Immich 2.7.0 → 3.0.3
8 releases · 33 breaking changes · 3 security fixes · 5 advisories fixed
3security33breaking1deprecated13feature65fix
Vulnerabilities fixed by this upgrade
- 8.8 CVE-2026-77439 Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpoints
- 4.3 GHSA-hv27-723h-qfjq Partner "view-only" sharing leaks GPS coordinates of the sharer's archived assets via GET /api/map/markers (the map endpoint omits the archived-asset guard the timeline endpoint enforces)
- 6.1 GHSA-qp2h-w794-2vhf Incomplete fix for login continue redirect allows slash-backslash open redirect
- 2.8 GHSA-jrp5-g662-hq92 Unsafe ZIP Entry Names (Zip Slip Class) in Archive Download Endpoint
- 5.1 CVE-2026-40096 Open Redirect via Shared Album name
Breaking changes
- breaking refactor!: migrate class-validator to zod in 3.0.0
- breaking refactor!: remove replace asset in 3.0.0
- breaking refactor!: remove my shared link dto in 3.0.0
- breaking chore!: remove deprecated env variables in 3.0.0
- breaking chore!: remove getRandom api endpoint in 3.0.0
- breaking chore!: remove unused token response param in 3.0.0
- breaking refactor: yeet old timeline in 3.0.0
- breaking chore!: remove old timeline sync endpoints in 3.0.0
- breaking chore!: remove deviceId and deviceAssetId in 3.0.0
- breaking chore!: rename API key schemas in 3.0.0
- breaking chore!: remove without assets in 3.0.0
- breaking fix: oauth issuerUrl validation in 3.0.0
- breaking fix!: do not allow insecure oauth requests by default in 3.0.0
- breaking fix!: set duration to null when not present in 3.0.0
- breaking chore!: remove /api/server/theme endpoint in 3.0.0
- breaking chore!: migrate album owner to album_user in 3.0.0
- breaking refactor!: change number to integer types in 3.0.0
- breaking refactor(server)!: move correlationId to X-Correlation-ID response header in 3.0.0
- breaking refactor(server)!: remove redundant error and statusCode fields from error responses in 3.0.0
- breaking chore(server)!: drop pgvecto.rs support in 3.0.0
- breaking chore!: duration in milliseconds in 3.0.0
- breaking refactor(server)!: sanitize error messages to avoid leaking resource details in 3.0.0
- breaking refactor(server)!: structured validation error responses in 3.0.0
- breaking feat(server)!: add isOwned filter to albums API in 3.0.0
- breaking chore(ml)!: require numpy 2.4 in 3.0.0
- breaking fix(deps): update dependency nestjs-otel to v8 in 3.0.0
- breaking chore(ml)!: remove deprecated envs in 3.0.0
- breaking chore(server)!: remove libopus enum in 3.0.0
- breaking refactor!: remove asset faces from AssetResponseDto in 3.0.0
- breaking refactor(server)!: drop empty string to null conversion in 3.0.0
- breaking refactor(server)!: remove changeExpiryTime in 3.0.0
- breaking refactor!: disallow star rating < 1 in 3.0.0
- breaking fix!: search endpoints visibility can be omitted in 3.0.0
Security changes
- security Fixes GHSA-jrp5-g662-hq92: Unsafe ZIP Entry Names (Zip Slip Class) in Archive Download Endpoint in 3.0.0
- security fix: run profile picture through thumbnail pipeline in 3.0.0
- security Fixes CVE-2026-40096: Open Redirect via Shared Album name in 2.7.3
Deprecations
- deprecated refactor(server): deprecate PUT routes in favor of PATCH in 3.0.0
Every release in between
fixvarious bug fixes
otherwe push to our own F-Droid repo at https://app.futo.org/fdroid/repo now. If you're using F-Droid, please pull the application from there from now on
fixfixes an issue where LivePhotos upload from the background isn't showing up.
featurefeat: publish app releases to FUTO F-Droid repo
fixfix(web): closing plugin method picker selects "unknown" method
fixfix: unauthorized album owner update
fixfix: still part of live photo hidden on bg upload
fixfix: system appbar icon color has incorrect color in asset viewer
fixfix: locked visibility in search random endpoint
fixfix(mobile): send a full datetime from the android memories widget
fixfix: memory search date validation
fixfix(server): set hvc1 tag when using hwa
fixfix(mobile): clear zoom state when swapping assets
fixfix: Ken Burns effect on sliver app bar jittery on Android
fixfix(docs): update fdroid link
featurefeat: system integrity docs
otherchore(web): update translations
fixfix(mobile): correct person age singular pluralization
featurefix(web): add ARIA label to ServerStatisticsCard
featurefeat(server): hls variant configuration
featurefeat: user agnostic database restore
featurefeat(server): date workflow filter
fixfix: re-add gCastEnabled negation
fixfix: downmix audio to stereo to fix broken channel layout
fixfix: live transcoding when viewing from a link share
fixfix: web search timeline visibility
fixfix(web): missing i18n strings
fixfix: chinese browser locales recognition
fixchore: improve added to album messages
fixfix(mobile): fix 10-bit heic and avif colors on android
fixfix(mobile): match iOS scroll to top and tabbar scroll (#28469)
fixfix: wrap migrations in transaction
fixfix: oauth account linking
fixfix: incorrect grouping of recently added assets
fixfix: integrity checks checksum pagination
fixfix(mobile): missing crop options and rotation scaling
fixfix(mobile): properly handle live photos locally
fixfix: integrity checks dto validation
fixfix(mobile): http request handling after isolate death
fixfix: do not log out on automatic url switch
fixfix(server): stream ffprobe packets
fixfix: search metadata for album shared links
fixfix(web): clear asset selection when search context changes
fixfix(mobile): update timeline args on layout constraint changes
fixfix: iso date parsing for three digit years
fixfix: missing files integrity checks
fixfix(mobile): play videos from search results and folder view
fixfix(web): recursively unnest class arrays
fixfix: emit album update event when uploading assets through shared link
fixfix(web): always initialize language manager to set lang and dir
otherchore: update docs with v3 tags
fixfix(docs): use correct heading name for DB dump
featurefeat(docs): add Malayalam language support in README files
fixfix(docs): clarify version policy
otherchore(web): update translations
fixFixes a bug that causes albums don't show up in the mobile app
featurefeat(web): recently added link in sidebar
fixfix: albums broken on v2 mobile clients
fixfix: setting input field description spacing for description snippet
otherchore(web): update translations
securityFixes GHSA-jrp5-g662-hq92: Unsafe ZIP Entry Names (Zip Slip Class) in Archive Download Endpoint
featureKids clothing: For those who are likely the reason for your Immich library's size
featureColored embroidery: We now have clothes with a full color embroidered Immich logo
featureMobile non-destructive editing
featureWorkflows (preview)
featureBackground backup improvement
breakingrefactor!: migrate class-validator to zod
breakingrefactor!: remove replace asset
breakingrefactor!: remove my shared link dto
breakingchore!: remove deprecated env variables
breakingchore!: remove getRandom api endpoint
breakingchore!: remove unused token response param
breakingrefactor: yeet old timeline
breakingchore!: remove old timeline sync endpoints
breakingchore!: remove deviceId and deviceAssetId
breakingchore!: rename API key schemas
breakingchore!: remove without assets
breakingfix: oauth issuerUrl validation
breakingfix!: do not allow insecure oauth requests by default
breakingfix!: set duration to null when not present
breakingchore!: remove /api/server/theme endpoint
breakingchore!: migrate album owner to album_user
breakingrefactor!: change number to integer types
breakingrefactor(server)!: move correlationId to X-Correlation-ID response header
breakingrefactor(server)!: remove redundant error and statusCode fields from error responses
breakingchore(server)!: drop pgvecto.rs support
breakingchore!: duration in milliseconds
breakingrefactor(server)!: sanitize error messages to avoid leaking resource details
breakingrefactor(server)!: structured validation error responses
breakingfeat(server)!: add isOwned filter to albums API
breakingchore(ml)!: require numpy 2.4
breakingfix(deps): update dependency nestjs-otel to v8
breakingchore(ml)!: remove deprecated envs
breakingchore(server)!: remove libopus enum
breakingrefactor!: remove asset faces from AssetResponseDto
breakingrefactor(server)!: drop empty string to null conversion
breakingrefactor(server)!: remove changeExpiryTime
breakingrefactor!: disallow star rating < 1
breakingfix!: search endpoints visibility can be omitted
deprecatedrefactor(server): deprecate PUT routes in favor of PATCH
+264 more items in the release notesfixfix(server): add rate limit and deduplication to version check
otherchore(web): update translations
fixrefactor(mobile): cleanup iOS image loading pipeline
fixfix(server): hide original filename when not showing metadata
fixfix(mobile): fix Flutter cache eviction on thumbnails
fixchore: pump cronet version
securityFixes CVE-2026-40096: Open Redirect via Shared Album name
fixfix(server): avoid false restore failures on large database imports
fixfix(mobile): improve image load cancellation handling
fixfix(server): people search not showing for 3 or less characters
fixfix(web): don't cache empty search results for people search
fixfix(mobile): get provider refs before async gaps in backup page
fixfix: ssr open graph tags
fixfix(docs): updated docker deprecation link
fixFix an issue with the default helmet.json file
fixFix an issue with ML containers not working on some older CPUs
fixFix an issue with importing external libraries
fixfix: csp quotes
fixfix(ml): downgrade numpy
fixfix(server): library import batch size