add file sharing permission

cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@immich/cli",
-  "version": "2.7.3",
+  "version": "2.7.2",
   "description": "Command Line Interface (CLI) for Immich",
   "type": "module",
   "exports": "./dist/index.js",

docs/docs/install/requirements.md

@@ -49,7 +49,7 @@ Immich requires [**Docker**](https://docs.docker.com/get-started/get-docker/) wi
 The Compose plugin will be installed by both Docker Engine and Desktop by following the linked installation guides; it can also be [separately installed](https://docs.docker.com/compose/install/).
 
 :::note
-Immich requires the command `docker compose`; the similarly named `docker-compose` is [deprecated](https://docs.docker.com/retired/#docker-compose-v1-replaced-by-compose-v2) and is no longer supported by Immich.
+Immich requires the command `docker compose`; the similarly named `docker-compose` is [deprecated](https://docs.docker.com/compose/migrate/) and is no longer supported by Immich.
 :::
 
 ### Special requirements for Windows users

docs/static/archived-versions.json

@@ -1,7 +1,7 @@
 [
   {
-    "label": "v2.7.3",
-    "url": "https://docs.v2.7.3.archive.immich.app"
+    "label": "v2.7.2",
+    "url": "https://docs.v2.7.2.archive.immich.app"
   },
   {
     "label": "v2.6.3",

e2e/package.json

@@ -1,6 +1,6 @@
 {
   "name": "immich-e2e",
-  "version": "2.7.3",
+  "version": "2.7.2",
   "description": "",
   "main": "index.js",
   "type": "module",

i18n/package.json

@@ -1,6 +1,6 @@
 {
   "name": "immich-i18n",
-  "version": "2.7.3",
+  "version": "2.7.2",
   "private": true,
   "scripts": {
     "format": "prettier --cache --check .",

machine-learning/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "immich-ml"
-version = "2.7.3"
+version = "2.7.2"
 description = ""
 authors = [{ name = "Hau Tran", email = "alex.tran1502@gmail.com" }]
 requires-python = ">=3.11,<4.0"

machine-learning/uv.lock

@@ -898,7 +898,7 @@ wheels = [
 
 [[package]]
 name = "immich-ml"
-version = "2.7.3"
+version = "2.7.2"
 source = { editable = "." }
 dependencies = [
     { name = "aiocache" },

mobile/android/fastlane/Fastfile

@@ -35,8 +35,8 @@ platform :android do
       task: 'bundle', 
       build_type: 'Release',
       properties: {
-        "android.injected.version.code" => 3044,
-        "android.injected.version.name" => "2.7.3",
+        "android.injected.version.code" => 3043,
+        "android.injected.version.name" => "2.7.2",
       }
     )
     upload_to_play_store(skip_upload_apk: true, skip_upload_images: true, skip_upload_screenshots: true, aab: '../build/app/outputs/bundle/release/app-release.aab')

mobile/ios/Runner/Core/URLSessionManager.swift

@@ -146,7 +146,7 @@ class URLSessionManager: NSObject {
 
   private static func buildSession(delegate: URLSessionManagerDelegate) -> URLSession {
     let config = URLSessionConfiguration.default
-    config.urlCache = urlCache
+    // config.urlCache = urlCache
     config.httpCookieStorage = cookieStorage
     config.httpMaximumConnectionsPerHost = 64
     config.timeoutIntervalForRequest = 60

mobile/ios/Runner/Info.plist

@@ -80,7 +80,7 @@
 	<key>CFBundlePackageType</key>
 	<string>APPL</string>
 	<key>CFBundleShortVersionString</key>
-	<string>2.7.3</string>
+	<string>2.7.2</string>
 	<key>CFBundleSignature</key>
 	<string>????</string>
 	<key>CFBundleURLTypes</key>
@@ -119,7 +119,9 @@
 	<key>LSRequiresIPhoneOS</key>
 	<true/>
 	<key>LSSupportsOpeningDocumentsInPlace</key>
-	<string>No</string>
+	<true/>                                                                                                                            
+    <key>UIFileSharingEnabled</key>                                                                                                    
+    <true/>
 	<key>MGLMapboxMetricsEnabledSettingShownInApp</key>
 	<true/>
 	<key>NSAppTransportSecurity</key>

mobile/lib/pages/backup/drift_backup.page.dart

@@ -45,17 +45,14 @@ class _DriftBackupPageState extends ConsumerState<DriftBackupPage> {
     }
 
     WidgetsBinding.instance.addPostFrameCallback((_) async {
-      final backupNotifier = ref.read(driftBackupProvider.notifier);
-      final syncManager = ref.read(backgroundSyncProvider);
+      await ref.read(driftBackupProvider.notifier).getBackupStatus(currentUser.id);
 
-      await backupNotifier.getBackupStatus(currentUser.id);
-
-      backupNotifier.updateSyncing(true);
-      syncSuccess = await syncManager.syncRemote();
-      backupNotifier.updateSyncing(false);
+      ref.read(driftBackupProvider.notifier).updateSyncing(true);
+      syncSuccess = await ref.read(backgroundSyncProvider).syncRemote();
+      ref.read(driftBackupProvider.notifier).updateSyncing(false);
 
       if (mounted) {
-        await backupNotifier.getBackupStatus(currentUser.id);
+        await ref.read(driftBackupProvider.notifier).getBackupStatus(currentUser.id);
       }
     });
   }
@@ -85,9 +82,9 @@ class _DriftBackupPageState extends ConsumerState<DriftBackupPage> {
       }
 
       if (syncSuccess == null) {
-        backupNotifier.updateSyncing(true);
+        ref.read(driftBackupProvider.notifier).updateSyncing(true);
         syncSuccess = await backupSyncManager.syncRemote();
-        backupNotifier.updateSyncing(false);
+        ref.read(driftBackupProvider.notifier).updateSyncing(false);
       }
 
       await backupNotifier.getBackupStatus(currentUser.id);

mobile/lib/presentation/widgets/asset_viewer/asset_viewer.page.dart

@@ -147,7 +147,7 @@ class _AssetViewerState extends ConsumerState<AssetViewer> {
   }
 
   void _onAssetInit(Duration timeStamp) {
-    _preloader.preload(widget.initialIndex, context.sizeData);
+    // _preloader.preload(widget.initialIndex, context.sizeData);
     _handleCasting();
   }
 
@@ -158,7 +158,7 @@ class _AssetViewerState extends ConsumerState<AssetViewer> {
     if (asset == null) return;
 
     AssetViewer._setAsset(ref, asset);
-    _preloader.preload(index, context.sizeData);
+    // _preloader.preload(index, context.sizeData);
     _handleCasting();
     _stackChildrenKeepAlive?.close();
     _stackChildrenKeepAlive = ref.read(stackChildrenNotifier(asset).notifier).ref.keepAlive();

mobile/lib/presentation/widgets/images/thumbnail.widget.dart

@@ -8,11 +8,16 @@ import 'package:immich_mobile/presentation/widgets/images/image_provider.dart';
 import 'package:immich_mobile/presentation/widgets/images/remote_image_provider.dart';
 import 'package:immich_mobile/presentation/widgets/images/thumb_hash_provider.dart';
 import 'package:immich_mobile/presentation/widgets/timeline/constants.dart';
+import 'package:immich_mobile/utils/image_load_histogram.dart';
 import 'package:logging/logging.dart';
 
 final log = Logger('ThumbnailWidget');
 
-enum ThumbhashMode { enabled, disabled, only }
+enum ImageType { thumbnail }
+
+final remoteImageHistogram = Histogram<ImageType>(maxSamples: 8192, values: ImageType.values);
+
+int thumbnailId = 0;
 
 class Thumbnail extends StatefulWidget {
   final ImageProvider? imageProvider;
@@ -111,8 +116,11 @@ class _ThumbnailState extends State<Thumbnail> with SingleTickerProviderStateMix
     if (imageProvider == null) return;
 
     final imageStream = _imageStream = imageProvider.resolve(ImageConfiguration.empty);
+    final stopwatch = Stopwatch();
+    final curThumbnailId = thumbnailId++;
     final imageStreamListener = _imageStreamListener = ImageStreamListener(
       (ImageInfo imageInfo, bool synchronousCall) {
+        stopwatch.stop();
         _stopListeningToThumbhashStream();
         if (!mounted) {
           imageInfo.dispose();
@@ -123,7 +131,27 @@ class _ThumbnailState extends State<Thumbnail> with SingleTickerProviderStateMix
           return;
         }
 
-        if ((synchronousCall && _providerImage == null) || !_isVisible()) {
+        final renderObject = context.findRenderObject() as RenderBox?;
+        final double topLeft;
+        final double bottomRight;
+        final double contextHeight = context.height;
+        if (renderObject == null || !renderObject.attached) {
+          topLeft = double.maxFinite;
+          bottomRight = double.maxFinite;
+        } else {
+          topLeft = renderObject.localToGlobal(Offset.zero).dy;
+          bottomRight = renderObject.localToGlobal(Offset(renderObject.size.width, renderObject.size.height)).dy;
+        }
+        remoteImageHistogram.record(
+          ImageType.thumbnail,
+          stopwatch.elapsedMicroseconds,
+          topLeft.toInt(),
+          bottomRight.toInt(),
+          contextHeight.toInt(),
+          curThumbnailId,
+        );
+
+        if ((synchronousCall && _providerImage == null) || !(topLeft < contextHeight && bottomRight > 0)) {
           _fadeController.value = 1.0;
         } else if (_fadeController.isAnimating) {
           _fadeController.forward();
@@ -146,6 +174,7 @@ class _ThumbnailState extends State<Thumbnail> with SingleTickerProviderStateMix
         _stopListeningToImageStream();
       },
     );
+    stopwatch.start();
     imageStream.addListener(imageStreamListener);
   }
 

mobile/lib/presentation/widgets/timeline/timeline.widget.dart

@@ -7,6 +7,7 @@ import 'package:flutter/foundation.dart';
 import 'package:flutter/gestures.dart';
 import 'package:flutter/material.dart';
 import 'package:flutter/rendering.dart';
+import 'package:flutter/scheduler.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:immich_mobile/domain/models/asset/base_asset.model.dart';
 import 'package:immich_mobile/domain/models/events.model.dart';
@@ -17,6 +18,7 @@ import 'package:immich_mobile/extensions/asyncvalue_extensions.dart';
 import 'package:immich_mobile/extensions/build_context_extensions.dart';
 import 'package:immich_mobile/presentation/widgets/action_buttons/download_status_floating_button.widget.dart';
 import 'package:immich_mobile/presentation/widgets/bottom_sheet/general_bottom_sheet.widget.dart';
+import 'package:immich_mobile/presentation/widgets/images/thumbnail.widget.dart';
 import 'package:immich_mobile/presentation/widgets/timeline/constants.dart';
 import 'package:immich_mobile/presentation/widgets/timeline/scrubber.widget.dart';
 import 'package:immich_mobile/presentation/widgets/timeline/segment.model.dart';
@@ -140,10 +142,14 @@ class _SliverTimeline extends ConsumerStatefulWidget {
   ConsumerState createState() => _SliverTimelineState();
 }
 
-class _SliverTimelineState extends ConsumerState<_SliverTimeline> {
+class _SliverTimelineState extends ConsumerState<_SliverTimeline> with SingleTickerProviderStateMixin {
   late final ScrollController _scrollController;
   StreamSubscription? _eventSubscription;
 
+  Ticker? _autoScrollTicker;
+  Duration _lastTickTime = Duration.zero;
+  static const _autoScrollVelocity = 4800.0; // pixels per second
+
   // Drag selection state
   bool _dragging = false;
   TimelineAssetIndex? _dragAnchorIndex;
@@ -246,11 +252,52 @@ class _SliverTimelineState extends ConsumerState<_SliverTimeline> {
 
   @override
   void dispose() {
+    _stopAutoScroll();
     _scrollController.dispose();
     _eventSubscription?.cancel();
     super.dispose();
   }
 
+  void _toggleAutoScroll() {
+    if (_autoScrollTicker?.isActive ?? false) {
+      _stopAutoScroll();
+    } else {
+      _startAutoScroll();
+    }
+  }
+
+  void _startAutoScroll() {
+    _lastTickTime = Duration.zero;
+    _autoScrollTicker = createTicker(_onAutoScrollTick)..start();
+  }
+
+  void _stopAutoScroll() {
+    _autoScrollTicker?.stop();
+    _autoScrollTicker?.dispose();
+    _autoScrollTicker = null;
+  }
+
+  void _onAutoScrollTick(Duration elapsed) {
+    if (_lastTickTime == Duration.zero) {
+      _lastTickTime = elapsed;
+      return;
+    }
+
+    final deltaSeconds = (elapsed - _lastTickTime).inMicroseconds / 1000000.0;
+    _lastTickTime = elapsed;
+
+    final newOffset = _scrollController.offset + (_autoScrollVelocity * deltaSeconds);
+    final maxOffset = _scrollController.position.maxScrollExtent;
+    if (newOffset >= maxOffset || remoteImageHistogram.count(ImageType.thumbnail) >= remoteImageHistogram.maxSamples) {
+      _scrollController.jumpTo(newOffset.clamp(0, maxOffset));
+      _stopAutoScroll();
+      remoteImageHistogram.logAll();
+      remoteImageHistogram.save();
+    } else {
+      _scrollController.jumpTo(newOffset);
+    }
+  }
+
   void _scrollToDate(DateTime date) {
     final asyncSegments = ref.read(timelineSegmentProvider);
     asyncSegments.whenData((segments) {
@@ -434,6 +481,16 @@ class _SliverTimelineState extends ConsumerState<_SliverTimeline> {
             controller: _scrollController,
             child: RawGestureDetector(
               gestures: {
+                SerialTapGestureRecognizer: GestureRecognizerFactoryWithHandlers<SerialTapGestureRecognizer>(
+                  () => SerialTapGestureRecognizer(),
+                  (SerialTapGestureRecognizer tap) {
+                    tap.onSerialTapDown = (details) {
+                      if (details.count == 3) {
+                        _toggleAutoScroll();
+                      }
+                    };
+                  },
+                ),
                 CustomScaleGestureRecognizer: GestureRecognizerFactoryWithHandlers<CustomScaleGestureRecognizer>(
                   () => CustomScaleGestureRecognizer(),
                   (CustomScaleGestureRecognizer scale) {

mobile/lib/utils/image_load_histogram.dart

@@ -0,0 +1,154 @@
+import 'dart:convert';
+import 'dart:io';
+import 'dart:math';
+import 'dart:typed_data';
+
+import 'package:logging/logging.dart';
+import 'package:path_provider/path_provider.dart';
+import 'package:share_plus/share_plus.dart';
+
+/// Ring buffer histogram for performance profiling.
+class Histogram<T extends Enum> {
+  final int _stride;
+  final int _strideMask;
+  final List<T> _values;
+  final Int64List _counts;
+  final Int64List _data;
+  final Stopwatch _clock;
+  static final _log = Logger('Histogram');
+
+  Histogram({required int maxSamples, required List<T> values})
+    : assert(maxSamples & (maxSamples - 1) == 0, 'maxSamples must be power of 2'),
+      _stride = maxSamples,
+      _strideMask = maxSamples - 1,
+      _values = values,
+      _counts = Int64List(values.length),
+      _data = Int64List(maxSamples * values.length * 6),
+      _clock = Stopwatch()..start();
+
+  @pragma("vm:prefer-inline")
+  @pragma("vm:unsafe:no-bounds-checks")
+  void record(T type, int microseconds, int topLeft, int bottomRight, int contextHeight, int id) {
+    final i = type.index;
+    final count = _counts[i];
+    final slot = count & _strideMask;
+
+    final offset = (i * _stride + slot) * 6;
+    _data[offset] = microseconds;
+    _data[offset + 1] = _clock.elapsedMicroseconds;
+    _data[offset + 2] = topLeft;
+    _data[offset + 3] = bottomRight;
+    _data[offset + 4] = contextHeight;
+    _data[offset + 5] = id;
+    _counts[i] = count + 1;
+  }
+
+  int count(T type) => _counts[type.index].clamp(0, _stride);
+
+  int get maxSamples => _stride;
+
+  @pragma("vm:unsafe:no-bounds-checks")
+  void log(T type) {
+    final index = type.index;
+    final total = _counts[index];
+    final count = min(total, _stride);
+    if (count == 0) return;
+
+    final baseOffset = index * _stride * 6;
+    final scratch = Int64List(count);
+
+    for (int i = 0; i < count; i++) {
+      scratch[i] = _data[baseOffset + i * 6];
+    }
+    scratch.sort();
+
+    int sum = 0;
+    for (int i = 0; i < count; i++) {
+      sum += scratch[i];
+    }
+
+    _log.info(
+      '${type.name} (n=$total, sampled=$count) - '
+      'Avg: ${(sum / count / 1000.0).toStringAsFixed(2)}ms, '
+      'Min: ${(scratch[0] / 1000.0).toStringAsFixed(2)}ms, '
+      'Max: ${(scratch[count - 1] / 1000.0).toStringAsFixed(2)}ms, '
+      'P25: ${(_percentile(scratch, count, 0.25) / 1000.0).toStringAsFixed(2)}ms, '
+      'P50: ${(_percentile(scratch, count, 0.50) / 1000.0).toStringAsFixed(2)}ms, '
+      'P75: ${(_percentile(scratch, count, 0.75) / 1000.0).toStringAsFixed(2)}ms, '
+      'P90: ${(_percentile(scratch, count, 0.90) / 1000.0).toStringAsFixed(2)}ms, '
+      'P95: ${(_percentile(scratch, count, 0.95) / 1000.0).toStringAsFixed(2)}ms, '
+      'P99: ${(_percentile(scratch, count, 0.99) / 1000.0).toStringAsFixed(2)}ms',
+    );
+  }
+
+  void logAll() {
+    for (final value in _values) {
+      log(value);
+    }
+  }
+
+  @pragma("vm:unsafe:no-bounds-checks")
+  (Int64List, Int64List, Int64List, Int64List, Int64List, Int64List) getSamples(T type) {
+    final index = type.index;
+    final count = min(_counts[index], _stride);
+    final samples = Int64List(count);
+    final timestamps = Int64List(count);
+    final topLeft = Int64List(count);
+    final bottomRight = Int64List(count);
+    final contextHeight = Int64List(count);
+    final id = Int64List(count);
+
+    final baseOffset = index * _stride * 6;
+    for (int i = 0; i < count; i++) {
+      samples[i] = _data[baseOffset + i * 6];
+      timestamps[i] = _data[baseOffset + i * 6 + 1];
+      topLeft[i] = _data[baseOffset + i * 6 + 2];
+      bottomRight[i] = _data[baseOffset + i * 6 + 3];
+      contextHeight[i] = _data[baseOffset + i * 6 + 4];
+      id[i] = _data[baseOffset + i * 6 + 5];
+    }
+    return (samples, timestamps, topLeft, bottomRight, contextHeight, id);
+  }
+
+  @pragma("vm:unsafe:no-bounds-checks")
+  Future<File> save({bool share = true}) async {
+    final dir = await getApplicationDocumentsDirectory();
+    final timestamp = DateTime.now().toIso8601String().replaceAll(':', '-');
+    final file = File('${dir.path}/samples_$timestamp.json');
+
+    final data = {};
+    for (int i = 0; i < _counts.length; i++) {
+      final name = _values[i].name;
+      final (samples, timestamps, topLeft, bottomRight, contextHeight, id) = getSamples(_values[i]);
+      data['${name}_us'] = samples;
+      data['${name}_ts'] = timestamps;
+      data['${name}_top_left'] = topLeft;
+      data['${name}_bottom_right'] = bottomRight;
+      data['${name}_context_height'] = contextHeight;
+      data['${name}_id'] = id;
+    }
+    data['timestamp'] = DateTime.now().toIso8601String();
+    await file.writeAsString(jsonEncode(data));
+    _log.info('Saved samples to ${file.path}');
+
+    if (share) {
+      await Share.shareXFiles([XFile(file.path)]);
+    }
+
+    return file;
+  }
+
+  void reset(T type) {
+    _counts[type.index] = 0;
+  }
+
+  void resetAll() {
+    _counts.fillRange(0, _counts.length, 0);
+  }
+
+  @pragma("vm:prefer-inline")
+  int _percentile(Int64List sorted, int count, double p) {
+    final idx = ((count - 1) * p).round();
+    return sorted[idx];
+  }
+}

mobile/openapi/README.md

@@ -3,7 +3,7 @@ Immich API
 
 This Dart package is automatically generated by the [OpenAPI Generator](https://openapi-generator.tech) project:
 
-- API version: 2.7.3
+- API version: 2.7.2
 - Generator version: 7.8.0
 - Build package: org.openapitools.codegen.languages.DartClientCodegen
 

mobile/pubspec.yaml

@@ -2,7 +2,7 @@ name: immich_mobile
 description: Immich - selfhosted backup media file on mobile phone
 
 publish_to: 'none'
-version: 2.7.3+3044
+version: 2.7.2+3043
 
 environment:
   sdk: '>=3.8.0 <4.0.0'

open-api/immich-openapi-specs.json

@@ -15225,7 +15225,7 @@
   "info": {
     "title": "Immich",
     "description": "Immich API",
-    "version": "2.7.3",
+    "version": "2.7.2",
     "contact": {}
   },
   "tags": [

open-api/typescript-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@immich/sdk",
-  "version": "2.7.3",
+  "version": "2.7.2",
   "description": "Auto-generated TypeScript SDK for the Immich API",
   "type": "module",
   "main": "./build/index.js",

open-api/typescript-sdk/src/fetch-client.ts

@@ -1,6 +1,6 @@
 /**
  * Immich
- * 2.7.3
+ * 2.7.2
  * DO NOT MODIFY - This file has been generated using oazapfts.
  * See https://www.npmjs.com/package/oazapfts
  */

package.json

@@ -1,6 +1,6 @@
 {
   "name": "immich-monorepo",
-  "version": "2.7.3",
+  "version": "2.7.2",
   "description": "Monorepo for Immich",
   "private": true,
   "packageManager": "pnpm@10.32.1+sha512.a706938f0e89ac1456b6563eab4edf1d1faf3368d1191fc5c59790e96dc918e4456ab2e67d613de1043d2e8c81f87303e6b40d4ffeca9df15ef1ad567348f2be",

pnpm-lock.yaml

@@ -553,6 +553,9 @@ importers:
       sanitize-filename:
         specifier: ^1.6.3
         version: 1.6.4
+      sanitize-html:
+        specifier: ^2.14.0
+        version: 2.17.2
       semver:
         specifier: ^7.6.2
         version: 7.7.4
@@ -656,6 +659,9 @@ importers:
       '@types/react':
         specifier: ^19.0.0
         version: 19.2.14
+      '@types/sanitize-html':
+        specifier: ^2.13.0
+        version: 2.16.1
       '@types/semver':
         specifier: ^7.5.8
         version: 7.7.1
@@ -5161,6 +5167,9 @@ packages:
   '@types/retry@0.12.2':
     resolution: {integrity: sha512-XISRgDJ2Tc5q4TRqvgJtzsRkFYNJzZrhTdtMoGVBttwzzQJkPnS3WWTFc7kuDRoPtPakl+T+OfdEUjYJj7Jbow==}
 
+  '@types/sanitize-html@2.16.1':
+    resolution: {integrity: sha512-n9wjs8bCOTyN/ynwD8s/nTcTreIHB1vf31vhLMGqUPNHaweKC4/fAl4Dj+hUlCTKYgm4P3k83fmiFfzkZ6sgMA==}
+
   '@types/sax@1.2.7':
     resolution: {integrity: sha512-rO73L89PJxeYM3s3pPPjiPgVVcymqU490g0YO5n5By0k2Erzj6tay/4lr1CHAAU4JyOWd1rpQ8bCf6cZfHU96A==}
 
@@ -7962,6 +7971,9 @@ packages:
       webpack:
         optional: true
 
+  htmlparser2@10.1.0:
+    resolution: {integrity: sha512-VTZkM9GWRAtEpveh7MSF6SjjrpNVNNVJfFup7xTY3UpFtm67foy9HDVXneLtFVt4pMz5kZtgNcvCniNFb1hlEQ==}
+
   htmlparser2@6.1.0:
     resolution: {integrity: sha512-gyyPk6rgonLFEDGoeRgQNaEUvdJ4ktTmmUh/h2t7s+M8oPpIPxgNACWa+6ESR57kXstwqPiCut0V8NRpcwgU7A==}
 
@@ -8291,6 +8303,10 @@ packages:
     resolution: {integrity: sha512-h5PpgXkWitc38BBMYawTYMWJHFZJVnBquFE57xFpjB8pJFiF6gZ+bU+WyI/yqXiFR5mdLsgYNaPe8uao6Uv9Og==}
     engines: {node: '>=0.10.0'}
 
+  is-plain-object@5.0.0:
+    resolution: {integrity: sha512-VRSzKkbMm5jMDoKLbltAkFQ5Qr7VDiTFGXxYFXXowVj387GeGNOCsOH6Msy00SGZ3Fp84b1Naa1psqgcCIEP5Q==}
+    engines: {node: '>=0.10.0'}
+
   is-potential-custom-element-name@1.0.1:
     resolution: {integrity: sha512-bCYeRA2rVibKZd+s2625gGnGF/t7DSqDs4dP7CrLA1m7jKWz6pps0LpYLJN8Q64HtmPKJ1hrN3nzPNKFEKOUiQ==}
 
@@ -9676,6 +9692,9 @@ packages:
   parse-numeric-range@1.3.0:
     resolution: {integrity: sha512-twN+njEipszzlMJd4ONUYgSfZPDxgHhT9Ahed5uTigpQn90FggW4SA/AIPq/6a149fTbE9qBEcSwE3FAEp6wQQ==}
 
+  parse-srcset@1.0.2:
+    resolution: {integrity: sha512-/2qh0lav6CmI15FzA3i/2Bzk2zCgQhGMkvhOhKNcBVQ1ldgpbfiNTVslmooUmWJcADi1f1kIeynbDRVzNlfR6Q==}
+
   parse5-htmlparser2-tree-adapter@7.1.0:
     resolution: {integrity: sha512-ruw5xyKs6lrpo9x9rCZqZZnIUntICjQAd0Wsmp396Ul9lN/h+ifgVV1x1gZHi8euej6wTfpqX8j+BFQxF0NS/g==}
 
@@ -10873,6 +10892,9 @@ packages:
   sanitize-filename@1.6.4:
     resolution: {integrity: sha512-9ZyI08PsvdQl2r/bBIGubpVdR3RR9sY6RDiWFPreA21C/EFlQhmgo20UZlNjZMMZNubusLhAQozkA0Od5J21Eg==}
 
+  sanitize-html@2.17.2:
+    resolution: {integrity: sha512-EnffJUl46VE9uvZ0XeWzObHLurClLlT12gsOk1cHyP2Ol1P0BnBnsXmShlBmWVJM+dKieQI68R0tsPY5m/B+Jg==}
+
   sass@1.97.1:
     resolution: {integrity: sha512-uf6HoO8fy6ClsrShvMgaKUn14f2EHQLQRtpsZZLeU/Mv0Q1K5P0+x2uvH6Cub39TVVbWNSrraUhDAoFph6vh0A==}
     engines: {node: '>=14.0.0'}
@@ -17437,6 +17459,10 @@ snapshots:
 
   '@types/retry@0.12.2': {}
 
+  '@types/sanitize-html@2.16.1':
+    dependencies:
+      htmlparser2: 10.1.0
+
   '@types/sax@1.2.7':
     dependencies:
       '@types/node': 24.12.2
@@ -20839,6 +20865,13 @@ snapshots:
     optionalDependencies:
       webpack: 5.104.1
 
+  htmlparser2@10.1.0:
+    dependencies:
+      domelementtype: 2.3.0
+      domhandler: 5.0.3
+      domutils: 3.2.2
+      entities: 7.0.1
+
   htmlparser2@6.1.0:
     dependencies:
       domelementtype: 2.3.0
@@ -21167,6 +21200,8 @@ snapshots:
     dependencies:
       isobject: 3.0.1
 
+  is-plain-object@5.0.0: {}
+
   is-potential-custom-element-name@1.0.1:
     optional: true
 
@@ -22898,6 +22933,8 @@ snapshots:
 
   parse-numeric-range@1.3.0: {}
 
+  parse-srcset@1.0.2: {}
+
   parse5-htmlparser2-tree-adapter@7.1.0:
     dependencies:
       domhandler: 5.0.3
@@ -24241,6 +24278,15 @@ snapshots:
     dependencies:
       truncate-utf8-bytes: 1.0.2
 
+  sanitize-html@2.17.2:
+    dependencies:
+      deepmerge: 4.3.1
+      escape-string-regexp: 4.0.0
+      htmlparser2: 10.1.0
+      is-plain-object: 5.0.0
+      parse-srcset: 1.0.2
+      postcss: 8.5.8
+
   sass@1.97.1:
     dependencies:
       chokidar: 4.0.3

server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "immich",
-  "version": "2.7.3",
+  "version": "2.7.2",
   "description": "",
   "author": "",
   "private": true,
@@ -110,6 +110,7 @@
     "reflect-metadata": "^0.2.0",
     "rxjs": "^7.8.1",
     "sanitize-filename": "^1.6.3",
+    "sanitize-html": "^2.14.0",
     "semver": "^7.6.2",
     "sharp": "^0.34.5",
     "sirv": "^3.0.0",
@@ -146,6 +147,7 @@
     "@types/picomatch": "^4.0.0",
     "@types/pngjs": "^6.0.5",
     "@types/react": "^19.0.0",
+    "@types/sanitize-html": "^2.13.0",
     "@types/semver": "^7.5.8",
     "@types/supertest": "^7.0.0",
     "@types/ua-parser-js": "^0.7.36",

server/src/queries/person.repository.sql

@@ -195,19 +195,13 @@ where
   "asset_face"."id" = $2
 
 -- PersonRepository.getByName
-with
-  "similarity_threshold" as (
-    select
-      set_config('pg_trgm.word_similarity_threshold', '0.5', true) as "thresh"
-  )
 select
   "person".*
 from
-  "similarity_threshold",
   "person"
 where
   "person"."ownerId" = $1
-  and f_unaccent ("person"."name") %> f_unaccent ($2)
+  and f_unaccent ("person"."name") %>> f_unaccent ($2)
 order by
   f_unaccent ("person"."name") <->>> f_unaccent ($3)
 limit

server/src/repositories/person.repository.ts

@@ -310,13 +310,10 @@ export class PersonRepository {
   @GenerateSql({ params: [DummyValue.UUID, DummyValue.STRING, { withHidden: true }] })
   getByName(userId: string, personName: string, { withHidden }: PersonNameSearchOptions) {
     return this.db
-      .with('similarity_threshold', (db) =>
-        db.selectNoFrom(sql`set_config('pg_trgm.word_similarity_threshold', '0.5', true)`.as('thresh')),
-      )
-      .selectFrom(['similarity_threshold', 'person'])
+      .selectFrom('person')
       .selectAll('person')
       .where('person.ownerId', '=', userId)
-      .where(() => sql`f_unaccent("person"."name") %> f_unaccent(${personName})`)
+      .where(() => sql`f_unaccent("person"."name") %>> f_unaccent(${personName})`)
       .orderBy(sql`f_unaccent("person"."name") <->>> f_unaccent(${personName})`)
       .limit(100)
       .$if(!withHidden, (qb) => qb.where('person.isHidden', '=', false))

server/src/services/api.service.spec.ts

@@ -1,36 +0,0 @@
-import { ApiService, render } from 'src/services/api.service';
-
-describe(ApiService.name, () => {
-  describe('render', () => {
-    it('should correctly render open graph tags', () => {
-      const output = render('<!-- metadata:tags -->', {
-        title: 'title',
-        description: 'description',
-        imageUrl: 'https://demo.immich.app/api/assets/123',
-      });
-      expect(output).toContain('<meta property="og:title" content="title" />');
-      expect(output).toContain('<meta property="og:description" content="description" />');
-      expect(output).toContain('<meta property="og:image" content="https://demo.immich.app/api/assets/123" />');
-    });
-
-    it('should escape html tags', () => {
-      expect(
-        render('<!-- metadata:tags -->', {
-          title: "<script>console.log('hello')</script>Test",
-          description: 'description',
-        }),
-      ).toContain(
-        '<meta property="og:title" content="&lt;script&gt;console.log(&#39;hello&#39;)&lt;/script&gt;Test" />',
-      );
-    });
-
-    it('should escape quotes', () => {
-      expect(
-        render('<!-- metadata:tags -->', {
-          title: `0;url=https://example.com" http-equiv="refresh`,
-          description: 'description',
-        }),
-      ).toContain('<meta property="og:title" content="0;url=https://example.com&quot; http-equiv=&quot;refresh" />');
-    });
-  });
-});

server/src/services/api.service.ts

@@ -1,7 +1,7 @@
 import { Injectable, NotAcceptableException } from '@nestjs/common';
 import { NextFunction, Request, Response } from 'express';
-import { escape } from 'lodash';
 import { readFileSync } from 'node:fs';
+import sanitizeHtml from 'sanitize-html';
 import { ConfigRepository } from 'src/repositories/config.repository';
 import { LoggingRepository } from 'src/repositories/logging.repository';
 import { AuthService } from 'src/services/auth.service';
@@ -10,7 +10,7 @@ import { OpenGraphTags } from 'src/utils/misc';
 
 export const render = (index: string, meta: OpenGraphTags) => {
   const [title, description, imageUrl] = [meta.title, meta.description, meta.imageUrl].map((item) =>
-    item ? escape(item) : '',
+    item ? sanitizeHtml(item, { allowedTags: [] }) : '',
   );
 
   const tags = `

web/package.json

@@ -1,6 +1,6 @@
 {
   "name": "immich-web",
-  "version": "2.7.3",
+  "version": "2.7.2",
   "license": "GNU Affero General Public License version 3",
   "type": "module",
   "scripts": {

web/src/lib/components/faces-page/people-search.svelte

@@ -70,12 +70,7 @@
       reset();
       return;
     }
-    if (
-      !force &&
-      searchedPeople.length > 0 &&
-      searchedPeople.length < maximumLengthSearchPeople &&
-      searchName.startsWith(searchWord)
-    ) {
+    if (!force && searchedPeople.length < maximumLengthSearchPeople && searchName.startsWith(searchWord)) {
       search();
       return;
     }