Skip to content

feat(oci/group/Immich)!: Update Immich v2.7.5 ➼ v3.3.1 - #6353

Open
tinfoild[bot] wants to merge 1 commit into
mainfrom
renovate/major-immich
Open

feat(oci/group/Immich)!: Update Immich v2.7.5 ➼ v3.3.1#6353
tinfoild[bot] wants to merge 1 commit into
mainfrom
renovate/major-immich

Conversation

@tinfoild

@tinfoild tinfoild Bot commented Jul 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Update Change OpenSSF
ghcr.io/immich-app/immich-machine-learning major v2.7.5 → v3.3.1 OpenSSF Scorecard
ghcr.io/immich-app/immich-machine-learning major v2.7.5-openvino → v3.3.1-openvino OpenSSF Scorecard
ghcr.io/immich-app/immich-server major v2.7.5 → v3.3.1 OpenSSF Scorecard

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

immich-app/immich (ghcr.io/immich-app/immich-machine-learning)

v3.3.1

Compare Source

This patch addresses various bugs around people sharing, as well as a scroll issue on mobile. Further, there is now an indicator showing which people are shared.

What's Changed
🌟 Enhancements
🐛 Bug fixes
📚 Documentation
🌐 Translations
New Contributors

Full Changelog: immich-app/immich@v3.3.0...v3.3.1

v3.3.0

Compare Source

v3.3.0

[!NOTE]
We're collecting feedback related to people sharing in this discussion: https://redirect.github.com/immich-app/immich/discussions/32196

Welcome to Immich v3.3.0!

This release includes people sharing, birthday memories, auto-stacked mobile edits, and a variety of other enhancements and bug fixes. Keep reading below for the full list of highlights.

Highlights
  • Shared people management
  • Birthday memories
  • Auto-stacked mobile edits
  • Sync OAuth claims on every login
  • Higher quality thumbnails and previews
  • Machine learning performance and accuracy improvements (opt-in)
  • New OCR models
  • Notable fix: correct storage size on MacOS
Shared people management

We are very pleased to release the next big milestone towards better sharing: people can now be shared!

As a user you can share people with another user in your cluster group:

[!NOTE]
The “Manage access” modal can be opened from both the “People” (/people) and “Sharing settings” (/user-settings) pages in the web application. The modal is not available on mobile, yet.

When sharing a person with another user, the shared person:

  • Shows up in both users’ list of people (on mobile and web)
  • Shows up in the asset viewer / asset detail view on both owned and shared assets
  • Can be edited by both users (only the name & birth date fields)

[!NOTE]
Person sharing is directional. This means that each user needs to share each person back for edits to automatically work in both directions.

By default, changes to the name & date of birth are reflected for both users. On the web, the “Edit person” modal has an option to change the name/date of birth for “Only me” instead of the whole group.

Also, there is a preference for this behavior in the “Sharing settings”, which can be changed to make this the default behavior when editing a person. The setting can be changed here: https://my.immich.app/user-settings?isOpen=feature+people.

The setting has two options:

  • “Everyone with shared access” — means an update will apply for everyone, covering the typical family use case where one or two users are supposed to be responsible for the entire family's people.
  • “Only me” — means the names and dates of births will remain unchanged for other users

Lastly, by allowing cross-user merging, you can now merge a face from your own assets with people shared with you from other users. This is especially helpful if you didn't want to re-run facial recognition after joining a cluster group before. Now, after setting up bi-directional sharing, users can manually link people together.

Birthday memories

In an effort of making Immich more joyful to use, we are introducing memories for people's birthdays.

If it's the birthday of a person in your library, Immich will now celebrate that with a special memory featuring previous birthdays.

Auto-stacked mobile edits

When using something other than Immich for editing images on your phone, Immich will now stack those edits on top of the original. This allows for Immich to show all edits in one place, without cluttering the timeline.

This should provide a more organized timeline, especially when you heavily rely on editing assets on your phone.
Sync OAuth claims on every login

Immich supports OAuth claims for storage quota, the user role, and the preferred username. Up until now, those were only synced on registration.

Now, they can be synced on every login, allowing you to do active user management through your IDP, updating quotas and roles as you go and as necessary, and Immich will adopt those changes.

Higher quality thumbnails and previews

Immich now uses a more accurate image resampling method, improving detail preservation and brightness, especially for high contrast details. All image formats benefit from this change.

Before

After

Thumbnails already generated before this release won’t be affected by this change. To make it apply to existing thumbnails, you can run thumbnail generation on all assets in the job panel.

Machine learning performance and accuracy improvements (opt-in)

[!NOTE]
We have re-exported and published the same machine learning models in an optimized format. This means they can be used as-is and do not require re-running any jobs. Opt-in to the revised machine learning models by adding the following environment variable to the machine learning container: MACHINE_LEARNING_MODEL_REVISION=v2.

After a long list of optimizations, ML is both significantly faster and uses less memory. This affects every backend, including CPU inference. However, the level of improvement varies by model and backend. Cases where certain backends (such as OpenVINO) produced wrong outputs at times should be resolved.

RKNPU, used by Rockchip boards, now supports every model in the catalog including OCR for the first time, bringing it to parity with other backends. Additionally, TensorRT RTX is now used for Ampere (30xx) and newer NVIDIA GPUs, improving performance significantly.

To fully benefit, set MACHINE_LEARNING_MODEL_REVISION=v2to allow more optimized models to be downloaded and used. Many of the improvements rely on these optimized models and will not take effect when using the old ones. The outputs of the new and old models are numerically equivalent, so switching doesn’t require re-running any tasks. This setting will be the default in a later release.

As always, keep in mind that the very first time you load a model requires more preparation work, so don’t be surprised if it takes some time at first. This preparation is cached and reused, so loading the model will be much faster after the first time.

New OCR models

The PP-OCRv6 family is now supported. These models are significantly more accurate than the previous PP-OCRv5 generation while all being multilingual. PP-OCRv6_tiny is efficient and suitable for modest hardware, PP-OCRv6_small is a notable jump in accuracy compared to PP-OCRv5_mobile, and PP-OCRv6_medium improves on PP-OCRv5_server as the highest quality and most demanding option.

Notable fix: correct storage size on MacOS

The block size used to calculate the storage capacity and usage has some nuances to it. In some situations (*cough*** Docker on MacOS *cough*), we didn’t have enough information to correctly compute accurate values. With this release, the reported storage usage and capacity should now be correct.

Technical details

Recent NodeJS releases now expose the frsize property, which is sometimes different from bsize (“block size”). In those cases the calculate storage sizes could often be off by a factor of4096 (or more). In fact, #​4318 has been our fourth oldest open issue (including the renovate dashboard), opened just over three years ago. Now, with accurate block sizes our storage calculation should be correct, even in Docker on MacOS.

We are very happy to finally see this issue resolved, even though it only meant a dependency bump and a tiny code change for us.

As always, please consider supporting the project.

🎉 Cheers! 🎉

Support Immich

If you find the project helpful, you can support Immich by purchasing a product key at https://buy.immich.app or our merchandise at https://immich.store

What's Changed
🚀 Features
🌟 Enhancements
🐛 Bug fixes
📚 Documentation
🌐 Translations
New Contributors

Full Changelog: immich-app/immich@v3.2.4...v3.3.0

v3.2.4

Compare Source

It's been a while since we last had to sacrifice a release. Let's hope v3.2.3 was a good sacrifice for v3.3, which is right around the corner!

Just another small patch that primarily fixes the memory leak people have observed through a dependency update.

What's Changed
🐛 Bug fixes

Full Changelog: immich-app/immich@v3.2.2...v3.2.4

v3.2.2

Compare Source

Just another small patch with a fix for the reassign faces feature.

What's Changed
🐛 Bug fixes

Full Changelog: immich-app/immich@v3.2.1...v3.2.2

v3.2.1

Compare Source

This patch release addresses various bugs, including:

  • An issue with connection pool exhaustion during sync
  • Problems with the new search modal
  • Not seeing partner shared assets on people page
  • Person merge not working for two named people

... and more. See the full list below.

What's Changed
🐛 Bug fixes

Full Changelog: immich-app/immich@v3.2.0...v3.2.1

v3.2.0

Compare Source

v3.2.0

Welcome to Immich v3.2.0!

This release includes many new features as well as the usual collection of bug fixes and cleanups. Keep reading below for a list of highlights.

Highlights
  • Docker compose builder
  • Revamped search UI (web)
  • Search API v2 (server)
  • View own people in shared assets, cross-user clustering
  • Workflow tags trigger and actions
  • Dedicated memories page
  • Tag renaming (web)
  • View assets in map viewport (web)
Docker compose builder

We recently released our new docker compose builder, which lets you put together a custom compose file for Immich more easily. Please try it out and give us your feedback!

Search API v2 (server)

We have built an entirely new search API that, amongst other things, will support searching within albums and combining multiple search filters with both AND and OR operations. Some of these features will be exposed to the search UI interfaces in the future, others will be used to power other fancy features as well as give 3rd party tools more functionality. If you are interested in the particular changes and examples for how to use the new API, feel free to check out the PR #​30179 as well as our API documentation at https://api.immich.app/endpoints/search/searchAssets.

Revamped search UI (web)

We have a new designer who helped us remodel the search modal, which has been pretty complex before and looks a lot more visually appealing in our opinion now. It still supports the same functionality, but with some quality of life additions as well as a significantly simpler look. In the future, we will extend this to also include some of the new features enabled by the new search API. Stay tuned and give us your feedback on the new design!

image

New search modal filtering by images with Jason in it, taken in the last 30 days in BC, Canada, tagged "Long Beach" with the context search term "Swimming"

image

Advanced filters showing camera make, model, and lens model, as well as filers for favorite and archive status, and album membership

View own people in shared assets

We are very happy to ship the first step towards better sharing. You can now have people recognized across trusted users, which also allows you to view people you already have records of in any shared assets!

In the user sharing settings there is a new section; cluster group.

cluster group

The user sharing settings showing a cluster group with Jane Doe and Mich in it

You can invite users on your instance that you trust to your own group, or join another group you have been invited to. These cluster groups make it possible to identify people in assets shared by users in the same group. They also likely improve accuracy, as the clustering will operate on a bigger pool of faces. People names and birth dates are still set on a per-user level and aren’t (yet) shared with users in the same group.

As of now, this requires resetting facial recognition for all users in the group, in order for the changes to apply retroactively for all assets. This means, names and birth dates will be lost, and the results can vary slightly compared to before. Only faces recognized by machine learning will be affected by this. We may be able to do some non-destructive merging in the future, but for now this is a necessary step in order to fully benefit from the feature. That is why we put a button in the sharing settings for every user in the group (specifically also non-admins) to reset the facial recognition for that group.

Workflow tags trigger and actions

Workflows have gotten a new trigger. You can now do automations when an asset has been tagged.

trigger list

In order to use this new trigger, there is also a new filter that allows you to match specific tags. It supports matching for all, any, or none in the provided list.

tag trigger

Lastly, a new workflow action to add tags to the current asset has also been added. It allows to add a list of tags at once.

add tag step

Dedicated memories page

The new memories page allows you to view past memories. You can also favorite memories and they will show up here and never get deleted. The goal is for this to be a place you can come back to at any point and reminisce in old memories.

image Memory page on the mobile app

Tag renaming (web)

Finally, you can also rename existing tags. This is a small addition to the edit tag modal on web, but under the hood was more complicated than you might expect.

tag renaming

View assets in map viewport (web)

Similarly to showing a timeline all assets in a cluster on the map when clicking on it, you can now open a timeline for assets currently in the viewport. There is a new button among the map controls to show assets in the area. It will open a timeline that will update as you pan around the map.

map view port with timeline

The map page showing a timeline of assets currently in the viewport on the right

As always, please consider supporting the project.

🎉 Cheers! 🎉

Support Immich

If you find the project helpful, you can support Immich by purchasing a product key at https://buy.immich.app or our merchandise at https://immich.store

What's Changed
🚀 Features
🌟 Enhancements
🐛 Bug fixes

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Asia/Singapore)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

@tinfoild

tinfoild Bot commented Jul 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

kube/helmrelease/out00

--- HelmRelease: immich/immich Deployment: immich/immich-app

+++ HelmRelease: immich/immich Deployment: immich/immich-app

@@ -115,13 +115,13 @@

           value: '6379'
         - name: TZ
           value: null
         envFrom:
         - secretRef:
             name: immich-secrets
-        image: ghcr.io/immich-app/immich-server:v2.7.5@sha256:c15bff75068effb03f4355997d03dc7e0fc58720c2b54ad6f7f10d1bc57efaa5
+        image: ghcr.io/immich-app/immich-server:v3.3.1@sha256:db996e352359771c6a3db121a0ed8761516b22f727fc092a0f46dcfef82c1bc1
         livenessProbe:
           failureThreshold: 3
           initialDelaySeconds: 0
           periodSeconds: 10
           tcpSocket:
             port: 8080
--- HelmRelease: immich/immich Deployment: immich/immich-microservices

+++ HelmRelease: immich/immich Deployment: immich/immich-microservices

@@ -116,13 +116,13 @@

           value: '6379'
         - name: TZ
           value: null
         envFrom:
         - secretRef:
             name: immich-secrets
-        image: ghcr.io/immich-app/immich-server:v2.7.5@sha256:c15bff75068effb03f4355997d03dc7e0fc58720c2b54ad6f7f10d1bc57efaa5
+        image: ghcr.io/immich-app/immich-server:v3.3.1@sha256:db996e352359771c6a3db121a0ed8761516b22f727fc092a0f46dcfef82c1bc1
         livenessProbe:
           failureThreshold: 3
           initialDelaySeconds: 0
           periodSeconds: 10
           tcpSocket:
             port: 8081
--- HelmRelease: immich/immich Deployment: immich/immich-ml

+++ HelmRelease: immich/immich Deployment: immich/immich-ml

@@ -116,13 +116,13 @@

         - name: REDIS_HOSTNAME
           value: immich-redis.immich.svc.cluster.local
         - name: REDIS_PORT
           value: '6379'
         - name: TZ
           value: null
-        image: ghcr.io/immich-app/immich-machine-learning:v2.7.5-openvino@sha256:71cd5a681823c4b818f4b24b3f05816eccc3d085559e7615f695bde77e64f1f2
+        image: ghcr.io/immich-app/immich-machine-learning:v3.3.1-openvino@sha256:9f5ea923b763435592280e2f5e051a62f1a33d6d14e87620fc15453c27a12ae0
         livenessProbe:
           failureThreshold: 3
           initialDelaySeconds: 0
           periodSeconds: 10
           tcpSocket:
             port: 8080
--- HelmRelease: immich/immich CronJob: immich/immich-ml-model-pull-clip

+++ HelmRelease: immich/immich CronJob: immich/immich-ml-model-pull-clip

@@ -66,13 +66,13 @@

             - --local-dir
             env:
             - name: HF_HOME
               value: /cache
             - name: HOME
               value: /cache
-            image: ghcr.io/immich-app/immich-machine-learning:v2.7.5@sha256:a2501141440f10516d329fdfba2c68082e19eb9ba6016c061ac80d23beadf7f3
+            image: ghcr.io/immich-app/immich-machine-learning:v3.3.1@sha256:513c831cfb010ad319341a0c86b42c575a0d5b688d3e8cae346ee624074a58ed
             name: app
             resources:
               limits:
                 cpu: '4'
                 memory: 2Gi
               requests:
--- HelmRelease: immich/immich CronJob: immich/immich-ml-model-pull-facial

+++ HelmRelease: immich/immich CronJob: immich/immich-ml-model-pull-facial

@@ -66,13 +66,13 @@

             - --local-dir
             env:
             - name: HF_HOME
               value: /cache
             - name: HOME
               value: /cache
-            image: ghcr.io/immich-app/immich-machine-learning:v2.7.5@sha256:a2501141440f10516d329fdfba2c68082e19eb9ba6016c061ac80d23beadf7f3
+            image: ghcr.io/immich-app/immich-machine-learning:v3.3.1@sha256:513c831cfb010ad319341a0c86b42c575a0d5b688d3e8cae346ee624074a58ed
             name: app
             resources:
               limits:
                 cpu: '4'
                 memory: 2Gi
               requests:

@tinfoild

tinfoild Bot commented Jul 2, 2026

Copy link
Copy Markdown
Contributor Author

kube/helmrelease/out00

--- HelmRelease: immich/immich Deployment: immich/immich-microservices

+++ HelmRelease: immich/immich Deployment: immich/immich-microservices

@@ -107,13 +107,13 @@

           value: '6379'
         - name: TZ
           value: null
         envFrom:
         - secretRef:
             name: immich-secrets
-        image: ghcr.io/immich-app/immich-server:v2.7.5@sha256:c15bff75068effb03f4355997d03dc7e0fc58720c2b54ad6f7f10d1bc57efaa5
+        image: ghcr.io/immich-app/immich-server:v3.0.0@sha256:685ba5c93337058ff8a189d3ed89f0ba470ef966b1c94d2eace1a3d991f9816e
         livenessProbe:
           failureThreshold: 3
           initialDelaySeconds: 0
           periodSeconds: 10
           tcpSocket:
             port: 8081
--- HelmRelease: immich/immich Deployment: immich/immich-ml

+++ HelmRelease: immich/immich Deployment: immich/immich-ml

@@ -107,13 +107,13 @@

         - name: REDIS_HOSTNAME
           value: immich-redis.immich.svc.cluster.local
         - name: REDIS_PORT
           value: '6379'
         - name: TZ
           value: null
-        image: ghcr.io/immich-app/immich-machine-learning:v2.7.5-openvino@sha256:71cd5a681823c4b818f4b24b3f05816eccc3d085559e7615f695bde77e64f1f2
+        image: ghcr.io/immich-app/immich-machine-learning:v3.0.0-openvino@sha256:9abb73aff96dc3a9aa28cfa090d1556708890811d3b8b9b6bacfb14436037a21
         livenessProbe:
           failureThreshold: 3
           initialDelaySeconds: 0
           periodSeconds: 10
           tcpSocket:
             port: 8080
--- HelmRelease: immich/immich Deployment: immich/immich-app

+++ HelmRelease: immich/immich Deployment: immich/immich-app

@@ -106,13 +106,13 @@

           value: '6379'
         - name: TZ
           value: null
         envFrom:
         - secretRef:
             name: immich-secrets
-        image: ghcr.io/immich-app/immich-server:v2.7.5@sha256:c15bff75068effb03f4355997d03dc7e0fc58720c2b54ad6f7f10d1bc57efaa5
+        image: ghcr.io/immich-app/immich-server:v3.0.0@sha256:685ba5c93337058ff8a189d3ed89f0ba470ef966b1c94d2eace1a3d991f9816e
         livenessProbe:
           failureThreshold: 3
           initialDelaySeconds: 0
           periodSeconds: 10
           tcpSocket:
             port: 8080
--- HelmRelease: immich/immich CronJob: immich/immich-ml-model-pull-clip

+++ HelmRelease: immich/immich CronJob: immich/immich-ml-model-pull-clip

@@ -66,13 +66,13 @@

             - --local-dir
             env:
             - name: HF_HOME
               value: /cache
             - name: HOME
               value: /cache
-            image: ghcr.io/immich-app/immich-machine-learning:v2.7.5@sha256:a2501141440f10516d329fdfba2c68082e19eb9ba6016c061ac80d23beadf7f3
+            image: ghcr.io/immich-app/immich-machine-learning:v3.0.0@sha256:5b480e92a2b77618d9ccae8c8110b0eae144ec9daf86715d246ec6d39cb7a553
             name: app
             resources:
               limits:
                 cpu: '4'
                 memory: 2Gi
               requests:
--- HelmRelease: immich/immich CronJob: immich/immich-ml-model-pull-facial

+++ HelmRelease: immich/immich CronJob: immich/immich-ml-model-pull-facial

@@ -66,13 +66,13 @@

             - --local-dir
             env:
             - name: HF_HOME
               value: /cache
             - name: HOME
               value: /cache
-            image: ghcr.io/immich-app/immich-machine-learning:v2.7.5@sha256:a2501141440f10516d329fdfba2c68082e19eb9ba6016c061ac80d23beadf7f3
+            image: ghcr.io/immich-app/immich-machine-learning:v3.0.0@sha256:5b480e92a2b77618d9ccae8c8110b0eae144ec9daf86715d246ec6d39cb7a553
             name: app
             resources:
               limits:
                 cpu: '4'
                 memory: 2Gi
               requests:

@tinfoild
tinfoild Bot force-pushed the renovate/major-immich branch from eb34259 to ec9e96a Compare July 2, 2026 23:08
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Jul 2, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying jjgadgets-biohazard with  Cloudflare Pages  Cloudflare Pages

Latest commit: 02b8b14
Status:🚫  Build failed.

View logs

@tinfoild tinfoild Bot changed the title feat(oci/group/Immich)!: Update Immich v2.7.5 ➼ v3.0.0 feat(oci/group/Immich)!: Update Immich v2.7.5 ➼ v3.0.1 Jul 2, 2026
@tinfoild
tinfoild Bot force-pushed the renovate/major-immich branch from ec9e96a to e0dea61 Compare July 9, 2026 19:48
@tinfoild tinfoild Bot changed the title feat(oci/group/Immich)!: Update Immich v2.7.5 ➼ v3.0.1 feat(oci/group/Immich)!: Update Immich v2.7.5 ➼ v3.0.2 Jul 9, 2026
@tinfoild
tinfoild Bot force-pushed the renovate/major-immich branch from e0dea61 to 5585bf0 Compare July 15, 2026 14:53
@tinfoild tinfoild Bot changed the title feat(oci/group/Immich)!: Update Immich v2.7.5 ➼ v3.0.2 feat(oci/group/Immich)!: Update Immich v2.7.5 ➼ v3.0.3 Jul 15, 2026
@tinfoild
tinfoild Bot force-pushed the renovate/major-immich branch from 5585bf0 to b213c33 Compare July 19, 2026 18:02
@tinfoild tinfoild Bot changed the title feat(oci/group/Immich)!: Update Immich v2.7.5 ➼ v3.0.3 feat(oci/immich-server)!: Update v2.7.5 ➼ v3.0.3 Jul 19, 2026
@tinfoild
tinfoild Bot force-pushed the renovate/major-immich branch from b213c33 to ab22729 Compare July 19, 2026 19:19
@tinfoild tinfoild Bot changed the title feat(oci/immich-server)!: Update v2.7.5 ➼ v3.0.3 feat(oci/group/Immich)!: Update Immich v2.7.5 ➼ v3.0.3 Jul 19, 2026
@tinfoild
tinfoild Bot force-pushed the renovate/major-immich branch from ab22729 to 727dd12 Compare July 20, 2026 10:14
@tinfoild

tinfoild Bot commented Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

kube/kustomization/out00

--- kube/clusters/biohazard/flux Kustomization: flux-system/0-biohazard-config Kustomization: immich/immich-pvc

+++ kube/clusters/biohazard/flux Kustomization: flux-system/0-biohazard-config Kustomization: immich/immich-pvc

@@ -277,13 +277,13 @@

       RGID: ''
       RUID: ''
       SC: file
       SIZE: 700Gi
       SNAP: file
       SNAP_ACCESSMODE: ReadOnlyMany
-      VS_APP_CURRENT_VERSION: ghcr.io/immich-app/immich-server:v2.7.5@sha256:c15bff75068effb03f4355997d03dc7e0fc58720c2b54ad6f7f10d1bc57efaa5
+      VS_APP_CURRENT_VERSION: ghcr.io/immich-app/immich-server:v3.3.1@sha256:db996e352359771c6a3db121a0ed8761516b22f727fc092a0f46dcfef82c1bc1
     substituteFrom:
     - kind: Secret
       name: biohazard-vars
       optional: false
     - kind: Secret
       name: biohazard-secrets
--- kube/clusters/biohazard/flux Kustomization: flux-system/0-biohazard-config Kustomization: immich/immich-db

+++ kube/clusters/biohazard/flux Kustomization: flux-system/0-biohazard-config Kustomization: immich/immich-db

@@ -48,13 +48,13 @@

       group: postgresql.cnpg.io
       kind: Database
   path: ./kube/deploy/core/db/pg/clusters/template/pguser
   postBuild:
     substitute:
       CLUSTER_NAME: biohazard
-      PG_APP_CURRENT_VERSION: ghcr.io/immich-app/immich-server:v2.7.5@sha256:c15bff75068effb03f4355997d03dc7e0fc58720c2b54ad6f7f10d1bc57efaa5
+      PG_APP_CURRENT_VERSION: ghcr.io/immich-app/immich-server:v3.3.1@sha256:db996e352359771c6a3db121a0ed8761516b22f727fc092a0f46dcfef82c1bc1
       PG_APP_NS: immich
       PG_DB_USER: immich
       PG_NAME: home
     substituteFrom:
     - kind: Secret
       name: biohazard-vars
--- kube/deploy/core/storage/volsync/template Kustomization: immich/immich-pvc ReplicationSource: immich/immich-data-r2-updates-restic

+++ kube/deploy/core/storage/volsync/template Kustomization: immich/immich-pvc ReplicationSource: immich/immich-data-r2-updates-restic

@@ -53,8 +53,8 @@

       daily: 14
       within: 7d
     storageClassName: file
     volumeSnapshotClassName: file
   sourcePVC: immich-data
   trigger:
-    manual: ghcr.io/immich-app/immich-server:v2.7.5@sha256:c15bff75068effb03f4355997d03dc7e0fc58720c2b54ad6f7f10d1bc57efaa5
+    manual: ghcr.io/immich-app/immich-server:v3.3.1@sha256:db996e352359771c6a3db121a0ed8761516b22f727fc092a0f46dcfef82c1bc1
 
--- kube/deploy/core/storage/volsync/template Kustomization: immich/immich-pvc VolumeSnapshot: immich/immich-data-vd1bc57efaa5

+++ kube/deploy/core/storage/volsync/template Kustomization: immich/immich-pvc VolumeSnapshot: immich/immich-data-vd1bc57efaa5

@@ -1,16 +0,0 @@

----
-apiVersion: snapshot.storage.k8s.io/v1
-kind: VolumeSnapshot
-metadata:
-  labels:
-    app.kubernetes.io/name: immich
-    kustomize.toolkit.fluxcd.io/name: immich-pvc
-    kustomize.toolkit.fluxcd.io/namespace: immich
-    pvc.home.arpa/volsync: 'true'
-  name: immich-data-vd1bc57efaa5
-  namespace: immich
-spec:
-  source:
-    persistentVolumeClaimName: immich-data
-  volumeSnapshotClassName: file
-
--- kube/deploy/core/storage/volsync/template Kustomization: immich/immich-pvc VolumeSnapshot: immich/immich-data-vcfef82c1bc1

+++ kube/deploy/core/storage/volsync/template Kustomization: immich/immich-pvc VolumeSnapshot: immich/immich-data-vcfef82c1bc1

@@ -0,0 +1,16 @@

+---
+apiVersion: snapshot.storage.k8s.io/v1
+kind: VolumeSnapshot
+metadata:
+  labels:
+    app.kubernetes.io/name: immich
+    kustomize.toolkit.fluxcd.io/name: immich-pvc
+    kustomize.toolkit.fluxcd.io/namespace: immich
+    pvc.home.arpa/volsync: 'true'
+  name: immich-data-vcfef82c1bc1
+  namespace: immich
+spec:
+  source:
+    persistentVolumeClaimName: immich-data
+  volumeSnapshotClassName: file
+
--- kube/deploy/apps/immich/app Kustomization: immich/immich-app HelmRelease: immich/immich

+++ kube/deploy/apps/immich/app Kustomization: immich/immich-app HelmRelease: immich/immich

@@ -79,13 +79,13 @@

               TZ: null
             envFrom:
             - secretRef:
                 name: immich-secrets
             image:
               repository: ghcr.io/immich-app/immich-server
-              tag: v2.7.5@sha256:c15bff75068effb03f4355997d03dc7e0fc58720c2b54ad6f7f10d1bc57efaa5
+              tag: v3.3.1@sha256:db996e352359771c6a3db121a0ed8761516b22f727fc092a0f46dcfef82c1bc1
             probes:
               liveness:
                 enabled: true
               readiness:
                 enabled: true
             resources:
@@ -150,13 +150,13 @@

               TZ: null
             envFrom:
             - secretRef:
                 name: immich-secrets
             image:
               repository: ghcr.io/immich-app/immich-server
-              tag: v2.7.5@sha256:c15bff75068effb03f4355997d03dc7e0fc58720c2b54ad6f7f10d1bc57efaa5
+              tag: v3.3.1@sha256:db996e352359771c6a3db121a0ed8761516b22f727fc092a0f46dcfef82c1bc1
             probes:
               liveness:
                 enabled: true
               readiness:
                 enabled: true
             resources:
@@ -225,13 +225,13 @@

               NODE_ENV: production
               REDIS_HOSTNAME: immich-redis.immich.svc.cluster.local
               REDIS_PORT: '6379'
               TZ: null
             image:
               repository: ghcr.io/immich-app/immich-machine-learning
-              tag: v2.7.5-openvino@sha256:71cd5a681823c4b818f4b24b3f05816eccc3d085559e7615f695bde77e64f1f2
+              tag: v3.3.1-openvino@sha256:9f5ea923b763435592280e2f5e051a62f1a33d6d14e87620fc15453c27a12ae0
             probes:
               liveness:
                 enabled: true
               readiness:
                 enabled: true
             resources:
@@ -272,13 +272,13 @@

             - --local-dir
             env:
               HF_HOME: /cache
               HOME: /cache
             image:
               repository: ghcr.io/immich-app/immich-machine-learning
-              tag: v2.7.5@sha256:a2501141440f10516d329fdfba2c68082e19eb9ba6016c061ac80d23beadf7f3
+              tag: v3.3.1@sha256:513c831cfb010ad319341a0c86b42c575a0d5b688d3e8cae346ee624074a58ed
             resources:
               limits:
                 cpu: '4'
                 memory: 2Gi
               requests:
                 cpu: 10m
@@ -310,13 +310,13 @@

             - --local-dir
             env:
               HF_HOME: /cache
               HOME: /cache
             image:
               repository: ghcr.io/immich-app/immich-machine-learning
-              tag: v2.7.5@sha256:a2501141440f10516d329fdfba2c68082e19eb9ba6016c061ac80d23beadf7f3
+              tag: v3.3.1@sha256:513c831cfb010ad319341a0c86b42c575a0d5b688d3e8cae346ee624074a58ed
             resources:
               limits:
                 cpu: '4'
                 memory: 2Gi
               requests:
                 cpu: 10m

@tinfoild
tinfoild Bot force-pushed the renovate/major-immich branch from 727dd12 to 85ede22 Compare July 24, 2026 00:02
@tinfoild tinfoild Bot changed the title feat(oci/group/Immich)!: Update Immich v2.7.5 ➼ v3.0.3 feat(oci/immich-server)!: Update v2.7.5 ➼ v3.0.3 Jul 24, 2026
@ciel-shieru

ciel-shieru commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

SECURITY VULNERABILITIES FOUND BY CIEL

📅 Scan date: 2026-07-24 08:02 SGT
🤖 Scanner: Ciel Security Scanner
🔗 PR: #6353 — feat(oci/immich-server)!: Update v2.7.5 ➼ v3.0.3
📦 Packages checked: 1
🔍 Sources: NVD, OSV.dev, GHSA, GHSL, CISA KEV, FortiGuard, CVE.org, Changelog
⚠️ Vulnerabilities found: 1

Severity Summary

Severity Count
CRITICAL 0
HIGH 1
MEDIUM / MODERATE 0
LOW 0
UNKNOWN / NEEDS VERIFICATION 0
Total 1

Results

Package: ghcr.io/immich-app/immich-server (immich-app/immich)

  • Ecosystem: Docker / OCI container (upstream: immich-app/immich)
  • Old version: v2.7.5 — VULNERABLE (1 HIGH severity CVE)
  • New version: v3.0.3 — CLEAN (no known vulnerabilities found)

Vulnerabilities in version v2.7.5

  1. CVE-2026-59258 — Severity: HIGH (CVSS 8.3)

Vulnerabilities in version v3.0.3

No known vulnerabilities found.

Excluded (not applicable to either version)

The following vulnerabilities were found for immich but do not apply to either version:

  • CVE-2025-43856 — OAuth account hijacking (fixed in v1.132.0; both versions well above this)
  • CVE-2026-23896 — API key privilege escalation (fixed in v2.5.0; both versions ≥ v2.7.5)
  • CVE-2026-25118 — Credential disclosure via shared album (fixed in v2.6.0)
  • CVE-2026-35455 — Stored XSS in panorama viewer (fixed in v2.7.0)
  • CVE-2026-40096 — Open redirect via shared album name (fixed in v2.7.3)
  • CVE-2026-53662 — Reflected XSS in /auth/login (CVSS 9.6 CRITICAL) — intentionally excluded: the GHSA explicitly states "No tagged release is affected — v2.7.5 (the current stable) and earlier are safe." This vulnerability only exists on the :main Docker tag between commits 4ffa26c9 and 4eb1003.

Changelog security highlights (v2.7.5 → v3.0.3)

  • v3.0.0 includes "🔒 Security: fix: run profile picture through thumbnail pipeline (#27890)"
  • v3.0.3 includes "fix: unauthorized album owner update (#29883)" — the fix for CVE-2026-59258

Recommendations

  • Merge priority: HIGH — This PR fixes CVE-2026-59258 (HIGH severity, CVSS 8.3), a broken access control vulnerability that allows shared album editors to take over album ownership. Merge ASAP to remediate this exposure.
  • Safe to merge — The new version (v3.0.3) does not introduce any known vulnerabilities. No new CVEs have been identified.
  • Review the v3 migration guide at https://immich.app/blog/v3-migration before upgrading, as v3.0.0 includes breaking changes.

⚠️ This comment was posted by an automated security scanner (Ciel).
To re-scan, trigger the renovate-security-scanner skill.

@tinfoild
tinfoild Bot force-pushed the renovate/major-immich branch from 85ede22 to fd98e12 Compare July 24, 2026 03:27
@tinfoild tinfoild Bot changed the title feat(oci/immich-server)!: Update v2.7.5 ➼ v3.0.3 feat(oci/group/Immich)!: Update Immich v2.7.5 ➼ v3.0.3 Jul 24, 2026
@tinfoild
tinfoild Bot force-pushed the renovate/major-immich branch from fd98e12 to 24ac1d8 Compare July 25, 2026 00:15
@tinfoild tinfoild Bot changed the title feat(oci/group/Immich)!: Update Immich v2.7.5 ➼ v3.0.3 feat(oci/group/Immich)!: Update Immich v2.7.5 ➼ v3.0.3 - autoclosed Jul 26, 2026
@tinfoild tinfoild Bot closed this Jul 26, 2026
@tinfoild
tinfoild Bot deleted the renovate/major-immich branch July 26, 2026 00:03
@tinfoild
tinfoild Bot force-pushed the renovate/major-immich branch from c308d16 to 968362a Compare August 1, 2026 18:03
@tinfoild tinfoild Bot changed the title feat(oci/group/Immich)!: Update Immich v2.7.5 ➼ v3.1.0 feat(oci/immich-server)!: Update v2.7.5 ➼ v3.1.0 Aug 1, 2026
@tinfoild
tinfoild Bot force-pushed the renovate/major-immich branch from 968362a to 93894fc Compare August 1, 2026 19:22
@tinfoild tinfoild Bot changed the title feat(oci/immich-server)!: Update v2.7.5 ➼ v3.1.0 feat(oci/group/Immich)!: Update Immich v2.7.5 ➼ v3.1.0 Aug 1, 2026
@tinfoild tinfoild Bot changed the title feat(oci/group/Immich)!: Update Immich v2.7.5 ➼ v3.1.0 feat(oci/group/Immich)!: Update Immich v2.7.5 ➼ v3.1.0 - autoclosed Aug 2, 2026
@tinfoild tinfoild Bot closed this Aug 2, 2026
@tinfoild tinfoild Bot changed the title feat(oci/group/Immich)!: Update Immich v2.7.5 ➼ v3.1.0 - autoclosed feat(oci/group/Immich)!: Update Immich v2.7.5 ➼ v3.1.0 Aug 2, 2026
@tinfoild tinfoild Bot reopened this Aug 2, 2026
@tinfoild
tinfoild Bot force-pushed the renovate/major-immich branch 2 times, most recently from 93894fc to a8eefd1 Compare August 2, 2026 14:36
@tinfoild tinfoild Bot changed the title feat(oci/group/Immich)!: Update Immich v2.7.5 ➼ v3.1.0 feat(oci/group/Immich)!: Update Immich v2.7.5 ➼ v3.1.0 - autoclosed Aug 2, 2026
@tinfoild tinfoild Bot closed this Aug 2, 2026
@tinfoild tinfoild Bot changed the title feat(oci/group/Immich)!: Update Immich v2.7.5 ➼ v3.1.0 - autoclosed feat(oci/group/Immich)!: Update Immich v2.7.5 ➼ v3.1.0 Aug 2, 2026
@tinfoild tinfoild Bot reopened this Aug 2, 2026
@tinfoild
tinfoild Bot force-pushed the renovate/major-immich branch 4 times, most recently from 6cc1703 to eb139da Compare August 5, 2026 14:16
@tinfoild tinfoild Bot changed the title feat(oci/group/Immich)!: Update Immich v2.7.5 ➼ v3.1.0 feat(oci/immich-machine-learning)!: Update v2.7.5 ➼ v3.1.0 Aug 5, 2026
@tinfoild
tinfoild Bot force-pushed the renovate/major-immich branch from eb139da to 7f9d448 Compare August 5, 2026 16:50
@tinfoild tinfoild Bot changed the title feat(oci/immich-machine-learning)!: Update v2.7.5 ➼ v3.1.0 feat(oci/group/Immich)!: Update Immich v2.7.5 ➼ v3.1.0 Aug 5, 2026
@tinfoild
tinfoild Bot force-pushed the renovate/major-immich branch from 7f9d448 to c2fe2a6 Compare August 11, 2026 10:03
@tinfoild tinfoild Bot changed the title feat(oci/group/Immich)!: Update Immich v2.7.5 ➼ v3.1.0 feat(oci/immich-server)!: Update v2.7.5 ➼ v3.1.0 Aug 11, 2026
@tinfoild
tinfoild Bot force-pushed the renovate/major-immich branch from c2fe2a6 to c632385 Compare August 11, 2026 10:58
@tinfoild tinfoild Bot changed the title feat(oci/immich-server)!: Update v2.7.5 ➼ v3.1.0 feat(oci/group/Immich)!: Update Immich v2.7.5 ➼ v3.1.0 Aug 11, 2026
@tinfoild
tinfoild Bot force-pushed the renovate/major-immich branch from c632385 to bd6a200 Compare August 11, 2026 19:03
@tinfoild tinfoild Bot changed the title feat(oci/group/Immich)!: Update Immich v2.7.5 ➼ v3.1.0 feat(oci/immich-machine-learning)!: Update v2.7.5 ➼ v3.1.0 Aug 11, 2026
@tinfoild
tinfoild Bot force-pushed the renovate/major-immich branch from bd6a200 to 4d6009d Compare August 11, 2026 20:06
@tinfoild tinfoild Bot changed the title feat(oci/immich-machine-learning)!: Update v2.7.5 ➼ v3.1.0 feat(oci/group/Immich)!: Update Immich v2.7.5 ➼ v3.1.0 Aug 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

kube/deploy/apps renovate/datasource/docker renovate/type/major

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ciel-shieru