v1.82.0

Security

We identified two security flaws that have been fixed and, therefore, urge all Immich users to upgrade as soon as possible.

• The first flaw link is of medium severity and could sometimes lead to information disclosure. This was reported to us by Andrea Alemani. Accessing the metadata of assets outside of the shared album was possible when using the shared album feature. This does not leak the entire photo/video content. Still, it includes the thumbhash (a very low-resolution placeholder) and information such as capture time, original filename, and file checksum.
• The other link is also an information disclosure classified as low severity. The signup process used a previously public endpoint (/api/user/count) to determine if the server had an initial administrator account. The endpoint revealed the number of user accounts on the Immich server, which is undesirable. We have added authentication to this endpoint and migrated the server initialization status to an alternative endpoint. This flaw was found by internal security testing (DAST) by the Immich team.

In addition, we have discovered that thumbnails (which can be downloaded from right-click -> save images as…) contain the full EXIF (metadata) information. Normally, you might expect this metadata to be scrubbed (as do Facebook, Google Photos, Twitter, etc.), but it isn’t. We are not able to fix it ourselves without significant performance degradation but have to wait for an upstream package. We advise users not to use the public-sharing feature if they have concerns about sharing metadata.

Highlights

Welcome to release v1.82.0 of Immich. This release is packed with many improvements, so buckle your seat belt and zoom on to the highlights below:

• Trash Feature
• Web Client WebSocket Feature
• Library Scanning Performance
• Time Bucket Grouping Accuracy
• Storage Template Improvements
• Notable fix: no longer read iOS-modified photos as “FullSizeRender” - Thanks, @xick, for fixing the issue upstream. You can fix the older assets by removing them from your immich server and reuploading the files, and they will have the original name.

Trash Feature

This release introduces the new trash feature, which is similar to the trash section on your native photo viewer. When a photo is deleted from Immich, it will go into the trash and stay there for 30 days before being permanently removed from Immich, which includes the database and the file system for non-external library assets. You can access the page from the sidebar on the web and the app drawer menu in the mobile app. Like with most features in Immich, you can adjust the trash duration or even opt out of the feature entirely from the Administration Settings. This has been a highly requested feature, and we hope you enjoy it. Let us know if you run into any issues using it.

Web Client WebSocket

Several actions in the web client previously required the user to manually refresh the page to see changes. In this release, we added a WebSocket connection to the web application, eliminating some of these manual refreshes and improving the user experience. Events that are now pushed from the server include:

• When a new feature photo is selected for a person
• When an asset is trashed, deleted, or restored
• When the server connects/disconnects
• When features are enabled/disabled (search, trash, map, machine learning, auth options, etc.)
• When server configuration is updated (trash days, map URL, OAuth button text)

With web sockets in place now both in the web and mobile apps, we hope to find additional ways to improve the user experience and push updates as they happen to appropriate clients.

Library Scanning Improvements

Library scanning performance has been significantly improved in this release. Specifically, the implementation for the initial scan has been greatly improved. Previously, this job had quadratic time complexity but has since been improved to linear time. On a library with 250k assets, the time to queue a library refresh has gone down from 10+ minutes (@etnoy said: I couldn’t be bothered to wait longer for a list comparison) to around 30 seconds.

Additionally, marking assets as offline has been improved as well. This process is used to execute a single query per asset, which adds up when large numbers of assets go offline. We have optimized this to use a single (bulk) update statement. For reference, marking 16k assets as offline went down from several minutes to a few seconds.

Lastly, we have added an index for asset lookups by path, which should decrease the amount of pressure on put on the database during library refreshes.

The default library job concurrency has been increased from 1 to 5.

These improvements will make it much easier to use Immich with large collections. Please let us know if you are still seeing performance bottlenecks in the library jobs. We plan to continue to iterate and improve this area in the future, and your feedback is very helpful in identifying issues.

Asset Time Buckets Grouping (web)

Assets are grouped by buckets on the web, and this was a problematic and complicated task when considering photos taken in different time zones. Even more so when considering a database, server, and client, which may all be running in different timezones, now, with a new database column localDateTime, we can query, sort, and group assets by the local date and time they were taken and show them consistently in the right bucket (in the correct order), regardless of the server or viewing timezone.

Storage Template Improvements

The storage template feature was added in the early days of Immich and has helped many people automatically organize the underlying files into a clean, predictable structure. However, the additional file move operations that were introduced with the feature have also been the cause of some nasty bugs, like #2877. In this release, we have hardened the move operations, which have significantly improved the resiliency of storage template move operations. Additionally, we have added a new page at Administration > Repair, which gives a report of orphaned and untracked files, with some initial tools to help correct previously orphaned files.

Please consider supporting the project.

Support

If you find the project helpful, you can support Immich via the following channels.

• Monthly donation via GitHub Sponsors
• One-time donation via GitHub Sponsors
• Librepay
• buymeacoffee
• Bitcoin: 1FvEp6P6NM8EZEkpGUFAN2LqJ1gxusNxZX

It is a great way to let me know that you want me to continue developing and working on this project for years to come.

Changelogs

Server

• feat(server): trash asset by @shalong-tanwen in #4015
• feat(server): jpe extension by @jrasm91 in #4374
• feat(server): full backend end-to-end testing with microservices by @jrasm91 in #4225
• fix(server): use local time for time buckets and improve memories by @jrasm91 in #4072
• fix(server): use fileCreatedAt in bucket calculation by @etnoy in #4354
• fix(server): dev compose by @jrasm91 in #4357
• fix(server): migration efficiency by @jrasm91 in #4359
• fix(server): time buckets by @jrasm91 in #4358
• fix(server): normalize external path by @etnoy in #4239
• fix(server): delete library actually deletes (all) assets by @danieldietzler in #4386
• fix(server): make system config core singleton by @danieldietzler in #4392
• fix(server): clean up android motion assets by @jrasm91 in #4393
• fix(server): timeline bucket access for shared links by @jrasm91 in #4404
• fix(server): add original path and library id index to asset by @etnoy in #4410
• fix(server): only check external path once by @etnoy in #4419
• fix(server): schema generation by @jrasm91 in #4424
• fix(server): improve library scan queuing performance by @etnoy in #4418
• fix(server): don't publicly reveal user count by @etnoy in #4409
• fix(server): include trashed asset during face re-index and cleanup by @shalong-tanwen in #4450
• fix(server): don't float promises by @etnoy in #4433
• fix(server): always show people with name, ignore count by @GenericGuy in #4414
• fix(server): include trashed assets in existing assets list by @shalong-tanwen in #4483
• fix(server): time buckets (again) by @jrasm91 in #4498
• fix(server): correctly remove metadata from shared links by @etnoy in #4464
• refactor(server): filesystem crawl by @jrasm91 in #4395
• refactor(server): domain repositories by @jrasm91 in #4403
• refactor(server): make file movement more resilient by @danieldietzler in #4361
• refactor(server): library asset delete by @jrasm91 in #4366
• chore(server): organize library imports by @jrasm91 in #4396
• chore(server): use force instead of forceRefresh by @jrasm91 in #4394

Machine Learning

• fix(ml): allow larger CLIP models by @mertalev in #4422

Web

• feat(web): improve performances in person page (1) by @martabal in #4387
• feat(web): offline/untracked files admin tool by @jrasm91 in #4447
• feat(web): enable WebSocket by @alextran1502 in #3765
• feat(web): ws - on_config_update by @shalong-tanwen in #4378
• feat(web) add hover background to image toolbar icons by @katsadim in #4402
• feat(web): show trash days info in trash page by @shalong-tanwen in #4484
• feat(web): save album sort direction/ sortDesc param by @JonasMayerDev in #4401
• fix(web): open external link in new tab by @daniele-athome in #4353
• fix(web): dev mode repeatedly optimizing dependencies by @mertalev in #4379
• fix(web): merge faces by @martabal in #4383
• fix(web): people initialization on the merge face selector by @martabal in #4435
• fix(web): previous route when hiding a person by @martabal in #4452
• fix(web): empty placeholders by @jrasm91 in #4470
• chore(web): move trash to alphabetical order by @jrasm91 in #4462
• refactor(web): admin layout by @jrasm91 in #4461

Mobile

• feat(mobile): Offer the same album sorting options on mobile as on web by @agross in #3804
• fix(mobile): remove upload soft limit by @shalong-tanwen in #4380
• fix(mobile): asset state change not updated in gallery app bar by @shalong-tanwen in #4441
• fix(mobile): description not render on first opening by @alextran1502 in #4451
• fix(mobile): reset trashed state for local assets on deletion by @shalong-tanwen in #4501
• fix(mobile): handle asset trash, restore and delete ws events by @shalong-tanwen in #4482
• chore(mobile): update flutter build version by @alextran1502 in #4429
• chore(mobile): pump photo_manager version by @alextran1502 in #4412
• chore(mobile): video indicator by @shalong-tanwen in #4443

Others

• chore: bulk bump of dependencies with vulnerabilities by @debricked in #4312
• docs: Update nginx config docs by @wipfli in #4346
• docs: add troubleshooting info to libraries + minor docs tweaks by @etnoy in #4377
• docs: production build by @alextran1502 in #4431
• docs: immich title by @jrasm91 in #4463

New Contributors

• @wipfli made their first contribution in #4346
• @JonasMayerDev made their first contribution in #4401
• @debricked made their first contribution in #4312
• @katsadim made their first contribution in #4402
• @agross made their first contribution in #3804

Full Changelog: v1.81.1...v1.82.0