svelte.compilerWarnings": {
+    "state_referenced_locally": "ignore"
+  },
   "tailwindCSS.experimental.configFile": {
     "web/src/app.css": "web/src/**"
   },
-  "js/ts.preferences.importModuleSpecifier": "non-relative",
   "vitest.maximumConfigs": 10
 }

CODEOWNERS

@@ -4,4 +4,4 @@
 /web/ @danieldietzler
 /machine-learning/ @mertalev
 /e2e/ @danieldietzler
-/mobile/ @shenlong-tanwen @santoshakil
+/mobile/ @shenlong-tanwen @santoshakil @agg23

CONTRIBUTING.md

@@ -19,7 +19,13 @@ We usually do not assign issues to new contributors, since it happens often that
 
 ## Use of generative AI
 
-We ask you not to open PRs generated with an LLM. We find that code generated like this tends to need a large amount of back-and-forth, which is a very inefficient use of our time. If we want LLM-generated code, it's much faster for us to use an LLM ourselves than to go through an intermediary via a pull request.
+We ask you not to open PRs generated with an LLM. We find that code generated like this tends to need a large amount of back-and-forth, which is a very inefficient use of our time. Even a one line change can have significant impact. We cannot have any confidence in an LLM, so if it's non-trivial for us to verify it works and you don't show that you fully understand all implications of the change, reviewing the PR is not worth our time. If we want LLM-generated code, it's much faster for us to use an LLM ourselves than to go through an intermediary via a pull request.
+
+If you use an LLM to translate a PR description or title, that is fine. Please make sure however that you stick to the PR template and that the text is written concisely.
+
+LLMs must not be used to fix GitHub issues labelled good first issue. These issues are generally not urgent, and are intended to be learning opportunities for new contributors to get familiar with the codebase. Whether you are a newcomer or not, fully automating the process of fixing this issue squanders the learning opportunity and doesn’t add much value to the project. Using LLMs to fix issues labelled as “good first issue” is forbidden, and those PRs will be closed automatically.
+
+Misrepresenting LLM use, contribution farming (automated low-effort PRs), or repeatedly hitting auto-close rules may be grounds for a block at maintainer discretion.
 
 ## Feature freezes
 
@@ -38,7 +44,7 @@ All our translations are done through [Weblate](https://hosted.weblate.org/proje
 
 ### Datasets
 
-Help us improve our [Immich Datasets](https://datasets.immich.app) by submitting photos and videos taken from a variety of devices, including smartphones, DSLRs, and action cameras, as well as photos with unique features, such as panoramas, burst photos, and photo spheres. These datasets will be publically available for anyone to use, do not submit private/sensitive photos.
+Help us improve our [Immich Datasets](https://datasets.immich.app) by submitting photos and videos taken from a variety of devices, including smartphones, DSLRs, and action cameras, as well as photos with unique features, such as panoramas, burst photos, and photo spheres. These datasets will be publicly available for anyone to use, do not submit private/sensitive photos.
 
 ### Community support
 

Makefile

@@ -1,58 +0,0 @@
-dev:
-	@printf "This command has been removed. Please use:\n\n    mise dev          # or mise //:dev from another directory\n\n" >&2 && exit 1
-
-dev-down:
-	@printf "This command has been removed. Please use:\n\n    mise dev-down          # or mise //:dev-down from another directory\n\n" >&2 && exit 1
-
-dev-update:
-	@printf "This command has been removed. Please use:\n\n    mise dev-update          # or mise //:dev-update from another directory\n\n" >&2 && exit 1
-
-dev-scale:
-	@printf "This command has been removed. Please use:\n\n    mise dev-scale          # or mise //:dev-scale from another directory\n\n" >&2 && exit 1
-
-dev-docs:
-	npm --prefix docs run start
-
-.PHONY: e2e
-e2e:
-	@printf "This command has been removed. Please use:\n\n    mise e2e          # or mise //:e2e from another directory\n\n" >&2 && exit 1
-
-e2e-dev:
-	@printf "This command has been removed. Please use:\n\n    mise e2e-dev          # or mise //:e2e-dev from another directory\n\n" >&2 && exit 1
-
-e2e-update:
-	@printf "This command has been removed. Please use:\n\n    mise e2e-update          # or mise //:e2e-update from another directory\n\n" >&2 && exit 1
-
-e2e-down:
-	@printf "This command has been removed. Please use:\n\n    mise e2e-down          # or mise //:e2e-down from another directory\n\n" >&2 && exit 1
-
-prod:
-	@printf "This command has been removed. Please use:\n\n    mise prod          # or mise //:prod from another directory\n\n" >&2 && exit 1
-
-prod-down:
-	@printf "This command has been removed. Please use:\n\n    mise prod-down          # or mise //:prod-down from another directory\n\n" >&2 && exit 1
-
-prod-scale:
-	@printf "This command has been removed. Please use:\n\n    mise prod-scale          # or mise //:prod-scale from another directory\n\n" >&2 && exit 1
-
-.PHONY: open-api
-open-api:
-	@printf "This command has been removed. Please use:\n\n    mise open-api          # or mise //:open-api from another directory\n\n" >&2 && exit 1
-
-sql:
-	@printf "This command has been removed. Please use:\n\n    mise sql               # or mise //:sql from another directory\n\n" >&2 && exit 1
-
-
-renovate:
-  LOG_LEVEL=debug pnpm exec renovate --platform=local --repository-cache=reset
-
-# Include .env file if it exists
--include docker/.env
-
-MODULES = e2e server web cli sdk docs .github
-
-test-e2e:
-	@printf "This command has been removed. Please use:\n\n    mise //e2e:test               # or mise //e2e:test-web for web tests, respectively\n\n" >&2 && exit 1
-
-clean:
-	@printf "This command has been removed. Please use:\n\n    mise clean               # or mise //:clean from another directory\n\n" >&2 && exit 1

README.md

@@ -32,11 +32,13 @@
   <a href="readme_i18n/README_zh_TW.md">正體中文</a>
   <a href="readme_i18n/README_uk_UA.md">Українська</a>
   <a href="readme_i18n/README_ru_RU.md">Русский</a>
+  <a href="readme_i18n/README_bg_BG.md">Български</a>
   <a href="readme_i18n/README_pt_BR.md">Português Brasileiro</a>
   <a href="readme_i18n/README_sv_SE.md">Svenska</a>
   <a href="readme_i18n/README_ar_JO.md">العربية</a>
   <a href="readme_i18n/README_vi_VN.md">Tiếng Việt</a>
   <a href="readme_i18n/README_th_TH.md">ภาษาไทย</a>
+  <a href="readme_i18n/README_ml_IN.md">മലയാളം</a>
 </p>
 
 

deployment/mise.lock

@@ -1,36 +1,43 @@
 # @generated - this file is auto-generated by `mise lock` https://mise.en.dev/dev-tools/mise-lock.html
 
 [[tools.opentofu]]
-version = "1.11.6"
+version = "1.12.5"
 backend = "aqua:opentofu/opentofu"
 
 [tools.opentofu."platforms.linux-arm64"]
-checksum = "sha256:d4f2ab15776925864b049bb329d69682851de6f5204f256e9fa86d07a0308850"
-url = "https://github.com/opentofu/opentofu/releases/download/v1.11.6/tofu_1.11.6_linux_arm64.tar.gz"
+checksum = "sha256:e67e9da2b1ddf5050ebee62a584cb826eafe1dfd3827d7ec20899ac62791ed1a"
+url = "https://github.com/opentofu/opentofu/releases/download/v1.12.5/tofu_1.12.5_linux_arm64.tar.gz"
+url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/484602545"
 
 [tools.opentofu."platforms.linux-arm64-musl"]
-checksum = "sha256:d4f2ab15776925864b049bb329d69682851de6f5204f256e9fa86d07a0308850"
-url = "https://github.com/opentofu/opentofu/releases/download/v1.11.6/tofu_1.11.6_linux_arm64.tar.gz"
+checksum = "sha256:e67e9da2b1ddf5050ebee62a584cb826eafe1dfd3827d7ec20899ac62791ed1a"
+url = "https://github.com/opentofu/opentofu/releases/download/v1.12.5/tofu_1.12.5_linux_arm64.tar.gz"
+url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/484602545"
 
 [tools.opentofu."platforms.linux-x64"]
-checksum = "sha256:02800fafa2753a9f50c38483e2fdf5bc353fd62895eb9e25eec9a5145df3a69e"
-url = "https://github.com/opentofu/opentofu/releases/download/v1.11.6/tofu_1.11.6_linux_amd64.tar.gz"
+checksum = "sha256:a6894d45ae7a17ce83189cce8fe04b5a65f68cefceb62455b5a6a89fa53ab38f"
+url = "https://github.com/opentofu/opentofu/releases/download/v1.12.5/tofu_1.12.5_linux_amd64.tar.gz"
+url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/484602624"
 
 [tools.opentofu."platforms.linux-x64-musl"]
-checksum = "sha256:02800fafa2753a9f50c38483e2fdf5bc353fd62895eb9e25eec9a5145df3a69e"
-url = "https://github.com/opentofu/opentofu/releases/download/v1.11.6/tofu_1.11.6_linux_amd64.tar.gz"
+checksum = "sha256:a6894d45ae7a17ce83189cce8fe04b5a65f68cefceb62455b5a6a89fa53ab38f"
+url = "https://github.com/opentofu/opentofu/releases/download/v1.12.5/tofu_1.12.5_linux_amd64.tar.gz"
+url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/484602624"
 
 [tools.opentofu."platforms.macos-arm64"]
-checksum = "sha256:62d7fa8539e13b444827aa0a3b90c5972da5c47e8f8882d9dcf2e430e78840c1"
-url = "https://github.com/opentofu/opentofu/releases/download/v1.11.6/tofu_1.11.6_darwin_arm64.tar.gz"
+checksum = "sha256:2ae38150a667f5c0bd57b318d18ad8091d08f93fcca40345f3d88998661de5a9"
+url = "https://github.com/opentofu/opentofu/releases/download/v1.12.5/tofu_1.12.5_darwin_arm64.tar.gz"
+url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/484602544"
 
 [tools.opentofu."platforms.macos-x64"]
-checksum = "sha256:1408cdef1c380f914565e6b4bb70794c6b163f195fcb233357f3d6c5745906b6"
-url = "https://github.com/opentofu/opentofu/releases/download/v1.11.6/tofu_1.11.6_darwin_amd64.tar.gz"
+checksum = "sha256:1012d8f3d4567bcbcd1f2c7d766feca39a30bced32fb8be47e1887fbbee2456d"
+url = "https://github.com/opentofu/opentofu/releases/download/v1.12.5/tofu_1.12.5_darwin_amd64.tar.gz"
+url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/484602621"
 
 [tools.opentofu."platforms.windows-x64"]
-checksum = "sha256:27323f70c875b8251bfd7e61a4cffc3ebff4e56ed1e611b955016f0c7077367e"
-url = "https://github.com/opentofu/opentofu/releases/download/v1.11.6/tofu_1.11.6_windows_amd64.tar.gz"
+checksum = "sha256:af11850b496f3720e0184084c56d8b43aa74ea92d2338978bf368d70c96473f1"
+url = "https://github.com/opentofu/opentofu/releases/download/v1.12.5/tofu_1.12.5_windows_amd64.tar.gz"
+url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/484602547"
 
 [[tools.terragrunt]]
 version = "1.0.3"
@@ -39,27 +46,34 @@ backend = "aqua:gruntwork-io/terragrunt"
 [tools.terragrunt."platforms.linux-arm64"]
 checksum = "sha256:e5b60ab05b5214db694e6bc215d8124fb626e277cdb56b86f6147ae110d510fe"
 url = "https://github.com/gruntwork-io/terragrunt/releases/download/v1.0.3/terragrunt_linux_arm64.tar.gz"
+url_api = "https://api.github.com/repos/gruntwork-io/terragrunt/releases/assets/406654253"
 
 [tools.terragrunt."platforms.linux-arm64-musl"]
 checksum = "sha256:e5b60ab05b5214db694e6bc215d8124fb626e277cdb56b86f6147ae110d510fe"
 url = "https://github.com/gruntwork-io/terragrunt/releases/download/v1.0.3/terragrunt_linux_arm64.tar.gz"
+url_api = "https://api.github.com/repos/gruntwork-io/terragrunt/releases/assets/406654253"
 
 [tools.terragrunt."platforms.linux-x64"]
 checksum = "sha256:6d48049baf82e0bf9c804368dc85cbfeadc10955e33777e9e8de3e020b94b073"
 url = "https://github.com/gruntwork-io/terragrunt/releases/download/v1.0.3/terragrunt_linux_amd64.tar.gz"
+url_api = "https://api.github.com/repos/gruntwork-io/terragrunt/releases/assets/406654196"
 
 [tools.terragrunt."platforms.linux-x64-musl"]
 checksum = "sha256:6d48049baf82e0bf9c804368dc85cbfeadc10955e33777e9e8de3e020b94b073"
 url = "https://github.com/gruntwork-io/terragrunt/releases/download/v1.0.3/terragrunt_linux_amd64.tar.gz"
+url_api = "https://api.github.com/repos/gruntwork-io/terragrunt/releases/assets/406654196"
 
 [tools.terragrunt."platforms.macos-arm64"]
 checksum = "sha256:aacb5be2ca5475300cbce246dfbd8a45eb47510fbaa70fab8561c49ef5db03aa"
 url = "https://github.com/gruntwork-io/terragrunt/releases/download/v1.0.3/terragrunt_darwin_arm64.tar.gz"
+url_api = "https://api.github.com/repos/gruntwork-io/terragrunt/releases/assets/406654084"
 
 [tools.terragrunt."platforms.macos-x64"]
 checksum = "sha256:3133c2251e191aede8e3dd2a5b3aee2e91c5f08f88f117aee40eed9a24c8ef6b"
 url = "https://github.com/gruntwork-io/terragrunt/releases/download/v1.0.3/terragrunt_darwin_amd64.tar.gz"
+url_api = "https://api.github.com/repos/gruntwork-io/terragrunt/releases/assets/406653970"
 
 [tools.terragrunt."platforms.windows-x64"]
 checksum = "sha256:183b2745b4e04980a6bfa4450ff81956a12596ca22d70f7aaa793980f5b036db"
 url = "https://github.com/gruntwork-io/terragrunt/releases/download/v1.0.3/terragrunt_windows_amd64.exe.tar.gz"
+url_api = "https://api.github.com/repos/gruntwork-io/terragrunt/releases/assets/406654412"

deployment/mise.toml

@@ -1,6 +1,6 @@
 [tools]
-terragrunt = "1.0.3"
-opentofu = "1.11.6"
+terragrunt = "1.1.1"
+opentofu = "1.12.5"
 
 [tasks."tg:fmt"]
 run = "terragrunt hclfmt"

deployment/modules/cloudflare/docs-release/.terraform.lock.hcl

@@ -2,37 +2,35 @@
 # Manual edits may be lost in future updates.
 
 provider "registry.opentofu.org/cloudflare/cloudflare" {
-  version     = "4.52.7"
-  constraints = "4.52.7"
+  version     = "4.52.8"
+  constraints = "4.52.8"
   hashes = [
-    "h1:+O72J3QYiZtYmYYZM/Eh0f4NNfl1BvjX1eju43qTQsQ=",
-    "h1:0oqjYIPXcXh7XiDiKI085cHDYQQ5mh8kDl9dmBtvtog=",
-    "h1:4b4ESb87MGv5bnadgYe7sK5rEkKMZhbkQcwPubQTsR4=",
-    "h1:6mTr3eA1Ddb348lLmJuyvn98z4KF+ejqaUEJ76D1rzQ=",
-    "h1:9/3YH+9k9HqsvFtbmBf7SO2+xqZeZrXNKzLkjNuhUEA=",
-    "h1:Jcq4tBWgyH4/2JsojNBSRaN0mcItVMchO+lynonrlqc=",
-    "h1:Y4Vv/2RdP0Q+uxqhOxzOdKxuuEMjXPDcU0vPc5bCQzI=",
-    "h1:a0gW8FBKsbP9Fi0HEDoy49WIbEWVHk9+BR4/iwuBdDQ=",
-    "h1:gElv6iqJtg8OKN77gbw+MjrkrQmJHPkkMEi1J+0xkpU=",
-    "h1:oslXUugD/NQ+duJgT4BhKQyfGbuFOANknMvR73fiOeM=",
-    "h1:pPItIWii5oymR+geZB219ROSPuSODPLTlM4S/u8xLvM=",
-    "h1:u67GWw8GwD9NDlDzp9Y5VRnSQGcCrE8rSpkGPaBpDl0=",
-    "h1:uUUa9dY0XQOycI8pxg16PFFtL0WCTi9uEJz8trTQ7pU=",
-    "h1:y3rV8KF2q6GEMANNlf5EkKJurlfbKlIKpjGcdxoy7pQ=",
-    "zh:0c904ce31a4c6c4a5b3bf7ff1560e77c0cc7e2450c8553ded8e8c90398e1418b",
-    "zh:36183d310c36373fe4cb936b83c595c6fd3b0a94bc7827f28e5789ccbf59752e",
-    "zh:556a568a6f0235e8f41647de9e4d3a1e7b1d6502df8b19b54ec441f1c653ea10",
-    "zh:633ebbd5b0245e75e500ef9be4d9e62288f97e8da3baaa51323892a786d90285",
-    "zh:6acfe60cf52a65ba8f044f748548d2119e7f4fd7f8ebcb14698960d87c68f529",
+    "h1:2uxVaMaGPDJljXqYzuD6xtyfOKdNudtGIgawRTkFJIs=",
+    "h1:34HL1GDpqYdn2iEC+85pCi+NddZf30qH3fJ8y3P6CAM=",
+    "h1:4Z+uD+YY/7HrqdypM7DyUK+RtWepoLBc9fqtRQYZx4I=",
+    "h1:8Ss6wlJL2BHvkIZU1iaHvyUntqNhPFZ0fl6mjsxhctc=",
+    "h1:AYeWWMTWaNg01N3hivxr/6YlG41j1RietMnft9vLjUI=",
+    "h1:BGRNOzo8NUgbx5RwpWkWmr38f/s3txb7mzQhqfM5blI=",
+    "h1:EEXRMdC8bPlpLuOU8u+dE8mFJe3BpquFdH6vXcKseY4=",
+    "h1:ENp29e6O6OnaHJlbtmRlyjlAmm3Wt4mGctWUpBY3d0g=",
+    "h1:IAtBAbGVe1npj/n1NvCIZkSYGl7qaPYT+FnVdZ2CZ00=",
+    "h1:QRGGKngrxLORr4CImKXLDDJL5s67zUNBDAgk6FIIFNk=",
+    "h1:bNql6cC+MfDbaJK3q7a8C1m3A21o7e5mrjBIGtk0RdI=",
+    "h1:gmNv+PEOkYDdu+c15bfpcoAE3EI7pgmov9RMf3GZLsI=",
+    "h1:yieZ7NWRYQcLYHUevzDDrrmDkoQICM+3ZeX4i/mw9ME=",
+    "zh:08b305329a680a9213b2d8e642fbce7e4d97a524b1d2cef59e190ba9d678c477",
+    "zh:47975bd711ee18a46e589822171fa87474a552b332bfc8dea8fd1a64504eed8d",
+    "zh:5640d0d226bbafff3395542456c29feb942ca9c55ac01b4245a34c0590a33363",
+    "zh:5b0ad839fafba938c60a95d6b4a865843643591e97573ed2b9c4af3754064f74",
     "zh:890df766e9b839623b1f0437355032a3c006226a6c200cd911e15ee1a9014e9f",
-    "zh:904acc31ebb9d6ef68c792074b30532ee61bf515f19e0a3c75b46f126cca1f13",
-    "zh:a1d0a81246afc8750286d3f6fe7a8fbe6460dd2662407b28dbfbabb612e5fa9d",
-    "zh:a41a36fe253fc365fe2b7ffc749624688b2693b4634862fda161179ab100029f",
-    "zh:a7ef269e77ffa8715c8945a2c14322c7ff159ea44c15f62505f3cbb2cae3b32d",
-    "zh:b01aa3bed30610633b762df64332b26f8844a68c3960cebcb30f04918efc67fe",
-    "zh:b069cc2cd18cae10757df3ae030508eac8d55de7e49eda7a5e3e11f2f7fe6455",
-    "zh:b2d2c6313729ebb7465dceece374049e2d08bda34473901be9ff46a8836d42b2",
-    "zh:db0e114edaf4bc2f3d4769958807c83022bfbc619a00bdf4c4bd17faa4ab2d8b",
-    "zh:ecc0aa8b9044f664fd2aaf8fa992d976578f78478980555b4b8f6148e8d1a5fe",
+    "zh:93a9bc1139f5c02a44fdbf51fb2ce0891e2a42033b66febb928ccf72e870408f",
+    "zh:977f75cdf365686aa16ae02dcc0fc1769bae6f86be6e165393756c940bfb4af0",
+    "zh:9afcda2660b3dc6ee6329acea532a719225bd1f6cf46f695feb2d77160847c1b",
+    "zh:9e3da67b1b05b03d1f0c18b8677edf3797815b5dd49629f10eb2f457dccbed30",
+    "zh:b8d7da230f5266367c1b6b1cf31aa39087e231a87d55b71bb9d5c854ca1fcfe6",
+    "zh:cc96e7cd7350456b7a11a53d1c76c73a542de8359f9750f637ff865e8e77be91",
+    "zh:da1f58d067def243047bb7178cb197e2b9c3a791a9eb380ad92b73290615ae29",
+    "zh:ed5f3e1f59a338bcdce0a2537a8a2f299cfe18c168626799b2a9c97af3d8d3cb",
+    "zh:f16cc31f73a58a26ffe2d93223eddb7c340623a4e2ef38c6091766fd611e3e11",
   ]
 }

deployment/modules/cloudflare/docs-release/config.tf

@@ -5,7 +5,7 @@ terraform {
   required_providers {
     cloudflare = {
       source = "cloudflare/cloudflare"
-      version = "4.52.7"
+      version = "4.52.8"
     }
   }
 }

deployment/modules/cloudflare/docs/.terraform.lock.hcl

@@ -2,37 +2,35 @@
 # Manual edits may be lost in future updates.
 
 provider "registry.opentofu.org/cloudflare/cloudflare" {
-  version     = "4.52.7"
-  constraints = "4.52.7"
+  version     = "4.52.8"
+  constraints = "4.52.8"
   hashes = [
-    "h1:+O72J3QYiZtYmYYZM/Eh0f4NNfl1BvjX1eju43qTQsQ=",
-    "h1:0oqjYIPXcXh7XiDiKI085cHDYQQ5mh8kDl9dmBtvtog=",
-    "h1:4b4ESb87MGv5bnadgYe7sK5rEkKMZhbkQcwPubQTsR4=",
-    "h1:6mTr3eA1Ddb348lLmJuyvn98z4KF+ejqaUEJ76D1rzQ=",
-    "h1:9/3YH+9k9HqsvFtbmBf7SO2+xqZeZrXNKzLkjNuhUEA=",
-    "h1:Jcq4tBWgyH4/2JsojNBSRaN0mcItVMchO+lynonrlqc=",
-    "h1:Y4Vv/2RdP0Q+uxqhOxzOdKxuuEMjXPDcU0vPc5bCQzI=",
-    "h1:a0gW8FBKsbP9Fi0HEDoy49WIbEWVHk9+BR4/iwuBdDQ=",
-    "h1:gElv6iqJtg8OKN77gbw+MjrkrQmJHPkkMEi1J+0xkpU=",
-    "h1:oslXUugD/NQ+duJgT4BhKQyfGbuFOANknMvR73fiOeM=",
-    "h1:pPItIWii5oymR+geZB219ROSPuSODPLTlM4S/u8xLvM=",
-    "h1:u67GWw8GwD9NDlDzp9Y5VRnSQGcCrE8rSpkGPaBpDl0=",
-    "h1:uUUa9dY0XQOycI8pxg16PFFtL0WCTi9uEJz8trTQ7pU=",
-    "h1:y3rV8KF2q6GEMANNlf5EkKJurlfbKlIKpjGcdxoy7pQ=",
-    "zh:0c904ce31a4c6c4a5b3bf7ff1560e77c0cc7e2450c8553ded8e8c90398e1418b",
-    "zh:36183d310c36373fe4cb936b83c595c6fd3b0a94bc7827f28e5789ccbf59752e",
-    "zh:556a568a6f0235e8f41647de9e4d3a1e7b1d6502df8b19b54ec441f1c653ea10",
-    "zh:633ebbd5b0245e75e500ef9be4d9e62288f97e8da3baaa51323892a786d90285",
-    "zh:6acfe60cf52a65ba8f044f748548d2119e7f4fd7f8ebcb14698960d87c68f529",
+    "h1:2uxVaMaGPDJljXqYzuD6xtyfOKdNudtGIgawRTkFJIs=",
+    "h1:34HL1GDpqYdn2iEC+85pCi+NddZf30qH3fJ8y3P6CAM=",
+    "h1:4Z+uD+YY/7HrqdypM7DyUK+RtWepoLBc9fqtRQYZx4I=",
+    "h1:8Ss6wlJL2BHvkIZU1iaHvyUntqNhPFZ0fl6mjsxhctc=",
+    "h1:AYeWWMTWaNg01N3hivxr/6YlG41j1RietMnft9vLjUI=",
+    "h1:BGRNOzo8NUgbx5RwpWkWmr38f/s3txb7mzQhqfM5blI=",
+    "h1:EEXRMdC8bPlpLuOU8u+dE8mFJe3BpquFdH6vXcKseY4=",
+    "h1:ENp29e6O6OnaHJlbtmRlyjlAmm3Wt4mGctWUpBY3d0g=",
+    "h1:IAtBAbGVe1npj/n1NvCIZkSYGl7qaPYT+FnVdZ2CZ00=",
+    "h1:QRGGKngrxLORr4CImKXLDDJL5s67zUNBDAgk6FIIFNk=",
+    "h1:bNql6cC+MfDbaJK3q7a8C1m3A21o7e5mrjBIGtk0RdI=",
+    "h1:gmNv+PEOkYDdu+c15bfpcoAE3EI7pgmov9RMf3GZLsI=",
+    "h1:yieZ7NWRYQcLYHUevzDDrrmDkoQICM+3ZeX4i/mw9ME=",
+    "zh:08b305329a680a9213b2d8e642fbce7e4d97a524b1d2cef59e190ba9d678c477",
+    "zh:47975bd711ee18a46e589822171fa87474a552b332bfc8dea8fd1a64504eed8d",
+    "zh:5640d0d226bbafff3395542456c29feb942ca9c55ac01b4245a34c0590a33363",
+    "zh:5b0ad839fafba938c60a95d6b4a865843643591e97573ed2b9c4af3754064f74",
     "zh:890df766e9b839623b1f0437355032a3c006226a6c200cd911e15ee1a9014e9f",
-    "zh:904acc31ebb9d6ef68c792074b30532ee61bf515f19e0a3c75b46f126cca1f13",
-    "zh:a1d0a81246afc8750286d3f6fe7a8fbe6460dd2662407b28dbfbabb612e5fa9d",
-    "zh:a41a36fe253fc365fe2b7ffc749624688b2693b4634862fda161179ab100029f",
-    "zh:a7ef269e77ffa8715c8945a2c14322c7ff159ea44c15f62505f3cbb2cae3b32d",
-    "zh:b01aa3bed30610633b762df64332b26f8844a68c3960cebcb30f04918efc67fe",
-    "zh:b069cc2cd18cae10757df3ae030508eac8d55de7e49eda7a5e3e11f2f7fe6455",
-    "zh:b2d2c6313729ebb7465dceece374049e2d08bda34473901be9ff46a8836d42b2",
-    "zh:db0e114edaf4bc2f3d4769958807c83022bfbc619a00bdf4c4bd17faa4ab2d8b",
-    "zh:ecc0aa8b9044f664fd2aaf8fa992d976578f78478980555b4b8f6148e8d1a5fe",
+    "zh:93a9bc1139f5c02a44fdbf51fb2ce0891e2a42033b66febb928ccf72e870408f",
+    "zh:977f75cdf365686aa16ae02dcc0fc1769bae6f86be6e165393756c940bfb4af0",
+    "zh:9afcda2660b3dc6ee6329acea532a719225bd1f6cf46f695feb2d77160847c1b",
+    "zh:9e3da67b1b05b03d1f0c18b8677edf3797815b5dd49629f10eb2f457dccbed30",
+    "zh:b8d7da230f5266367c1b6b1cf31aa39087e231a87d55b71bb9d5c854ca1fcfe6",
+    "zh:cc96e7cd7350456b7a11a53d1c76c73a542de8359f9750f637ff865e8e77be91",
+    "zh:da1f58d067def243047bb7178cb197e2b9c3a791a9eb380ad92b73290615ae29",
+    "zh:ed5f3e1f59a338bcdce0a2537a8a2f299cfe18c168626799b2a9c97af3d8d3cb",
+    "zh:f16cc31f73a58a26ffe2d93223eddb7c340623a4e2ef38c6091766fd611e3e11",
   ]
 }

deployment/modules/cloudflare/docs/config.tf

@@ -5,7 +5,7 @@ terraform {
   required_providers {
     cloudflare = {
       source = "cloudflare/cloudflare"
-      version = "4.52.7"
+      version = "4.52.8"
     }
   }
 }

docker/docker-compose.dev.yml

@@ -154,7 +154,7 @@ services:
 
   redis:
     container_name: immich_redis
-    image: docker.io/valkey/valkey:9@sha256:4963247afc4cd33c7d3b2d2816b9f7f8eeebab148d29056c2ca4d7cbc966f2d9
+    image: docker.io/valkey/valkey:9@sha256:3acc0687f2a2e1091fae6450d7842dd658c941338cf0a873ddd9e14b9e4ea4dd
     healthcheck:
       test: redis-cli ping || exit 1
 

docker/docker-compose.prod.yml

@@ -56,7 +56,7 @@ services:
 
   redis:
     container_name: immich_redis
-    image: docker.io/valkey/valkey:9@sha256:4963247afc4cd33c7d3b2d2816b9f7f8eeebab148d29056c2ca4d7cbc966f2d9
+    image: docker.io/valkey/valkey:9@sha256:3acc0687f2a2e1091fae6450d7842dd658c941338cf0a873ddd9e14b9e4ea4dd
     healthcheck:
       test: redis-cli ping || exit 1
     restart: always
@@ -85,7 +85,7 @@ services:
     container_name: immich_prometheus
     ports:
       - 9090:9090
-    image: prom/prometheus@sha256:69f5241418838263316593f7274a304b095c40bcf22e57272865da91bd60a8ac
+    image: prom/prometheus@sha256:508729e0e2d18e11fd742a5a5ca70e557b940a93948c3c95fd0123a6fd538b69
     volumes:
       - ./prometheus.yml:/etc/prometheus/prometheus.yml
       - prometheus-data:/prometheus
@@ -97,7 +97,7 @@ services:
     command: ['./run.sh', '-disable-reporting']
     ports:
       - 3000:3000
-    image: grafana/grafana:12.4.4-ubuntu@sha256:df2e7ef5f32f771794cf76bad5f2bceac227036460a2cc269a9045e5662abc58
+    image: grafana/grafana:12.4.7-ubuntu@sha256:d327f509400334fbea74a282d287f20c3187222741ec99e76f253cac16c90129
     volumes:
       - grafana-data:/var/lib/grafana
 

docker/docker-compose.rootless.yml

@@ -51,8 +51,6 @@ services:
       - NET_RAW
     volumes:
       - ./ml-model-cache:/cache
-      - ./ml-dotcache:/.cache
-      - ./ml-config:/.config
     env_file:
       - .env
     restart: always
@@ -61,7 +59,7 @@ services:
 
   redis:
     container_name: immich_redis
-    image: docker.io/valkey/valkey:9@sha256:4963247afc4cd33c7d3b2d2816b9f7f8eeebab148d29056c2ca4d7cbc966f2d9
+    image: docker.io/valkey/valkey:9@sha256:3acc0687f2a2e1091fae6450d7842dd658c941338cf0a873ddd9e14b9e4ea4dd
     user: '1000:1000'
     security_opt:
       - no-new-privileges:true

docker/docker-compose.yml

@@ -49,7 +49,7 @@ services:
 
   redis:
     container_name: immich_redis
-    image: docker.io/valkey/valkey:9@sha256:4963247afc4cd33c7d3b2d2816b9f7f8eeebab148d29056c2ca4d7cbc966f2d9
+    image: docker.io/valkey/valkey:9@sha256:3acc0687f2a2e1091fae6450d7842dd658c941338cf0a873ddd9e14b9e4ea4dd
     healthcheck:
       test: redis-cli ping || exit 1
     restart: always

docker/example.env

@@ -10,7 +10,7 @@ DB_DATA_LOCATION=./postgres
 # TZ=Etc/UTC
 
 # The Immich version to use. You can pin this to a specific version like "v2.1.0"
-IMMICH_VERSION=v2
+IMMICH_VERSION=v3
 
 # Connection secret for postgres. You should change it to a random password
 # Please use only the characters `A-Za-z0-9`, without special characters or spaces

docs/docs/FAQ.mdx

@@ -409,12 +409,10 @@ To decrease Redis logs, you can add the following line to the `redis:` section o
 
 You can change the user in the container by setting the `user` argument in `docker-compose.yml` for each service.
 
-[Example docker-compose.yml file](https://github.com/immich-app/immich/blob/main/docker/docker-compose.rootless.yml)
+[Example docker-compose.rootless.yml file](https://github.com/immich-app/immich/blob/main/docker/docker-compose.rootless.yml)
 
 You may need to add mount points or docker volumes for the following internal container paths:
 
-- `immich-machine-learning:/.config`
-- `immich-machine-learning:/.cache`
 - `redis:/data`
 
 The non-root user/group needs read/write access to the volume mounts, including `UPLOAD_LOCATION` and `/cache` for machine-learning.

docs/docs/administration/backup-and-restore.md

@@ -31,7 +31,7 @@ You can trigger a database backup manually:
 
 1. Go to **Administration > Job Queues**
 2. Click **Create job** in the top right
-3. Select **Create Database Backup** and click **Confirm**
+3. Select **Create Database Dump** and click **Confirm**
 
 The backup will appear in `UPLOAD_LOCATION/backups` and counts toward your retention limit.
 

docs/docs/administration/email-notification.mdx

@@ -14,6 +14,8 @@ Under Email, enter the required details to connect with an SMTP server.
 
 You can use [this guide](/guides/smtp-gmail) to use Gmail's SMTP server.
 
+You can use [this guide](/guides/smtp-microsoft365) to use Microsoft's SMTP server.
+
 ## User's notifications settings
 
 Users can manage their email notification settings from their account settings page on the web. They can choose to turn email notifications on or off for the following events:

docs/docs/administration/oauth.md

@@ -280,7 +280,7 @@ Configuration of OAuth in Immich System Settings
 | ---------------------------- | ----------------------------------------------------- |
 | Issuer URL                   | `https://<KEYCLOAK_DOMAIN>/realms/<YOUR_REALM>`       |
 | Client ID                    | immich                                                |
-| Client Secret                | can be optained from Clients -> immich -> Credentials |
+| Client Secret                | can be obtained from Clients -> immich -> Credentials |
 | Scope                        | openid email profile                                  |
 | Signing Algorithm            | RS256                                                 |
 | Storage Label Claim          | preferred_username                                    |

docs/docs/administration/server-commands.md

@@ -35,6 +35,7 @@ Found Admin:
 - Email=admin@example.com
 - Name=Immich Admin
 ? Please choose a new password (optional) immich-is-cool
+? Invalidate existing sessions? Yes
 The admin password has been updated.
 ```
 

docs/docs/administration/system-integrity.md

@@ -1,5 +1,30 @@
 # System Integrity
 
+## Integrity report
+
+At a [customizable interval](https://my.immich.app/admin/system-settings?isOpen=integrity-checks), Immich runs integrity checks to ensure that your library is still intact and there are no corrupt files.
+There are three kind of issues Immich checks for:
+
+- Untracked files: the path was found in Immich's directories but it is not referenced in Immich's database
+- Missing files: the path is found in the Immich internal database, but does not actually exist on disk
+- Checksum mismatches: the checksum of the file stored in Immich's database does not match the actual file's checksum anymore
+
+All three run nightly at 3am by default. For the "Checksum files" check, there are additional time and progress limits, as those are the most taxing checks. With these additional limits, Immich can slowly check checksums of your files over the course of a couple of days.
+
+You can see the results of these checks on the [maintenance](https://my.immich.app/admin/maintenance) page. Here, you can also trigger a full scan (a _check_) for specific jobs, or all of them. In addition, you can also _refresh_ checks. This will only look at items that have currently been reported on, and check if those have been fixed.
+
+### Common causes
+
+Most common are untracked files. In many cases those are corrupted thumbnails or encoded videos that have been partially generated at some point and never got cleaned up properly. These are usually fine to delete, as both can always be regenerated at a later point. Other files will need to be investigated on a case-by-case basis by checking they already exist in Immich and thinking about how they might have gotten untracked.
+
+:::info
+You might want to run the _missing_ jobs for thumbnails and encoded videos (https://my.immich.app/admin/queues) to make sure all your assets have proper thumbnails and encoded videos. Watch the server logs while running the jobs, in case there are any issues with some assets.
+:::
+
+Missing files are files where Immich references them internally, but they don't actually exist on disk in that location. It could be that you deleted a file on disk from the internal library (don't do that, Immich doesn't support it). It could also be that there are issues with your file storage. Please carefully investigate missing files, and never hesitate to reach out on [our Discord](https://discord.immich.app) if you have any questions!
+
+Checksum mismatches are often indicative of file system corruption. It could also be that you previously edited a file from the internal library on the disk, which is also not supported and will cause a checksum mismatch. Again, the recommended action is to look at any reported item individually, check it out, try to remember if you changed it or some metadata on it at some point. If you edited the file, the supported resolution is to delete the mismatched asset from Immich and reupload it as a new asset.
+
 ## Folder checks
 
 :::info
@@ -40,7 +65,7 @@ The above error messages show that the server has previously (successfully) writ
 
 ### Ignoring the checks
 
-:::warning
+:::danger
 The checks are designed to catch common problems that we have seen users have in the past, and often indicate there's something wrong that you should solve. If you know what you're doing and you want to disable them you can set the following environment variable:
 :::
 

docs/docs/api.md

@@ -10,4 +10,4 @@ OpenAPI is used to generate the client (Typescript, Dart) SDK. `openapi-generato
 mise open-api
 ```
 
-You can find the generated client SDK in the `packages/sdk/client` for Typescript SDK and `mobile/openapi` for Dart SDK.
+You can find the generated client SDK in the `packages/sdk/client` for Typescript SDK and `mobile/generated/openapi` for Dart SDK.

docs/docs/developer/directories.md

@@ -12,11 +12,11 @@ Our [GitHub Repository](https://github.com/immich-app/immich) is a [monorepo](ht
 | `.vscode/`          | VSCode debug launch profiles                                         |
 | `packages/cli`      | Source code for the CLI                                              |
 | `packages/sdk`      | Source code for the generated OpenAPI SDK                            |
+| `packages/scripts`  | Scripts for version bumps and draft releases                         |
 | `docker/`           | Docker compose resources for dev, test, production                   |
 | `design/`           | Screenshots and logos for the README                                 |
 | `docs/`             | Source code for the [https://immich.app](https://immich.app) website |
 | `machine-learning/` | Source code for the `immich-machine-learning` docker image           |
-| `misc/release/`     | Scripts for version bumps and draft releases                         |
 | `mobile/`           | Source code for the mobile app, both Android and iOS                 |
 | `server/`           | Source code for the `immich-server` docker image                     |
 | `web/`              | Source code for the `web`                                            |

docs/docs/developer/setup.md

@@ -30,7 +30,7 @@ This environment includes the services below. Additional details are available i
 - Redis
 - PostgreSQL development database with exposed port `5432` so you can use any database client to access it
 
-All the services are packaged to run as with single Docker Compose command.
+All the services are packaged to run with a single Docker Compose command.
 
 :::tip mise
 [mise](https://mise.jdx.dev) is used throughout the project to manage tool versions and run tasks. [Install mise](https://mise.jdx.dev/installing-mise.html), then from the repo root run `mise trust` and `mise install` to get all required tools. Tasks for each service can be run from the repo root using `mise //namespace:task` (e.g. `mise //server:lint`). To list all available tasks, run `mise tasks ls --all`.
@@ -41,7 +41,7 @@ All the services are packaged to run as with single Docker Compose command.
 1. Clone the project repo.
 2. Run `cp docker/example.env docker/.env`.
 3. Edit `docker/.env` to provide values for the required variable `UPLOAD_LOCATION`.
-4. Install dependencies - `pnpm i`
+4. Install dependencies - `mise x -- pnpm i`
 5. From the root directory, run:
 
 ```bash title="Start development server"
@@ -52,7 +52,7 @@ mise dev
 
 All the services will be started with hot-reloading enabled for a quick feedback loop.
 
-You can access the web from `http://your-machine-ip:3000` or `http://localhost:3000` and access the server from the mobile app at `http://your-machine-ip:3000/api`
+You can access the web from `http://your-machine-ip:3000` or `http://localhost:3000` and access the server from the mobile app at `http://your-machine-ip:3000`
 
 **Notes:**
 
@@ -99,6 +99,21 @@ To see local changes to `@immich/ui` in Immich, do the following:
 2. Run `mise //mobile:translation` to generate the translation file.
 3. Change to the `mobile/` directory and run `flutter run` to start the app.
 
+##### iOS Code Signing
+
+The Immich Apple Team ID and bundle IDs are specified in `mobile/ios/Signing.xcconfig`. For local development, we provide an override mechanism.
+
+Create `mobile/ios/Signing.local.xcconfig` and populate it with the necessary values needed to build and sign Immich yourself. This local override file is gitignored.
+
+```
+IMMICH_TEAM_ID = ABCDE12345
+IMMICH_BUNDLE_ID_PROD = com.customuniqueid.immich
+IMMICH_BUNDLE_ID_DEV = com.customuniqueid.immichdev
+IMMICH_GROUP_ID = group.com.customuniqueid.immich
+```
+
+The environment values are used across Immich's targets and schemes to prevent redundant edits by contributors.
+
 #### Translation
 
 To add a new translation text, enter the key-value pair in the `i18n/en.json` in the root of the immich project. Then run:

docs/docs/features/command-line-interface.md

@@ -99,6 +99,7 @@ Options:
   -H, --include-hidden        Include hidden folders (default: false, env: IMMICH_INCLUDE_HIDDEN)
   -a, --album                 Automatically create albums based on folder name (default: false, env: IMMICH_AUTO_CREATE_ALBUM)
   -A, --album-name <name>     Add all assets to specified album (env: IMMICH_ALBUM_NAME)
+  --visibility <visibility>   Set the visibility of uploaded assets (choices: "archive", "timeline", "hidden", "locked", env: IMMICH_VISIBILITY)
   -n, --dry-run               Don't perform any actions, just show what will be done (default: false, env: IMMICH_DRY_RUN)
   -c, --concurrency <number>  Number of assets to upload at the same time (default: 4, env: IMMICH_UPLOAD_CONCURRENCY)
   -j, --json-output           Output detailed information in json format (default: false, env: IMMICH_JSON_OUTPUT)
@@ -176,6 +177,12 @@ By default, hidden files are skipped. If you want to include hidden files, use t
 immich upload --include-hidden --recursive directory/
 ```
 
+You can set the visibility of uploaded assets to `archive`, `timeline`, `hidden`, or `locked` with the `--visibility` option:
+
+```bash
+immich upload --visibility archive --recursive directory/
+```
+
 You can use the `--json-output` option to get a json printed which includes
 three keys: `newFiles`, `duplicates` and `newAssets`. Due to some logging
 output you will need to strip the first three lines of output to get the json.

docs/docs/features/duplicates-utility.md

@@ -15,14 +15,14 @@ When using "Deduplicate All" or viewing suggestions, Immich automatically presel
 
 ### Synchronizing metadata
 
-When resolving duplicates, metadata from trashed assets is automatically synchronized to the kept assets. The following metadata is synchronized:
+When resolving duplicates, metadata from trashed assets is automatically synchronized to the kept asset. This synchronization only happens when **exactly one** asset is kept and at least one asset is trashed. When more than one asset is kept, metadata is not merged — the assets keep their own metadata and are simply removed from the duplicate group. The following metadata is synchronized:
 
-| Name        | Description                                                                                                                     |
-| ----------- | ------------------------------------------------------------------------------------------------------------------------------- |
-| Album       | The kept assets will be added to _every_ album that the other assets in the group belong to.                                    |
-| Favorite    | If any of the assets in the group have been added to favorites, every kept asset will also be added to favorites.               |
-| Rating      | If one or more assets in the duplicate group have a rating, the highest rating is selected and synchronized to the kept assets. |
-| Description | Descriptions from each asset are combined together and synchronized to all the kept assets.                                     |
-| Visibility  | The most restrictive visibility is applied to the kept assets.                                                                  |
-| Location    | Latitude and longitude are copied if all assets with geolocation data in the group share the same coordinates.                  |
-| Tag         | Tags from all assets in the group are merged and applied to every kept asset.                                                   |
+| Name        | Description                                                                                                                    |
+| ----------- | ------------------------------------------------------------------------------------------------------------------------------ |
+| Album       | The kept asset will be added to _every_ album that the other assets in the group belong to.                                    |
+| Favorite    | If any of the assets in the group have been added to favorites, the kept asset will also be added to favorites.                |
+| Rating      | If one or more assets in the duplicate group have a rating, the highest rating is selected and synchronized to the kept asset. |
+| Description | Descriptions from each asset are combined together and synchronized to the kept asset.                                         |
+| Visibility  | The most restrictive visibility is applied to the kept asset.                                                                  |
+| Location    | Latitude and longitude are copied if all assets with geolocation data in the group share the same coordinates.                 |
+| Tag         | Tags from all assets in the group are merged and applied to the kept asset.                                                    |

docs/docs/guides/smtp-microsoft365.md

@@ -0,0 +1,19 @@
+# SMTP settings using Microsoft 365
+
+This guide walks you through how to get the information you need to set up your Immich instance to send emails using Microsoft's SMTP server.
+
+## Create an app password
+
+You will need to generate an app password to use your Microsoft email in Immich. Depending on if you have a personal or business account, you can use https://go.microsoft.com/fwlink/?linkid=2274139 or https://myaccount.microsoft.com/securtiy-info respectively.
+
+## Entering the SMTP credential in Immich
+
+Entering your credential in Immich's email notification settings at `Administration -> Settings -> Notification Settings`
+
+Host: smtp-mail.outlook.com
+Port: 587
+username: your mail address
+Password: app password you created earlier
+SMTPS: set it to disabled
+
+<img src={require('./img/email-ms-settings.webp').default} width="80%" title="SMTP settings" />

docs/docs/install/config-file.md

@@ -6,14 +6,18 @@ sidebar_position: 100
 
 A config file can be provided as an alternative to the UI configuration.
 
+:::note Interaction with the web UI
+While the config file does not need to include all keys from the below example, specifying `IMMICH_CONFIG_FILE` will disable the ability to edit other properties from the Immich web UI.
+:::
+
 ### Step 1 - Create a new config file
 
-In JSON format, create a new config file (e.g. `immich.json`) and put it in a location mounted in the container that can be accessed by Immich.
+In JSON format, create a new config file (e.g. `immich-config.json`) and put it in a location mounted in the container that can be accessed by Immich.
 YAML-formatted config files are also supported.
 The default configuration looks like this:
 
 <details>
-<summary>immich.json</summary>
+<summary>immich-config.json</summary>
 
 ```json
 {
@@ -250,6 +254,10 @@ So you can just grab it from there, paste it into a file and you're pretty much
 
 ### Step 2 - Specify the file location
 
+:::note
+If you have any `microservices` workers, they will also need to have the config file mounted to their container.
+:::
+
 In your `.env` file, set the variable `IMMICH_CONFIG_FILE` to the path of your config.
 For more information, refer to the [Environment Variables](/install/environment-variables.md) section.
 
@@ -261,7 +269,7 @@ It is recommended to reuse this variable in your `docker-compose.yml`:
 
 ```yaml
 volumes:
-  - ./configuration.yml:${IMMICH_CONFIG_FILE}
+  - ./immich-config.json:${IMMICH_CONFIG_FILE}
 ```
 
 :::

docs/docs/install/environment-variables.md

@@ -19,7 +19,7 @@ If this does not work, try running `docker compose up -d --force-recreate`.
 
 | Variable           | Description                     | Default | Containers               |
 | :----------------- | :------------------------------ | :-----: | :----------------------- |
-| `IMMICH_VERSION`   | Image tags                      |  `v2`   | server, machine learning |
+| `IMMICH_VERSION`   | Image tags                      |  `v3`   | server, machine learning |
 | `UPLOAD_LOCATION`  | Host path for uploads           |         | server                   |
 | `DB_DATA_LOCATION` | Host path for Postgres database |         | database                 |
 
@@ -45,7 +45,7 @@ These environment variables are used by the `docker-compose.yml` file and do **N
 | `IMMICH_PROCESS_INVALID_IMAGES`     | When `true`, generate thumbnails for invalid images                                                                                                                  |                              | server                   | microservices      |
 | `IMMICH_TRUSTED_PROXIES`            | List of comma-separated IPs set as trusted proxies                                                                                                                   |                              | server                   | api                |
 | `IMMICH_IGNORE_MOUNT_CHECK_ERRORS`  | See [System Integrity](/administration/system-integrity)                                                                                                             |                              | server                   | api, microservices |
-| `IMMICH_ALLOW_SETUP`                | When `false` disables the `/auth/admin-sign-up` endpoint                                                                                                             |            `true`            | server                   | api                |
+| `IMMICH_ALLOW_SETUP`                | When `false` disables the `/auth/admin-sign-up` and `/admin/database-backups/start-restore` endpoints                                                                |            `true`            | server                   | api                |
 
 \*1: `TZ` should be set to a `TZ identifier` from [this list][tz-list]. For example, `TZ="Etc/UTC"`.
 `TZ` is used by `exiftool` as a fallback in case the timezone cannot be determined from the image metadata. It is also used for logfile timestamps and cron job execution.
@@ -89,7 +89,7 @@ Information on the current workers can be found [here](/administration/jobs-work
 
 \*1: The values of `DB_USERNAME`, `DB_PASSWORD`, and `DB_DATABASE_NAME` are passed to the Postgres container as the variables `POSTGRES_USER`, `POSTGRES_PASSWORD`, and `POSTGRES_DB` in `docker-compose.yml`.
 
-\*2: If not provided, the appropriate extension to use is auto-detected at startup by introspecting the database. When multiple extensions are installed, the order of preference is VectorChord, pgvecto.rs, pgvector.
+\*2: If not provided, the appropriate extension to use is auto-detected at startup by inspecting the database. When multiple extensions are installed, the order of preference is VectorChord, pgvector.
 
 \*3: Uses either [`postgresql.ssd.conf`](https://github.com/immich-app/base-images/blob/main/postgres/postgresql.ssd.conf) or [`postgresql.hdd.conf`](https://github.com/immich-app/base-images/blob/main/postgres/postgresql.hdd.conf) which mainly controls the Postgres `effective_io_concurrency` setting to allow for concurrenct IO on SSDs and sequential IO on HDDs.
 

docs/docs/install/synology.md

@@ -7,7 +7,7 @@ sidebar_position: 85
 :::note
 This is a community contribution and not officially supported by the Immich team, but included here for convenience.
 
-Community support can be found in the dedicated channel on the [Discord Server](https://discord.immich.app/).
+Community support should be directed to Synology-specific support platforms.
 :::
 
 Immich can easily be installed on a Synology NAS using Container Manager within DSM. If you have not installed Container Manager already, you can install it in the Packages Center. Refer to the [Container Manager docs](https://kb.synology.com/en-us/DSM/help/ContainerManager/docker_desc?version=7) for more information on using Container Manager.

docs/docs/install/unraid.md

@@ -1,13 +1,19 @@
 ---
-sidebar_position: 60
+sidebar_position: 70
 ---
 
-# Unraid
+# Unraid [ Community ]
+
+:::note
+This is a community contribution and not officially supported by the Immich team, but included here for convenience.
+
+Community support can be found in the dedicated channel on the [Discord Server](https://discord.immich.app/).
+:::
 
 Immich can easily be installed and updated on Unraid via:
 
-1. [Docker Compose Manager](https://forums.unraid.net/topic/114415-plugin-docker-compose-manager/) plugin from the Unraid Community Apps
-2. Community made template on the Unraid Community Apps
+1. Community made template on the Unraid Community Apps
+2. [Docker Compose Manager](https://forums.unraid.net/topic/114415-plugin-docker-compose-manager/) plugin from the Unraid Community Apps
 
 ## Community Applications Template
 
@@ -23,7 +29,7 @@ Once you have Redis and PostgreSQL running, search for Immich on the Unraid CA,
 
 For more information about setting up the community image see [here](https://github.com/imagegenius/docker-immich#application-setup)
 
-## Docker-Compose Method (Official)
+## Docker-Compose Method
 
 :::info
 
@@ -121,7 +127,7 @@ alt="Go to Docker Tab and visit the address listed next to immich-web"
         width="90%"
         alt="Go to Docker Tab and visit the address listed next to immich-web"
     />
-    
+
 </details>
 
 :::tip

docs/docs/install/upgrading.md

@@ -28,11 +28,15 @@ docker image prune
 
 ## Versioning Policy
 
-Immich follows [semantic versioning][semver], which tags releases in the format `<major>.<minor>.<patch>`. We intend for breaking changes to be limited to major version releases.
-You can configure your Docker image to point to the current major version by using a metatag, such as `:v2`.
+Immich follows [semantic versioning][semver], which tags releases in the format `<major>.<minor>.<patch>`.
+We intend for breaking changes, including those to the API or deployment, to be limited to major version releases.
+You can configure your Docker image to point to the current major version by using a metatag, such as `:v3`. These metatags do not follow release candidates.
 
-Currently, we have no plans to backport patches to earlier versions. We encourage all users to run the most recent release of Immich.
-Switching back to an earlier version, even within the same minor release tag, is not supported.
+The mobile app is typically compatible with the current and prior major version. However, the server is only compatible with the matching major version.
+Thus, we recommend upgrading all mobile clients before upgrading the server to ensure compatibility.
+
+We do not backport patches to earlier versions. We encourage all users to run the most recent stable release of Immich.
+Downgrading to an earlier version, even within the same minor version, is not supported.
 
 [semver]: https://semver.org/
 

docs/docs/partials/_mobile-app-download.md

@@ -1,7 +1,7 @@
 The mobile app can be downloaded from the following places:
 
-- Obtainium: You can get your Obtainium config link from the [Utilities page of your Immich server](https://my.immich.app/utilities).
-- [Google Play Store](https://play.google.com/store/apps/details?id=app.alextran.immich)
 - [Apple App Store](https://apps.apple.com/us/app/immich/id1613945652)
-- [F-Droid](https://f-droid.org/packages/app.alextran.immich)
-- [GitHub Releases (apk)](https://github.com/immich-app/immich/releases)
+- [Google Play Store](https://play.google.com/store/apps/details?id=app.alextran.immich)
+- [GitHub Releases (APK)](https://github.com/immich-app/immich/releases)
+- Obtainium: You can get your Obtainium config link from the [Utilities page of your Immich server](https://my.immich.app/utilities).
+- [F-Droid](https://app.futo.org/fdroid/repo/)

docs/docusaurus.config.js

@@ -191,7 +191,7 @@ const config = {
               },
               {
                 label: 'Privacy Policy',
-                to: '/privacy-policy',
+                href: 'https://immich.app/privacy-policy',
               },
             ],
           },

docs/mise.lock

@@ -1,7 +1,7 @@
 # @generated - this file is auto-generated by `mise lock` https://mise.en.dev/dev-tools/mise-lock.html
 
 [[tools.wrangler]]
-version = "4.100.0"
+version = "4.110.0"
 backend = "npm:wrangler"
 
 [tools.wrangler.options]

docs/mise.toml

@@ -28,4 +28,4 @@ run = "prettier --write ."
 run = "wrangler pages deploy build --project-name=${PROJECT_NAME} --branch=${BRANCH_NAME}"
 
 [tools]
-wrangler = "4.100.0"
+wrangler = "4.119.0"

docs/package.json

@@ -40,7 +40,8 @@
     "@docusaurus/tsconfig": "^3.10.0",
     "@docusaurus/types": "^3.10.0",
     "prettier": "^3.7.4",
-    "typescript": "^6.0.0"
+    "@typescript/native": "npm:typescript@^7.0.2",
+    "typescript": "npm:@typescript/typescript6@^6.0.2"
   },
   "browserslist": {
     "production": [

docs/src/components/timeline.tsx

@@ -1,78 +0,0 @@
-import useIsBrowser from '@docusaurus/useIsBrowser';
-import { mdiCheckboxBlankCircle, mdiCheckboxMarkedCircle } from '@mdi/js';
-import Icon from '@mdi/react';
-import React from 'react';
-
-export type Item = {
-  icon: string;
-  iconColor: string;
-  title: string;
-  description?: string;
-  link?: { url: string; text: string };
-  done?: false;
-  getDateLabel: (language: string) => string;
-};
-
-interface Props {
-  items: Item[];
-}
-
-export function Timeline({ items }: Props): JSX.Element {
-  const isBrowser = useIsBrowser();
-
-  return (
-    <ul className="flex flex-col pl-4">
-      {items.map((item, index) => {
-        const isFirst = index === 0;
-        const isLast = index === items.length - 1;
-        const done = item.done ?? true;
-        const dateLabel = item.getDateLabel(isBrowser ? navigator.language : 'en-US');
-        const timelineIcon = done ? mdiCheckboxMarkedCircle : mdiCheckboxBlankCircle;
-        const cardIcon = item.icon;
-
-        return (
-          <li key={index} className={`flex min-h-24 w-[700px] max-w-[90vw] ${done ? '' : 'italic'}`}>
-            <div className="md:flex justify-start w-36 mr-8 items-center dark:text-immich-dark-primary text-immich-primary hidden">
-              {dateLabel}
-            </div>
-            <div className={`${isFirst && 'relative top-[50%]'} ${isLast && 'relative bottom-[50%]'}`}>
-              <div
-                className={`h-full border-solid border-4 border-immich-primary dark:border-immich-dark-primary ${
-                  isFirst && 'rounded rounded-t-full'
-                } ${isLast && 'rounded rounded-b-full'}`}
-              ></div>
-            </div>
-            <div className="z-10 flex items-center bg-immich-primary dark:bg-immich-dark-primary border-2 border-solid rounded-full dark:text-black text-white relative top-[50%] left-[-3px] translate-y-[-50%] translate-x-[-50%] w-8 h-8 shadow-lg ">
-              {<Icon path={timelineIcon} size={1.25} />}
-            </div>
-            <section className=" dark:bg-immich-dark-gray bg-immich-gray dark:border-0 border-gray-200 border border-solid rounded-2xl flex flex-row w-full gap-2 p-4 md:ml-4 my-2 hover:bg-immich-primary/10 dark:hover:bg-immich-dark-primary/10 transition-all">
-              <div className="flex flex-col flex-grow justify-between gap-2">
-                <div className="flex gap-2 items-center">
-                  {cardIcon === 'immich' ? (
-                    <img src="/img/immich-logo.svg" height="30" className="rounded-none" />
-                  ) : (
-                    <Icon path={cardIcon} size={1} color={item.iconColor} />
-                  )}
-                  <p className="m-0 mt-1 text-lg items-start flex gap-2 place-items-center content-center">
-                    <span>{item.title}</span>
-                  </p>
-                </div>
-                <p className="m-0 text-sm text-gray-600 dark:text-gray-300">{item.description}</p>
-              </div>
-              <div className="flex flex-col justify-between place-items-end">
-                <span className="dark:text-immich-dark-primary text-immich-primary">
-                  {item.link && (
-                    <a href={item.link.url} target="_blank" rel="noopener">
-                      [{item.link.text}]
-                    </a>
-                  )}
-                </span>
-                <div className="md:hidden text-sm text-right">{dateLabel}</div>
-              </div>
-            </section>
-          </li>
-        );
-      })}
-    </ul>
-  );
-}

docs/src/components/version-switcher.tsx

@@ -2,6 +2,8 @@ import { useWindowSize } from '@docusaurus/theme-common';
 import DropdownNavbarItem from '@theme/NavbarItem/DropdownNavbarItem';
 import React, { useEffect, useState } from 'react';
 
+const ARCHIVED_VERSIONS_URL = 'https://version.immich.cloud/v1/docs/versions';
+
 export default function VersionSwitcher(): JSX.Element {
   const [versions, setVersions] = useState([]);
   const [activeLabel, setLabel] = useState('Versions');
@@ -11,12 +13,7 @@ export default function VersionSwitcher(): JSX.Element {
   useEffect(() => {
     async function getVersions() {
       try {
-        let baseUrl = 'https://docs.immich.app';
-        if (window.location.origin === 'http://localhost:3005') {
-          baseUrl = window.location.origin;
-        }
-
-        const response = await fetch(`${baseUrl}/archived-versions.json`);
+        const response = await fetch(ARCHIVED_VERSIONS_URL);
 
         const archiveVersions = await response.json();
 

docs/src/pages/privacy-policy.tsx

@@ -1,110 +0,0 @@
-import React from 'react';
-import Layout from '@theme/Layout';
-function HomepageHeader() {
-  return (
-    <header>
-      <section className="max-w-[900px] m-4 p-4 md:p-6 md:m-auto md:my-12 border border-red-400 rounded-2xl  bg-slate-200 dark:bg-immich-dark-gray">
-        <section>
-          <h1>Privacy Policy</h1>
-          <p>Last updated: July 31st 2024</p>
-          <p>
-            Welcome to Immich. We are committed to respecting your privacy. This Privacy Policy sets out how we collect,
-            use, and share information when you use our Immich app.
-          </p>
-        </section>
-
-        {/* 1. Scope of This Policy */}
-        <section>
-          <h2>1. Scope of This Policy</h2>
-          <p>
-            This Privacy Policy applies to the Immich app ("we", "our", or "us") and covers our collection, use, and
-            disclosure of your information. This Policy does not cover any third-party websites, services, or
-            applications that can be accessed through our app, or third-party services you may access through Immich.
-          </p>
-        </section>
-
-        {/* 2. Information We Collect */}
-        <section>
-          <h2>2. Information We Collect</h2>
-          <div>
-            <p>
-              <strong>Locally Stored Data</strong>: Immich stores all your photos, albums, settings, and locally on your
-              device. We do not have access to this data, nor do we transmit or store it on any of our servers.
-            </p>
-          </div>
-
-          <div>
-            <p>
-              <strong>Purchase Information:</strong> When you make a purchase within the{' '}
-              <a href="https://buy.immich.app">https://buy.immich.app</a>, we collect the following information for tax
-              calculation purposes:
-            </p>
-            <ul>
-              <li>Country of origin</li>
-              <li>Postal code (if the user is from Canada or the United States)</li>
-            </ul>
-          </div>
-        </section>
-
-        {/* 3. Use of Your Information */}
-        <section>
-          <h2>3. Use of Your Information</h2>
-          <p>
-            <strong>Tax Calculation:</strong> The country of origin and postal code (for users from Canada or the United
-            States) are collected solely for determining the applicable tax rates on your purchase.
-          </p>
-        </section>
-
-        {/* 4. Sharing of Your Information */}
-        <section>
-          <h2>4. Sharing of Your Information</h2>
-          <ul>
-            <li>
-              <strong>Tax Authorities:</strong> The purchase information may be shared with tax authorities as required
-              by law.
-            </li>
-            <li>
-              <strong>Payment Providers:</strong> The purchase information may be shared with payment providers where
-              required.
-            </li>
-          </ul>
-        </section>
-
-        {/* 5. Changes to This Policy */}
-        <section>
-          <h2>5. Changes to This Policy</h2>
-          <p>
-            We may update our Privacy Policy from time to time. If we make any changes, we will notify you by revising
-            the "Last updated" date at the top of this policy. It's encouraged that users frequently check this page for
-            any changes to stay informed about how we are helping to protect the personal information we collect.
-          </p>
-        </section>
-
-        {/* 6. Contact Us */}
-        <section>
-          <h2>6. Contact Us</h2>
-          <p>
-            If you have any questions about this Privacy Policy, please contact us at{' '}
-            <a href="mailto:immich@futo.org">immich@futo.org</a>
-          </p>
-        </section>
-      </section>
-    </header>
-  );
-}
-
-export default function Home(): JSX.Element {
-  return (
-    <Layout
-      title="Home"
-      description="immich Self-hosted photo and video backup solution directly from your mobile phone "
-      noFooter={true}
-    >
-      <HomepageHeader />
-      <div className="flex flex-col place-items-center place-content-center">
-        <p>This project is available under GNU AGPL v3 license.</p>
-        <p className="text-xs">Privacy should not be a luxury</p>
-      </div>
-    </Layout>
-  );
-}

docs/static/_redirects

@@ -1,3 +1,4 @@
+/archived-versions.json https://version.immich.cloud/v1/docs/versions 307
 / /overview/quick-start 307
 /mobile-app-beta-program /features/mobile-app 307
 /contribution-guidelines /overview/support-the-project#contributing 307
@@ -36,3 +37,4 @@
 /overview/welcome /overview/quick-start 307
 /docs/* /:splat 307
 /features/automatic-backup /features/mobile-backup 307
+/privacy-policy https://immich.app/privacy-policy 307

docs/static/archived-versions.json

@@ -1,261 +0,0 @@
-[
-  {
-    "label": "v3.0.0-rc.2",
-    "url": "https://docs.v3.0.0-rc.2.archive.immich.app"
-  },
-  {
-    "label": "v2.7.5",
-    "url": "https://docs.v2.7.5.archive.immich.app"
-  },
-  {
-    "label": "v2.6.3",
-    "url": "https://docs.v2.6.3.archive.immich.app"
-  },
-  {
-    "label": "v2.5.6",
-    "url": "https://docs.v2.5.6.archive.immich.app"
-  },
-  {
-    "label": "v2.4.1",
-    "url": "https://docs.v2.4.1.archive.immich.app"
-  },
-  {
-    "label": "v2.3.1",
-    "url": "https://docs.v2.3.1.archive.immich.app"
-  },
-  {
-    "label": "v2.2.3",
-    "url": "https://docs.v2.2.3.archive.immich.app"
-  },
-  {
-    "label": "v2.1.0",
-    "url": "https://docs.v2.1.0.archive.immich.app"
-  },
-  {
-    "label": "v2.0.1",
-    "url": "https://docs.v2.0.1.archive.immich.app"
-  },
-  {
-    "label": "v1.144.1",
-    "url": "https://docs.v1.144.1.archive.immich.app"
-  },
-  {
-    "label": "v1.143.1",
-    "url": "https://docs.v1.143.1.archive.immich.app"
-  },
-  {
-    "label": "v1.142.1",
-    "url": "https://v1.142.1.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.141.1",
-    "url": "https://v1.141.1.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.140.1",
-    "url": "https://v1.140.1.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.139.4",
-    "url": "https://v1.139.4.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.138.1",
-    "url": "https://v1.138.1.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.137.3",
-    "url": "https://v1.137.3.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.136.0",
-    "url": "https://v1.136.0.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.135.3",
-    "url": "https://v1.135.3.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.134.0",
-    "url": "https://v1.134.0.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.133.1",
-    "url": "https://v1.133.1.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.132.3",
-    "url": "https://v1.132.3.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.131.3",
-    "url": "https://v1.131.3.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.130.3",
-    "url": "https://v1.130.3.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.129.0",
-    "url": "https://v1.129.0.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.128.0",
-    "url": "https://v1.128.0.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.127.0",
-    "url": "https://v1.127.0.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.126.1",
-    "url": "https://v1.126.1.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.125.7",
-    "url": "https://v1.125.7.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.124.2",
-    "url": "https://v1.124.2.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.123.0",
-    "url": "https://v1.123.0.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.122.3",
-    "url": "https://v1.122.3.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.121.0",
-    "url": "https://v1.121.0.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.120.2",
-    "url": "https://v1.120.2.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.119.1",
-    "url": "https://v1.119.1.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.118.2",
-    "url": "https://v1.118.2.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.117.0",
-    "url": "https://v1.117.0.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.116.2",
-    "url": "https://v1.116.2.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.115.0",
-    "url": "https://v1.115.0.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.114.0",
-    "url": "https://v1.114.0.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.113.1",
-    "url": "https://v1.113.1.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.112.1",
-    "url": "https://v1.112.1.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.111.0",
-    "url": "https://v1.111.0.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.110.0",
-    "url": "https://v1.110.0.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.109.2",
-    "url": "https://v1.109.2.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.108.0",
-    "url": "https://v1.108.0.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.107.2",
-    "url": "https://v1.107.2.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.106.4",
-    "url": "https://v1.106.4.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.105.1",
-    "url": "https://v1.105.1.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.104.0",
-    "url": "https://v1.104.0.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.103.1",
-    "url": "https://v1.103.1.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.102.3",
-    "url": "https://v1.102.3.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.101.0",
-    "url": "https://v1.101.0.archive.immich.app",
-    "rootPath": "/docs"
-  },
-  {
-    "label": "v1.100.0",
-    "url": "https://v1.100.0.archive.immich.app",
-    "rootPath": "/docs"
-  }
-]

docs/tailwind.config.js

@@ -11,15 +11,9 @@ module.exports = {
       colors: {
         // Light Theme
         'immich-primary': '#4250af',
-        'immich-bg': '#f9f8fb',
-        'immich-fg': 'black',
-        'immich-gray': '#F6F6F4',
 
         // Dark Theme
         'immich-dark-primary': '#adcbfa',
-        'immich-dark-bg': '#000000',
-        'immich-dark-fg': '#e5e7eb',
-        'immich-dark-gray': '#111111',
       },
     },
   },

e2e/docker-compose.yml

@@ -45,7 +45,7 @@ services:
 
   redis:
     container_name: immich-e2e-redis
-    image: docker.io/valkey/valkey:9@sha256:4963247afc4cd33c7d3b2d2816b9f7f8eeebab148d29056c2ca4d7cbc966f2d9
+    image: docker.io/valkey/valkey:9@sha256:3acc0687f2a2e1091fae6450d7842dd658c941338cf0a873ddd9e14b9e4ea4dd
     healthcheck:
       test: redis-cli ping || exit 1
 

e2e/eslint.config.mjs

@@ -2,13 +2,8 @@ import js from '@eslint/js';
 import eslintPluginPrettierRecommended from 'eslint-plugin-prettier/recommended';
 import eslintPluginUnicorn from 'eslint-plugin-unicorn';
 import globals from 'globals';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
 import typescriptEslint from 'typescript-eslint';
 
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = path.dirname(__filename);
-
 export default typescriptEslint.config([
   eslintPluginUnicorn.configs.recommended,
   eslintPluginPrettierRecommended,
@@ -29,7 +24,7 @@ export default typescriptEslint.config([
 
       parserOptions: {
         project: 'tsconfig.json',
-        tsconfigRootDir: __dirname,
+        tsconfigRootDir: import.meta.dirname,
       },
     },
 
@@ -41,9 +36,18 @@ export default typescriptEslint.config([
       '@typescript-eslint/no-floating-promises': 'error',
       'unicorn/prefer-module': 'off',
       'unicorn/import-style': 'off',
+      'unicorn/consistent-boolean-name': 'off',
+      'unicorn/no-non-function-verb-prefix': 'off',
+      'unicorn/no-unreadable-for-of-expression': 'off',
+      'unicorn/max-nested-calls': 'off',
+      'unicorn/prefer-uint8array-base64': 'off',
+      'unicorn/isolated-functions': 'off',
+      'unicorn/prefer-promise-with-resolvers': 'off',
+      'unicorn/no-declarations-before-early-exit': 'off',
+      'unicorn/prefer-simple-condition-first': 'off',
       curly: 2,
       'prettier/prettier': 0,
-      'unicorn/prevent-abbreviations': 'off',
+      'unicorn/name-replacements': 'off',
       'unicorn/filename-case': 'off',
       'unicorn/no-null': 'off',
       'unicorn/prefer-top-level-await': 'off',

e2e/mise.toml

@@ -1,5 +1,5 @@
 [tasks.install]
-run = "pnpm install --filter immich-e2e --frozen-lockfile"
+run = "pnpm install --filter immich-e2e... --frozen-lockfile"
 
 [tasks.build]
 dir = "{{ config_root }}"
@@ -40,18 +40,19 @@ run = "tsc --noEmit"
 
 
 [tasks.ci-setup]
-depends = [
-  "//:sdk:install",
-  "//:sdk:build",
-  "//packages/cli:install",
-  "//packages/cli:build",
+run = [
+  { task = "//:sdk:install" },
+  { task = "//:sdk:build" },
+  { task = "//packages/cli:install" },
+  { task = "//packages/cli:build" },
+  { task = ":install" },
 ]
-run = { task = ":install" }
 
 
 [tasks.ci-unit]
-depends = ["//:sdk:install", "//:sdk:build"]
 run = [
+  { task = "//:sdk:install" },
+  { task = "//:sdk:build" },
   { task = ":install" },
   { task = ":format" },
   { task = ":lint" },

e2e/package.json

@@ -1,6 +1,6 @@
 {
   "name": "immich-e2e",
-  "version": "3.0.0-rc.2",
+  "version": "3.1.0",
   "description": "",
   "main": "index.js",
   "type": "module",
@@ -32,7 +32,7 @@
     "@playwright/test": "^1.44.1",
     "@socket.io/component-emitter": "^3.1.2",
     "@types/luxon": "^3.4.2",
-    "@types/node": "^24.13.2",
+    "@types/node": "^24.13.3",
     "@types/pg": "^8.15.1",
     "@types/pngjs": "^6.0.4",
     "@types/supertest": "^7.0.0",
@@ -40,7 +40,7 @@
     "eslint": "^10.0.0",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-prettier": "^5.1.3",
-    "eslint-plugin-unicorn": "^64.0.0",
+    "eslint-plugin-unicorn": "^72.0.0",
     "exiftool-vendored": "^35.0.0",
     "globals": "^17.0.0",
     "luxon": "^3.4.4",
@@ -51,7 +51,8 @@
     "sharp": "^0.34.5",
     "socket.io-client": "^4.7.4",
     "supertest": "^7.0.0",
-    "typescript": "^6.0.0",
+    "@typescript/native": "npm:typescript@^7.0.2",
+    "typescript": "npm:@typescript/typescript6@^6.0.2",
     "typescript-eslint": "^8.28.0",
     "utimes": "^5.2.1",
     "vitest": "^4.0.0"

e2e/src/api/specs/duplicate.e2e-spec.ts

@@ -1,651 +0,0 @@
-import { LoginResponseDto } from '@immich/sdk';
-import { createUserDto, uuidDto } from 'src/fixtures';
-import { errorDto } from 'src/responses';
-import { app, utils } from 'src/utils';
-import request from 'supertest';
-import { beforeAll, beforeEach, describe, expect, it } from 'vitest';
-
-describe('/duplicates', () => {
-  let admin: LoginResponseDto;
-  let user1: LoginResponseDto;
-  let user2: LoginResponseDto;
-
-  beforeAll(async () => {
-    await utils.resetDatabase();
-
-    admin = await utils.adminSetup();
-
-    [user1, user2] = await Promise.all([
-      utils.userSetup(admin.accessToken, createUserDto.user1),
-      utils.userSetup(admin.accessToken, createUserDto.user2),
-    ]);
-  });
-
-  beforeEach(async () => {
-    // Reset assets, albums, tags, and stacks between tests to ensure clean state for repeated test runs
-    // Note: We don't reset users since they're set up once in beforeAll
-    // Stack must be reset before asset due to foreign key constraint
-    await utils.resetDatabase(['stack', 'asset', 'album', 'tag']);
-  });
-
-  describe('GET /duplicates', () => {
-    it('should return empty array when no duplicates', async () => {
-      const { status, body } = await request(app)
-        .get('/duplicates')
-        .set('Authorization', `Bearer ${user1.accessToken}`);
-
-      expect(status).toBe(200);
-      expect(body).toEqual([]);
-    });
-
-    it('should return duplicate groups with suggestedKeepAssetIds', async () => {
-      // Create assets with different file sizes for duplicate detection
-      const [asset1, asset2] = await Promise.all([
-        utils.createAsset(user1.accessToken),
-        utils.createAsset(user1.accessToken),
-      ]);
-
-      // Manually set duplicateId on both assets to create a duplicate group
-      const duplicateId = '00000000-0000-4000-8000-000000000001';
-      await utils.setAssetDuplicateId(user1.accessToken, asset1.id, duplicateId);
-      await utils.setAssetDuplicateId(user1.accessToken, asset2.id, duplicateId);
-
-      const { status, body } = await request(app)
-        .get('/duplicates')
-        .set('Authorization', `Bearer ${user1.accessToken}`);
-
-      expect(status).toBe(200);
-      expect(body).toEqual([
-        {
-          duplicateId,
-          assets: expect.arrayContaining([
-            expect.objectContaining({ id: asset1.id }),
-            expect.objectContaining({ id: asset2.id }),
-          ]),
-          suggestedKeepAssetIds: expect.any(Array),
-        },
-      ]);
-      expect(body[0].suggestedKeepAssetIds.length).toBe(1);
-    });
-  });
-
-  describe('POST /duplicates/resolve', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(app)
-        .post('/duplicates/resolve')
-        .send({
-          groups: [{ duplicateId: uuidDto.dummy, keepAssetIds: [], trashAssetIds: [] }],
-        });
-
-      expect(status).toBe(401);
-      expect(body).toEqual(errorDto.unauthorized);
-    });
-
-    it('should return failure for non-existent duplicate group', async () => {
-      const { status, body } = await request(app)
-        .post('/duplicates/resolve')
-        .set('Authorization', `Bearer ${user1.accessToken}`)
-        .send({
-          groups: [{ duplicateId: uuidDto.dummy, keepAssetIds: [], trashAssetIds: [] }],
-        });
-
-      expect(status).toBe(200);
-      expect(body).toEqual({
-        status: 'COMPLETED',
-        results: [
-          {
-            duplicateId: uuidDto.dummy,
-            status: 'FAILED',
-            reason: expect.stringContaining('not found or access denied'),
-          },
-        ],
-      });
-    });
-
-    it('should resolve duplicate group with keepers', async () => {
-      const [asset1, asset2] = await Promise.all([
-        utils.createAsset(user1.accessToken),
-        utils.createAsset(user1.accessToken),
-      ]);
-
-      const duplicateId = '00000000-0000-4000-8000-000000000002';
-      await utils.setAssetDuplicateId(user1.accessToken, asset1.id, duplicateId);
-      await utils.setAssetDuplicateId(user1.accessToken, asset2.id, duplicateId);
-
-      const { status, body } = await request(app)
-        .post('/duplicates/resolve')
-        .set('Authorization', `Bearer ${user1.accessToken}`)
-        .send({
-          groups: [{ duplicateId, keepAssetIds: [asset1.id], trashAssetIds: [asset2.id] }],
-        });
-
-      expect(status).toBe(200);
-      expect(body).toEqual({
-        status: 'COMPLETED',
-        results: [
-          {
-            duplicateId,
-            status: 'SUCCESS',
-          },
-        ],
-      });
-
-      // Verify side effects: duplicateId cleared on kept asset
-      const keptAsset = await utils.getAssetInfo(user1.accessToken, asset1.id);
-      expect(keptAsset.duplicateId).toBeNull();
-
-      // Verify side effects: trashed asset is trashed and duplicateId cleared
-      const trashedAsset = await utils.getAssetInfo(user1.accessToken, asset2.id);
-      expect(trashedAsset.isTrashed).toBe(true);
-      expect(trashedAsset.duplicateId).toBeNull();
-    });
-
-    it('should reject when keepAssetIds and trashAssetIds overlap', async () => {
-      const [asset1, asset2] = await Promise.all([
-        utils.createAsset(user1.accessToken),
-        utils.createAsset(user1.accessToken),
-      ]);
-
-      const duplicateId = '00000000-0000-4000-8000-000000000003';
-      await utils.setAssetDuplicateId(user1.accessToken, asset1.id, duplicateId);
-      await utils.setAssetDuplicateId(user1.accessToken, asset2.id, duplicateId);
-
-      const { status, body } = await request(app)
-        .post('/duplicates/resolve')
-        .set('Authorization', `Bearer ${user1.accessToken}`)
-        .send({
-          groups: [{ duplicateId, keepAssetIds: [asset1.id], trashAssetIds: [asset1.id] }],
-        });
-
-      expect(status).toBe(200);
-      expect(body.results[0].status).toBe('FAILED');
-      expect(body.results[0].reason).toContain('disjoint');
-    });
-
-    it('should require keepAssetIds when partially trashing', async () => {
-      const [asset1, asset2] = await Promise.all([
-        utils.createAsset(user1.accessToken),
-        utils.createAsset(user1.accessToken),
-      ]);
-
-      const duplicateId = '00000000-0000-4000-8000-000000000004';
-      await utils.setAssetDuplicateId(user1.accessToken, asset1.id, duplicateId);
-      await utils.setAssetDuplicateId(user1.accessToken, asset2.id, duplicateId);
-
-      const { status, body } = await request(app)
-        .post('/duplicates/resolve')
-        .set('Authorization', `Bearer ${user1.accessToken}`)
-        .send({
-          groups: [{ duplicateId, keepAssetIds: [], trashAssetIds: [asset1.id] }],
-        });
-
-      expect(status).toBe(200);
-      expect(body.results[0].status).toBe('FAILED');
-      expect(body.results[0].reason).toContain('must cover all assets');
-    });
-
-    it('should reject partial resolution (not all assets covered)', async () => {
-      const [asset1, asset2, asset3] = await Promise.all([
-        utils.createAsset(user1.accessToken),
-        utils.createAsset(user1.accessToken),
-        utils.createAsset(user1.accessToken),
-      ]);
-
-      const duplicateId = '00000000-0000-4000-8000-000000000010';
-      await utils.setAssetDuplicateId(user1.accessToken, asset1.id, duplicateId);
-      await utils.setAssetDuplicateId(user1.accessToken, asset2.id, duplicateId);
-      await utils.setAssetDuplicateId(user1.accessToken, asset3.id, duplicateId);
-
-      const { status, body } = await request(app)
-        .post('/duplicates/resolve')
-        .set('Authorization', `Bearer ${user1.accessToken}`)
-        .send({
-          groups: [{ duplicateId, keepAssetIds: [asset1.id], trashAssetIds: [asset2.id] }],
-        });
-
-      expect(status).toBe(200);
-      expect(body.results[0].status).toBe('FAILED');
-      expect(body.results[0].reason).toContain('must cover all assets');
-    });
-
-    it('should reject asset not in duplicate group', async () => {
-      const [asset1, asset2, outsideAsset] = await Promise.all([
-        utils.createAsset(user1.accessToken),
-        utils.createAsset(user1.accessToken),
-        utils.createAsset(user1.accessToken),
-      ]);
-
-      const duplicateId = '00000000-0000-4000-8000-000000000011';
-      await utils.setAssetDuplicateId(user1.accessToken, asset1.id, duplicateId);
-      await utils.setAssetDuplicateId(user1.accessToken, asset2.id, duplicateId);
-
-      const { status, body } = await request(app)
-        .post('/duplicates/resolve')
-        .set('Authorization', `Bearer ${user1.accessToken}`)
-        .send({
-          groups: [{ duplicateId, keepAssetIds: [asset1.id], trashAssetIds: [outsideAsset.id] }],
-        });
-
-      expect(status).toBe(200);
-      expect(body.results[0].status).toBe('FAILED');
-      expect(body.results[0].reason).toContain('not a member of duplicate group');
-    });
-
-    it('should allow trash-all without keepers', async () => {
-      const [asset1, asset2] = await Promise.all([
-        utils.createAsset(user1.accessToken),
-        utils.createAsset(user1.accessToken),
-      ]);
-
-      const duplicateId = '00000000-0000-4000-8000-000000000012';
-      await utils.setAssetDuplicateId(user1.accessToken, asset1.id, duplicateId);
-      await utils.setAssetDuplicateId(user1.accessToken, asset2.id, duplicateId);
-
-      const { status, body } = await request(app)
-        .post('/duplicates/resolve')
-        .set('Authorization', `Bearer ${user1.accessToken}`)
-        .send({
-          groups: [{ duplicateId, keepAssetIds: [], trashAssetIds: [asset1.id, asset2.id] }],
-        });
-
-      expect(status).toBe(200);
-      expect(body).toEqual({
-        status: 'COMPLETED',
-        results: [
-          {
-            duplicateId,
-            status: 'SUCCESS',
-          },
-        ],
-      });
-
-      // Verify both assets are trashed
-      const [asset1Info, asset2Info] = await Promise.all([
-        utils.getAssetInfo(user1.accessToken, asset1.id),
-        utils.getAssetInfo(user1.accessToken, asset2.id),
-      ]);
-
-      expect(asset1Info.isTrashed).toBe(true);
-      expect(asset1Info.duplicateId).toBeNull();
-      expect(asset2Info.isTrashed).toBe(true);
-      expect(asset2Info.duplicateId).toBeNull();
-    });
-
-    it('should reject cross-user duplicate group access', async () => {
-      const asset1 = await utils.createAsset(user1.accessToken);
-      const asset2 = await utils.createAsset(user2.accessToken);
-
-      const duplicateId = '00000000-0000-4000-8000-000000000013';
-      await utils.setAssetDuplicateId(user1.accessToken, asset1.id, duplicateId);
-      await utils.setAssetDuplicateId(user2.accessToken, asset2.id, duplicateId);
-
-      // User1 tries to resolve a group containing user2's asset
-      const { status, body } = await request(app)
-        .post('/duplicates/resolve')
-        .set('Authorization', `Bearer ${user1.accessToken}`)
-        .send({
-          groups: [{ duplicateId, keepAssetIds: [asset1.id], trashAssetIds: [asset2.id] }],
-        });
-
-      expect(status).toBe(200);
-      expect(body.results[0].status).toBe('FAILED');
-      expect(body.results[0].reason).toContain('not a member of duplicate group');
-    });
-
-    it('should synchronize favorites when enabled', async () => {
-      const [asset1, asset2] = await Promise.all([
-        utils.createAsset(user1.accessToken),
-        utils.createAsset(user1.accessToken),
-      ]);
-
-      // Mark one asset as favorite
-      await request(app)
-        .put('/assets')
-        .set('Authorization', `Bearer ${user1.accessToken}`)
-        .send({ ids: [asset2.id], isFavorite: true });
-
-      const duplicateId = '00000000-0000-4000-8000-000000000020';
-      await utils.setAssetDuplicateId(user1.accessToken, asset1.id, duplicateId);
-      await utils.setAssetDuplicateId(user1.accessToken, asset2.id, duplicateId);
-
-      const { status, body } = await request(app)
-        .post('/duplicates/resolve')
-        .set('Authorization', `Bearer ${user1.accessToken}`)
-        .send({
-          groups: [{ duplicateId, keepAssetIds: [asset1.id], trashAssetIds: [asset2.id] }],
-        });
-
-      expect(status).toBe(200);
-      expect(body.results[0].status).toBe('SUCCESS');
-
-      // Verify favorite was synchronized to keeper
-      const keptAsset = await utils.getAssetInfo(user1.accessToken, asset1.id);
-      expect(keptAsset.isFavorite).toBe(true);
-      expect(keptAsset.duplicateId).toBeNull();
-    });
-
-    it('should synchronize visibility when enabled', async () => {
-      const [asset1, asset2] = await Promise.all([
-        utils.createAsset(user1.accessToken),
-        utils.createAsset(user1.accessToken),
-      ]);
-
-      // Archive one asset
-      await utils.archiveAssets(user1.accessToken, [asset2.id]);
-
-      const duplicateId = '00000000-0000-4000-8000-000000000021';
-      await utils.setAssetDuplicateId(user1.accessToken, asset1.id, duplicateId);
-      await utils.setAssetDuplicateId(user1.accessToken, asset2.id, duplicateId);
-
-      const { status, body } = await request(app)
-        .post('/duplicates/resolve')
-        .set('Authorization', `Bearer ${user1.accessToken}`)
-        .send({
-          groups: [{ duplicateId, keepAssetIds: [asset1.id], trashAssetIds: [asset2.id] }],
-        });
-
-      expect(status).toBe(200);
-      expect(body.results[0].status).toBe('SUCCESS');
-
-      // Verify visibility was synchronized to keeper
-      const keptAsset = await utils.getAssetInfo(user1.accessToken, asset1.id);
-      expect(keptAsset.visibility).toBe('archive');
-      expect(keptAsset.duplicateId).toBeNull();
-    });
-
-    it('should synchronize rating when enabled', async () => {
-      const [asset1, asset2] = await Promise.all([
-        utils.createAsset(user1.accessToken),
-        utils.createAsset(user1.accessToken),
-      ]);
-
-      // Set rating on one asset
-      await request(app)
-        .put('/assets')
-        .set('Authorization', `Bearer ${user1.accessToken}`)
-        .send({ ids: [asset2.id], rating: 5 });
-
-      const duplicateId = '00000000-0000-4000-8000-000000000022';
-      await utils.setAssetDuplicateId(user1.accessToken, asset1.id, duplicateId);
-      await utils.setAssetDuplicateId(user1.accessToken, asset2.id, duplicateId);
-
-      const { status, body } = await request(app)
-        .post('/duplicates/resolve')
-        .set('Authorization', `Bearer ${user1.accessToken}`)
-        .send({
-          groups: [{ duplicateId, keepAssetIds: [asset1.id], trashAssetIds: [asset2.id] }],
-        });
-
-      expect(status).toBe(200);
-      expect(body.results[0].status).toBe('SUCCESS');
-
-      // Verify rating was synchronized to keeper
-      const keptAsset = await utils.getAssetInfo(user1.accessToken, asset1.id);
-      expect(keptAsset.exifInfo?.rating).toBe(5);
-      expect(keptAsset.duplicateId).toBeNull();
-    });
-
-    it('should synchronize description when enabled', async () => {
-      const [asset1, asset2] = await Promise.all([
-        utils.createAsset(user1.accessToken),
-        utils.createAsset(user1.accessToken),
-      ]);
-
-      // Set description on one asset
-      await request(app)
-        .put('/assets')
-        .set('Authorization', `Bearer ${user1.accessToken}`)
-        .send({ ids: [asset2.id], description: 'Test description for duplicate' });
-
-      const duplicateId = '00000000-0000-4000-8000-000000000023';
-      await utils.setAssetDuplicateId(user1.accessToken, asset1.id, duplicateId);
-      await utils.setAssetDuplicateId(user1.accessToken, asset2.id, duplicateId);
-
-      const { status, body } = await request(app)
-        .post('/duplicates/resolve')
-        .set('Authorization', `Bearer ${user1.accessToken}`)
-        .send({
-          groups: [{ duplicateId, keepAssetIds: [asset1.id], trashAssetIds: [asset2.id] }],
-        });
-
-      expect(status).toBe(200);
-      expect(body.results[0].status).toBe('SUCCESS');
-
-      // Verify description was synchronized to keeper
-      const keptAsset = await utils.getAssetInfo(user1.accessToken, asset1.id);
-      expect(keptAsset.exifInfo?.description).toBe('Test description for duplicate');
-      expect(keptAsset.duplicateId).toBeNull();
-    });
-
-    it('should synchronize location when enabled', async () => {
-      const [asset1, asset2] = await Promise.all([
-        utils.createAsset(user1.accessToken),
-        utils.createAsset(user1.accessToken),
-      ]);
-
-      // Set location on one asset
-      await request(app)
-        .put('/assets')
-        .set('Authorization', `Bearer ${user1.accessToken}`)
-        .send({ ids: [asset2.id], latitude: 40.7128, longitude: -74.006 });
-
-      const duplicateId = '00000000-0000-4000-8000-000000000024';
-      await utils.setAssetDuplicateId(user1.accessToken, asset1.id, duplicateId);
-      await utils.setAssetDuplicateId(user1.accessToken, asset2.id, duplicateId);
-
-      const { status, body } = await request(app)
-        .post('/duplicates/resolve')
-        .set('Authorization', `Bearer ${user1.accessToken}`)
-        .send({
-          groups: [{ duplicateId, keepAssetIds: [asset1.id], trashAssetIds: [asset2.id] }],
-        });
-
-      expect(status).toBe(200);
-      expect(body.results[0].status).toBe('SUCCESS');
-
-      // Verify location was synchronized to keeper
-      const keptAsset = await utils.getAssetInfo(user1.accessToken, asset1.id);
-      expect(keptAsset.exifInfo?.latitude).toBe(40.7128);
-      expect(keptAsset.exifInfo?.longitude).toBe(-74.006);
-      expect(keptAsset.duplicateId).toBeNull();
-    });
-
-    it('should synchronize albums when enabled', async () => {
-      const [asset1, asset2] = await Promise.all([
-        utils.createAsset(user1.accessToken),
-        utils.createAsset(user1.accessToken),
-      ]);
-
-      // Create albums and add assets to different albums
-      const album1 = await utils.createAlbum(user1.accessToken, {
-        albumName: 'Album 1',
-        assetIds: [asset1.id],
-      });
-      const album2 = await utils.createAlbum(user1.accessToken, {
-        albumName: 'Album 2',
-        assetIds: [asset2.id],
-      });
-
-      const duplicateId = '00000000-0000-4000-8000-000000000025';
-      await utils.setAssetDuplicateId(user1.accessToken, asset1.id, duplicateId);
-      await utils.setAssetDuplicateId(user1.accessToken, asset2.id, duplicateId);
-
-      const { status, body } = await request(app)
-        .post('/duplicates/resolve')
-        .set('Authorization', `Bearer ${user1.accessToken}`)
-        .send({
-          groups: [{ duplicateId, keepAssetIds: [asset1.id], trashAssetIds: [asset2.id] }],
-        });
-
-      expect(status).toBe(200);
-      expect(body.results[0].status).toBe('SUCCESS');
-
-      // Verify keeper is now in both albums
-      const keptAsset = await utils.getAssetInfo(user1.accessToken, asset1.id);
-      expect(keptAsset.duplicateId).toBeNull();
-
-      // Check albums directly
-      const { status: album1Status, body: album1Body } = await request(app)
-        .get(`/albums/${album1.id}`)
-        .set('Authorization', `Bearer ${user1.accessToken}`);
-      const { status: album2Status, body: album2Body } = await request(app)
-        .get(`/albums/${album2.id}`)
-        .set('Authorization', `Bearer ${user1.accessToken}`);
-
-      expect(album1Status).toBe(200);
-      expect(album2Status).toBe(200);
-      expect(album1Body.assets.map((a: any) => a.id)).toContain(asset1.id);
-      expect(album2Body.assets.map((a: any) => a.id)).toContain(asset1.id);
-    });
-
-    it('should synchronize tags when enabled', async () => {
-      const [asset1, asset2] = await Promise.all([
-        utils.createAsset(user1.accessToken),
-        utils.createAsset(user1.accessToken),
-      ]);
-
-      // Wait for metadata extraction to complete before adding tags
-      // Otherwise, metadata jobs will race and overwrite our tags
-      await utils.waitForQueueFinish(admin.accessToken, 'metadataExtraction');
-
-      // Create tags and tag assets differently
-      const tags = await utils.upsertTags(user1.accessToken, ['tag1', 'tag2']);
-      await utils.tagAssets(user1.accessToken, tags[0].id, [asset1.id]);
-      await utils.tagAssets(user1.accessToken, tags[1].id, [asset2.id]);
-
-      const duplicateId = '00000000-0000-4000-8000-000000000026';
-      await utils.setAssetDuplicateId(user1.accessToken, asset1.id, duplicateId);
-      await utils.setAssetDuplicateId(user1.accessToken, asset2.id, duplicateId);
-
-      const { status, body } = await request(app)
-        .post('/duplicates/resolve')
-        .set('Authorization', `Bearer ${user1.accessToken}`)
-        .send({
-          groups: [{ duplicateId, keepAssetIds: [asset1.id], trashAssetIds: [asset2.id] }],
-        });
-
-      expect(status).toBe(200);
-      expect(body.results[0].status).toBe('SUCCESS');
-
-      // Verify keeper has both tags
-      const keptAsset = await utils.getAssetInfo(user1.accessToken, asset1.id);
-      expect(keptAsset.duplicateId).toBeNull();
-      expect(keptAsset.tags).toBeDefined();
-      const tagIds = keptAsset.tags?.map((t) => t.id) || [];
-      expect(tagIds).toContain(tags[0].id);
-      expect(tagIds).toContain(tags[1].id);
-    });
-
-    it('should handle batch resolve with mixed success and failure', async () => {
-      // Create first group that will succeed
-      const [asset1, asset2] = await Promise.all([
-        utils.createAsset(user1.accessToken),
-        utils.createAsset(user1.accessToken),
-      ]);
-      const duplicateId1 = '00000000-0000-4000-8000-000000000027';
-      await utils.setAssetDuplicateId(user1.accessToken, asset1.id, duplicateId1);
-      await utils.setAssetDuplicateId(user1.accessToken, asset2.id, duplicateId1);
-
-      // Create second group with non-existent duplicate ID (will fail)
-      const fakeId = '00000000-0000-4000-8000-000000000099';
-
-      const { status, body } = await request(app)
-        .post('/duplicates/resolve')
-        .set('Authorization', `Bearer ${user1.accessToken}`)
-        .send({
-          groups: [
-            { duplicateId: duplicateId1, keepAssetIds: [asset1.id], trashAssetIds: [asset2.id] },
-            { duplicateId: fakeId, keepAssetIds: [], trashAssetIds: [] },
-          ],
-        });
-
-      expect(status).toBe(200);
-      expect(body.status).toBe('COMPLETED');
-      expect(body.results).toHaveLength(2);
-
-      // First group should succeed
-      expect(body.results[0].duplicateId).toBe(duplicateId1);
-      expect(body.results[0].status).toBe('SUCCESS');
-
-      // Second group should fail
-      expect(body.results[1].duplicateId).toBe(fakeId);
-      expect(body.results[1].status).toBe('FAILED');
-      expect(body.results[1].reason).toContain('not found or access denied');
-
-      // Verify first group was actually resolved despite second failure
-      const asset1Info = await utils.getAssetInfo(user1.accessToken, asset1.id);
-      expect(asset1Info.duplicateId).toBeNull();
-      const asset2Info = await utils.getAssetInfo(user1.accessToken, asset2.id);
-      expect(asset2Info.isTrashed).toBe(true);
-    });
-
-    it('should trash assets when trash is enabled', async () => {
-      const [asset1, asset2] = await Promise.all([
-        utils.createAsset(user1.accessToken),
-        utils.createAsset(user1.accessToken),
-      ]);
-
-      const duplicateId = '00000000-0000-4000-8000-000000000028';
-      await utils.setAssetDuplicateId(user1.accessToken, asset1.id, duplicateId);
-      await utils.setAssetDuplicateId(user1.accessToken, asset2.id, duplicateId);
-
-      // Ensure trash is enabled (default)
-      const config = await utils.getSystemConfig(admin.accessToken);
-      expect(config.trash.enabled).toBe(true);
-
-      const { status, body } = await request(app)
-        .post('/duplicates/resolve')
-        .set('Authorization', `Bearer ${user1.accessToken}`)
-        .send({
-          groups: [{ duplicateId, keepAssetIds: [asset1.id], trashAssetIds: [asset2.id] }],
-        });
-
-      expect(status).toBe(200);
-      expect(body.results[0].status).toBe('SUCCESS');
-
-      // Verify asset is trashed (not deleted)
-      const trashedAsset = await utils.getAssetInfo(user1.accessToken, asset2.id);
-      expect(trashedAsset.isTrashed).toBe(true);
-    });
-
-    it('should delete assets when trash is disabled', async () => {
-      const [asset1, asset2] = await Promise.all([
-        utils.createAsset(user1.accessToken),
-        utils.createAsset(user1.accessToken),
-      ]);
-
-      const duplicateId = '00000000-0000-4000-8000-000000000029';
-      await utils.setAssetDuplicateId(user1.accessToken, asset1.id, duplicateId);
-      await utils.setAssetDuplicateId(user1.accessToken, asset2.id, duplicateId);
-
-      // Disable trash
-      await request(app)
-        .put('/system-config')
-        .set('Authorization', `Bearer ${admin.accessToken}`)
-        .send({
-          trash: { enabled: false, days: 30 },
-        });
-
-      const { status, body } = await request(app)
-        .post('/duplicates/resolve')
-        .set('Authorization', `Bearer ${user1.accessToken}`)
-        .send({
-          groups: [{ duplicateId, keepAssetIds: [asset1.id], trashAssetIds: [asset2.id] }],
-        });
-
-      expect(status).toBe(200);
-      expect(body.results[0].status).toBe('SUCCESS');
-
-      // Asset should be marked as deleted (force delete)
-      const { status: getStatus } = await request(app)
-        .get(`/assets/${asset2.id}`)
-        .set('Authorization', `Bearer ${user1.accessToken}`);
-
-      // Asset should still be accessible (soft deleted) but marked as deleted
-      expect(getStatus).toBe(200);
-
-      // Re-enable trash for other tests
-      await utils.resetAdminConfig(admin.accessToken);
-    });
-  });
-});

e2e/src/fixtures.ts

@@ -1,9 +1,7 @@
 export const uuidDto = {
-  invalid: 'invalid-uuid',
   // valid uuid v4
   notFound: '00000000-0000-4000-a000-000000000000',
   dummy: '00000000-0000-4000-a000-000000000001',
-  dummy2: '00000000-0000-4000-a000-000000000002',
 };
 
 const adminLoginDto = {
@@ -57,22 +55,6 @@ export const createUserDto = {
 };
 
 export const userDto = {
-  admin: {
-    name: signupDto.admin.name,
-    email: signupDto.admin.email,
-    password: signupDto.admin.password,
-    storageLabel: 'admin',
-    oauthId: '',
-    shouldChangePassword: false,
-    profileImagePath: '',
-    createdAt: new Date('2021-01-01'),
-    deletedAt: null,
-    updatedAt: new Date('2021-01-01'),
-    tags: [],
-    assets: [],
-    quotaSizeInBytes: null,
-    quotaUsageInBytes: 0,
-  },
   user1: {
     name: createUserDto.user1.name,
     email: createUserDto.user1.email,

e2e/src/responses.ts

@@ -38,46 +38,8 @@ export const errorDto = {
   incorrectLogin: {
     message: 'Incorrect email or password',
   },
-  alreadyHasAdmin: {
-    message: 'The server already has an admin',
-  },
 };
 
-export const signupResponseDto = {
-  admin: {
-    avatarColor: expect.any(String),
-    id: expect.any(String),
-    name: 'Immich Admin',
-    email: 'admin@immich.cloud',
-    storageLabel: 'admin',
-    profileImagePath: '',
-    // why? lol
-    shouldChangePassword: true,
-    isAdmin: true,
-    createdAt: expect.any(String),
-    updatedAt: expect.any(String),
-    deletedAt: null,
-    oauthId: '',
-    quotaUsageInBytes: 0,
-    quotaSizeInBytes: null,
-    status: 'active',
-    license: null,
-    profileChangedAt: expect.any(String),
-  },
-};
-
-export const loginResponseDto = {
-  admin: {
-    accessToken: expect.any(String),
-    name: 'Immich Admin',
-    isAdmin: true,
-    isOnboarded: false,
-    profileImagePath: '',
-    shouldChangePassword: true,
-    userEmail: 'admin@immich.cloud',
-    userId: expect.any(String),
-  },
-};
 export const deviceDto = {
   current: {
     id: expect.any(String),

e2e/src/specs/maintenance/server/database-backups.e2e-spec.ts

@@ -108,7 +108,7 @@ describe('/admin/database-backups', () => {
       const { status, body } = await request(app).post('/admin/database-backups/start-restore').send();
 
       expect(status).toBe(400);
-      expect(body).toEqual(errorDto.badRequest('The server already has an admin'));
+      expect(body).toEqual(errorDto.badRequest('Admin setup is not available'));
     });
 
     it.sequential('should enter maintenance mode in "database restore mode"', async () => {
@@ -118,7 +118,7 @@ describe('/admin/database-backups', () => {
 
       expect(status).toBe(201);
 
-      cookie = headers['set-cookie'][0].split(';')[0];
+      cookie = headers['set-cookie'][0].split(';', 1)[0];
 
       await expect
         .poll(
@@ -224,7 +224,7 @@ describe('/admin/database-backups', () => {
         });
 
       expect(status).toBe(201);
-      cookie = headers['set-cookie'][0].split(';')[0];
+      cookie = headers['set-cookie'][0].split(';', 1)[0];
 
       await expect
         .poll(
@@ -295,7 +295,7 @@ describe('/admin/database-backups', () => {
         });
 
       expect(status).toBe(201);
-      cookie = headers['set-cookie'][0].split(';')[0];
+      cookie = headers['set-cookie'][0].split(';', 1)[0];
 
       await expect
         .poll(

e2e/src/specs/maintenance/server/maintenance.e2e-spec.ts

@@ -85,7 +85,7 @@ describe('/admin/maintenance', () => {
 
       expect(status).toBe(201);
 
-      cookie = headers['set-cookie'][0].split(';')[0];
+      cookie = headers['set-cookie'][0].split(';', 1)[0];
       expect(cookie).toEqual(
         expect.stringMatching(/^immich_maintenance_token=[A-Za-z0-9-_]*\.[A-Za-z0-9-_]*\.[A-Za-z0-9-_]*$/),
       );
@@ -149,7 +149,7 @@ describe('/admin/maintenance', () => {
         const { status, body } = await request(app)
           .post('/admin/maintenance/login')
           .send({
-            token: cookie!.split('=')[1].trim(),
+            token: cookie!.split('=', 2)[1].trim(),
           });
         expect(status).toBe(201);
         expect(body).toEqual(

e2e/src/specs/maintenance/web/maintenance.e2e-spec.ts

@@ -27,7 +27,7 @@ test.describe('Maintenance', () => {
   test('maintenance shows no options to users until they authenticate', async ({ page }) => {
     const setCookie = await utils.enterMaintenance(admin.accessToken);
     const cookie = setCookie
-      ?.map((cookie) => cookie.split(';')[0].split('='))
+      ?.map((cookie) => cookie.split(';', 1)[0].split('='))
       ?.find(([name]) => name === 'immich_maintenance_token');
 
     expect(cookie).toBeTruthy();

e2e/src/specs/server/api/album.e2e-spec.ts

@@ -120,6 +120,7 @@ describe('/albums', () => {
       }),
     ]);
 
+    // eslint-disable-next-line unicorn/no-unreadable-array-destructuring
     [user2Albums[0]] = await Promise.all([
       getAlbumInfo({ id: user2Albums[0].id }, { headers: asBearerAuth(user2.accessToken) }),
       deleteUserAdmin({ id: user3.userId, userAdminDeleteDto: {} }, { headers: asBearerAuth(admin.accessToken) }),
@@ -796,5 +797,22 @@ describe('/albums', () => {
       expect(status).toBe(400);
       expect(body).toEqual(errorDto.badRequest('Not found or no album.share access'));
     });
+
+    it('should not allow an editor to change the role of an owner', async () => {
+      const album = await utils.createAlbum(user1.accessToken, {
+        albumName: 'testAlbum',
+        albumUsers: [{ userId: user2.userId, role: AlbumUserRole.Editor }],
+      });
+
+      expect(album.albumUsers[1].role).toEqual(AlbumUserRole.Editor);
+
+      const { status, body } = await request(app)
+        .put(`/albums/${album.id}/user/${user1.userId}`)
+        .set('Authorization', `Bearer ${user2.accessToken}`)
+        .send({ role: AlbumUserRole.Editor });
+
+      expect(status).toBe(400);
+      expect(body).toEqual(errorDto.badRequest('User is owner'));
+    });
   });
 });

e2e/src/specs/server/api/asset.e2e-spec.ts

@@ -781,7 +781,7 @@ describe('/asset', () => {
             exifImageWidth: 4032,
             exifImageHeight: 3024,
             latitude: 41.2203,
-            longitude: -96.071_625,
+            longitude: -96.071625,
             make: 'Apple',
             model: 'iPhone 7',
             lensModel: 'iPhone 7 back camera 3.99mm f/1.8',
@@ -973,9 +973,9 @@ describe('/asset', () => {
             fileSizeInByte: 31_175_472,
             focalLength: 18.3,
             iso: 100,
-            latitude: 36.613_24,
+            latitude: 36.61324,
             lensModel: '18.3mm F2.8',
-            longitude: -121.897_85,
+            longitude: -121.89785,
             make: 'RICOH IMAGING COMPANY, LTD.',
             model: 'RICOH GR III',
             orientation: '1',

e2e/src/specs/server/api/map.e2e-spec.ts

@@ -75,7 +75,7 @@ describe('/map', () => {
           country: 'United States of America',
           id: expect.any(String),
           lat: expect.closeTo(39.115),
-          lon: expect.closeTo(-108.400_968),
+          lon: expect.closeTo(-108.400968),
           state: 'Colorado',
         },
         {
@@ -83,7 +83,7 @@ describe('/map', () => {
           country: 'United States of America',
           id: expect.any(String),
           lat: expect.closeTo(41.2203),
-          lon: expect.closeTo(-96.071_625),
+          lon: expect.closeTo(-96.071625),
           state: 'Nebraska',
         },
       ]);
@@ -123,7 +123,7 @@ describe('/map', () => {
           country: 'United States of America',
           id: expect.any(String),
           lat: expect.closeTo(39.115),
-          lon: expect.closeTo(-108.400_968),
+          lon: expect.closeTo(-108.400968),
           state: 'Colorado',
         },
         {
@@ -131,7 +131,7 @@ describe('/map', () => {
           country: 'United States of America',
           id: expect.any(String),
           lat: expect.closeTo(41.2203),
-          lon: expect.closeTo(-96.071_625),
+          lon: expect.closeTo(-96.071625),
           state: 'Nebraska',
         },
       ]);
@@ -188,20 +188,20 @@ describe('/map', () => {
     const reverseGeocodeTestCases = [
       {
         name: 'Vaucluse',
-        lat: -33.858_977_058_663_13,
-        lon: 151.278_490_730_270_48,
+        lat: -33.85897705866313,
+        lon: 151.27849073027048,
         results: [{ city: 'Vaucluse', state: 'New South Wales', country: 'Australia' }],
       },
       {
         name: 'Ravenhall',
-        lat: -37.765_732_399_174_75,
-        lon: 144.752_453_164_883_3,
+        lat: -37.76573239917475,
+        lon: 144.7524531648833,
         results: [{ city: 'Ravenhall', state: 'Victoria', country: 'Australia' }],
       },
       {
         name: 'Scarborough',
-        lat: -31.894_346_156_789_997,
-        lon: 115.757_617_103_904_64,
+        lat: -31.894346156789997,
+        lon: 115.75761710390464,
         results: [{ city: 'Scarborough', state: 'Western Australia', country: 'Australia' }],
       },
     ];

e2e/src/specs/server/api/oauth.e2e-spec.ts

@@ -44,7 +44,7 @@ const loginWithOAuth = async (sub: OAuthUser | string, redirectUri?: string) =>
   });
 
   // login
-  const response1 = await redirect(url.replace(authServer.internal, authServer.external));
+  const response1 = await redirect(url.replace(authServer.internal, () => authServer.external));
   const response2 = await request(authServer.external + response1.location)
     .post('')
     .set('Cookie', response1.cookies)

e2e/src/specs/server/api/partner.e2e-spec.ts

@@ -1,6 +1,5 @@
 import { LoginResponseDto, createPartner } from '@immich/sdk';
 import { createUserDto } from 'src/fixtures';
-import { errorDto } from 'src/responses';
 import { app, asBearerAuth, utils } from 'src/utils';
 import request from 'supertest';
 import { beforeAll, describe, expect, it } from 'vitest';
@@ -29,13 +28,6 @@ describe('/partners', () => {
   });
 
   describe('GET /partners', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(app).get('/partners');
-
-      expect(status).toBe(401);
-      expect(body).toEqual(errorDto.unauthorized);
-    });
-
     it('should get all partners shared by user', async () => {
       const { status, body } = await request(app)
         .get('/partners')
@@ -58,13 +50,6 @@ describe('/partners', () => {
   });
 
   describe('POST /partners/:id', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(app).post(`/partners/${user3.userId}`);
-
-      expect(status).toBe(401);
-      expect(body).toEqual(errorDto.unauthorized);
-    });
-
     it('should share with new partner', async () => {
       const { status, body } = await request(app)
         .post(`/partners/${user3.userId}`)
@@ -85,13 +70,6 @@ describe('/partners', () => {
   });
 
   describe('PUT /partners/:id', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(app).put(`/partners/${user2.userId}`);
-
-      expect(status).toBe(401);
-      expect(body).toEqual(errorDto.unauthorized);
-    });
-
     it('should update partner', async () => {
       const { status, body } = await request(app)
         .put(`/partners/${user2.userId}`)
@@ -104,13 +82,6 @@ describe('/partners', () => {
   });
 
   describe('DELETE /partners/:id', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(app).delete(`/partners/${user3.userId}`);
-
-      expect(status).toBe(401);
-      expect(body).toEqual(errorDto.unauthorized);
-    });
-
     it('should delete partner', async () => {
       const { status } = await request(app)
         .delete(`/partners/${user3.userId}`)

e2e/src/specs/server/api/search.e2e-spec.ts

@@ -4,6 +4,7 @@ import {
   AssetVisibility,
   deleteAssets,
   LoginResponseDto,
+  SharedLinkType,
   updateAsset,
 } from '@immich/sdk';
 import { DateTime } from 'luxon';
@@ -86,23 +87,23 @@ describe('/search', () => {
 
     // note: the coordinates here are not the actual coordinates of the images and are random for most of them
     const coordinates = [
-      { latitude: 48.853_41, longitude: 2.3488 }, // paris
-      { latitude: 35.6895, longitude: 139.691_71 }, // tokyo
-      { latitude: 52.524_37, longitude: 13.410_53 }, // berlin
-      { latitude: 1.314_663_1, longitude: 103.845_409_3 }, // singapore
-      { latitude: 41.013_84, longitude: 28.949_66 }, // istanbul
-      { latitude: 5.556_02, longitude: -0.1969 }, // accra
-      { latitude: 37.544_270_6, longitude: -4.727_752_8 }, // andalusia
-      { latitude: 23.133_02, longitude: -82.383_04 }, // havana
-      { latitude: 41.694_11, longitude: 44.833_68 }, // tbilisi
-      { latitude: 31.222_22, longitude: 121.458_06 }, // shanghai
+      { latitude: 48.85341, longitude: 2.3488 }, // paris
+      { latitude: 35.6895, longitude: 139.69171 }, // tokyo
+      { latitude: 52.52437, longitude: 13.41053 }, // berlin
+      { latitude: 1.3146631, longitude: 103.8454093 }, // singapore
+      { latitude: 41.01384, longitude: 28.94966 }, // istanbul
+      { latitude: 5.55602, longitude: -0.1969 }, // accra
+      { latitude: 37.5442706, longitude: -4.7277528 }, // andalusia
+      { latitude: 23.13302, longitude: -82.38304 }, // havana
+      { latitude: 41.69411, longitude: 44.83368 }, // tbilisi
+      { latitude: 31.22222, longitude: 121.45806 }, // shanghai
       { latitude: 38.9711, longitude: -109.7137 }, // thompson springs
-      { latitude: 40.714_27, longitude: -74.005_97 }, // new york
-      { latitude: 47.040_57, longitude: 9.068_04 }, // glarus
-      { latitude: 32.771_52, longitude: -89.116_73 }, // philadelphia
-      { latitude: 31.634_16, longitude: -7.999_94 }, // marrakesh
-      { latitude: 38.523_735_4, longitude: -78.488_619_4 }, // tanners ridge
-      { latitude: 59.938_63, longitude: 30.314_13 }, // st. petersburg
+      { latitude: 40.71427, longitude: -74.00597 }, // new york
+      { latitude: 47.04057, longitude: 9.06804 }, // glarus
+      { latitude: 32.77152, longitude: -89.11673 }, // philadelphia
+      { latitude: 31.63416, longitude: -7.99994 }, // marrakesh
+      { latitude: 38.5237354, longitude: -78.4886194 }, // tanners ridge
+      { latitude: 59.93863, longitude: 30.31413 }, // st. petersburg
       { latitude: 0, longitude: 0 }, // null island
     ];
 
@@ -111,7 +112,7 @@ describe('/search', () => {
     );
 
     await Promise.all(updates);
-    for (const [i] of coordinates.entries()) {
+    for (const i of coordinates.keys()) {
       await utils.waitForWebsocketEvent({ event: 'assetUpdate', id: assets[i].id });
     }
 
@@ -357,6 +358,32 @@ describe('/search', () => {
         expect(body.assets.items).toHaveLength(assets.length);
       });
     }
+
+    it('should reject shared link access without an album filter', async () => {
+      const album = await utils.createAlbum(admin.accessToken, { albumName: 'foo' });
+      const sharedLink = await utils.createSharedLink(admin.accessToken, {
+        type: SharedLinkType.Album,
+        albumId: album.id,
+      });
+      const { status, body } = await request(app).post(`/search/metadata?key=${sharedLink.key}`).send({});
+      expect(status).toBe(400);
+      expect(body).toEqual({ message: 'Shared link access is only allowed in combination with an albumIds filter' });
+    });
+
+    it('should allow shared link access for albums', async () => {
+      const asset = await utils.createAsset(admin.accessToken);
+      const album = await utils.createAlbum(admin.accessToken, { albumName: 'foo', assetIds: [asset.id] });
+      const sharedLink = await utils.createSharedLink(admin.accessToken, {
+        type: SharedLinkType.Album,
+        albumId: album.id,
+      });
+
+      const { status, body } = await request(app)
+        .post(`/search/metadata?key=${sharedLink.key}`)
+        .send({ albumIds: [album.id] });
+      expect(status).toBe(200);
+      expect(body.assets.items).toEqual([expect.objectContaining({ id: asset.id })]);
+    });
   });
 
   describe('POST /search/random', () => {

e2e/src/specs/server/api/server.e2e-spec.ts

@@ -22,12 +22,6 @@ describe('/server', () => {
   });
 
   describe('GET /server/about', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(app).get('/server/about');
-      expect(status).toBe(401);
-      expect(body).toEqual(errorDto.unauthorized);
-    });
-
     it('should return about information', async () => {
       const { status, body } = await request(app)
         .get('/server/about')
@@ -56,12 +50,6 @@ describe('/server', () => {
   });
 
   describe('GET /server/storage', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(app).get('/server/storage');
-      expect(status).toBe(401);
-      expect(body).toEqual(errorDto.unauthorized);
-    });
-
     it('should return the disk information', async () => {
       const { status, body } = await request(app)
         .get('/server/storage')
@@ -91,12 +79,14 @@ describe('/server', () => {
     it('should respond with the server version', async () => {
       const { status, body } = await request(app).get('/server/version');
       expect(status).toBe(200);
-      expect(body).toEqual({
-        major: expect.any(Number),
-        minor: expect.any(Number),
-        patch: expect.any(Number),
-        prerelease: expect.anything(),
-      });
+      expect(body).toEqual(
+        expect.objectContaining({
+          major: expect.any(Number),
+          minor: expect.any(Number),
+          patch: expect.any(Number),
+        }),
+      );
+      expect(Object.keys(body)).toEqual(expect.arrayContaining(['major', 'minor', 'patch', 'prerelease']));
     });
   });
 
@@ -147,12 +137,6 @@ describe('/server', () => {
   });
 
   describe('GET /server/statistics', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(app).get('/server/statistics');
-      expect(status).toBe(401);
-      expect(body).toEqual(errorDto.unauthorized);
-    });
-
     it('should only work for admins', async () => {
       const { status, body } = await request(app)
         .get('/server/statistics')
@@ -211,12 +195,6 @@ describe('/server', () => {
   });
 
   describe('GET /server/license', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(app).get('/server/license');
-      expect(status).toBe(401);
-      expect(body).toEqual(errorDto.unauthorized);
-    });
-
     it('should only work for admins', async () => {
       const { status, body } = await request(app)
         .get('/server/license')
@@ -239,12 +217,6 @@ describe('/server', () => {
   });
 
   describe('DELETE /server/license', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(app).delete('/server/license');
-      expect(status).toBe(401);
-      expect(body).toEqual(errorDto.unauthorized);
-    });
-
     it('should only work for admins', async () => {
       const { status, body } = await request(app)
         .delete('/server/license')
@@ -264,12 +236,6 @@ describe('/server', () => {
   });
 
   describe('PUT /server/license', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(app).put('/server/license');
-      expect(status).toBe(401);
-      expect(body).toEqual(errorDto.unauthorized);
-    });
-
     it('should only work for admins', async () => {
       const { status, body } = await request(app)
         .put('/server/license')

e2e/src/specs/server/api/session.e2e-spec.ts

@@ -15,12 +15,6 @@ describe('/sessions', () => {
   });
 
   describe('GET /sessions', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(app).get('/sessions');
-      expect(status).toBe(401);
-      expect(body).toEqual(errorDto.unauthorized);
-    });
-
     it('should get a list of authorized devices', async () => {
       const { status, body } = await request(app).get('/sessions').set('Authorization', `Bearer ${admin.accessToken}`);
       expect(status).toBe(200);
@@ -29,12 +23,6 @@ describe('/sessions', () => {
   });
 
   describe('DELETE /sessions', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(app).delete(`/sessions`);
-      expect(status).toBe(401);
-      expect(body).toEqual(errorDto.unauthorized);
-    });
-
     it('should logout all devices (except the current one)', async () => {
       for (let i = 0; i < 5; i++) {
         await login({ loginCredentialDto: loginDto.admin });

e2e/src/specs/server/api/shared-link.e2e-spec.ts

@@ -137,13 +137,6 @@ describe('/shared-links', () => {
   });
 
   describe('GET /shared-links', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(app).get('/shared-links');
-
-      expect(status).toBe(401);
-      expect(body).toEqual(errorDto.unauthorized);
-    });
-
     it('should get all shared links created by user', async () => {
       const { status, body } = await request(app)
         .get('/shared-links')
@@ -200,12 +193,6 @@ describe('/shared-links', () => {
   });
 
   describe('GET /shared-links/me', () => {
-    it('should not require admin authentication', async () => {
-      const { status } = await request(app).get('/shared-links/me').set('Authorization', `Bearer ${admin.accessToken}`);
-
-      expect(status).toBe(403);
-    });
-
     it('should get data for correct shared link', async () => {
       const { status, body } = await request(app).get('/shared-links/me').query({ key: linkWithAlbum.key });
 
@@ -293,13 +280,6 @@ describe('/shared-links', () => {
   });
 
   describe('GET /shared-links/:id', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(app).get(`/shared-links/${linkWithAlbum.id}`);
-
-      expect(status).toBe(401);
-      expect(body).toEqual(errorDto.unauthorized);
-    });
-
     it('should get shared link by id', async () => {
       const { status, body } = await request(app)
         .get(`/shared-links/${linkWithAlbum.id}`)
@@ -326,26 +306,6 @@ describe('/shared-links', () => {
   });
 
   describe('POST /shared-links', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(app)
-        .post('/shared-links')
-        .send({ type: SharedLinkType.Album, albumId: uuidDto.notFound });
-
-      expect(status).toBe(401);
-      expect(body).toEqual(errorDto.unauthorized);
-    });
-
-    it('should require a type and the correspondent asset/album id', async () => {
-      const { status, body } = await request(app)
-        .post('/shared-links')
-        .set('Authorization', `Bearer ${user1.accessToken}`);
-
-      expect(status).toBe(400);
-      expect(body).toEqual(
-        errorDto.validationError([{ path: [], message: 'Invalid input: expected object, received undefined' }]),
-      );
-    });
-
     it('should require an asset/album id', async () => {
       const { status, body } = await request(app)
         .post('/shared-links')
@@ -353,17 +313,17 @@ describe('/shared-links', () => {
         .send({ type: SharedLinkType.Album });
 
       expect(status).toBe(400);
-      expect(body).toEqual(expect.objectContaining({ message: 'Invalid albumId' }));
+      expect(body).toEqual(errorDto.validationError([{ path: [], message: 'albumId is required for type ALBUM' }]));
     });
 
     it('should require a valid asset id', async () => {
       const { status, body } = await request(app)
         .post('/shared-links')
         .set('Authorization', `Bearer ${user1.accessToken}`)
-        .send({ type: SharedLinkType.Individual, assetId: uuidDto.notFound });
+        .send({ type: SharedLinkType.Individual, assetIds: [uuidDto.notFound] });
 
       expect(status).toBe(400);
-      expect(body).toEqual(expect.objectContaining({ message: 'Invalid assetIds' }));
+      expect(body).toEqual(expect.objectContaining({ message: 'Not found or no asset.share access' }));
     });
 
     it('should create a shared link', async () => {
@@ -383,15 +343,6 @@ describe('/shared-links', () => {
   });
 
   describe('PATCH /shared-links/:id', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(app)
-        .patch(`/shared-links/${linkWithAlbum.id}`)
-        .send({ description: 'foo' });
-
-      expect(status).toBe(401);
-      expect(body).toEqual(errorDto.unauthorized);
-    });
-
     it('should fail if invalid link', async () => {
       const { status, body } = await request(app)
         .patch(`/shared-links/${uuidDto.notFound}`)
@@ -474,13 +425,6 @@ describe('/shared-links', () => {
   });
 
   describe('DELETE /shared-links/:id', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(app).delete(`/shared-links/${linkWithAlbum.id}`);
-
-      expect(status).toBe(401);
-      expect(body).toEqual(errorDto.unauthorized);
-    });
-
     it('should fail if invalid link', async () => {
       const { status, body } = await request(app)
         .delete(`/shared-links/${uuidDto.notFound}`)

e2e/src/specs/server/api/stack.e2e-spec.ts

@@ -1,5 +1,5 @@
 import { AssetMediaResponseDto, LoginResponseDto, searchStacks } from '@immich/sdk';
-import { createUserDto, uuidDto } from 'src/fixtures';
+import { createUserDto } from 'src/fixtures';
 import { errorDto } from 'src/responses';
 import { app, asBearerAuth, utils } from 'src/utils';
 import request from 'supertest';
@@ -25,42 +25,6 @@ describe('/stacks', () => {
   });
 
   describe('POST /stacks', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(app)
-        .post('/stacks')
-        .send({ assetIds: [asset.id] });
-
-      expect(status).toBe(401);
-      expect(body).toEqual(errorDto.unauthorized);
-    });
-
-    it('should require at least two assets', async () => {
-      const { status, body } = await request(app)
-        .post('/stacks')
-        .set('Authorization', `Bearer ${user1.accessToken}`)
-        .send({ assetIds: [asset.id] });
-
-      expect(status).toBe(400);
-      expect(body).toEqual(
-        errorDto.validationError([{ path: ['assetIds'], message: 'Too small: expected array to have >=2 items' }]),
-      );
-    });
-
-    it('should require a valid id', async () => {
-      const { status, body } = await request(app)
-        .post('/stacks')
-        .set('Authorization', `Bearer ${user1.accessToken}`)
-        .send({ assetIds: [uuidDto.invalid, uuidDto.invalid] });
-
-      expect(status).toBe(400);
-      expect(body).toEqual(
-        errorDto.validationError([
-          { path: ['assetIds', 0], message: 'Invalid UUID' },
-          { path: ['assetIds', 1], message: 'Invalid UUID' },
-        ]),
-      );
-    });
-
     it('should require access', async () => {
       const user2Asset = await utils.createAsset(user2.accessToken);
       const { status, body } = await request(app)

e2e/src/specs/server/api/system-metadata.e2e-spec.ts

@@ -16,12 +16,6 @@ describe('/server-info', () => {
   });
 
   describe('POST /system-metadata/admin-onboarding', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(app).post('/system-metadata/admin-onboarding').send({ isOnboarded: true });
-      expect(status).toBe(401);
-      expect(body).toEqual(errorDto.unauthorized);
-    });
-
     it('should only work for admins', async () => {
       const { status, body } = await request(app)
         .post('/system-metadata/admin-onboarding')
@@ -47,12 +41,6 @@ describe('/server-info', () => {
   });
 
   describe('GET /system-metadata/reverse-geocoding-state', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(app).get('/system-metadata/reverse-geocoding-state');
-      expect(status).toBe(401);
-      expect(body).toEqual(errorDto.unauthorized);
-    });
-
     it('should only work for admins', async () => {
       const { status, body } = await request(app)
         .get('/system-metadata/reverse-geocoding-state')

e2e/src/specs/server/api/tag.e2e-spec.ts

@@ -41,12 +41,6 @@ describe('/tags', () => {
   });
 
   describe('POST /tags', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(app).post('/tags').send({ name: 'TagA' });
-      expect(status).toBe(401);
-      expect(body).toEqual(errorDto.unauthorized);
-    });
-
     it('should require authorization (api key)', async () => {
       const { secret } = await utils.createApiKey(user.accessToken, [Permission.AssetRead]);
       const { status, body } = await request(app).post('/tags').set('x-api-key', secret).send({ name: 'TagA' });
@@ -117,12 +111,6 @@ describe('/tags', () => {
   });
 
   describe('GET /tags', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(app).get('/tags');
-      expect(status).toBe(401);
-      expect(body).toEqual(errorDto.unauthorized);
-    });
-
     it('should require authorization (api key)', async () => {
       const { secret } = await utils.createApiKey(user.accessToken, [Permission.AssetRead]);
       const { status, body } = await request(app).get('/tags').set('x-api-key', secret);
@@ -169,12 +157,6 @@ describe('/tags', () => {
   });
 
   describe('PUT /tags', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(app).put(`/tags`).send({ name: 'TagA/TagB' });
-      expect(status).toBe(401);
-      expect(body).toEqual(errorDto.unauthorized);
-    });
-
     it('should require authorization (api key)', async () => {
       const { secret } = await utils.createApiKey(user.accessToken, [Permission.AssetRead]);
       const { status, body } = await request(app).put('/tags').set('x-api-key', secret).send({ name: 'TagA' });
@@ -213,12 +195,6 @@ describe('/tags', () => {
   });
 
   describe('PUT /tags/assets', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(app).put(`/tags/assets`).send({ tagIds: [], assetIds: [] });
-      expect(status).toBe(401);
-      expect(body).toEqual(errorDto.unauthorized);
-    });
-
     it('should require authorization (api key)', async () => {
       const { secret } = await utils.createApiKey(user.accessToken, [Permission.AssetRead]);
       const { status, body } = await request(app)
@@ -279,12 +255,6 @@ describe('/tags', () => {
   });
 
   describe('GET /tags/:id', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(app).get(`/tags/${uuidDto.notFound}`);
-      expect(status).toBe(401);
-      expect(body).toEqual(errorDto.unauthorized);
-    });
-
     it('should require authorization', async () => {
       const tag = await create(user.accessToken, { name: 'TagA' });
       const { status, body } = await request(app)
@@ -304,14 +274,6 @@ describe('/tags', () => {
       expect(body).toEqual(errorDto.missingPermission('tag.read'));
     });
 
-    it('should require a valid uuid', async () => {
-      const { status, body } = await request(app)
-        .get(`/tags/${uuidDto.invalid}`)
-        .set('Authorization', `Bearer ${admin.accessToken}`);
-      expect(status).toBe(400);
-      expect(body).toEqual(errorDto.validationError([{ path: ['id'], message: 'Invalid UUID' }]));
-    });
-
     it('should get tag details', async () => {
       const tag = await create(user.accessToken, { name: 'TagA' });
       const { status, body } = await request(app)
@@ -349,13 +311,6 @@ describe('/tags', () => {
   });
 
   describe('PUT /tags/:id', () => {
-    it('should require authentication', async () => {
-      const tag = await create(user.accessToken, { name: 'TagA' });
-      const { status, body } = await request(app).put(`/tags/${tag.id}`).send({ color: '#000000' });
-      expect(status).toBe(401);
-      expect(body).toEqual(errorDto.unauthorized);
-    });
-
     it('should require authorization', async () => {
       const tag = await create(admin.accessToken, { name: 'tagA' });
       const { status, body } = await request(app)
@@ -399,12 +354,6 @@ describe('/tags', () => {
   });
 
   describe('DELETE /tags/:id', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(app).delete(`/tags/${uuidDto.notFound}`);
-      expect(status).toBe(401);
-      expect(body).toEqual(errorDto.unauthorized);
-    });
-
     it('should require authorization', async () => {
       const tag = await create(user.accessToken, { name: 'TagA' });
       const { status, body } = await request(app)
@@ -422,14 +371,6 @@ describe('/tags', () => {
       expect(body).toEqual(errorDto.missingPermission('tag.delete'));
     });
 
-    it('should require a valid uuid', async () => {
-      const { status, body } = await request(app)
-        .delete(`/tags/${uuidDto.invalid}`)
-        .set('Authorization', `Bearer ${admin.accessToken}`);
-      expect(status).toBe(400);
-      expect(body).toEqual(errorDto.validationError([{ path: ['id'], message: 'Invalid UUID' }]));
-    });
-
     it('should delete a tag', async () => {
       const tag = await create(user.accessToken, { name: 'TagA' });
       const { status } = await request(app)
@@ -463,15 +404,6 @@ describe('/tags', () => {
   });
 
   describe('PUT /tags/:id/assets', () => {
-    it('should require authentication', async () => {
-      const tagA = await create(user.accessToken, { name: 'TagA' });
-      const { status, body } = await request(app)
-        .put(`/tags/${tagA.id}/assets`)
-        .send({ ids: [userAsset.id] });
-      expect(status).toBe(401);
-      expect(body).toEqual(errorDto.unauthorized);
-    });
-
     it('should require authorization', async () => {
       const tag = await create(user.accessToken, { name: 'TagA' });
       const { status, body } = await request(app)
@@ -531,16 +463,6 @@ describe('/tags', () => {
   });
 
   describe('DELETE /tags/:id/assets', () => {
-    it('should require authentication', async () => {
-      const tagA = await create(admin.accessToken, { name: 'TagA' });
-      const { status, body } = await request(app)
-        .delete(`/tags/${tagA}/assets`)
-        .send({ ids: [userAsset.id] });
-
-      expect(status).toBe(401);
-      expect(body).toEqual(errorDto.unauthorized);
-    });
-
     it('should require authorization', async () => {
       const tagA = await create(user.accessToken, { name: 'TagA' });
       await tagAssets(

e2e/src/specs/server/api/user-admin.e2e-spec.ts

@@ -1,5 +1,6 @@
 import {
   LoginResponseDto,
+  Permission,
   QueueName,
   createStack,
   deleteUserAdmin,
@@ -45,12 +46,6 @@ describe('/admin/users', () => {
   });
 
   describe('GET /admin/users', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(app).get(`/admin/users`);
-      expect(status).toBe(401);
-      expect(body).toEqual(errorDto.unauthorized);
-    });
-
     it('should require authorization', async () => {
       const { status, body } = await request(app)
         .get(`/admin/users`)
@@ -93,12 +88,6 @@ describe('/admin/users', () => {
   });
 
   describe('POST /admin/users', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(app).post(`/admin/users`).send(createUserDto.user1);
-      expect(status).toBe(401);
-      expect(body).toEqual(errorDto.unauthorized);
-    });
-
     it('should require authorization', async () => {
       const { status, body } = await request(app)
         .post(`/admin/users`)
@@ -108,23 +97,6 @@ describe('/admin/users', () => {
       expect(body).toEqual(errorDto.forbidden);
     });
 
-    for (const [key, message] of [
-      ['password', 'Invalid input: expected string, received null'],
-      ['email', 'Invalid input: expected email, received object'],
-      ['name', 'Invalid input: expected string, received null'],
-      ['shouldChangePassword', 'Invalid input: expected boolean, received null'],
-      ['notify', 'Invalid input: expected boolean, received null'],
-    ] as const) {
-      it(`should not allow null ${key}`, async () => {
-        const { status, body } = await request(app)
-          .post(`/admin/users`)
-          .set('Authorization', `Bearer ${admin.accessToken}`)
-          .send({ ...createUserDto.user1, [key]: null });
-        expect(status).toBe(400);
-        expect(body).toEqual(errorDto.validationError([{ path: [key], message }]));
-      });
-    }
-
     it('should accept `isAdmin`', async () => {
       const { status, body } = await request(app)
         .post(`/admin/users`)
@@ -145,12 +117,6 @@ describe('/admin/users', () => {
   });
 
   describe('PUT /admin/users/:id', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(app).put(`/admin/users/${uuidDto.notFound}`);
-      expect(status).toBe(401);
-      expect(body).toEqual(errorDto.unauthorized);
-    });
-
     it('should require authorization', async () => {
       const { status, body } = await request(app)
         .put(`/admin/users/${uuidDto.notFound}`)
@@ -159,22 +125,6 @@ describe('/admin/users', () => {
       expect(body).toEqual(errorDto.forbidden);
     });
 
-    for (const [key, message] of [
-      ['password', 'Invalid input: expected string, received null'],
-      ['email', 'Invalid input: expected email, received object'],
-      ['name', 'Invalid input: expected string, received null'],
-      ['shouldChangePassword', 'Invalid input: expected boolean, received null'],
-    ] as const) {
-      it(`should not allow null ${key}`, async () => {
-        const { status, body } = await request(app)
-          .put(`/admin/users/${uuidDto.notFound}`)
-          .set('Authorization', `Bearer ${admin.accessToken}`)
-          .send({ [key]: null });
-        expect(status).toBe(400);
-        expect(body).toEqual(errorDto.validationError([{ path: [key], message }]));
-      });
-    }
-
     it('should allow a non-admin to become an admin', async () => {
       const user = await utils.userSetup(admin.accessToken, createUserDto.create('admin2'));
       const { status, body } = await request(app)
@@ -244,12 +194,6 @@ describe('/admin/users', () => {
   });
 
   describe('PUT /admin/users/:id/preferences', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(app).put(`/admin/users/${userToDelete.userId}/preferences`);
-      expect(status).toBe(401);
-      expect(body).toEqual(errorDto.unauthorized);
-    });
-
     it('should update memories enabled', async () => {
       const before = await getUserPreferencesAdmin({ id: admin.userId }, { headers: asBearerAuth(admin.accessToken) });
       expect(before).toMatchObject({ memories: { enabled: true } });
@@ -281,12 +225,6 @@ describe('/admin/users', () => {
   });
 
   describe('DELETE /admin/users/:id', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(app).delete(`/admin/users/${userToDelete.userId}`);
-      expect(status).toBe(401);
-      expect(body).toEqual(errorDto.unauthorized);
-    });
-
     it('should require authorization', async () => {
       const { status, body } = await request(app)
         .delete(`/admin/users/${userToDelete.userId}`)
@@ -358,13 +296,26 @@ describe('/admin/users', () => {
     });
   });
 
-  describe('POST /admin/users/:id/restore', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(app).post(`/admin/users/${userToDelete.userId}/restore`);
-      expect(status).toBe(401);
-      expect(body).toEqual(errorDto.unauthorized);
+  describe('GET /admin/users/:id/calendar-heatmap', () => {
+    it('should require admin permissions', async () => {
+      const { status, body } = await request(app)
+        .get(`/admin/users/${nonAdmin.userId}/calendar-heatmap`)
+        .set('Authorization', `Bearer ${nonAdmin.accessToken}`);
+      expect(status).toBe(403);
+      expect(body).toEqual(errorDto.forbidden);
     });
 
+    it('should require the AdminUserRead permission', async () => {
+      const { secret } = await utils.createApiKey(admin.accessToken, [Permission.UserRead]);
+      const { status, body } = await request(app)
+        .get(`/admin/users/${nonAdmin.userId}/calendar-heatmap`)
+        .set('x-api-key', secret);
+      expect(status).toBe(403);
+      expect(body).toEqual(errorDto.forbidden);
+    });
+  });
+
+  describe('POST /admin/users/:id/restore', () => {
     it('should require authorization', async () => {
       const { status, body } = await request(app)
         .post(`/admin/users/${userToDelete.userId}/restore`)

e2e/src/specs/server/api/user.e2e-spec.ts

@@ -1,34 +1,18 @@
-import { LoginResponseDto, SharedLinkType, deleteUserAdmin, getMyPreferences, getMyUser, login } from '@immich/sdk';
+import { LoginResponseDto, SharedLinkType, getMyUser, login } from '@immich/sdk';
 import { createUserDto } from 'src/fixtures';
 import { errorDto } from 'src/responses';
 import { app, asBearerAuth, utils } from 'src/utils';
 import request from 'supertest';
 import { beforeAll, describe, expect, it } from 'vitest';
 
-const userLicense = {
-  licenseKey: 'IMCL-FF69-TUK1-RWZU-V9Q8-QGQS-S5GC-X4R2-UFK4',
-  activationKey:
-    'KuX8KsktrBSiXpQMAH0zLgA5SpijXVr_PDkzLdWUlAogCTMBZ0I3KCHXK0eE9EEd7harxup8_EHMeqAWeHo5VQzol6LGECpFv585U9asXD4Zc-UXt3mhJr2uhazqipBIBwJA2YhmUCDy8hiyiGsukDQNu9Rg9C77UeoKuZBWVjWUBWG0mc1iRqfvF0faVM20w53czAzlhaMxzVGc3Oimbd7xi_CAMSujF_2y8QpA3X2fOVkQkzdcH9lV0COejl7IyH27zQQ9HrlrXv3Lai5Hw67kNkaSjmunVBxC5PS0TpKoc9SfBJMaAGWnaDbjhjYUrm-8nIDQnoeEAidDXVAdPw',
-};
-
 describe('/users', () => {
   let admin: LoginResponseDto;
-  let deletedUser: LoginResponseDto;
   let nonAdmin: LoginResponseDto;
 
   beforeAll(async () => {
     await utils.resetDatabase();
     admin = await utils.adminSetup({ onboarding: false });
-
-    [deletedUser, nonAdmin] = await Promise.all([
-      utils.userSetup(admin.accessToken, createUserDto.user1),
-      utils.userSetup(admin.accessToken, createUserDto.user2),
-    ]);
-
-    await deleteUserAdmin(
-      { id: deletedUser.userId, userAdminDeleteDto: {} },
-      { headers: asBearerAuth(admin.accessToken) },
-    );
+    nonAdmin = await utils.userSetup(admin.accessToken, createUserDto.user2);
   });
 
   describe('GET /users/me', () => {
@@ -42,55 +26,9 @@ describe('/users', () => {
       expect(status).toBe(403);
       expect(body).toEqual(errorDto.forbidden);
     });
-
-    it('should get my user', async () => {
-      const { status, body } = await request(app).get(`/users/me`).set('Authorization', `Bearer ${admin.accessToken}`);
-      expect(status).toBe(200);
-      expect(body).toMatchObject({
-        id: admin.userId,
-        email: 'admin@immich.cloud',
-        quotaUsageInBytes: 0,
-      });
-    });
-
-    it('should get my user with license info', async () => {
-      const { status: licenseStatus } = await request(app)
-        .put(`/users/me/license`)
-        .send(userLicense)
-        .set('Authorization', `Bearer ${nonAdmin.accessToken}`);
-      expect(licenseStatus).toBe(200);
-      const { status, body } = await request(app)
-        .get(`/users/me`)
-        .set('Authorization', `Bearer ${nonAdmin.accessToken}`);
-      expect(status).toBe(200);
-      expect(body).toMatchObject({
-        id: nonAdmin.userId,
-        email: nonAdmin.userEmail,
-        quotaUsageInBytes: 0,
-        license: userLicense,
-      });
-    });
   });
 
   describe('PUT /users/me', () => {
-    it('should update first and last name', async () => {
-      const before = await getMyUser({ headers: asBearerAuth(admin.accessToken) });
-
-      const { status, body } = await request(app)
-        .put(`/users/me`)
-        .send({ name: 'Name' })
-        .set('Authorization', `Bearer ${admin.accessToken}`);
-
-      expect(status).toBe(200);
-      expect(body).toEqual({
-        ...before,
-        updatedAt: expect.any(String),
-        profileChangedAt: expect.any(String),
-        createdAt: expect.any(String),
-        name: 'Name',
-      });
-    });
-
     /** @deprecated */
     it('should allow a user to change their password (deprecated)', async () => {
       const user = await getMyUser({ headers: asBearerAuth(nonAdmin.accessToken) });
@@ -112,222 +50,5 @@ describe('/users', () => {
 
       expect(token.accessToken).toBeDefined();
     });
-
-    it('should not allow user to change to a taken email', async () => {
-      const { status, body } = await request(app)
-        .put(`/users/me`)
-        .send({ email: 'admin@immich.cloud' })
-        .set('Authorization', `Bearer ${nonAdmin.accessToken}`);
-
-      expect(status).toBe(400);
-      expect(body).toMatchObject(errorDto.badRequest('Email is not available'));
-    });
-
-    it('should update my email', async () => {
-      const before = await getMyUser({ headers: asBearerAuth(nonAdmin.accessToken) });
-      const { status, body } = await request(app)
-        .put(`/users/me`)
-        .send({ email: 'non-admin@immich.cloud' })
-        .set('Authorization', `Bearer ${nonAdmin.accessToken}`);
-
-      expect(status).toBe(200);
-      expect(body).toMatchObject({
-        ...before,
-        email: 'non-admin@immich.cloud',
-        updatedAt: expect.anything(),
-        createdAt: expect.anything(),
-        profileChangedAt: expect.anything(),
-      });
-    });
-
-    it('should update avatar color', async () => {
-      const { status, body } = await request(app)
-        .put(`/users/me`)
-        .send({ avatarColor: 'blue' })
-        .set('Authorization', `Bearer ${admin.accessToken}`);
-
-      expect(status).toBe(200);
-      expect(body).toMatchObject({ avatarColor: 'blue' });
-
-      const after = await getMyUser({ headers: asBearerAuth(admin.accessToken) });
-      expect(after).toMatchObject({ avatarColor: 'blue' });
-    });
-  });
-
-  describe('PUT /users/me/preferences', () => {
-    it('should update memories enabled', async () => {
-      const before = await getMyPreferences({ headers: asBearerAuth(admin.accessToken) });
-      expect(before).toMatchObject({ memories: { enabled: true } });
-
-      const { status, body } = await request(app)
-        .put(`/users/me/preferences`)
-        .send({ memories: { enabled: false } })
-        .set('Authorization', `Bearer ${admin.accessToken}`);
-
-      expect(status).toBe(200);
-      expect(body).toMatchObject({ memories: { enabled: false } });
-
-      const after = await getMyPreferences({ headers: asBearerAuth(admin.accessToken) });
-      expect(after).toMatchObject({ memories: { enabled: false } });
-    });
-
-    it('should require an integer for download archive size', async () => {
-      const { status, body } = await request(app)
-        .put(`/users/me/preferences`)
-        .send({ download: { archiveSize: 1_234_567.89 } })
-        .set('Authorization', `Bearer ${admin.accessToken}`);
-
-      expect(status).toBe(400);
-      expect(body).toEqual(
-        errorDto.validationError([
-          { path: ['download', 'archiveSize'], message: 'Invalid input: expected int, received number' },
-        ]),
-      );
-    });
-
-    it('should update download archive size', async () => {
-      const before = await getMyPreferences({ headers: asBearerAuth(admin.accessToken) });
-      expect(before).toMatchObject({ download: { archiveSize: 4 * 2 ** 30 } });
-
-      const { status, body } = await request(app)
-        .put(`/users/me/preferences`)
-        .send({ download: { archiveSize: 1_234_567 } })
-        .set('Authorization', `Bearer ${admin.accessToken}`);
-
-      expect(status).toBe(200);
-      expect(body).toMatchObject({ download: { archiveSize: 1_234_567 } });
-
-      const after = await getMyPreferences({ headers: asBearerAuth(admin.accessToken) });
-      expect(after).toMatchObject({ download: { archiveSize: 1_234_567 } });
-    });
-
-    it('should require a boolean for download include embedded videos', async () => {
-      const { status, body } = await request(app)
-        .put(`/users/me/preferences`)
-        .send({ download: { includeEmbeddedVideos: 1_234_567.89 } })
-        .set('Authorization', `Bearer ${admin.accessToken}`);
-
-      expect(status).toBe(400);
-      expect(body).toEqual(
-        errorDto.validationError([
-          { path: ['download', 'includeEmbeddedVideos'], message: 'Invalid input: expected boolean, received number' },
-        ]),
-      );
-    });
-
-    it('should update download include embedded videos', async () => {
-      const before = await getMyPreferences({ headers: asBearerAuth(admin.accessToken) });
-      expect(before).toMatchObject({ download: { includeEmbeddedVideos: false } });
-
-      const { status, body } = await request(app)
-        .put(`/users/me/preferences`)
-        .send({ download: { includeEmbeddedVideos: true } })
-        .set('Authorization', `Bearer ${admin.accessToken}`);
-
-      expect(status).toBe(200);
-      expect(body).toMatchObject({ download: { includeEmbeddedVideos: true } });
-
-      const after = await getMyPreferences({ headers: asBearerAuth(admin.accessToken) });
-      expect(after).toMatchObject({ download: { includeEmbeddedVideos: true } });
-    });
-
-    it('should update minimum face count to display people', async () => {
-      const before = await getMyPreferences({ headers: asBearerAuth(admin.accessToken) });
-      expect(before).toMatchObject({ people: { minimumFaces: 3 } });
-
-      const { status, body } = await request(app)
-        .put('/users/me/preferences')
-        .send({ people: { minimumFaces: 2 } })
-        .set('Authorization', `Bearer ${admin.accessToken}`);
-      expect(status).toBe(200);
-      expect(body).toMatchObject({ people: { minimumFaces: 2 } });
-
-      const after = await getMyPreferences({ headers: asBearerAuth(admin.accessToken) });
-      expect(after).toMatchObject({ people: { minimumFaces: 2 } });
-    });
-  });
-
-  describe('GET /users/:id', () => {
-    it('should get the user', async () => {
-      const { status, body } = await request(app)
-        .get(`/users/${admin.userId}`)
-        .set('Authorization', `Bearer ${admin.accessToken}`);
-      expect(status).toBe(200);
-      expect(body).toMatchObject({
-        id: admin.userId,
-        email: 'admin@immich.cloud',
-      });
-
-      expect(body).not.toMatchObject({
-        shouldChangePassword: expect.anything(),
-        storageLabel: expect.anything(),
-      });
-    });
-  });
-
-  describe('GET /server/license', () => {
-    it('should return the user license', async () => {
-      await request(app)
-        .put('/users/me/license')
-        .set('Authorization', `Bearer ${nonAdmin.accessToken}`)
-        .send(userLicense);
-      const { status, body } = await request(app)
-        .get('/users/me/license')
-        .set('Authorization', `Bearer ${nonAdmin.accessToken}`);
-      expect(status).toBe(200);
-      expect(body).toEqual({
-        ...userLicense,
-        activatedAt: expect.any(String),
-      });
-    });
-  });
-
-  describe('PUT /users/me/license', () => {
-    it('should set the user license', async () => {
-      const { status, body } = await request(app)
-        .put(`/users/me/license`)
-        .send(userLicense)
-        .set('Authorization', `Bearer ${nonAdmin.accessToken}`);
-      expect(status).toBe(200);
-      expect(body).toMatchObject({ ...userLicense, activatedAt: expect.any(String) });
-      expect(status).toBe(200);
-      expect(body).toEqual({ ...userLicense, activatedAt: expect.any(String) });
-      const { body: licenseBody } = await request(app)
-        .get('/users/me/license')
-        .set('Authorization', `Bearer ${nonAdmin.accessToken}`);
-      expect(licenseBody).toEqual({ ...userLicense, activatedAt: expect.any(String) });
-    });
-
-    it('should reject license not starting with IMCL-', async () => {
-      const { status, body } = await request(app)
-        .put('/users/me/license')
-        .set('Authorization', `Bearer ${nonAdmin.accessToken}`)
-        .send({ licenseKey: 'IMSV-ABCD-ABCD-ABCD-ABCD-ABCD-ABCD-ABCD-ABCD', activationKey: 'activationKey' });
-      expect(status).toBe(400);
-      expect(body.message).toBe('Invalid license key');
-    });
-
-    it('should reject license with invalid activation key', async () => {
-      const { status, body } = await request(app)
-        .put('/users/me/license')
-        .set('Authorization', `Bearer ${nonAdmin.accessToken}`)
-        .send({ licenseKey: userLicense.licenseKey, activationKey: `invalid${userLicense.activationKey}` });
-      expect(status).toBe(400);
-      expect(body.message).toBe('Invalid license key');
-    });
-  });
-
-  describe('DELETE /users/me/license', () => {
-    it('should require authentication', async () => {
-      const { status } = await request(app).put(`/users/me/license`);
-      expect(status).toEqual(401);
-    });
-
-    it('should delete the user license', async () => {
-      const { status } = await request(app)
-        .delete(`/users/me/license`)
-        .set('Authorization', `Bearer ${nonAdmin.accessToken}`);
-      expect(status).toBe(204);
-    });
   });
 });

e2e/src/specs/server/cli/login.e2e-spec.ts

@@ -31,7 +31,7 @@ describe(`immich login`, () => {
   it('should login and save auth.yml with 600', async () => {
     const admin = await utils.adminSetup();
     const key = await utils.createApiKey(admin.accessToken, [Permission.All]);
-    const { stdout, stderr, exitCode } = await immichCli(['login', app, `${key.secret}`]);
+    const { stdout, stderr, exitCode } = await immichCli(['login', app, key.secret]);
     expect(stdout.split('\n')).toEqual([
       'Logging in to http://127.0.0.1:2285/api',
       'Logged in as admin@immich.cloud',
@@ -48,7 +48,7 @@ describe(`immich login`, () => {
   it('should login without /api in the url', async () => {
     const admin = await utils.adminSetup();
     const key = await utils.createApiKey(admin.accessToken, [Permission.All]);
-    const { stdout, stderr, exitCode } = await immichCli(['login', app.replaceAll('/api', ''), `${key.secret}`]);
+    const { stdout, stderr, exitCode } = await immichCli(['login', app.replaceAll('/api', ''), key.secret]);
     expect(stdout.split('\n')).toEqual([
       'Logging in to http://127.0.0.1:2285',
       'Discovered API at http://127.0.0.1:2285/api',

e2e/src/specs/server/cli/upload.e2e-spec.ts

@@ -119,7 +119,9 @@ describe(`immich upload`, () => {
           const baseDir = `/tmp/upload/`;
 
           const testPaths = Object.keys(files).map((filePath) => `${baseDir}/${filePath}`);
-          testPaths.map((filePath) => utils.createImageFile(filePath));
+          for (const filePath of testPaths) {
+            utils.createImageFile(filePath);
+          }
 
           const commandLine = paths.map((argument) => `${baseDir}/${argument}`);
 
@@ -135,7 +137,9 @@ describe(`immich upload`, () => {
           const assets = await getAssetStatistics({}, { headers: asKeyAuth(key) });
           expect(assets.total).toBe(expectedCount);
 
-          testPaths.map((filePath) => utils.removeImageFile(filePath));
+          for (const filePath of testPaths) {
+            utils.removeImageFile(filePath);
+          }
         });
       }
     });
@@ -646,7 +650,7 @@ describe(`immich upload`, () => {
       ]);
 
       expect(stdout).toBe('');
-      expect(stderr).toEqual(`error: option '-n, --dry-run' cannot be used with option '-h, --skip-hash'`);
+      expect(stderr).toEqual(`error: option '-n, --dry-run' cannot be used with option '--skip-hash'`);
       expect(exitCode).not.toBe(0);
 
       const assets = await getAssetStatistics({}, { headers: asKeyAuth(key) });

e2e/src/specs/server/immich-admin/immich-admin.e2e-spec.ts

@@ -65,6 +65,10 @@ describe(`immich-admin`, () => {
       child.stdout.on('data', (chunk) => {
         data += chunk;
         if (data.includes('Please choose a new password (optional)')) {
+          child.stdin.write('\n');
+        }
+
+        if (data.includes('Invalidate existing sessions?')) {
           child.stdin.end('\n');
         }
       });

e2e/src/ui/generators/timeline/images.ts

@@ -21,7 +21,7 @@ export const randomImageFromString = async (
   let seedNumber = 0;
   for (let i = 0; i < seed.length; i++) {
     seedNumber = (seedNumber << 5) - seedNumber + (seed.codePointAt(i) ?? 0);
-    seedNumber = seedNumber & seedNumber; // Convert to 32bit integer
+    seedNumber &= seedNumber; // Convert to 32bit integer
   }
   return randomImage(new SeededRandom(Math.abs(seedNumber)), { width, height });
 };