Commit Graph
2200 Commits
Author SHA1 Message Date
bo0tzz 64d50dc4b7 perf(server): index asset (ownerId, updateId) for sync (#32624)
(cherry picked from commit 73603bcafe5d1e52434f736476d07c9578f3b888)
2026-10-28 20:41:28 +03:00
renovate[bot] 7fb7699c06 chore(deps): update dependency eslint-plugin-unicorn to v78 (#32588)
Co-authored-by: Jason Rasmussen <jason@rasm.me>
Co-authored-by: Daniel Dietzler <mail@ddietzler.dev>
(cherry picked from commit 72e2bc8b0bc4a7e0a84ac16c0bde7f5e538729fb)
2026-10-28 20:41:28 +03:00
Yaros 1f422ea4c4 fix(server): add album-shared assets to albums (#32609)
Co-authored-by: Jason Rasmussen <jason@rasm.me>
(cherry picked from commit 37c34343e1b98edf07dc3ff34c5da461de03c746)
2026-10-28 20:40:53 +03:00
Mert db411a4497 feat(server): add jxl as target format (#32732)
(cherry picked from commit 9560989cb97fb93cd6ab74f7811acce133a9b768)
2026-10-27 23:12:52 +03:00
bo0tzz a93bbdf3e7 feat: inline hashes in helmet CSP (#30529)
* feat: inline hashes in helmet CSP

* tests

* fix: svelte3 merge

* chore: clean up

---------

Co-authored-by: Daniel Dietzler <mail@ddietzler.dev>
Co-authored-by: Jason Rasmussen <jason@rasm.me>
(cherry picked from commit 02a5d4b2060dad6f5779c196b7bb2b43f871ffb2)
2026-10-27 23:12:41 +03:00
bo0tzz 1707635743 fix(server): require update access on the motion video when linking a live photo (#32606)
* fix(server): require update access on the motion video when linking a live photo

* chore: allow linking with existing shared link assets

---------

Co-authored-by: Jason Rasmussen <jason@rasm.me>
(cherry picked from commit a7afb4c9e9d2f099f9204a41f62e17b54fca3b17)
2026-10-27 23:12:41 +03:00
Yaros eca952720a fix: permission for admin notification endpoints (#32567)
(cherry picked from commit 045d295d2d0b506af6f2abe14d1ed2cb89c5235f)
2026-10-27 23:12:13 +03:00
Maximilian Rink d8030f3d14 fix(server): index edited assets in smart search (#32300)
(cherry picked from commit adca900fe277bd6dff93b96b6a7841a8632ce62b)
2026-10-27 23:12:13 +03:00
Santo Shakil 6569aad605 feat(server): accept the iOS app origin for mobile passkeys (#32733)
(cherry picked from commit 1119e9c7a7c9f5ad657aa4e893b897772f75a124)
2026-10-27 23:11:30 +03:00
bo0tzz 9669f7cc6e perf(server): use a createdAt range for "recently added" time buckets (#32434)
(cherry picked from commit cf719e733e6250e0fcd8f45d2e2c46f166d3557d)
2026-10-25 16:23:45 +03:00
Codex d17640a283 Handle optional OAuth config in visibility regression assertion 2026-10-22 21:15:41 +03:00
Codex 9e889bd4dc Adapt local regression tests to new configuration queries 2026-10-22 20:48:48 +03:00
Jason Rasmussen 9a66f16102 fix: account management url visibility (#32645)
(cherry picked from commit 22fe7b4179464c73d7e0487df90f2064fa30a5e0)
2026-10-22 20:43:14 +03:00
bo0tzz b3bd5d1fd1 feat(server): remove deprecated password field from update-me (#32623)
* feat(server): remove deprecated password field from update-me

* fix: tests for removed password field

(cherry picked from commit 3f6a071203187681b6c06b977665dc624c431336)
2026-10-22 05:25:45 +03:00
bo0tzz ad9b368cb8 fix(server): exclude partners' locked assets from legacy search (#32604)
(cherry picked from commit 8dab52c7491c79cba742315dea8d7f5212915875)
2026-10-22 05:25:45 +03:00
renovate[bot] 689105c949 fix(deps): update dependency exiftool-vendored to v39 (#31917)
Co-authored-by: Daniel Dietzler <mail@ddietzler.dev>
(cherry picked from commit bb9f18a1d007d530fcf477a0fa56528fdfa91dd0)
2026-10-22 05:25:45 +03:00
Jonathan Jogenfors 42dffaa0c8 fix(server): dont follow symlinks (#32614)
(cherry picked from commit 10e216b8385ac40e6aa150f75fc4730c4e8a7494)
2026-10-22 05:24:55 +03:00
renovate[bot] 235e57bf77 fix(deps): update dependency cookie to v2 (#31916)
Co-authored-by: Daniel Dietzler <mail@ddietzler.dev>
(cherry picked from commit e505e5113b43177ad215d075dca25dc056dd1a40)
2026-10-22 05:23:59 +03:00
renovate[bot] 238617e566 fix(deps): update dependency archiver to v8 (#31913)
Co-authored-by: Daniel Dietzler <mail@ddietzler.dev>
(cherry picked from commit 51da695c62f3415a97c7b752ef62927e39ab086f)
2026-10-22 05:23:23 +03:00
bo0tzz 01ba579766 perf(server): index updateId on asset_face, stack and workflow (#32432)
asset_face, stack and workflow were the only tables with an updateId
column but no index on it. Face and stack sync (AssetFacesV1/V2,
StacksV1, PartnerStacksV1) filter and order on updateId, so every mobile
sync seq-scanned every face on the instance and walked all of the user's
(or partners') stacks, even when nothing had changed. workflow isn't
synced; it gets the index for consistency.

Incremental sync with nothing changed, PG 14:

| query                              | before   | after    |
| ---------------------------------- | -------- | -------- |
| assetFace.getUpserts (425k faces)  | 33-37 ms | 0.15 ms  |
| stack.getUpserts (6k stacks)       | 0.8 ms   | 0.004 ms |
| partnerStack.getUpserts (6k)       | 0.6 ms   | 0.007 ms |

The face scan grows with the instance's face count (~10x that at 4M
faces); the stack one with the user's stack count.

(cherry picked from commit 9df807ed4a9536a28dad463270082095ec1fe94d)
2026-10-22 05:23:22 +03:00
bo0tzz e2864b6664 fix(server): do not expose album members to shared link viewers (#32607)
(cherry picked from commit 380f3e74e622938b6b6c450859df8655be4e21ba)
2026-10-22 05:23:22 +03:00
bo0tzz 1756d70fda fix(server): only set OAuth cookies for server-generated state (#32600)
(cherry picked from commit d468c468867edcbafd4d934d3ba97bee2414050f)
2026-10-22 05:23:22 +03:00
Jason Rasmussen b12be9119f feat: passkeys (#32194)
Co-authored-by: Daniel Dietzler <mail@ddietzler.dev>
(cherry picked from commit 6233a79bf7e4cec11e9ea1094908ff3b228fcbe0)
2026-10-22 05:23:22 +03:00
bo0tzz 59be6583b8 fix(server): only serve edited assets to shared links in archive downloads (#32562)
(cherry picked from commit cd47ee30676e8575a5048d12cde2ee86fc02b965)
2026-10-22 05:21:00 +03:00
bo0tzz aeefb962d4 fix(server): sanitize EXIF template variables and tighten storage path check (#32566)
(cherry picked from commit 6141f8bdbf6d21a14558d9f7d7325918023d1037)
2026-10-22 05:21:00 +03:00
bo0tzz f80be1030b fix(server): restrict partner timeline requests to timeline assets (#32565)
* fix(server): restrict partner timeline requests to timeline assets

* test(server): update medium timeline tests for consolidated check

(cherry picked from commit e9fb180f466a687cebda9b7e17cef403de4b81fa)
2026-10-22 05:21:00 +03:00
bo0tzz c66634fcfd fix(server): escape template variables in custom email templates (#32563)
* fix(server): escape template variables in custom email templates

* fix(server): strip preview tags until stable

(cherry picked from commit 616839e8d43a9de21d0c9391847fba97ac41a759)
2026-10-22 05:21:00 +03:00
bo0tzz d92248c664 fix(server): require upload access for checksum duplicate check (#32559)
* fix(server): require upload access for checksum duplicate check

* fix(server): use the upload access check for the checksum short circuit

(cherry picked from commit 5c02b17495947d7332cce13273226082bd8ae2a1)
2026-10-22 05:21:00 +03:00
bo0tzz 67152772d2 fix(server): anchor plugin allowedHosts matching (#32560)
(cherry picked from commit 4acf935ba3ee7b6171e3965cb3ce47b2ba9bad1a)
2026-10-22 05:21:00 +03:00
Mert 4c89b0f7df perf(server): more efficient person queries (#32523)
(cherry picked from commit 38a2ce4daa678615561d2b87a8f2bb30f70fdc53)
2026-10-22 05:20:19 +03:00
bo0tzz 43848a7d68 fix: locking around concurrency-1 jobs (#28410)
* fix: locking around concurrency-1 jobs

* fix: no lock on queue duplicates

(cherry picked from commit 477452b5c51ca71ecdf74205e0004eaec4e18874)
2026-10-22 05:19:10 +03:00
bo0tzz c4c5b8ae3a fix(server): apply shared link metadata visibility in asset mapper (#32561) 2026-10-19 20:31:26 +03:00
renovate[bot]andDaniel Dietzler 743e555a1b fix(deps): update dependency bullmq to v6 (#31914)
Co-authored-by: Daniel Dietzler <mail@ddietzler.dev>
2026-10-19 20:31:26 +03:00
Codex ca7766fcd6 Show on-this-day memories from the last 20 years with automatic playback 2026-10-18 19:00:06 +03:00
Jason Rasmussen 36a6e033aa fix: public config properties (#32500)
fix: public config visibility
2026-10-17 19:32:36 +03:00
Jason Rasmussen 4341a2f34c fix: smpt email visibility (#32492) 2026-10-17 19:32:36 +03:00
renovate[bot] c36be7692c fix(deps): update dependency react-email to v6 (#32143)
* fix(deps): update dependency react-email to v6

* fix: move all react email imports to react-email

* fix: linting

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Daniel Dietzler <mail@ddietzler.dev>
(cherry picked from commit 9755f64684de63f1e9c5d14d31d00f599f8925b9)
2026-10-15 14:33:10 +03:00
Jason Rasmussen c318714fdc feat: server feature level (#32178)
* feat: server feature level

* fix: correctly compute feature level

(cherry picked from commit cc1e2363651eaff63848baad2c7932923ca66554)
2026-10-14 21:24:14 +03:00
bo0tzz 4fe7d42cfc perf(server): stop aggregating every album asset when loading a shared link (#32412)
SharedLinkRepository.get (shared link page load, /shared-links/me, and the
OpenGraph tags rendered for /share/:key) json_agg'd every asset of the
album, with its full exif row, ordered by fileCreatedAt. The only things
used from it are the asset count and the first/last localDateTime.

Load the album without assets and fill assetCount/startDate/endDate from
getMetadataForIds, which is what GET /albums/:id already uses. The counts
now also respect the default visibility filter, and the dates are
formatted the same as on /albums/:id.

150k-asset album link, PG 14:

|                        | before          | after  |
|------------------------|-----------------|--------|
| query                  | 4.2-6.5 s       | ~0.26 s (metadata aggregate) |
| JSON built by postgres | 261 MB          | -      |
| GET /shared-links/me   | -               | 0.28 s, 961 B |

(cherry picked from commit ac453b5557e42ad45962d3079a4e4450671053e9)
2026-10-14 21:24:13 +03:00
bo0tzz 1978b77a40 perf(server): stop loading every album asset to build album responses (#32413)
* perf(server): stop loading every album asset to build album responses

Album create, update (rename, description, cover, sort order, activity
toggle) and add-users json_agg'd every asset of the album with its exif
row, only for mapAlbum to read the count and the first/last
localDateTime. Use getMetadataForIds for those fields, as GET /albums/:id
already does, and drop the now unused withAssets option from getById.

The responses now carry the same date format and lastModifiedAssetTimestamp
as GET /albums/:id.

PATCH /albums/:id on a 150k-asset album, PG 14 (response is ~900 B either
way): 3.4-3.6 s -> 0.13-0.16 s.

* refactor(server): share album metadata mapping

(cherry picked from commit 2a4e876ec990a4a8d5fdca00291cbeebd3d1bccf)
2026-10-14 21:24:13 +03:00
bo0tzz c7a5ac3d11 perf(server): check shared link asset access without scanning the album (#32411)
* perf(server): check shared link asset access without scanning the album

checkSharedLinkAccess runs on every thumbnail, preview, playback and asset
info request made through a shared link. It joined every asset of the
link's album and only then filtered on an array overlap across four
outer-joined columns, so each request cost O(album size).

Split it into two branches (link assets, album assets) that find the
requested ids through the asset pkey / livePhotoVideoId index and then
probe the album_asset pkey.

Median per request, PG 14, 1.36M-asset instance:

| album behind the link | before | after   |
|-----------------------|--------|---------|
| 290 assets            | 2.1 ms | 0.17 ms |
| 150k assets           | 296 ms | 0.19 ms |

* chore: clean up

---------

Co-authored-by: Jason Rasmussen <jason@rasm.me>
(cherry picked from commit bb024c862609c9e2baffc08fef795cfa3418df16)
2026-10-14 21:24:13 +03:00
immich-push-o-matic[bot]andZack Pollard ea1bfcf248 perf(server): improve people query performance (#32441)
perf(server): improve people query performance (#32405)

fix(server): slow people query

(cherry picked from commit 6b79a82800cb984a755b163bca0cf689b486ad9a)

Co-authored-by: Zack Pollard <zack@futo.org>
2026-10-14 16:27:32 +00:00
5b2a3a52be fix: run workflow steps in their configured order (#32241)
fix: run workflow steps in their configured order (#32240)



(cherry picked from commit 56319b76fc60d7e3bd57a2275ac908da42665e5f)

Co-authored-by: infocus13 <74890563+infocus13@users.noreply.github.com>
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Co-authored-by: Daniel Dietzler <mail@ddietzler.dev>
2026-10-08 19:48:52 +00:00
immich-push-o-matic[bot]andJason Rasmussen 3b53f1b4bb fix: include unamed people in otherPeople (#32239)
fix: include unamed people in otherPeople (#32237)

(cherry picked from commit 9971dade1b2db76a5a79d287eb2d725152cb0323)

Co-authored-by: Jason Rasmussen <jason@rasm.me>
2026-10-08 18:57:55 +00:00
immich-push-o-matic[bot]andDaniel Dietzler 5a7e65fac3 chore: mark people users endpoints as beta (#32233)
chore: mark people users endpoints as beta (#32232)

(cherry picked from commit 481a7bf3ae0d2c2613100d74b028463117e44a39)

Co-authored-by: Daniel Dietzler <36593685+danieldietzler@users.noreply.github.com>
2026-10-08 17:02:27 +00:00
immich-push-o-matic[bot]andDaniel Dietzler 28bd3a550b fix: include partner shared assets for people even without showInTimeline (#32226)
fix: include partner shared assets for people even without showInTimeline (#32219)

(cherry picked from commit 5fa7789e2672350c76b9b026f2b8c2bc3ffdf7c4)

Co-authored-by: Daniel Dietzler <36593685+danieldietzler@users.noreply.github.com>
2026-10-08 14:23:17 +00:00
immich-push-o-matic[bot]andbo0tzz c6c8e516d7 fix(server): read ISO values above 65535 (#32183)
fix(server): read ISO values above 65535 (#32182)

(cherry picked from commit 6962412c0be35bf21c87d6a5935035adc7ae94e2)

Co-authored-by: bo0tzz <git@bo0tzz.me>
2026-10-07 08:16:22 +00:00
ed3073624b fix: memories mobile sync for older clients (#32167)
fix: memories mobile sync for older clients (#32150)


(cherry picked from commit 8d377bfef5a0c9d840bf2c19d155f9779387baeb)

Co-authored-by: Daniel Dietzler <36593685+danieldietzler@users.noreply.github.com>
Co-authored-by: Santo Shakil <shakil.mezbah@gmail.com>
2026-10-06 14:10:38 +00:00
immich-push-o-matic[bot]andJason Rasmussen 1aede8d8c3 fix: memory upcoming query (#32166)
fix: memory upcoming query (#32164)

(cherry picked from commit e49a5bb8c99abbf9944ca3d84220427d340c6786)

Co-authored-by: Jason Rasmussen <jason@rasm.me>
2026-10-06 13:56:17 +00:00
d806bc002c fix: person without assets (#32117)
fix: person without assets (#32114)

(cherry picked from commit c0506fe723995808f4effd8d40d0235fcaf104b5)

Co-authored-by: Jason Rasmussen <jason@rasm.me>
Co-authored-by: Daniel Dietzler <36593685+danieldietzler@users.noreply.github.com>
2026-10-06 08:38:24 +00:00