Skip to content

Update immich monorepo to v2.7.5#2048

Merged
claytono merged 1 commit intomainfrom
renovate/immich-monorepo
Apr 22, 2026
Merged

Update immich monorepo to v2.7.5#2048
claytono merged 1 commit intomainfrom
renovate/immich-monorepo

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Apr 20, 2026 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
ghcr.io/immich-app/immich-machine-learning Kustomization minor v2.3.1-cuda → v2.7.5-cuda
ghcr.io/immich-app/immich-server Kustomization minor v2.3.1 → v2.7.5

Release Notes

immich-app/immich (ghcr.io/immich-app/immich-machine-learning)

v2.7.5

Compare Source

v2.7.5
What's Changed
🐛 Bug fixes
🌐 Translations

Full Changelog: immich-app/immich@v2.7.4...v2.7.5

v2.7.4

Compare Source

v2.7.4

This release addresses some issues with image rendering on the mobile app

What's Changed
🐛 Bug fixes

Full Changelog: immich-app/immich@v2.7.3...v2.7.4

v2.7.3

Compare Source

v2.7.3
What's Changed
🐛 Bug fixes
📚 Documentation
New Contributors

Full Changelog: immich-app/immich@v2.7.2...v2.7.3

v2.7.2

Compare Source

You knew it was coming 😅

This release addresses the following issues:

  • Fix an issue with the default helmet.json file
  • Fix an issue with ML containers not working on some older CPUs
  • Fix an issue with importing external libraries
What's Changed
🐛 Bug fixes

Full Changelog: immich-app/immich@v2.7.0...v2.7.2

v2.7.0

Compare Source

v2.7.0

Welcome to Immich v2.7.0!

This release includes enhancements to the asset viewer, security improvements, changes to the duplicate APIs and viewer, and a bunch of bug fixes. Keep reading below for the complete highlights and a note on the upcoming v3.0.0 release.

[!NOTE]
We're working on a managed backup service for Immich with end-to-end encrypted backups of your library to a remote datacentre where only you hold the keys.

We've put together a quick survey (~5 mins) to get a better idea of how you're backing things up today and what you'd actually want from something like this. Your answers help us figure out what to prioritise, so we'd really appreciate it if you took a few minutes to fill it out.

Leave your email at the end if you're interested in joining our free closed beta when it's ready.

https://futo-backups-survey.immich.app/

Known limitations
  • The machine learning service on amd64 currently requires the >= x86-64-v2 microarchitecture. This will be patched in an upcoming patch release for backward compatibility with very old processors (before ~2010), but it will become a minimum requirement in 3.0. arm64 is not affected by this change.
Highlights
  • Remove from album (asset viewer)
  • Move to locked folder (folder page)
  • Editor shortcuts
  • Create a new face on-the-fly in the face tag editor
  • Resolve duplicates
  • Helmet configuration
  • Version check infrastructure
  • Notable fix: live photo and video download in Safari
  • Notable fix: escape HTML in the Panorama Photo Viewer
Remove from album

The web has a new action, "Remove from album," available in the asset viewer that makes it easier to remove an asset from an album. This action is available to both album and asset owners.

image
Move to locked folder in the Folder view

Similarly, the folder view now includes the "Move to locked folder" action.

image
Editor shortcuts

Users on the web can now edit with keyboard shortcuts. Press e to open the editor. Once in the editor, press [ or ] to rotate the asset +/- 90 degrees. Finally, save any changes and close the editor with ENTER.

slice.mp4
Create a new face on-the-fly in the face tag editor

You can now create a new face/person on the fly from the face tagging editor interface

image image
Deduplication improvements

The duplicate screen has gone through a bunch of iterations since it was first introduced all the way back in May, 2024. The latest release moves a bunch of logic from the client to the server, which now automatically suggests which asset to keep based on image size and EXIF data. Additionally, the new server implementation will automatically synchronize metadata, including albums, favorite status, rating, description, visibility, location, and tags. For more information about this process, see the new documentation.

Helmet configuration

You can now opt in to using a Content Security Policy (CSP) in Immich. The new environment variant IMMICH_HELMET_FILE accepts a boolean or a path to a helmet configuration file.

Recommend action: The team recommends setting IMMICH_HELMET_FILE=true to enable the default policy. Then, please let us know if you run into any issues with it.

Background and details

Since Immich is deployed in so many different ways, it has been hard to figure out how to enable a CSP that would not conflict with or break existing installs that might use 3rd party map providers, custom CSS, embed Immich in an iframe, or other such features. In this release, we have added the ability to both opt in to a default policy and configure a custom one. To use the default policy, simply set the environment variable IMMICH_HELMET_FILE=true. To use a custom policy, set the environment variable to a path on disk (within the immich-server) that contains a valid helmet configuration (e.g. IMMICH_HELMET_FILE=/opt/immich/helmet.json). CSP can be used to control what scripts are allowed to run on the page, which domains to load images from, etc. Additionally, it can be used to configure headers for Referrer-Policy, X-Powered-By, X-Frame-Options, and others.

New version check infrastructure

Prior to this release, instances that used the automatic version check feature would send HTTP requests to github.com. Now, we have set up a small service at version.immich.cloud to handle these types of requests. This avoids any privacy implications of connecting to github.com , as well as moves the request load to our own infrastructure.

Notable fix: live photo and video download in Safari

When downloading files in Safari with the same name, it will simply overwrite the file instead of automatically renaming it. In this release, the still and motion parts of a live photo are now named differently to prevent this from happening.

Notable fix: escape HTML in panorama photo viewer

In v2.6.0, we added the ability to show/view clip text in the panorama viewer, but introduced an XSS vulnerability, which has been fixed in this release. Interestingly, this was XSS using text in the image, which would then get read by OCR.

Notable fix: Immich User Agent for external requests

Similar to the mobile app, the server now sends a custom User Agent header. The format for the User Agent is immich-server/{version}. For example, immich-server/2.7.0.

v3.0.0

Just a heads up that this is the likely to be the last release before v3.0.0. Being a major release there will be a handful of breaking changes, although it's worth noting that nothing is currently planned that requires user intervention. It is mainly changes that impact 3rd party developers. More information and details should be available in the coming weeks.

Support Immich

If you find the project helpful, you can support Immich by purchasing a product key at https://buy.immich.app or our merchandise at https://immich.store

What's Changed
🚀 Features
🌟 Enhancements
🐛 Bug fixes
📚 Documentation
🌐 Translations
New Contributors

Full Changelog: immich-app/immich@v2.6.3...v2.7.0

v2.6.3

Compare Source

v2.6.3
What's Changed
🐛 Bug fixes

Full Changelog: immich-app/immich@v2.6.2...v2.6.3

v2.6.2

Compare Source

v2.6.2

This release addresses the following issues

  • Fixed a bug where the shared link would error out when public users upload to the shared link
  • Fixed a bug where the URL switching feature doesn't work with external URLs
  • Fixed a bug where the "add to album" selection box on the web doesn't include albums that are shared with the user
  • Fixed several issues regarding the search filter on the mobile app and the web
What's Changed
🐛 Bug fixes
📚 Documentation
New Contributors

Full Changelog: immich-app/immich@v2.6.1...v2.6.2

v2.6.1

Compare Source

v2.6.1
Hot fixes
  • Fixed a failed migration issue on the mobile app when the URL Switching feature is used
What's Changed
🐛 Bug fixes

Full Changelog: immich-app/immich@v2.6.0...v2.6.1

v2.6.0

Compare Source

v2.6.0

Welcome to Immich v2.6.0, This release is a collection of more than 350 commits over 6 weeks. I know, it is an eternity between releases compared to our previous era. This version focuses on bug fixes and enhancements across the app to provide a more delightful and smoother experience to you. This release also prepares for the next major release in the coming month, which will remove the old timeline implementation. Let's dive into the highlights of the release:

[!WARNING]
For those who are still using the old timeline, please switch to the new timeline to avoid interruption, as the old timeline will be removed in the next release.

ps: The old timeline has an exclamation icon next to the logo. image

Highlights
  • Map side panel (web)
  • Pick album cover (mobile)
  • Shared link slugs (mobile)
  • Shared link presets (web)
  • Native HTTP clients (mobile)
  • Video player and asset viewer improvements (mobile)
  • Improved search results (mobile)
  • schema-check: a new immich-admin command
  • Read profile claims from ID token (OAuth)
  • Notable fix: cast videos now automatically loop
  • Notable fix: correctly extract make and model from Sony XAVC video files
  • Notable fix: escape key handling on web
  • Notable fix: healthcheck endpoint in maintenance mode
  • Notable fix: timeline rendering for RTL languages like Arabic and Hebrew
  • Notable fix: prevent server crash when extracting invalid metadata
Map side panel (web)

The map view on the web now opens a mini-timeline component as a side panel when you click on a cluster of assets. This makes it easier to view the cluster at a glance and enables bulk actions, such as adding to favorites and adding to an album.

image
Pick album cover (mobile)

Users can now pick a new album cover directly from the mobile app.

540300751-58fc1937-aed8-40b8-869c-9cb47c1d40c2.mov
Shared link slugs (mobile)

The mobile app now also supports setting a shared link slug, a feature that's been available on the web for a while.

shasre-slug.mp4
Shared link presets (web)

The expiration form input on the web was always a bit confusing, but it's been updated to make it easier to see and understand when a shared link will expire.

image
Native HTTP clients (mobile)

The mobile app now uses native HTTP clients across both Android and iOS, with support for mTLS, self-signed certificates, basic auth, and custom headers. These features should now be more reliable and extend to background tasks, video playback, and other parts of the app. This also improves the app's overall network request performance thanks to HTTP/2 and HTTP/3, multiplexing, and caching.

Video player and asset viewer improvements (mobile)

The asset viewer has undergone many improvements under the hood to make it simpler, faster and more reliable. We've also added playback support for GIFs, enabled video zooming, and made many more bug fixes and tweaks.

The asset viewer now uses a gradient for actions, and video controls have been restyled
image
Inline asset details

This used to be a bottom sheet and had a lot of glue for alignment. The new version is much more responsive and less buggy.

Before
ScreenRecording_03-19-2026_15-37-19_1.mov
After
ScreenRecording_03-19-2026.14-23-44_1.mp4
Improved search results (mobile)

The search results page now loads more results without rebuilding the entire grid, and should now load much faster. There are also new screens for when there are no search results and when all results have been loaded.

screen-20260224-231550-1771974915747.2.mp4
schema-check: a new immich-admin command

A new immich-admin command has been added in this release: schema-check. The command runs a report on the database to check if any indexes, constraints, tables, or columns are missing. This check also runs automatically on startup.

Read profile claims from idToken (OAuth)

Prior to v2.6.0, Immich resolved the email and other claims from the userinfo endpoint. Now, Immich also supports reading those claims directly from the idToken. This makes it possible to use providers such as Microsoft ADFS that do not support the userinfo endpoint.

As always, there are many more QoL improvements, bug fixes, and enhancements in this release. Please find the full release note below

Support Immich

If you find the project helpful, you can support Immich by purchasing a product key at https://buy.immich.app or our merchandise at https://immich.store

What's Changed
🔒 Security
🚀 Features
🌟 Enhancements
🐛 Bug fixes

Configuration

📅 Schedule: (in timezone America/New_York)

  • Branch creation
    • "after 2am and before 8am on monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the renovate label Apr 20, 2026
@renovate renovate Bot requested a review from claytono as a code owner April 20, 2026 06:05
@renovate renovate Bot added the renovate label Apr 20, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Apr 20, 2026

immich-server (docker) v2.3.1 -> v2.7.5, immich-machine-learning (docker) v2.3.1-cuda -> v2.7.5-cuda

Risk: 🟡 Caution

The Deep Dive

Update Scope

Updates the two Immich images pinned in kubernetes/immich/kustomization.yaml: immich-server and immich-machine-learning move from v2.3.1 to v2.7.5 (CUDA variant for ML). This is a 4 minor-version jump (2.3 → 2.4 → 2.5 → 2.6 → 2.7) that includes multiple database migrations. The Helm chart (immich 0.11.1 in Chart.yaml) and VectorChord Postgres image (tensorchord/cloudnative-vectorchord:17-0.4.3 in immich-postgres-cluster.yaml) are unchanged. VectorChord 0.4.3 remains in the Immich-supported range (>= 0.3, < 2.0) per the v2.7.5 postgres docs.

Performance & Stability

Features & UX

The jump from 2.3.1 brings several user-visible features. None requires a config change to keep the service working, but some are worth enabling:

  • IMMICH_HELMET_FILE (v2.7.0) — opt-in Content Security Policy. Not configured today (values.yaml sets no IMMICH_HELMET_* var). Upstream recommends IMMICH_HELMET_FILE=true to enable the default CSP. Given this instance is fronted by Authentik OIDC, test in staging before enabling to avoid breaking embeds/custom CSS.
  • IMMICH_ALLOW_SETUP (v2.5.0) — new env to disable the admin-sign-up endpoint. Default true. Consider setting to false since admin is already provisioned (defense-in-depth if DB is ever restored blank).
  • Non-destructive editing (v2.5.0) — image edits stored separately from original. Available in web UI without config.
  • DB backup/restore from web UI (v2.5.0) — automated pg_dumpall requires DB superuser. The CNPG cluster in immich-postgres-cluster.yaml uses a normal immich owner; if web-based DB restore is desired, grant superuser to that role (not required for normal operation).
  • Command palette (v2.4.0) — ctrl/cmd+k in the web UI, no config.
  • Duplicates resolver + metadata sync (v2.7.0) — automatic suggestion of which duplicate to keep.
  • Version check moved to version.immich.cloud (v2.7.0) — outbound traffic that used to hit github.com now hits version.immich.cloud. If egress is firewalled, verify this host is reachable.
  • schema-check admin command (v2.6.0) — runs automatically on startup; useful to watch in the first boot log after this upgrade.

Security

This upgrade closes four CVEs that currently affect the deployed v2.3.1:

All four are closed by moving to v2.7.5.

One further advisory, GHSA-3832-6r8h-9cfm / CVE-2025-43856 (high Account hijacking through OAuth2), targets the immich-server docker image with vulnerable range < v1.132.0 and patched range >= v1.132.0. The deployed v2.3.1 is already well past the fix (Immich bumped from 1.x to 2.x in April 2025, ~11 months before this PR), so it is already patched on the currently-deployed version and unaffected by this update. No new CVEs are introduced by moving to v2.7.5.

Key Fixes

Newer Versions

v2.7.5 is the latest release on the upstream tag list as of 2026-04-20 (tagged 2026-04-13). No newer patch exists; no regressions to flag.

Hazards & Risks

  • Multi-step database migration. Four minor releases of schema changes will run on first startup (e.g., v2.5.0 image editing tables, v2.7.0 helmet/CSP config, duplicate suggester, bulk metadata endpoints). Immich is known to run long-running ALTER TABLEs for embedding/exif indexes; the Postgres storage.size: 20Gi PVC in immich-postgres-cluster.yaml should be checked for free space before deploy, and a fresh CNPG backup is advisable. Expect an extended first-boot window while schema-check and migrations complete.
  • Old timeline deprecated in 2.6.0; still available in 2.7.x, removal promised in 3.0.0 (release note). Any user accounts still on the old timeline should switch before the next major.
  • v3.0.0 is upstream-flagged as the next release (v2.7.0 notes). Upstream states it will contain breaking changes mostly affecting 3rd-party integrations — plan to pause Renovate or pin before it auto-proposes v3.x.
  • Version-check egress. The server now calls version.immich.cloud instead of github.com for update checks (v2.7.0). Verify any egress firewall permits this host or disable the check.
  • ML microarchitecture warning is not relevant: values.yaml pins the ML pod to node k2 via kubernetes.io/hostname: k2 and uses the -cuda image — the x86-64-v2 restriction applies only to the pure-CPU amd64 ML image path noted in v2.7.0 known limitations, and even then any post-2010 CPU qualifies.
  • No breaking env-var renames found between 2.3.1 and 2.7.5 for the variables actually injected into the deployed container. From kubernetes/immich/values.yaml the explicitly-set names are TZ, DB_DATABASE_NAME, DB_HOSTNAME, DB_PORT, DB_USERNAME, DB_PASSWORD, REDIS_HOSTNAME, REDIS_PORT, REDIS_PASSWORD; via envFrom: secretRef: name: immich-secrets the server additionally receives IMMICH_SECRET (defined in externalsecret.yaml). No OAUTH_* variables are wired into the server — the immich-oidc external secret's OAUTH_CLIENT_ID/OAUTH_CLIENT_SECRET keys are not referenced by envFrom or secretKeyRef in values.yaml or the rendered helm/immich/server.yaml; OIDC is terminated at the ingress via the ak-type: oidc Authentik annotation. All of the above names are still recognized by 2.7.5 per the v2.7.5 environment variables docs.

Sources

🟡 Verdict: Caution

Labelled renovate:caution: the PR itself is a standard Renovate image bump (digests + tags only), but it compounds four minor versions of schema migrations onto a single boot and introduces several opt-in features (CSP/helmet, ALLOW_SETUP=false, DB restore from UI). Take a CNPG backup before merging and watch the first server pod through schema-check and migrations; no config changes are required for the upgrade to succeed.

@renovate renovate Bot force-pushed the renovate/immich-monorepo branch 24 times, most recently from 77ac1a1 to 9c99518 Compare April 22, 2026 14:00
@renovate renovate Bot force-pushed the renovate/immich-monorepo branch 2 times, most recently from ef1ec33 to 07e866b Compare April 22, 2026 15:02
@renovate renovate Bot force-pushed the renovate/immich-monorepo branch from 07e866b to 52e3b54 Compare April 22, 2026 15:38
@claytono claytono merged commit 98e1dd1 into main Apr 22, 2026
20 checks passed
@claytono claytono deleted the renovate/immich-monorepo branch April 22, 2026 16:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@claytono claytono Awaiting requested review from claytono claytono is a code owner

Assignees

No one assigned

Labels

renovate:caution renovate:evaluated renovate

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@claytono