fix(mobile): cronet buffer overflow on compressed thumbnails

CronetImageFetcher sized the response buffer from Content-Length, which is
the compressed wire size. Cronet auto-decompresses gzip/br responses and
writes decompressed bytes into the buffer, exceeding it and throwing
IllegalArgumentException: ByteBuffer is already full on the next read. Use
the growable path; Content-Length becomes an initial alloc hint only,
capped at 128 MB so an untrusted server can't overflow Int.MAX_VALUE or
OOM us upfront. Reuse Cronet's ByteBuffer between reads when no grow is
needed.

.github/workflows/build-mobile.yml

@@ -116,7 +116,6 @@ jobs:
             ~/.gradle/wrapper
             ~/.android/sdk
             mobile/android/.gradle
-            mobile/.dart_tool
           key: build-mobile-gradle-${{ runner.os }}-main
 
       - name: Setup Android SDK
@@ -189,7 +188,6 @@ jobs:
             ~/.gradle/wrapper
             ~/.android/sdk
             mobile/android/.gradle
-            mobile/.dart_tool
           key: ${{ steps.cache-gradle-restore.outputs.cache-primary-key }}
 
   build-sign-ios:

.github/workflows/prepare-release.yml

@@ -17,15 +17,6 @@ on:
         description: 'Bump mobile build number'
         required: false
         type: boolean
-      rc:
-        description: 'Release candidate mode'
-        required: false
-        default: 'false'
-        type: choice
-        options:
-          - 'false'
-          - 'true'
-          - 'finalize'
       skipTranslations:
         description: 'Skip translations'
         required: false
@@ -83,8 +74,7 @@ jobs:
         env:
           SERVER_BUMP: ${{ inputs.serverBump }}
           MOBILE_BUMP: ${{ inputs.mobileBump }}
-          RC: ${{ inputs.rc }}
-        run: misc/release/pump-version.sh -s "${SERVER_BUMP}" -m "${MOBILE_BUMP}" -r "${RC}"
+        run: misc/release/pump-version.sh -s "${SERVER_BUMP}" -m "${MOBILE_BUMP}"
 
       - id: output
         run: echo "version=$IMMICH_VERSION" >> $GITHUB_OUTPUT
@@ -118,7 +108,7 @@ jobs:
 
     with:
       ref: ${{ needs.bump_version.outputs.ref }}
-      environment: ${{ inputs.rc != 'false' && 'rc' || 'production' }}
+      environment: production
 
   prepare_release:
     runs-on: ubuntu-latest
@@ -150,7 +140,6 @@ jobs:
         uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
         with:
           draft: true
-          prerelease: ${{ inputs.rc == 'true' }}
           tag_name: ${{ needs.bump_version.outputs.version }}
           token: ${{ steps.generate-token.outputs.token }}
           generate_release_notes: true

docs/docs/install/synology.md

@@ -52,7 +52,7 @@ Scroll to the bottom of the "**Details**" section and find the `IP Address` list
 
 ## Step 4 - Configure Firewall Settings
 
-Once your project completes the build process, your containers will start. In order to be able to access Immich from your browser, you need to configure the firewall settings for your Synology NAS.
+Once your project completes the build process, your containers will start. In order to be able to access Immich from your browser, you need to configure the firewall settings for your Synology NAS to allow communication between the Immich containers.
 
 Open "**Control Panel**" on your Synology NAS, and select "**Security**". Navigate to "**Firewall**"
 
@@ -74,6 +74,7 @@ Read the [Post Installation](/install/post-install.mdx) steps and [upgrade instr
 
 <details>
   <summary>Updating Immich using Container Manager</summary>
+
 Check the post installation and upgrade instructions at the links above before proceeding with this section.
 
 ## Step 1. Backup
@@ -110,7 +111,7 @@ Go to **Project**, select **Action** then **Build**. This will download, unpack,
 
 ## Step 5. Update firewall rule
 
-The default behavior is to automatically start the containers once installed. If `immich_server` runs for a few seconds and then stops, it may be because the firewall rule no longer matches the server IP address.
+Without a fixed subnet, the default behavior is to automatically start the containers once installed. If `immich_server` runs for a few seconds and then stops, it may be because the firewall rule no longer matches the server IP address.
 
 Go to the **Container** section. Click on `immich_server` and scroll down on **General** to find the IP address.
 ![Container IP](../../static/img/synology-container-ip.png)
@@ -123,4 +124,67 @@ In this example, the IP addresses mismatch and the firewall rule needs to be edi
 
 ![Edit IP](../../static/img/synology-fw-ipedit.png)
 
+To prevent future firewall issues, you may set a fixed subnet. [See Set Fixed Subnet](#set-fixed-subnet) for instructions.
+
+</details>
+
+<details id="set-fixed-subnet">
+  <summary>Set Fixed Subnet</summary>
+
+Docker by default assigns dynamic subnets to bridge networks which can change when rebuilding containers and can cause firewall rules to break. To avoid this, define a fixed subnet in your `docker-compose.yml`:
+
+## Step 1. Determine current subnet
+
+Go to the **Container** section. Click on `immich_server` and scroll down on **General** to find the IP address.
+![Container IP](../../static/img/synology-container-ip.png)
+
+## Step 2. Add network configuration
+
+Add the following network configuration at the end of your `docker-compose.yml` file:
+
+```yaml
+networks:
+  immich-network:
+    driver: bridge
+    ipam:
+      config:
+        - subnet: 172.20.0.0/16
+          gateway: 172.20.0.1
+```
+
+If your docker container is running on a different subnet then update accordingly.
+
+## Step 3. Add network to each service
+
+Add the network to each service (immich-server, immich-machine-learning, redis, database):
+
+```yaml
+services:
+  immich-server:
+    # other config options
+    networks:
+      - immich-network
+
+  immich-machine-learning:
+    # other config options
+    networks:
+      - immich-network
+
+  redis:
+    # other config options
+    networks:
+      - immich-network
+
+  database:
+    # other config options
+    networks:
+      - immich-network
+```
+
+Save your changes. Synology will ask if you want to save changes only or rebuild containers. Select rebuild containers.
+
+## Step 4. Update Firewall Rules, if necessary
+
+If your firewall rules were not already set for this subnet, the firewall rules will need to be updated. See [Step 4 - Configure Firewall Settings](#step-4---configure-firewall-settings).
+
 </details>

e2e/src/specs/maintenance/server/database-backups.e2e-spec.ts

@@ -2,7 +2,7 @@ import { LoginResponseDto, ManualJobName } from '@immich/sdk';
 import { errorDto } from 'src/responses';
 import { app, utils } from 'src/utils';
 import request from 'supertest';
-import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { afterAll, beforeAll, beforeEach, describe, expect, it } from 'vitest';
 
 describe('/admin/database-backups', () => {
   let cookie: string | undefined;
@@ -13,6 +13,9 @@ describe('/admin/database-backups', () => {
     admin = await utils.adminSetup({
       onboarding: false,
     });
+  });
+
+  beforeEach(async () => {
     await utils.resetBackups(admin.accessToken);
   });
 

e2e/src/utils.ts

@@ -568,6 +568,8 @@ export const utils = {
       name: ManualJobName.BackupDatabase,
     });
 
+    await utils.waitForQueueFinish(accessToken, 'backupDatabase');
+
     return utils.poll(
       () => request(app).get('/admin/database-backups').set('Authorization', `Bearer ${accessToken}`),
       ({ status, body }) => status === 200 && body.backups.length === 1,

misc/release/pump-version.sh

@@ -3,26 +3,21 @@
 #
 # Pump one or both of the server/mobile versions in appropriate files
 #
-# usage: './scripts/pump-version.sh -s <major|minor|patch> <-m> <true|false> <-r> <true|false|finalize>
+# usage: './scripts/pump-version.sh -s <major|minor|patch> <-m> <true|false>
 #
 # examples:
 #    ./scripts/pump-version.sh -s major         # 1.0.0+50 => 2.0.0+50
 #    ./scripts/pump-version.sh -s minor -m true # 1.0.0+50 => 1.1.0+51
 #    ./scripts/pump-version.sh -m true          # 1.0.0+50 => 1.0.0+51
-#    ./scripts/pump-version.sh -s minor -m true -r true     # 3.0.0 => 3.1.0-rc.0 (start RC)
-#    ./scripts/pump-version.sh -m true -r true              # 3.1.0-rc.0 => 3.1.0-rc.1 (iterate RC)
-#    ./scripts/pump-version.sh -m true -r finalize          # 3.1.0-rc.1 => 3.1.0 (finalize RC)
 #
 
 SERVER_PUMP="false"
 MOBILE_PUMP="false"
-RC="false"
 
-while getopts 's:m:r:' flag; do
+while getopts 's:m:' flag; do
   case "${flag}" in
   s) SERVER_PUMP=${OPTARG} ;;
   m) MOBILE_PUMP=${OPTARG} ;;
-  r) RC=${OPTARG} ;;
   *)
     echo "Invalid args"
     exit 1
@@ -30,71 +25,28 @@ while getopts 's:m:r:' flag; do
   esac
 done
 
-if [[ "$RC" != "true" && "$RC" != "false" && "$RC" != "finalize" ]]; then
-  echo "Expected <true|false|finalize> for the -r argument"
-  exit 1
-fi
-
 CURRENT_SERVER=$(jq -r '.version' server/package.json)
+MAJOR=$(echo "$CURRENT_SERVER" | cut -d '.' -f1)
+MINOR=$(echo "$CURRENT_SERVER" | cut -d '.' -f2)
+PATCH=$(echo "$CURRENT_SERVER" | cut -d '.' -f3)
 
-if [[ "$CURRENT_SERVER" == *-rc.* ]]; then
-  CURRENT_BASE="${CURRENT_SERVER%-rc.*}"
-  CURRENT_RC_NUM="${CURRENT_SERVER##*-rc.}"
+if [[ $SERVER_PUMP == "major" ]]; then
+  MAJOR=$((MAJOR + 1))
+  MINOR=0
+  PATCH=0
+elif [[ $SERVER_PUMP == "minor" ]]; then
+  MINOR=$((MINOR + 1))
+  PATCH=0
+elif [[ $SERVER_PUMP == "patch" ]]; then
+  PATCH=$((PATCH + 1))
+elif [[ $SERVER_PUMP == "false" ]]; then
+  echo 'Skipping Server Pump'
 else
-  CURRENT_BASE="$CURRENT_SERVER"
-  CURRENT_RC_NUM=""
-fi
-
-# Validate RC/server-bump combinations against current version state
-if [[ -n "$CURRENT_RC_NUM" ]]; then
-  # Currently on an RC
-  if [[ "$RC" == "false" ]]; then
-    echo "Current version $CURRENT_SERVER is a release candidate. Pass -r true to iterate the RC or -r finalize to finalize the release."
-    exit 1
-  fi
-  if [[ "$RC" == "true" && "$SERVER_PUMP" != "false" ]]; then
-    echo "Cannot start a new RC while still on an RC; finalize first."
-    exit 1
-  fi
-  if [[ "$RC" == "finalize" && "$SERVER_PUMP" != "false" ]]; then
-    echo "Finalize takes no server bump."
-    exit 1
-  fi
-else
-  # Not currently on an RC
-  if [[ "$RC" == "true" && "$SERVER_PUMP" == "false" ]]; then
-    echo "Starting an RC requires a server bump."
-    exit 1
-  fi
-  if [[ "$RC" == "finalize" ]]; then
-    echo "Nothing to finalize."
-    exit 1
-  fi
-fi
-
-if [[ "$SERVER_PUMP" != "major" && "$SERVER_PUMP" != "minor" && "$SERVER_PUMP" != "patch" && "$SERVER_PUMP" != "false" ]]; then
   echo 'Expected <major|minor|patch|false> for the server argument'
   exit 1
 fi
 
-NEXT_SERVER="$CURRENT_SERVER"
-if [[ "$SERVER_PUMP" == "false" && "$RC" == "false" ]]; then
-  echo 'Skipping Server Pump'
-else
-  npm version "$CURRENT_SERVER" --allow-same-version --no-git-tag-version || exit 1
-
-  if [[ "$RC" == "true" && -n "$CURRENT_RC_NUM" ]]; then
-    npm version prerelease --no-git-tag-version || exit 1
-  elif [[ "$RC" == "true" ]]; then
-    npm version "pre$SERVER_PUMP" --preid=rc --no-git-tag-version || exit 1
-  elif [[ "$RC" == "finalize" ]]; then
-    npm version "$CURRENT_BASE" --no-git-tag-version || exit 1
-  else
-    npm version "$SERVER_PUMP" --no-git-tag-version || exit 1
-  fi
-
-  NEXT_SERVER=$(jq -r '.version' package.json)
-fi
+NEXT_SERVER=$MAJOR.$MINOR.$PATCH
 
 CURRENT_MOBILE=$(grep "^version: .*+[0-9]\+$" mobile/pubspec.yaml | cut -d "+" -f2)
 NEXT_MOBILE=$CURRENT_MOBILE
@@ -110,6 +62,7 @@ fi
 if [ "$CURRENT_SERVER" != "$NEXT_SERVER" ]; then
   echo "Pumping Server: $CURRENT_SERVER => $NEXT_SERVER"
 
+  pnpm version "$NEXT_SERVER" --no-git-tag-version
   pnpm version "$NEXT_SERVER" --no-git-tag-version --prefix server
   pnpm version "$NEXT_SERVER" --no-git-tag-version --prefix packages/cli
   pnpm version "$NEXT_SERVER" --no-git-tag-version --prefix web
@@ -119,12 +72,9 @@ if [ "$CURRENT_SERVER" != "$NEXT_SERVER" ]; then
   # copy version to open-api spec
   mise run //:open-api
 
-  NEXT_PY="${NEXT_SERVER//-rc./rc}"
-  uv version --directory machine-learning "$NEXT_PY"
+  uv version --directory machine-learning "$NEXT_SERVER"
 
-  if [[ "$NEXT_SERVER" != *-rc.* ]]; then
-    ./misc/release/archive-version.js "$NEXT_SERVER"
-  fi
+  ./misc/release/archive-version.js "$NEXT_SERVER"
 fi
 
 if [ "$CURRENT_MOBILE" != "$NEXT_MOBILE" ]; then
@@ -134,9 +84,7 @@ fi
 sed -i "s/\"android\.injected\.version\.name\" => \"$CURRENT_SERVER\",/\"android\.injected\.version\.name\" => \"$NEXT_SERVER\",/" mobile/android/fastlane/Fastfile
 sed -i "s/\"android\.injected\.version\.code\" => $CURRENT_MOBILE,/\"android\.injected\.version\.code\" => $NEXT_MOBILE,/" mobile/android/fastlane/Fastfile
 sed -i "s/^version: $CURRENT_SERVER+$CURRENT_MOBILE$/version: $NEXT_SERVER+$NEXT_MOBILE/" mobile/pubspec.yaml
-# iOS marketing version cannot contain a pre-release suffix; the plist always holds the base version.
-IOS_NEXT="${NEXT_SERVER%-rc.*}"
-perl -i -p0e "s/(<key>CFBundleShortVersionString<\/key>\s*<string>)$CURRENT_BASE(<\/string>)/\${1}$IOS_NEXT\${2}/s" mobile/ios/Runner/Info.plist
+perl -i -p0e "s/(<key>CFBundleShortVersionString<\/key>\s*<string>)$CURRENT_SERVER(<\/string>)/\${1}$NEXT_SERVER\${2}/s" mobile/ios/Runner/Info.plist
 
 
 echo "IMMICH_VERSION=v$NEXT_SERVER" >>"$GITHUB_ENV"

misc/release/pump-version.test.mjs

@@ -1,300 +0,0 @@
-import { spawnSync } from 'node:child_process';
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import assert from 'node:assert/strict';
-import test from 'node:test';
-
-const scriptDir = dirname(fileURLToPath(import.meta.url));
-const repoRoot = resolve(scriptDir, '../..');
-const scriptUnderTest = join(repoRoot, 'misc/release/pump-version.sh');
-
-const read = (path) => readFileSync(path, 'utf8');
-const packageVersion = (dir) => JSON.parse(read(join(dir, 'package.json'))).version;
-const shellQuote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
-
-const writeExecutable = (path, contents) => {
-  writeFileSync(path, contents, { mode: 0o755 });
-};
-
-const writePackageJson = (dir, name, version) => {
-  writeFileSync(
-    join(dir, 'package.json'),
-    `${JSON.stringify({ name, version, private: true }, null, 2)}\n`,
-  );
-};
-
-const makeFixture = (t, { rootVersion = '2.7.5', serverVersion = '3.0.0', mobileBuild = 3047 } = {}) => {
-  const workdir = mkdtempSync(join(tmpdir(), 'pump-version-'));
-  t.after(() => rmSync(workdir, { recursive: true, force: true }));
-
-  const currentBase = serverVersion.replace(/-rc\..+$/, '');
-
-  for (const path of [
-    'bin',
-    'server',
-    'packages/cli',
-    'web',
-    'e2e',
-    'packages/sdk',
-    'misc/release',
-    'mobile/android/fastlane',
-    'mobile/ios/Runner',
-    'machine-learning',
-  ]) {
-    mkdirSync(join(workdir, path), { recursive: true });
-  }
-
-  writeCommandStubs(workdir);
-
-  writePackageJson(workdir, 'immich-monorepo', rootVersion);
-  writePackageJson(join(workdir, 'server'), 'immich', serverVersion);
-  writePackageJson(join(workdir, 'packages/cli'), '@immich/cli', serverVersion);
-  writePackageJson(join(workdir, 'web'), 'immich-web', serverVersion);
-  writePackageJson(join(workdir, 'e2e'), 'immich-e2e', serverVersion);
-  writePackageJson(join(workdir, 'packages/sdk'), '@immich/sdk', serverVersion);
-
-  writeExecutable(
-    join(workdir, 'misc/release/archive-version.js'),
-    `#!/usr/bin/env bash
-set -euo pipefail
-echo "$*" >>"$PWD/archive-version.calls"
-`,
-  );
-
-  writeFileSync(
-    join(workdir, 'mobile/pubspec.yaml'),
-    `name: immich_mobile
-version: ${serverVersion}+${mobileBuild}
-`,
-  );
-
-  writeFileSync(
-    join(workdir, 'mobile/android/fastlane/Fastfile'),
-    `lane :gha_release_prod do
-  gradle(
-    properties: {
-      "android.injected.version.code" => ${mobileBuild},
-      "android.injected.version.name" => "${serverVersion}",
-    }
-  )
-end
-`,
-  );
-
-  writeFileSync(
-    join(workdir, 'mobile/ios/Runner/Info.plist'),
-    `<?xml version="1.0" encoding="UTF-8"?>
-<plist version="1.0">
-<dict>
-  <key>CFBundleShortVersionString</key>
-  <string>${currentBase}</string>
-</dict>
-</plist>
-`,
-  );
-
-  return {
-    path: workdir,
-    file: (path) => join(workdir, path),
-    readFile: (path) => read(join(workdir, path)),
-    hasFile: (path) => {
-      try {
-        return read(join(workdir, path)).length > 0;
-      } catch {
-        return false;
-      }
-    },
-    run: (...args) =>
-      spawnSync('bash', [scriptUnderTest, ...args], {
-        cwd: workdir,
-        env: {
-          ...process.env,
-          GITHUB_ENV: join(workdir, 'github_env'),
-          PATH: `${join(workdir, 'bin')}:${process.env.PATH}`,
-        },
-        encoding: 'utf8',
-      }),
-  };
-};
-
-const writeCommandStubs = (workdir) => {
-  const realNpm = spawnSync('which', ['npm'], { encoding: 'utf8' }).stdout.trim();
-
-  writeExecutable(
-    join(workdir, 'bin/npm'),
-    `#!/usr/bin/env bash
-set -euo pipefail
-real_npm=${shellQuote(realNpm)}
-echo "$*" >>"$PWD/npm.calls"
-"$real_npm" "$@"
-`,
-  );
-
-  writeExecutable(
-    join(workdir, 'bin/pnpm'),
-    `#!/usr/bin/env bash
-set -euo pipefail
-
-if [[ "\${1:-}" != "version" ]]; then
-  echo "Unexpected pnpm command: $*" >&2
-  exit 1
-fi
-
-shift
-version="\${1:-}"
-shift
-prefix="."
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --prefix)
-      prefix="$2"
-      shift 2
-      ;;
-    --no-git-tag-version)
-      shift
-      ;;
-    *)
-      echo "Unexpected pnpm argument: $1" >&2
-      exit 1
-      ;;
-  esac
-done
-
-npm --prefix "$prefix" version "$version" --no-git-tag-version --allow-same-version >/dev/null
-`,
-  );
-
-  writeExecutable(
-    join(workdir, 'bin/mise'),
-    `#!/usr/bin/env bash
-set -euo pipefail
-echo "$*" >>"$PWD/mise.calls"
-`,
-  );
-
-  writeExecutable(
-    join(workdir, 'bin/uv'),
-    `#!/usr/bin/env bash
-set -euo pipefail
-echo "$*" >>"$PWD/uv.calls"
-
-if [[ "\${1:-}" != "version" ]]; then
-  echo "Unexpected uv command: $*" >&2
-  exit 1
-fi
-
-shift
-directory="."
-
-if [[ "\${1:-}" == "--directory" ]]; then
-  directory="$2"
-  shift 2
-fi
-
-version="\${1:-}"
-mkdir -p "$directory"
-cat >"$directory/pyproject.toml" <<PYPROJECT
-[project]
-version = "$version"
-PYPROJECT
-`,
-  );
-};
-
-const assertCommandPassed = (result) => {
-  assert.equal(result.status, 0, result.stderr || result.stdout);
-};
-
-const assertPackageVersions = (fixture, expected) => {
-  assert.equal(packageVersion(fixture.path), expected);
-  assert.equal(packageVersion(fixture.file('server')), expected);
-  assert.equal(packageVersion(fixture.file('packages/cli')), expected);
-  assert.equal(packageVersion(fixture.file('web')), expected);
-  assert.equal(packageVersion(fixture.file('e2e')), expected);
-  assert.equal(packageVersion(fixture.file('packages/sdk')), expected);
-};
-
-const npmCalls = (fixture) => fixture.readFile('npm.calls').trim().split('\n');
-
-test('starts an RC from the server version when the root package is stale', (t) => {
-  const fixture = makeFixture(t, { rootVersion: '2.7.5', serverVersion: '3.0.0', mobileBuild: 3047 });
-
-  const result = fixture.run('-s', 'minor', '-m', 'true', '-r', 'true');
-
-  assertCommandPassed(result);
-  assertPackageVersions(fixture, '3.1.0-rc.0');
-  assert.ok(npmCalls(fixture).includes('version preminor --preid=rc --no-git-tag-version'));
-  assert.match(fixture.readFile('mobile/pubspec.yaml'), /version: 3\.1\.0-rc\.0\+3048/);
-  assert.match(fixture.readFile('mobile/android/fastlane/Fastfile'), /"android\.injected\.version\.name" => "3\.1\.0-rc\.0"/);
-  assert.match(fixture.readFile('mobile/android/fastlane/Fastfile'), /"android\.injected\.version\.code" => 3048/);
-  assert.match(fixture.readFile('mobile/ios/Runner/Info.plist'), /<string>3\.1\.0<\/string>/);
-  assert.match(fixture.readFile('uv.calls'), /version --directory machine-learning 3\.1\.0rc0/);
-  assert.equal(fixture.hasFile('archive-version.calls'), false);
-  assert.match(fixture.readFile('github_env'), /IMMICH_VERSION=v3\.1\.0-rc\.0/);
-});
-
-test('iterates an existing RC', (t) => {
-  const fixture = makeFixture(t, { rootVersion: '2.7.5', serverVersion: '3.1.0-rc.0', mobileBuild: 3048 });
-
-  const result = fixture.run('-m', 'false', '-r', 'true');
-
-  assertCommandPassed(result);
-  assertPackageVersions(fixture, '3.1.0-rc.1');
-  assert.ok(npmCalls(fixture).includes('version prerelease --no-git-tag-version'));
-  assert.equal(npmCalls(fixture).some((call) => call.startsWith('version prerelease --preid')), false);
-  assert.match(fixture.readFile('mobile/pubspec.yaml'), /version: 3\.1\.0-rc\.1\+3048/);
-  assert.match(fixture.readFile('uv.calls'), /version --directory machine-learning 3\.1\.0rc1/);
-  assert.equal(fixture.hasFile('archive-version.calls'), false);
-});
-
-test('finalizes an existing RC', (t) => {
-  const fixture = makeFixture(t, { rootVersion: '2.7.5', serverVersion: '3.1.0-rc.1', mobileBuild: 3048 });
-
-  const result = fixture.run('-m', 'false', '-r', 'finalize');
-
-  assertCommandPassed(result);
-  assertPackageVersions(fixture, '3.1.0');
-  assert.match(fixture.readFile('mobile/pubspec.yaml'), /version: 3\.1\.0\+3048/);
-  assert.match(fixture.readFile('mobile/ios/Runner/Info.plist'), /<string>3\.1\.0<\/string>/);
-  assert.match(fixture.readFile('uv.calls'), /version --directory machine-learning 3\.1\.0/);
-  assert.match(fixture.readFile('archive-version.calls'), /3\.1\.0/);
-});
-
-test('bumps a normal patch release', (t) => {
-  const fixture = makeFixture(t, { rootVersion: '2.7.5', serverVersion: '3.1.0', mobileBuild: 3048 });
-
-  const result = fixture.run('-s', 'patch', '-m', 'true');
-
-  assertCommandPassed(result);
-  assertPackageVersions(fixture, '3.1.1');
-  assert.match(fixture.readFile('mobile/pubspec.yaml'), /version: 3\.1\.1\+3049/);
-  assert.match(fixture.readFile('uv.calls'), /version --directory machine-learning 3\.1\.1/);
-  assert.match(fixture.readFile('archive-version.calls'), /3\.1\.1/);
-});
-
-test('bumps mobile only', (t) => {
-  const fixture = makeFixture(t, { rootVersion: '2.7.5', serverVersion: '3.1.0', mobileBuild: 3048 });
-
-  const result = fixture.run('-m', 'true');
-
-  assertCommandPassed(result);
-  assert.equal(packageVersion(fixture.path), '2.7.5');
-  assert.equal(packageVersion(fixture.file('server')), '3.1.0');
-  assert.match(fixture.readFile('mobile/pubspec.yaml'), /version: 3\.1\.0\+3049/);
-  assert.equal(fixture.hasFile('uv.calls'), false);
-  assert.equal(fixture.hasFile('archive-version.calls'), false);
-});
-
-test('rejects starting a new RC while already on an RC', (t) => {
-  const fixture = makeFixture(t, { rootVersion: '2.7.5', serverVersion: '3.1.0-rc.0', mobileBuild: 3048 });
-
-  const result = fixture.run('-s', 'patch', '-r', 'true');
-
-  assert.notEqual(result.status, 0);
-  assert.match(result.stdout, /Cannot start a new RC while still on an RC; finalize first\./);
-  assert.equal(packageVersion(fixture.path), '2.7.5');
-  assert.equal(packageVersion(fixture.file('server')), '3.1.0-rc.0');
-});

mobile/android/app/src/main/kotlin/app/alextran/immich/images/RemoteImagesImpl.kt

@@ -23,6 +23,8 @@ import java.io.IOException
 import java.nio.ByteBuffer
 import java.util.concurrent.ConcurrentHashMap
 
+private const val MAX_PREALLOC_BYTES = 128 * 1024 * 1024
+
 private class RemoteRequest(val cancellationSignal: CancellationSignal)
 
 class RemoteImagesImpl(context: Context) : RemoteImageApi {
@@ -228,7 +230,6 @@ private class CronetImageFetcher : ImageFetcher {
     private val onComplete: () -> Unit,
   ) : UrlRequest.Callback() {
     private var buffer: NativeByteBuffer? = null
-    private var wrapped: ByteBuffer? = null
     private var error: Exception? = null
 
     override fun onRedirectReceived(request: UrlRequest, info: UrlResponseInfo, newUrl: String) {
@@ -242,15 +243,16 @@ private class CronetImageFetcher : ImageFetcher {
       }
 
       try {
+        // Content-Length is a size hint only. With Content-Encoding (gzip/br/...),
+        // Cronet auto-decompresses and writes decompressed bytes to our buffer, which
+        // may exceed the wire/compressed Content-Length. Always use the growable
+        // buffer path so we can't overflow.
         val contentLength = info.allHeaders["content-length"]?.firstOrNull()?.toIntOrNull() ?: 0
-        if (contentLength > 0) {
-          buffer = NativeByteBuffer(contentLength + 1)
-          wrapped = NativeBuffer.wrap(buffer!!.pointer, contentLength + 1)
-          request.read(wrapped)
-        } else {
-          buffer = NativeByteBuffer(INITIAL_BUFFER_SIZE)
-          request.read(buffer!!.wrapRemaining())
-        }
+        // Cap the up-front alloc: Content-Length is untrusted and can be huge or near
+        // Int.MAX_VALUE (overflowing `+1`). For larger responses the grow path takes over.
+        val initialSize = if (contentLength in 1..MAX_PREALLOC_BYTES) contentLength + 1 else INITIAL_BUFFER_SIZE
+        buffer = NativeByteBuffer(initialSize)
+        request.read(buffer!!.wrapRemaining())
       } catch (e: Exception) {
         error = e
         return request.cancel()
@@ -263,14 +265,18 @@ private class CronetImageFetcher : ImageFetcher {
       byteBuffer: ByteBuffer
     ) {
       try {
-        val buf = if (wrapped == null) {
-          buffer!!.run {
-            advance(byteBuffer.position())
-            ensureHeadroom()
-            wrapRemaining()
-          }
+        val b = buffer!!
+        b.advance(byteBuffer.position())
+        // Reuse the caller-supplied ByteBuffer as long as we don't need to grow.
+        // It already points at our native memory with position advanced past the
+        // written bytes — Cronet can keep writing into the remaining tail.
+        // Only when the buffer is full do we grow (which may realloc + move the
+        // native pointer) and need a fresh wrap.
+        val buf = if (b.offset == b.capacity) {
+          b.ensureHeadroom()
+          b.wrapRemaining()
         } else {
-          wrapped
+          byteBuffer
         }
         request.read(buf)
       } catch (e: Exception) {
@@ -280,7 +286,6 @@ private class CronetImageFetcher : ImageFetcher {
     }
 
     override fun onSucceeded(request: UrlRequest, info: UrlResponseInfo) {
-      wrapped?.let { buffer!!.advance(it.position()) }
       onSuccess(buffer!!)
       onComplete()
     }

mobile/lib/domain/models/asset/remote_asset.model.dart

@@ -11,6 +11,7 @@ class RemoteAsset extends BaseAsset {
   final String ownerId;
   final String? stackId;
   final DateTime? uploadedAt;
+  final DateTime? deletedAt;
 
   const RemoteAsset({
     required this.id,
@@ -31,6 +32,7 @@ class RemoteAsset extends BaseAsset {
     super.livePhotoVideoId,
     this.stackId,
     required super.isEdited,
+    this.deletedAt,
   }) : localAssetId = localId;
 
   @override
@@ -48,6 +50,8 @@ class RemoteAsset extends BaseAsset {
   @override
   bool get isEditable => isImage && !isMotionPhoto && !isAnimatedImage;
 
+  bool get isTrashed => deletedAt != null;
+
   @override
   String toString() {
     return '''Asset {
@@ -86,7 +90,8 @@ class RemoteAsset extends BaseAsset {
         thumbHash == other.thumbHash &&
         visibility == other.visibility &&
         stackId == other.stackId &&
-        uploadedAt == other.uploadedAt;
+        uploadedAt == other.uploadedAt &&
+        deletedAt == other.deletedAt;
   }
 
   @override
@@ -98,7 +103,8 @@ class RemoteAsset extends BaseAsset {
       thumbHash.hashCode ^
       visibility.hashCode ^
       stackId.hashCode ^
-      uploadedAt.hashCode;
+      uploadedAt.hashCode ^
+      deletedAt.hashCode;
 
   RemoteAsset copyWith({
     String? id,
@@ -119,6 +125,7 @@ class RemoteAsset extends BaseAsset {
     String? livePhotoVideoId,
     String? stackId,
     bool? isEdited,
+    DateTime? deletedAt,
   }) {
     return RemoteAsset(
       id: id ?? this.id,
@@ -139,6 +146,7 @@ class RemoteAsset extends BaseAsset {
       livePhotoVideoId: livePhotoVideoId ?? this.livePhotoVideoId,
       stackId: stackId ?? this.stackId,
       isEdited: isEdited ?? this.isEdited,
+      deletedAt: deletedAt ?? this.deletedAt,
     );
   }
 }
@@ -156,6 +164,7 @@ class RemoteAssetExif extends RemoteAsset {
     required super.createdAt,
     required super.updatedAt,
     super.uploadedAt,
+    super.deletedAt,
     super.width,
     super.height,
     super.durationMs,
@@ -193,6 +202,7 @@ class RemoteAssetExif extends RemoteAsset {
     DateTime? createdAt,
     DateTime? updatedAt,
     DateTime? uploadedAt,
+    DateTime? deletedAt,
     int? width,
     int? height,
     int? durationMs,
@@ -214,6 +224,7 @@ class RemoteAssetExif extends RemoteAsset {
       createdAt: createdAt ?? this.createdAt,
       updatedAt: updatedAt ?? this.updatedAt,
       uploadedAt: uploadedAt ?? this.uploadedAt,
+      deletedAt: deletedAt ?? this.deletedAt,
       width: width ?? this.width,
       height: height ?? this.height,
       durationMs: durationMs ?? this.durationMs,

mobile/lib/domain/models/store.model.dart

@@ -4,25 +4,15 @@ import 'package:immich_mobile/domain/models/user.model.dart';
 /// Defines the data type for each value
 enum StoreKey<T> {
   version<int>._(0),
-  assetETag<String>._(1),
   currentUser<UserDto>._(2),
-  deviceIdHash<int>._(3),
   deviceId<String>._(4),
-  backupFailedSince<DateTime>._(5),
-  backupRequireWifi<bool>._(6),
   backupRequireCharging<bool>._(7),
   backupTriggerDelay<int>._(8),
   serverUrl<String>._(10),
   accessToken<String>._(11),
   serverEndpoint<String>._(12),
-  autoBackup<bool>._(13),
-  backgroundBackup<bool>._(14),
-  sslClientCertData<String>._(15),
-  sslClientPasswd<String>._(16),
-  uploadErrorNotificationGracePeriod<int>._(106),
   selectedAlbumSortOrder<int>._(113),
   advancedTroubleshooting<bool>._(114),
-  selfSignedCert<bool>._(120),
   selectedAlbumSortReverse<bool>._(123),
   enableHapticFeedback<bool>._(126),
   customHeaders<String>._(127),
@@ -38,7 +28,6 @@ enum StoreKey<T> {
   // Read-only Mode settings
   readonlyModeEnabled<bool>._(138),
   albumGridView<bool>._(140),
-  loadOriginal<bool>._(101),
 
   // Experimental stuff
   enableBackup<bool>._(1003),

mobile/lib/infrastructure/entities/remote_asset.entity.dart

@@ -74,5 +74,6 @@ extension RemoteAssetEntityDataDomainEx on RemoteAssetEntityData {
     localId: localId,
     stackId: stackId,
     isEdited: isEdited,
+    deletedAt: deletedAt,
   );
 }

mobile/lib/presentation/widgets/action_buttons/base_action_button.widget.dart

@@ -35,10 +35,11 @@ class BaseActionButton extends ConsumerWidget {
     final miniWidth = minWidth ?? (context.isMobile ? context.width / 4.5 : 75.0);
     final iconTheme = IconTheme.of(context);
     final iconSize = iconTheme.size ?? 24.0;
-    final iconColor = this.iconColor ?? iconTheme.color ?? context.themeData.iconTheme.color;
     final textColor = context.themeData.textTheme.labelLarge?.color;
 
     if (iconOnly) {
+      final iconColor = this.iconColor ?? iconTheme.color ?? context.themeData.iconTheme.color;
+
       return IconButton(
         onPressed: onPressed,
         icon: Icon(iconData, size: iconSize, color: iconColor),
@@ -46,17 +47,18 @@ class BaseActionButton extends ConsumerWidget {
     }
 
     if (menuItem) {
-      final theme = context.themeData;
-      final effectiveIconColor = iconColor ?? theme.iconTheme.color ?? theme.colorScheme.onSurfaceVariant;
+      final iconColor = this.iconColor;
 
       return MenuItemButton(
         style: MenuItemButton.styleFrom(alignment: Alignment.centerLeft, padding: const EdgeInsets.all(16)),
-        leadingIcon: Icon(iconData, color: effectiveIconColor),
+        leadingIcon: Icon(iconData, color: iconColor),
         onPressed: onPressed,
-        child: Text(label, style: theme.textTheme.labelLarge?.copyWith(fontSize: 16, color: iconColor)),
+        child: Text(label, style: TextStyle(fontSize: 16, color: iconColor)),
       );
     }
 
+    final iconColor = this.iconColor ?? iconTheme.color ?? context.themeData.iconTheme.color;
+
     return ConstrainedBox(
       constraints: BoxConstraints(maxWidth: maxWidth),
       child: MaterialButton(

mobile/lib/presentation/widgets/action_buttons/delete_permanent_action_button.widget.dart

@@ -18,8 +18,15 @@ class DeletePermanentActionButton extends ConsumerWidget {
   final ActionSource source;
   final bool iconOnly;
   final bool menuItem;
+  final bool useShortLabel;
 
-  const DeletePermanentActionButton({super.key, required this.source, this.iconOnly = false, this.menuItem = false});
+  const DeletePermanentActionButton({
+    super.key,
+    required this.source,
+    this.iconOnly = false,
+    this.menuItem = false,
+    this.useShortLabel = false,
+  });
 
   void _onTap(BuildContext context, WidgetRef ref) async {
     if (!context.mounted) {
@@ -64,7 +71,7 @@ class DeletePermanentActionButton extends ConsumerWidget {
     return BaseActionButton(
       maxWidth: 110.0,
       iconData: Icons.delete_forever,
-      label: "delete_permanently".t(context: context),
+      label: useShortLabel ? "delete".t(context: context) : "delete_permanently".t(context: context),
       iconOnly: iconOnly,
       menuItem: menuItem,
       onPressed: () => _onTap(context, ref),

mobile/lib/presentation/widgets/action_buttons/restore_action_button.widget.dart

@@ -0,0 +1,55 @@
+import 'package:flutter/material.dart';
+import 'package:fluttertoast/fluttertoast.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+import 'package:immich_mobile/constants/enums.dart';
+import 'package:immich_mobile/domain/models/events.model.dart';
+import 'package:immich_mobile/domain/utils/event_stream.dart';
+import 'package:immich_mobile/extensions/translate_extensions.dart';
+import 'package:immich_mobile/presentation/widgets/action_buttons/base_action_button.widget.dart';
+import 'package:immich_mobile/providers/infrastructure/action.provider.dart';
+import 'package:immich_mobile/providers/timeline/multiselect.provider.dart';
+import 'package:immich_mobile/widgets/common/immich_toast.dart';
+
+class RestoreActionButton extends ConsumerWidget {
+  final ActionSource source;
+  final bool iconOnly;
+  final bool menuItem;
+
+  const RestoreActionButton({super.key, required this.source, this.iconOnly = false, this.menuItem = false});
+
+  void _onTap(BuildContext context, WidgetRef ref) async {
+    if (!context.mounted) {
+      return;
+    }
+
+    final result = await ref.read(actionProvider.notifier).restoreTrash(source);
+    ref.read(multiSelectProvider.notifier).reset();
+
+    if (source == ActionSource.viewer) {
+      EventStream.shared.emit(const ViewerReloadAssetEvent());
+    }
+
+    final successMessage = 'assets_restored_count'.t(context: context, args: {'count': result.count.toString()});
+
+    if (context.mounted) {
+      ImmichToast.show(
+        context: context,
+        msg: result.success ? successMessage : 'scaffold_body_error_occurred'.t(context: context),
+        gravity: ToastGravity.BOTTOM,
+        toastType: result.success ? ToastType.success : ToastType.error,
+      );
+    }
+  }
+
+  @override
+  Widget build(BuildContext context, WidgetRef ref) {
+    return BaseActionButton(
+      iconData: Icons.history_rounded,
+      label: 'restore'.t(context: context),
+      iconOnly: iconOnly,
+      menuItem: menuItem,
+      onPressed: () => _onTap(context, ref),
+      maxWidth: 100.0,
+    );
+  }
+}

mobile/lib/presentation/widgets/asset_viewer/bottom_bar.widget.dart

@@ -2,15 +2,19 @@ import 'package:flutter/material.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:immich_mobile/constants/enums.dart';
 import 'package:immich_mobile/domain/models/asset/base_asset.model.dart';
+import 'package:immich_mobile/domain/services/timeline.service.dart';
 import 'package:immich_mobile/extensions/build_context_extensions.dart';
 import 'package:immich_mobile/presentation/widgets/action_buttons/add_action_button.widget.dart';
 import 'package:immich_mobile/presentation/widgets/action_buttons/delete_action_button.widget.dart';
 import 'package:immich_mobile/presentation/widgets/action_buttons/delete_local_action_button.widget.dart';
+import 'package:immich_mobile/presentation/widgets/action_buttons/delete_permanent_action_button.widget.dart';
 import 'package:immich_mobile/presentation/widgets/action_buttons/edit_image_action_button.widget.dart';
+import 'package:immich_mobile/presentation/widgets/action_buttons/restore_action_button.widget.dart';
 import 'package:immich_mobile/presentation/widgets/action_buttons/share_action_button.widget.dart';
 import 'package:immich_mobile/presentation/widgets/action_buttons/upload_action_button.widget.dart';
 import 'package:immich_mobile/providers/asset_viewer/asset_viewer.provider.dart';
 import 'package:immich_mobile/providers/infrastructure/readonly_mode.provider.dart';
+import 'package:immich_mobile/providers/infrastructure/timeline.provider.dart';
 import 'package:immich_mobile/providers/routes.provider.dart';
 import 'package:immich_mobile/providers/server_info.provider.dart';
 import 'package:immich_mobile/providers/user.provider.dart';
@@ -33,23 +37,31 @@ class ViewerBottomBar extends ConsumerWidget {
     final showingDetails = ref.watch(assetViewerProvider.select((s) => s.showingDetails));
     final isInLockedView = ref.watch(inLockedViewProvider);
     final serverInfo = ref.watch(serverInfoProvider);
+    final isInTrash = ref.read(timelineServiceProvider).origin == TimelineOrigin.trash;
 
     final originalTheme = context.themeData;
 
     final actions = <Widget>[
-      const ShareActionButton(source: ActionSource.viewer),
+      if (isInTrash && isOwner && asset.hasRemote)
+        const RestoreActionButton(source: ActionSource.viewer)
+      else
+        const ShareActionButton(source: ActionSource.viewer),
 
       if (!isInLockedView) ...[
-        if (asset.isLocalOnly) const UploadActionButton(source: ActionSource.viewer),
-        // edit sync was added in 2.6.0
-        if (asset.isEditable && serverInfo.serverVersion >= const SemVer(major: 2, minor: 6, patch: 0))
-          const EditImageActionButton(),
-        if (asset.hasRemote) AddActionButton(originalTheme: originalTheme),
-
+        if (!isInTrash) ...[
+          if (asset.isLocalOnly) const UploadActionButton(source: ActionSource.viewer),
+          // edit sync was added in 2.6.0
+          if (asset.isEditable && serverInfo.serverVersion >= const SemVer(major: 2, minor: 6, patch: 0))
+            const EditImageActionButton(),
+          if (asset.hasRemote) AddActionButton(originalTheme: originalTheme),
+        ],
         if (isOwner) ...[
-          asset.isLocalOnly
-              ? const DeleteLocalActionButton(source: ActionSource.viewer)
-              : const DeleteActionButton(source: ActionSource.viewer, showConfirmation: true),
+          if (asset.isLocalOnly)
+            const DeleteLocalActionButton(source: ActionSource.viewer)
+          else if (asset.isTrashed)
+            const DeletePermanentActionButton(source: ActionSource.viewer, useShortLabel: true)
+          else
+            const DeleteActionButton(source: ActionSource.viewer, showConfirmation: true),
         ],
       ],
     ];

mobile/lib/presentation/widgets/asset_viewer/viewer_kebab_menu.widget.dart

@@ -50,7 +50,7 @@ class ViewerKebabMenu extends ConsumerWidget {
       timelineOrigin: timelineOrigin,
     );
 
-    final menuChildren = ActionButtonBuilder.buildViewerKebabMenu(actionContext, context);
+    final menuChildren = ActionButtonBuilder.buildViewerKebabMenu(actionContext, context, ref);
 
     return MenuAnchor(
       consumeOutsideTap: true,

mobile/lib/providers/auth.provider.dart

@@ -11,12 +11,11 @@ import 'package:immich_mobile/providers/api.provider.dart';
 import 'package:immich_mobile/providers/infrastructure/user.provider.dart';
 import 'package:immich_mobile/services/api.service.dart';
 import 'package:immich_mobile/services/auth.service.dart';
+import 'package:immich_mobile/services/background_upload.service.dart';
 import 'package:immich_mobile/services/foreground_upload.service.dart';
 import 'package:immich_mobile/services/secure_storage.service.dart';
-import 'package:immich_mobile/services/background_upload.service.dart';
 import 'package:immich_mobile/services/widget.service.dart';
 import 'package:immich_mobile/utils/debug_print.dart';
-import 'package:immich_mobile/utils/hash.dart';
 import 'package:logging/logging.dart';
 import 'package:openapi/api.dart';
 
@@ -144,7 +143,6 @@ class AuthNotifier extends StateNotifier<AuthState> {
         // Due to the flow of the code, this will always happen on first login
         user = serverUser;
         await Store.put(StoreKey.deviceId, deviceId);
-        await Store.put(StoreKey.deviceIdHash, fastHash(deviceId));
       }
     } on ApiException catch (error, stackTrace) {
       if (error.code == 401) {

mobile/lib/services/app_settings.service.dart

@@ -2,15 +2,9 @@ import 'package:immich_mobile/domain/models/store.model.dart';
 import 'package:immich_mobile/entities/store.entity.dart';
 
 enum AppSettingsEnum<T> {
-  uploadErrorNotificationGracePeriod<int>(
-    StoreKey.uploadErrorNotificationGracePeriod,
-    "uploadErrorNotificationGracePeriod",
-    2,
-  ),
   selectedAlbumSortOrder<int>(StoreKey.selectedAlbumSortOrder, "selectedAlbumSortOrder", 2),
   advancedTroubleshooting<bool>(StoreKey.advancedTroubleshooting, null, false),
   manageLocalMediaAndroid<bool>(StoreKey.manageLocalMediaAndroid, null, false),
-  allowSelfSignedSSLCert<bool>(StoreKey.selfSignedCert, null, false),
   selectedAlbumSortReverse<bool>(StoreKey.selectedAlbumSortReverse, null, true),
   enableHapticFeedback<bool>(StoreKey.enableHapticFeedback, null, true),
   syncAlbums<bool>(StoreKey.syncAlbums, null, false),

mobile/lib/services/auth.service.dart

@@ -123,7 +123,6 @@ class AuthService {
       _authRepository.clearLocalData(),
       Store.delete(StoreKey.currentUser),
       Store.delete(StoreKey.accessToken),
-      Store.delete(StoreKey.assetETag),
       Store.delete(StoreKey.autoEndpointSwitching),
       Store.delete(StoreKey.preferredWifiName),
       Store.delete(StoreKey.localEndpoint),

mobile/lib/utils/action_button.utils.dart

@@ -21,6 +21,7 @@ import 'package:immich_mobile/presentation/widgets/action_buttons/move_to_lock_f
 import 'package:immich_mobile/presentation/widgets/action_buttons/open_in_browser_action_button.widget.dart';
 import 'package:immich_mobile/presentation/widgets/action_buttons/remove_from_album_action_button.widget.dart';
 import 'package:immich_mobile/presentation/widgets/action_buttons/remove_from_lock_folder_action_button.widget.dart';
+import 'package:immich_mobile/presentation/widgets/action_buttons/restore_action_button.widget.dart';
 import 'package:immich_mobile/presentation/widgets/action_buttons/set_album_cover.widget.dart';
 import 'package:immich_mobile/presentation/widgets/action_buttons/set_profile_picture_action_button.widget.dart';
 import 'package:immich_mobile/presentation/widgets/action_buttons/share_action_button.widget.dart';
@@ -81,6 +82,7 @@ enum ActionButtonType {
   moveToLockFolder,
   removeFromLockFolder,
   removeFromAlbum,
+  restoreTrash,
   trash,
   deleteLocal,
   deletePermanent,
@@ -112,12 +114,17 @@ enum ActionButtonType {
         context.isOwner && //
             !context.isInLockedView && //
             context.asset.hasRemote && //
-            context.isTrashEnabled,
+            context.isTrashEnabled && //
+            context.timelineOrigin != TimelineOrigin.trash,
+      ActionButtonType.restoreTrash =>
+        context.isOwner && //
+            !context.isInLockedView && //
+            context.asset.hasRemote && //
+            context.timelineOrigin == TimelineOrigin.trash,
       ActionButtonType.deletePermanent =>
         context.isOwner && //
-                context.asset.hasRemote && //
-                !context.isTrashEnabled ||
-            context.isInLockedView,
+            context.asset.hasRemote && //
+            (!context.isTrashEnabled || context.timelineOrigin == TimelineOrigin.trash || context.isInLockedView),
       ActionButtonType.delete =>
         context.isOwner && //
             !context.isInLockedView && //
@@ -201,6 +208,11 @@ enum ActionButtonType {
       ),
       ActionButtonType.download => DownloadActionButton(source: context.source, iconOnly: iconOnly, menuItem: menuItem),
       ActionButtonType.trash => TrashActionButton(source: context.source, iconOnly: iconOnly, menuItem: menuItem),
+      ActionButtonType.restoreTrash => RestoreActionButton(
+        source: context.source,
+        iconOnly: iconOnly,
+        menuItem: menuItem,
+      ),
       ActionButtonType.deletePermanent => DeletePermanentActionButton(
         source: context.source,
         iconOnly: iconOnly,
@@ -292,6 +304,7 @@ enum ActionButtonType {
     ActionButtonType.moveToLockFolder => 10,
     ActionButtonType.deleteLocal => 10,
     ActionButtonType.delete => 10,
+    ActionButtonType.restoreTrash => 10,
     // 90: advancedInfo
     ActionButtonType.advancedInfo => 90,
     // 1: others
@@ -309,13 +322,15 @@ class ActionButtonBuilder {
     ActionButtonType.delete,
     ActionButtonType.archive,
     ActionButtonType.unarchive,
+    ActionButtonType.restoreTrash,
+    ActionButtonType.deletePermanent,
   };
 
   static List<Widget> build(ActionButtonContext context) {
     return _actionTypes.where((type) => type.shouldShow(context)).map((type) => type.buildButton(context)).toList();
   }
 
-  static List<Widget> buildViewerKebabMenu(ActionButtonContext context, BuildContext buildContext) {
+  static List<Widget> buildViewerKebabMenu(ActionButtonContext context, BuildContext buildContext, WidgetRef ref) {
     final visibleButtons = defaultViewerKebabMenuOrder
         .where((type) => !defaultViewerBottomBarButtons.contains(type) && type.shouldShow(context))
         .toList();
@@ -331,7 +346,7 @@ class ActionButtonBuilder {
       if (lastGroup != null && type.kebabMenuGroup != lastGroup) {
         result.add(const Divider(height: 1));
       }
-      result.add(type.buildButton(context, buildContext, false, true));
+      result.add(type.buildButton(context, buildContext, false, true).build(buildContext, ref));
       lastGroup = type.kebabMenuGroup;
     }
 

mobile/lib/widgets/settings/notification_setting.dart

@@ -3,10 +3,7 @@ import 'package:flutter/material.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:immich_mobile/extensions/build_context_extensions.dart';
 import 'package:immich_mobile/providers/notification_permission.provider.dart';
-import 'package:immich_mobile/services/app_settings.service.dart';
-import 'package:immich_mobile/utils/hooks/app_settings_update_hook.dart';
 import 'package:immich_mobile/widgets/settings/settings_button_list_tile.dart';
-import 'package:immich_mobile/widgets/settings/settings_slider_list_tile.dart';
 import 'package:immich_mobile/widgets/settings/settings_sub_page_scaffold.dart';
 import 'package:permission_handler/permission_handler.dart';
 
@@ -16,9 +13,6 @@ class NotificationSetting extends HookConsumerWidget {
   @override
   Widget build(BuildContext context, WidgetRef ref) {
     final permissionService = ref.watch(notificationPermissionProvider);
-
-    final sliderValue = useAppSettingsState(AppSettingsEnum.uploadErrorNotificationGracePeriod);
-
     final hasPermission = permissionService == PermissionStatus.granted;
 
     openAppNotificationSettings(BuildContext ctx) {
@@ -41,8 +35,6 @@ class NotificationSetting extends HookConsumerWidget {
       );
     }
 
-    final String formattedValue = _formatSliderValue(sliderValue.value.toDouble());
-
     final notificationSettings = [
       if (!hasPermission)
         SettingsButtonListTile(
@@ -57,32 +49,8 @@ class NotificationSetting extends HookConsumerWidget {
                 }
               }),
         ),
-      SettingsSliderListTile(
-        enabled: hasPermission,
-        valueNotifier: sliderValue,
-        text: 'setting_notifications_notify_failures_grace_period'.tr(namedArgs: {'duration': formattedValue}),
-        maxValue: 5.0,
-        noDivisons: 5,
-        label: formattedValue,
-      ),
     ];
 
     return SettingsSubPageScaffold(settings: notificationSettings);
   }
 }
-
-String _formatSliderValue(double v) {
-  if (v == 0.0) {
-    return 'setting_notifications_notify_immediately'.tr();
-  } else if (v == 1.0) {
-    return 'setting_notifications_notify_minutes'.tr(namedArgs: {'count': '30'});
-  } else if (v == 2.0) {
-    return 'setting_notifications_notify_hours'.tr(namedArgs: {'count': '2'});
-  } else if (v == 3.0) {
-    return 'setting_notifications_notify_hours'.tr(namedArgs: {'count': '8'});
-  } else if (v == 4.0) {
-    return 'setting_notifications_notify_hours'.tr(namedArgs: {'count': '24'});
-  } else {
-    return 'setting_notifications_notify_never'.tr();
-  }
-}

mobile/test/domain/services/store_service_test.dart

@@ -9,9 +9,8 @@ import 'package:mocktail/mocktail.dart';
 import '../../infrastructure/repository.mock.dart';
 
 const _kAccessToken = '#ThisIsAToken';
-const _kBackgroundBackup = false;
+const _kEnableBackup = false;
 const _kVersion = 2;
-final _kBackupFailedSince = DateTime.utc(2023);
 
 void main() {
   late StoreService sut;
@@ -24,15 +23,13 @@ void main() {
     // For generics, we need to provide fallback to each concrete type to avoid runtime errors
     registerFallbackValue(StoreKey.accessToken);
     registerFallbackValue(StoreKey.backupTriggerDelay);
-    registerFallbackValue(StoreKey.backgroundBackup);
-    registerFallbackValue(StoreKey.backupFailedSince);
+    registerFallbackValue(StoreKey.enableBackup);
 
     when(() => mockDriftStoreRepo.getAll()).thenAnswer(
       (_) async => [
         const StoreDto(StoreKey.accessToken, _kAccessToken),
-        const StoreDto(StoreKey.backgroundBackup, _kBackgroundBackup),
+        const StoreDto(StoreKey.enableBackup, _kEnableBackup),
         const StoreDto(StoreKey.version, _kVersion),
-        StoreDto(StoreKey.backupFailedSince, _kBackupFailedSince),
       ],
     );
     when(() => mockDriftStoreRepo.watchAll()).thenAnswer((_) => controller.stream);
@@ -49,9 +46,8 @@ void main() {
     test('Populates the internal cache on init', () {
       verify(() => mockDriftStoreRepo.getAll()).called(1);
       expect(sut.tryGet(StoreKey.accessToken), _kAccessToken);
-      expect(sut.tryGet(StoreKey.backgroundBackup), _kBackgroundBackup);
+      expect(sut.tryGet(StoreKey.enableBackup), _kEnableBackup);
       expect(sut.tryGet(StoreKey.version), _kVersion);
-      expect(sut.tryGet(StoreKey.backupFailedSince), _kBackupFailedSince);
       // Other keys should be null
       expect(sut.tryGet(StoreKey.currentUser), isNull);
     });
@@ -151,9 +147,8 @@ void main() {
       await sut.clear();
       verify(() => mockDriftStoreRepo.deleteAll()).called(1);
       expect(sut.tryGet(StoreKey.accessToken), isNull);
-      expect(sut.tryGet(StoreKey.backgroundBackup), isNull);
+      expect(sut.tryGet(StoreKey.enableBackup), isNull);
       expect(sut.tryGet(StoreKey.version), isNull);
-      expect(sut.tryGet(StoreKey.backupFailedSince), isNull);
     });
   });
 }

mobile/test/infrastructure/repositories/store_repository_test.dart

@@ -12,9 +12,8 @@ import 'package:immich_mobile/infrastructure/repositories/store.repository.dart'
 import '../../fixtures/user.stub.dart';
 
 const _kTestAccessToken = "#TestToken";
-final _kTestBackupFailed = DateTime(2025, 2, 20, 11, 45);
 const _kTestVersion = 10;
-const _kTestBackupRequireWifi = false;
+const _kTestBackupRequireCharging = false;
 final _kTestUser = UserStub.admin;
 
 Future<void> _populateStore(Drift db) async {
@@ -22,16 +21,8 @@ Future<void> _populateStore(Drift db) async {
     batch.insert(
       db.storeEntity,
       StoreEntityCompanion(
-        id: Value(StoreKey.backupRequireWifi.id),
-        intValue: const Value(_kTestBackupRequireWifi ? 1 : 0),
-        stringValue: const Value(null),
-      ),
-    );
-    batch.insert(
-      db.storeEntity,
-      StoreEntityCompanion(
-        id: Value(StoreKey.backupFailedSince.id),
-        intValue: Value(_kTestBackupFailed.millisecondsSinceEpoch),
+        id: Value(StoreKey.backupRequireCharging.id),
+        intValue: const Value(_kTestBackupRequireCharging ? 1 : 0),
         stringValue: const Value(null),
       ),
     );
@@ -84,20 +75,12 @@ void main() {
       expect(accessToken, _kTestAccessToken);
     });
 
-    test('converts datetime', () async {
-      DateTime? backupFailedSince = await sut.tryGet(StoreKey.backupFailedSince);
-      expect(backupFailedSince, isNull);
-      await sut.upsert(StoreKey.backupFailedSince, _kTestBackupFailed);
-      backupFailedSince = await sut.tryGet(StoreKey.backupFailedSince);
-      expect(backupFailedSince, _kTestBackupFailed);
-    });
-
     test('converts bool', () async {
-      bool? backupRequireWifi = await sut.tryGet(StoreKey.backupRequireWifi);
-      expect(backupRequireWifi, isNull);
-      await sut.upsert(StoreKey.backupRequireWifi, _kTestBackupRequireWifi);
-      backupRequireWifi = await sut.tryGet(StoreKey.backupRequireWifi);
-      expect(backupRequireWifi, _kTestBackupRequireWifi);
+      bool? backupRequireCharging = await sut.tryGet(StoreKey.backupRequireCharging);
+      expect(backupRequireCharging, isNull);
+      await sut.upsert(StoreKey.backupRequireCharging, _kTestBackupRequireCharging);
+      backupRequireCharging = await sut.tryGet(StoreKey.backupRequireCharging);
+      expect(backupRequireCharging, _kTestBackupRequireCharging);
     });
 
     test('converts user', () async {
@@ -115,11 +98,11 @@ void main() {
     });
 
     test('delete()', () async {
-      bool? backupRequireWifi = await sut.tryGet(StoreKey.backupRequireWifi);
-      expect(backupRequireWifi, isFalse);
-      await sut.delete(StoreKey.backupRequireWifi);
-      backupRequireWifi = await sut.tryGet(StoreKey.backupRequireWifi);
-      expect(backupRequireWifi, isNull);
+      bool? backupRequireCharging = await sut.tryGet(StoreKey.backupRequireCharging);
+      expect(backupRequireCharging, isFalse);
+      await sut.delete(StoreKey.backupRequireCharging);
+      backupRequireCharging = await sut.tryGet(StoreKey.backupRequireCharging);
+      expect(backupRequireCharging, isNull);
     });
 
     test('deleteAll()', () async {
@@ -164,14 +147,12 @@ void main() {
           emitsInOrder([
             [
               const StoreDto<Object>(StoreKey.version, _kTestVersion),
-              StoreDto<Object>(StoreKey.backupFailedSince, _kTestBackupFailed),
-              const StoreDto<Object>(StoreKey.backupRequireWifi, _kTestBackupRequireWifi),
+              const StoreDto<Object>(StoreKey.backupRequireCharging, _kTestBackupRequireCharging),
               const StoreDto<Object>(StoreKey.accessToken, _kTestAccessToken),
             ],
             [
               const StoreDto<Object>(StoreKey.version, _kTestVersion + 10),
-              StoreDto<Object>(StoreKey.backupFailedSince, _kTestBackupFailed),
-              const StoreDto<Object>(StoreKey.backupRequireWifi, _kTestBackupRequireWifi),
+              const StoreDto<Object>(StoreKey.backupRequireCharging, _kTestBackupRequireCharging),
               const StoreDto<Object>(StoreKey.accessToken, _kTestAccessToken),
             ],
           ]),

mobile/test/utils_legacy/action_button_utils_test.dart

@@ -3,6 +3,7 @@ import 'package:flutter_test/flutter_test.dart';
 import 'package:immich_mobile/constants/enums.dart';
 import 'package:immich_mobile/domain/models/album/album.model.dart';
 import 'package:immich_mobile/domain/models/asset/base_asset.model.dart';
+import 'package:immich_mobile/domain/services/timeline.service.dart';
 import 'package:immich_mobile/utils/action_button.utils.dart';
 
 LocalAsset createLocalAsset({
@@ -37,6 +38,7 @@ RemoteAsset createRemoteAsset({
   DateTime? updatedAt,
   DateTime? uploadedAt,
   bool isFavorite = false,
+  DateTime? deletedAt,
 }) {
   return RemoteAsset(
     id: 'remote-id',
@@ -50,6 +52,7 @@ RemoteAsset createRemoteAsset({
     uploadedAt: uploadedAt ?? DateTime.now(),
     isFavorite: isFavorite,
     isEdited: false,
+    deletedAt: deletedAt,
   );
 }
 
@@ -458,6 +461,62 @@ void main() {
 
         expect(ActionButtonType.trash.shouldShow(context), isFalse);
       });
+
+      test('should not show when asset is already trashed', () {
+        final remoteAsset = createRemoteAsset(deletedAt: DateTime(2024));
+        final context = ActionButtonContext(
+          asset: remoteAsset,
+          isOwner: true,
+          isArchived: false,
+          isTrashEnabled: true,
+          isInLockedView: false,
+          currentAlbum: null,
+          advancedTroubleshooting: false,
+          isStacked: false,
+          source: ActionSource.viewer,
+          timelineOrigin: TimelineOrigin.trash,
+        );
+
+        expect(ActionButtonType.trash.shouldShow(context), isFalse);
+      });
+    });
+
+    group('restoreTrash button', () {
+      test('should show when owner, not locked, has remote, and is in trash timeline', () {
+        final remoteAsset = createRemoteAsset();
+        final context = ActionButtonContext(
+          asset: remoteAsset,
+          isOwner: true,
+          isArchived: false,
+          isTrashEnabled: true,
+          isInLockedView: false,
+          currentAlbum: null,
+          advancedTroubleshooting: false,
+          isStacked: false,
+          source: ActionSource.timeline,
+          timelineOrigin: TimelineOrigin.trash,
+        );
+
+        expect(ActionButtonType.restoreTrash.shouldShow(context), isTrue);
+      });
+
+      test('should not show when not in trash timeline', () {
+        final remoteAsset = createRemoteAsset();
+        final context = ActionButtonContext(
+          asset: remoteAsset,
+          isOwner: true,
+          isArchived: false,
+          isTrashEnabled: false,
+          isInLockedView: false,
+          currentAlbum: null,
+          advancedTroubleshooting: false,
+          isStacked: false,
+          source: ActionSource.timeline,
+          timelineOrigin: TimelineOrigin.main,
+        );
+
+        expect(ActionButtonType.restoreTrash.shouldShow(context), isFalse);
+      });
     });
 
     group('deletePermanent button', () {
@@ -494,6 +553,24 @@ void main() {
 
         expect(ActionButtonType.deletePermanent.shouldShow(context), isFalse);
       });
+
+      test('should show when asset is trashed even with trash enabled', () {
+        final remoteAsset = createRemoteAsset(deletedAt: DateTime(2024));
+        final context = ActionButtonContext(
+          asset: remoteAsset,
+          isOwner: true,
+          isArchived: false,
+          isTrashEnabled: true,
+          isInLockedView: false,
+          currentAlbum: null,
+          advancedTroubleshooting: false,
+          isStacked: false,
+          source: ActionSource.viewer,
+          timelineOrigin: TimelineOrigin.trash,
+        );
+
+        expect(ActionButtonType.deletePermanent.shouldShow(context), isTrue);
+      });
     });
 
     group('delete button', () {

server/src/repositories/job.repository.ts

@@ -171,8 +171,8 @@ export class JobRepository {
         options: this.getJobOptions(item) || undefined,
       } as JobItem & { data: any; options: JobsOptions | undefined };
 
-      if (job.options?.jobId) {
-        // need to use add() instead of addBulk() for jobId deduplication
+      if (job.options?.jobId || job.options?.deduplication) {
+        // need to use add() instead of addBulk() for jobId/deduplication to take effect
         promises.push(this.getQueue(queueName).add(item.name, item.data, job.options));
       } else {
         itemsByQueue[queueName] = itemsByQueue[queueName] || [];
@@ -230,10 +230,13 @@ export class JobRepository {
         return { priority: 1 };
       }
       case JobName.FacialRecognitionQueueAll: {
-        return { jobId: JobName.FacialRecognitionQueueAll };
+        return { deduplication: { id: JobName.FacialRecognitionQueueAll } };
       }
       case JobName.VersionCheck: {
-        return { jobId: JobName.VersionCheck };
+        return { deduplication: { id: JobName.VersionCheck } };
+      }
+      case JobName.DatabaseBackup: {
+        return { deduplication: { id: JobName.DatabaseBackup } };
       }
       default: {
         return null;

server/src/repositories/machine-learning.repository.ts

@@ -132,7 +132,7 @@ export class MachineLearningRepository {
   private async check(url: string) {
     let healthy = false;
     try {
-      const response = await fetch(new URL('/ping', url), {
+      const response = await fetch(new URL('ping', url), {
         signal: AbortSignal.timeout(this.config.availabilityChecks.timeout),
       });
       if (response.ok) {
@@ -170,7 +170,7 @@ export class MachineLearningRepository {
       ...this.config.urls.filter((url) => !this.isHealthy(url)),
     ]) {
       try {
-        const response = await fetch(new URL('/predict', url), { method: 'POST', body: formData });
+        const response = await fetch(new URL('predict', url), { method: 'POST', body: formData });
         if (response.ok) {
           this.setHealthy(url, true);
           return response.json();

web/src/routes/(user)/explore/+page.svelte

@@ -4,15 +4,18 @@
   import OnEvents from '$lib/components/OnEvents.svelte';
   import EmptyPlaceholder from '$lib/components/shared-components/EmptyPlaceholder.svelte';
   import SingleGridRow from '$lib/components/shared-components/SingleGridRow.svelte';
+  import { assetViewerManager } from '$lib/managers/asset-viewer-manager.svelte';
   import { Route } from '$lib/route';
   import { getAssetMediaUrl, getPeopleThumbnailUrl } from '$lib/utils';
-  import { AssetMediaSize, type SearchExploreResponseDto } from '@immich/sdk';
+  import { getAssetInfo, AssetMediaSize, type SearchExploreResponseDto } from '@immich/sdk';
+  import { authManager } from '$lib/managers/auth-manager.svelte';
   import { Icon } from '@immich/ui';
   import { mdiHeart } from '@mdi/js';
   import { t } from 'svelte-i18n';
   import type { PageData } from './$types';
   import { toTimelineAsset } from '$lib/utils/timeline-util';
   import { getAltText } from '$lib/utils/thumbnail-util';
+  import Portal from '$lib/elements/Portal.svelte';
 
   interface Props {
     data: PageData;
@@ -40,6 +43,15 @@
       }
     }
   };
+
+  const onViewAsset = async (id: string) => {
+    const asset = await getAssetInfo({ ...authManager.params, id });
+    assetViewerManager.setAsset(asset);
+  };
+
+  const assetCursor = $derived({
+    current: assetViewerManager.asset!,
+  });
 </script>
 
 <OnEvents {onPersonThumbnailReady} />
@@ -122,15 +134,20 @@
           draggable="false">{$t('view_all')}</a
         >
       </div>
-      <div class="flex h-24 flex-wrap gap-x-1 overflow-hidden md:h-42">
+      <div class="flex h-24 max-w-fit flex-wrap gap-x-1 overflow-hidden md:h-42">
         {#each recents as item (item.data.id)}
-          <a class="relative h-full flex-auto" href={Route.viewAsset({ id: item.data.id })} draggable="false">
+          <button
+            type="button"
+            class="relative h-full flex-auto"
+            onclick={() => onViewAsset(item.data.id)}
+            draggable="false"
+          >
             <img
               src={getAssetMediaUrl({ id: item.data.id, size: AssetMediaSize.Thumbnail })}
               alt={$getAltText(toTimelineAsset(item.data))}
               class="size-full min-w-max rounded-xl object-cover"
             />
-          </a>
+          </button>
         {/each}
       </div>
     </div>
@@ -140,3 +157,15 @@
     <EmptyPlaceholder text={$t('no_explore_results_message')} class="mx-auto mt-10" />
   {/if}
 </UserPageLayout>
+
+{#if assetViewerManager.isViewing}
+  {#await import('$lib/components/asset-viewer/AssetViewer.svelte') then { default: AssetViewer }}
+    <Portal target="body">
+      <AssetViewer
+        cursor={assetCursor}
+        showNavigation={false}
+        onClose={() => assetViewerManager.showAssetViewer(false)}
+      />
+    </Portal>
+  {/await}
+{/if}