v2.7.0

Welcome to Immich v2.7.0!

This release includes enhancements to the asset viewer, security improvements, changes to the duplicate APIs and viewer, and a bunch of bug fixes. Keep reading below for the complete highlights and a note on the upcoming v3.0.0 release.

Known limitations

• The machine learning service on amd64 currently requires the >= x86-64-v2 microarchitecture. This will be patched in an upcoming patch release for backward compatibility with very old processors (before ~2010), but it will become a minimum requirement in 3.0. arm64 is not affected by this change.

Highlights

• Remove from album (asset viewer)
• Move to locked folder (folder page)
• Editor shortcuts
• Create a new face on-the-fly in the face tag editor
• Resolve duplicates
• Helmet configuration
• Version check infrastructure
• Notable fix: live photo and video download in Safari
• Notable fix: escape HTML in the Panorama Photo Viewer

Remove from album

The web has a new action, "Remove from album," available in the asset viewer that makes it easier to remove an asset from an album. This action is available to both album and asset owners.

Move to locked folder in the Folder view

Similarly, the folder view now includes the "Move to locked folder" action.

Editor shortcuts

Users on the web can now edit with keyboard shortcuts. Press e to open the editor. Once in the editor, press [ or ] to rotate the asset +/- 90 degrees. Finally, save any changes and close the editor with ENTER.

Create a new face on-the-fly in the face tag editor

You can now create a new face/person on the fly from the face tagging editor interface

Deduplication improvements

The duplicate screen has gone through a bunch of iterations since it was first introduced all the way back in May, 2024. The latest release moves a bunch of logic from the client to the server, which now automatically suggests which asset to keep based on image size and EXIF data. Additionally, the new server implementation will automatically synchronize metadata, including albums, favorite status, rating, description, visibility, location, and tags. For more information about this process, see the new documentation.

Helmet configuration

You can now opt in to using a Content Security Policy (CSP) in Immich. The new environment variant IMMICH_HELMET_FILE accepts a boolean or a path to a helmet configuration file.

Recommend action: The team recommends setting IMMICH_HELMET_FILE=true to enable the default policy. Then, please let us know if you run into any issues with it.

Background and details

Since Immich is deployed in so many different ways, it has been hard to figure out how to enable a CSP that would not conflict with or break existing installs that might use 3rd party map providers, custom CSS, embed Immich in an iframe, or other such features. In this release, we have added the ability to both opt in to a default policy and configure a custom one. To use the default policy, simply set the environment variable IMMICH_HELMET_FILE=true. To use a custom policy, set the environment variable to a path on disk (within the immich-server) that contains a valid helmet configuration (e.g. IMMICH_HELMET_FILE=/opt/immich/helmet.json). CSP can be used to control what scripts are allowed to run on the page, which domains to load images from, etc. Additionally, it can be used to configure headers for Referrer-Policy, X-Powered-By, X-Frame-Options, and others.

New version check infrastructure

Prior to this release, instances that used the automatic version check feature would send HTTP requests to github.com. Now, we have set up a small service at version.immich.cloud to handle these types of requests. This avoids any privacy implications of connecting to github.com , as well as moves the request load to our own infrastructure.

Notable fix: live photo and video download in Safari

When downloading files in Safari with the same name, it will simply overwrite the file instead of automatically renaming it. In this release, the still and motion parts of a live photo are now named differently to prevent this from happening.

Notable fix: escape HTML in panorama photo viewer

In v2.6.0, we added the ability to show/view clip text in the panorama viewer, but introduced an XSS vulnerability, which has been fixed in this release. Interestingly, this was XSS using text in the image, which would then get read by OCR.

Notable fix: Immich User Agent for external requests

Similar to the mobile app, the server now sends a custom User Agent header. The format for the User Agent is immich-server/{version}. For example, immich-server/2.7.0.

v3.0.0

Just a heads up that this is the likely to be the last release before v3.0.0. Being a major release there will be a handful of breaking changes, although it's worth noting that nothing is currently planned that requires user intervention. It is mainly changes that impact 3rd party developers. More information and details should be available in the coming weeks.

Support Immich

If you find the project helpful, you can support Immich by purchasing a product key at https://buy.immich.app or our merchandise at https://immich.store

What's Changed

🚀 Features

• feat: add support for helmet configuration by @jrasm91 in #27058
• feat: create new person in face editor by @alextran1502 in #27364

🌟 Enhancements

• feat(web): add a seperate tooltip for switching from dark to light mode by @Vogeluff in #27297
• feat(web): focus on face-editor search input by @cratoo in #27136
• feat(web): add RemoveFromAlbumAction to asset viewer nav bar by @timonrieger in #27000
• feat(web): add shortcuts to rotate images by @squishykid in #26927
• feat(server): add checksum algorithm field by @etnoy in #26573
• feat(server): resolve duplicates by @Phlogi in #25316
• chore(mobile): reduce spacing on video controls by @uhthomas in #27313
• perf(server): optimize people page query by @ffchung in #27346
• feat(web): dim photo outside hovered face bounding box by @midzelis in #27402
• feat(web): OCR overlay interactivity during zoom by @midzelis in #27039
• feat: add move to lock folder in folder view by @alextran1502 in #27384
• feat(web): highlight active person thumbnail in detail panel and edit faces panel by @midzelis in #27401
• feat: move version checks to our own infrastructure by @zackpollard in #27450
• feat: add preview button when selecting images by @johnmaguire in #27305
• fix: user-agent format by @jrasm91 in #27488
• chore(mobile): reduce buffering timer duration by @uhthomas in #27111
• fix(mobile): use key on video controls by @uhthomas in #27512
• feat(server): Add support for .ts files by @ray in #27529

🐛 Bug fixes

• fix(server): refresh unedited asset dimensions on metadata extraction by @michelheusschen in #27220
• fix(server): memory fragmentation by @mertalev in #27027
• fix(database restores): don't assume onboarding has completed by @insertish in #27052
• fix(web): preserve timezone when changing timestamp (Closes #25354) by @updatemike in #27095
• fix: various command palette usages by @danieldietzler in #27304
• fix(web): keep map view open after closing asset viewer by @diiogofer in #26980
• fix(web): prevent Safari from overwriting live photo image with video by @saurav61091 in #26898
• fix(mobile): video icon not showing on memories by @YarosMallorca in #27311
• fix(mobile): mismatch between system and app color when using low-chroma system color scheme by @putuprema in #27282
• fix(mobile): images loads sometimes cancel too early by @LeLunZ in #27067
• fix(mobile): streamline error handling for live photo saving by @LeLunZ in #27337
• fix(web): keep upload totals stable when dismissing items (#27247) by @Nicolas-micuda-becker in #27354
• fix(mobile): low upload timeout on android by @mertalev in #27399
• fix(web): add drop shadow to asset viewer nav bar and prevent button shrinking by @midzelis in #27404
• fix(mobile): favorite button not updating state by @YarosMallorca in #27271
• fix: detection of WebM container by @chanb22 in #24182
• fix(web): prevent AssetUpdate from adding unrelated timeline assets by @michelheusschen in #27369
• fix: withFilePath select edited or unedited file by @bwees in #27328
• fix(web): Enable stack selector in shared album view by @timonrieger in #24641
• fix(server): use substring matching for person name search by @okxint in #26903
• fix: escape html by @jrasm91 in #27469
• fix(mobile): ignore pointer events on toasts by @uhthomas in #26990
• fix(mobile): reset video controls hide timer when showing controls ch… by @uhthomas in #26985
• fix(mobile): don't update search filters in-place by @uhthomas in #26965
• fix(web): isFullScreen initial value check is incorrect by @midzelis in #27520
• fix(mobile): transparent system navbar when trash bottom bar is visible by @putuprema in #27093
• fix: timestamp handling for database backup in Web UI by @AfonsoMendoncaRibeiro in #27359
• fix: allow bots to access /s/ urls by @domints in #27579

📚 Documentation

• feat(docs): add keycloack example to oauth docs by @robson90 in #27425

🌐 Translations

• chore(web): update translations by @weblate in #27029
• chore(web): update translations by @weblate in #27483

New Contributors

• @Vogeluff made their first contribution in #27297
• @updatemike made their first contribution in #27095
• @diiogofer made their first contribution in #26980
• @squishykid made their first contribution in #26927
• @Phlogi made their first contribution in #25316
• @saurav61091 made their first contribution in #26898
• @putuprema made their first contribution in #27282
• @ffchung made their first contribution in #27346
• @chanb22 made their first contribution in #24182
• @robson90 made their first contribution in #27425
• @okxint made their first contribution in #26903
• @johnmaguire made their first contribution in #27305
• @ray made their first contribution in #27529
• @AfonsoMendoncaRibeiro made their first contribution in #27359
• @domints made their first contribution in #27579

Full Changelog: v2.6.3...v2.7.0