fix: remove from album

cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@immich/cli",
-  "version": "2.7.3",
+  "version": "2.7.2",
   "description": "Command Line Interface (CLI) for Immich",
   "type": "module",
   "exports": "./dist/index.js",

docs/static/archived-versions.json

@@ -1,7 +1,7 @@
 [
   {
-    "label": "v2.7.3",
-    "url": "https://docs.v2.7.3.archive.immich.app"
+    "label": "v2.7.2",
+    "url": "https://docs.v2.7.2.archive.immich.app"
   },
   {
     "label": "v2.6.3",

e2e/package.json

@@ -1,6 +1,6 @@
 {
   "name": "immich-e2e",
-  "version": "2.7.3",
+  "version": "2.7.2",
   "description": "",
   "main": "index.js",
   "type": "module",

i18n/package.json

@@ -1,6 +1,6 @@
 {
   "name": "immich-i18n",
-  "version": "2.7.3",
+  "version": "2.7.2",
   "private": true,
   "scripts": {
     "format": "prettier --cache --check .",

machine-learning/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "immich-ml"
-version = "2.7.3"
+version = "2.7.2"
 description = ""
 authors = [{ name = "Hau Tran", email = "alex.tran1502@gmail.com" }]
 requires-python = ">=3.11,<4.0"

machine-learning/uv.lock

@@ -898,7 +898,7 @@ wheels = [
 
 [[package]]
 name = "immich-ml"
-version = "2.7.3"
+version = "2.7.2"
 source = { editable = "." }
 dependencies = [
     { name = "aiocache" },

mobile/android/fastlane/Fastfile

@@ -35,8 +35,8 @@ platform :android do
       task: 'bundle', 
       build_type: 'Release',
       properties: {
-        "android.injected.version.code" => 3044,
-        "android.injected.version.name" => "2.7.3",
+        "android.injected.version.code" => 3043,
+        "android.injected.version.name" => "2.7.2",
       }
     )
     upload_to_play_store(skip_upload_apk: true, skip_upload_images: true, skip_upload_screenshots: true, aab: '../build/app/outputs/bundle/release/app-release.aab')

mobile/ios/Runner/Info.plist

@@ -80,7 +80,7 @@
 	<key>CFBundlePackageType</key>
 	<string>APPL</string>
 	<key>CFBundleShortVersionString</key>
-	<string>2.7.3</string>
+	<string>2.7.2</string>
 	<key>CFBundleSignature</key>
 	<string>????</string>
 	<key>CFBundleURLTypes</key>

mobile/lib/pages/backup/drift_backup.page.dart

@@ -45,17 +45,14 @@ class _DriftBackupPageState extends ConsumerState<DriftBackupPage> {
     }
 
     WidgetsBinding.instance.addPostFrameCallback((_) async {
-      final backupNotifier = ref.read(driftBackupProvider.notifier);
-      final syncManager = ref.read(backgroundSyncProvider);
+      await ref.read(driftBackupProvider.notifier).getBackupStatus(currentUser.id);
 
-      await backupNotifier.getBackupStatus(currentUser.id);
-
-      backupNotifier.updateSyncing(true);
-      syncSuccess = await syncManager.syncRemote();
-      backupNotifier.updateSyncing(false);
+      ref.read(driftBackupProvider.notifier).updateSyncing(true);
+      syncSuccess = await ref.read(backgroundSyncProvider).syncRemote();
+      ref.read(driftBackupProvider.notifier).updateSyncing(false);
 
       if (mounted) {
-        await backupNotifier.getBackupStatus(currentUser.id);
+        await ref.read(driftBackupProvider.notifier).getBackupStatus(currentUser.id);
       }
     });
   }
@@ -85,9 +82,9 @@ class _DriftBackupPageState extends ConsumerState<DriftBackupPage> {
       }
 
       if (syncSuccess == null) {
-        backupNotifier.updateSyncing(true);
+        ref.read(driftBackupProvider.notifier).updateSyncing(true);
         syncSuccess = await backupSyncManager.syncRemote();
-        backupNotifier.updateSyncing(false);
+        ref.read(driftBackupProvider.notifier).updateSyncing(false);
       }
 
       await backupNotifier.getBackupStatus(currentUser.id);

mobile/openapi/README.md

@@ -3,7 +3,7 @@ Immich API
 
 This Dart package is automatically generated by the [OpenAPI Generator](https://openapi-generator.tech) project:
 
-- API version: 2.7.3
+- API version: 2.7.2
 - Generator version: 7.8.0
 - Build package: org.openapitools.codegen.languages.DartClientCodegen
 

mobile/pubspec.yaml

@@ -2,7 +2,7 @@ name: immich_mobile
 description: Immich - selfhosted backup media file on mobile phone
 
 publish_to: 'none'
-version: 2.7.3+3044
+version: 2.7.2+3043
 
 environment:
   sdk: '>=3.8.0 <4.0.0'

open-api/immich-openapi-specs.json

@@ -15225,7 +15225,7 @@
   "info": {
     "title": "Immich",
     "description": "Immich API",
-    "version": "2.7.3",
+    "version": "2.7.2",
     "contact": {}
   },
   "tags": [

open-api/typescript-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@immich/sdk",
-  "version": "2.7.3",
+  "version": "2.7.2",
   "description": "Auto-generated TypeScript SDK for the Immich API",
   "type": "module",
   "main": "./build/index.js",

open-api/typescript-sdk/src/fetch-client.ts

@@ -1,6 +1,6 @@
 /**
  * Immich
- * 2.7.3
+ * 2.7.2
  * DO NOT MODIFY - This file has been generated using oazapfts.
  * See https://www.npmjs.com/package/oazapfts
  */

package.json

@@ -1,6 +1,6 @@
 {
   "name": "immich-monorepo",
-  "version": "2.7.3",
+  "version": "2.7.2",
   "description": "Monorepo for Immich",
   "private": true,
   "packageManager": "pnpm@10.32.1+sha512.a706938f0e89ac1456b6563eab4edf1d1faf3368d1191fc5c59790e96dc918e4456ab2e67d613de1043d2e8c81f87303e6b40d4ffeca9df15ef1ad567348f2be",

pnpm-lock.yaml

@@ -553,6 +553,9 @@ importers:
       sanitize-filename:
         specifier: ^1.6.3
         version: 1.6.4
+      sanitize-html:
+        specifier: ^2.14.0
+        version: 2.17.2
       semver:
         specifier: ^7.6.2
         version: 7.7.4
@@ -656,6 +659,9 @@ importers:
       '@types/react':
         specifier: ^19.0.0
         version: 19.2.14
+      '@types/sanitize-html':
+        specifier: ^2.13.0
+        version: 2.16.1
       '@types/semver':
         specifier: ^7.5.8
         version: 7.7.1
@@ -5161,6 +5167,9 @@ packages:
   '@types/retry@0.12.2':
     resolution: {integrity: sha512-XISRgDJ2Tc5q4TRqvgJtzsRkFYNJzZrhTdtMoGVBttwzzQJkPnS3WWTFc7kuDRoPtPakl+T+OfdEUjYJj7Jbow==}
 
+  '@types/sanitize-html@2.16.1':
+    resolution: {integrity: sha512-n9wjs8bCOTyN/ynwD8s/nTcTreIHB1vf31vhLMGqUPNHaweKC4/fAl4Dj+hUlCTKYgm4P3k83fmiFfzkZ6sgMA==}
+
   '@types/sax@1.2.7':
     resolution: {integrity: sha512-rO73L89PJxeYM3s3pPPjiPgVVcymqU490g0YO5n5By0k2Erzj6tay/4lr1CHAAU4JyOWd1rpQ8bCf6cZfHU96A==}
 
@@ -7962,6 +7971,9 @@ packages:
       webpack:
         optional: true
 
+  htmlparser2@10.1.0:
+    resolution: {integrity: sha512-VTZkM9GWRAtEpveh7MSF6SjjrpNVNNVJfFup7xTY3UpFtm67foy9HDVXneLtFVt4pMz5kZtgNcvCniNFb1hlEQ==}
+
   htmlparser2@6.1.0:
     resolution: {integrity: sha512-gyyPk6rgonLFEDGoeRgQNaEUvdJ4ktTmmUh/h2t7s+M8oPpIPxgNACWa+6ESR57kXstwqPiCut0V8NRpcwgU7A==}
 
@@ -8291,6 +8303,10 @@ packages:
     resolution: {integrity: sha512-h5PpgXkWitc38BBMYawTYMWJHFZJVnBquFE57xFpjB8pJFiF6gZ+bU+WyI/yqXiFR5mdLsgYNaPe8uao6Uv9Og==}
     engines: {node: '>=0.10.0'}
 
+  is-plain-object@5.0.0:
+    resolution: {integrity: sha512-VRSzKkbMm5jMDoKLbltAkFQ5Qr7VDiTFGXxYFXXowVj387GeGNOCsOH6Msy00SGZ3Fp84b1Naa1psqgcCIEP5Q==}
+    engines: {node: '>=0.10.0'}
+
   is-potential-custom-element-name@1.0.1:
     resolution: {integrity: sha512-bCYeRA2rVibKZd+s2625gGnGF/t7DSqDs4dP7CrLA1m7jKWz6pps0LpYLJN8Q64HtmPKJ1hrN3nzPNKFEKOUiQ==}
 
@@ -9676,6 +9692,9 @@ packages:
   parse-numeric-range@1.3.0:
     resolution: {integrity: sha512-twN+njEipszzlMJd4ONUYgSfZPDxgHhT9Ahed5uTigpQn90FggW4SA/AIPq/6a149fTbE9qBEcSwE3FAEp6wQQ==}
 
+  parse-srcset@1.0.2:
+    resolution: {integrity: sha512-/2qh0lav6CmI15FzA3i/2Bzk2zCgQhGMkvhOhKNcBVQ1ldgpbfiNTVslmooUmWJcADi1f1kIeynbDRVzNlfR6Q==}
+
   parse5-htmlparser2-tree-adapter@7.1.0:
     resolution: {integrity: sha512-ruw5xyKs6lrpo9x9rCZqZZnIUntICjQAd0Wsmp396Ul9lN/h+ifgVV1x1gZHi8euej6wTfpqX8j+BFQxF0NS/g==}
 
@@ -10873,6 +10892,9 @@ packages:
   sanitize-filename@1.6.4:
     resolution: {integrity: sha512-9ZyI08PsvdQl2r/bBIGubpVdR3RR9sY6RDiWFPreA21C/EFlQhmgo20UZlNjZMMZNubusLhAQozkA0Od5J21Eg==}
 
+  sanitize-html@2.17.2:
+    resolution: {integrity: sha512-EnffJUl46VE9uvZ0XeWzObHLurClLlT12gsOk1cHyP2Ol1P0BnBnsXmShlBmWVJM+dKieQI68R0tsPY5m/B+Jg==}
+
   sass@1.97.1:
     resolution: {integrity: sha512-uf6HoO8fy6ClsrShvMgaKUn14f2EHQLQRtpsZZLeU/Mv0Q1K5P0+x2uvH6Cub39TVVbWNSrraUhDAoFph6vh0A==}
     engines: {node: '>=14.0.0'}
@@ -17437,6 +17459,10 @@ snapshots:
 
   '@types/retry@0.12.2': {}
 
+  '@types/sanitize-html@2.16.1':
+    dependencies:
+      htmlparser2: 10.1.0
+
   '@types/sax@1.2.7':
     dependencies:
       '@types/node': 24.12.2
@@ -20839,6 +20865,13 @@ snapshots:
     optionalDependencies:
       webpack: 5.104.1
 
+  htmlparser2@10.1.0:
+    dependencies:
+      domelementtype: 2.3.0
+      domhandler: 5.0.3
+      domutils: 3.2.2
+      entities: 7.0.1
+
   htmlparser2@6.1.0:
     dependencies:
       domelementtype: 2.3.0
@@ -21167,6 +21200,8 @@ snapshots:
     dependencies:
       isobject: 3.0.1
 
+  is-plain-object@5.0.0: {}
+
   is-potential-custom-element-name@1.0.1:
     optional: true
 
@@ -22898,6 +22933,8 @@ snapshots:
 
   parse-numeric-range@1.3.0: {}
 
+  parse-srcset@1.0.2: {}
+
   parse5-htmlparser2-tree-adapter@7.1.0:
     dependencies:
       domhandler: 5.0.3
@@ -24241,6 +24278,15 @@ snapshots:
     dependencies:
       truncate-utf8-bytes: 1.0.2
 
+  sanitize-html@2.17.2:
+    dependencies:
+      deepmerge: 4.3.1
+      escape-string-regexp: 4.0.0
+      htmlparser2: 10.1.0
+      is-plain-object: 5.0.0
+      parse-srcset: 1.0.2
+      postcss: 8.5.8
+
   sass@1.97.1:
     dependencies:
       chokidar: 4.0.3

server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "immich",
-  "version": "2.7.3",
+  "version": "2.7.2",
   "description": "",
   "author": "",
   "private": true,
@@ -110,6 +110,7 @@
     "reflect-metadata": "^0.2.0",
     "rxjs": "^7.8.1",
     "sanitize-filename": "^1.6.3",
+    "sanitize-html": "^2.14.0",
     "semver": "^7.6.2",
     "sharp": "^0.34.5",
     "sirv": "^3.0.0",
@@ -146,6 +147,7 @@
     "@types/picomatch": "^4.0.0",
     "@types/pngjs": "^6.0.5",
     "@types/react": "^19.0.0",
+    "@types/sanitize-html": "^2.13.0",
     "@types/semver": "^7.5.8",
     "@types/supertest": "^7.0.0",
     "@types/ua-parser-js": "^0.7.36",

server/src/services/album.service.ts

@@ -265,13 +265,11 @@ export class AlbumService extends BaseService {
   }
 
   async removeAssets(auth: AuthDto, id: string, dto: BulkIdsDto): Promise<BulkIdResponseDto[]> {
-    await this.requireAccess({ auth, permission: Permission.AlbumAssetDelete, ids: [id] });
-
     const album = await this.findOrFail(id, { withAssets: false });
     const results = await removeAssets(
       auth,
       { access: this.accessRepository, bulk: this.albumRepository },
-      { parentId: id, assetIds: dto.ids, canAlwaysRemove: Permission.AlbumDelete },
+      { parentId: id, assetIds: dto.ids, canAlwaysRemove: Permission.AlbumUpdate },
     );
 
     const removedIds = results.filter(({ success }) => success).map(({ id }) => id);

server/src/services/api.service.spec.ts

@@ -1,36 +0,0 @@
-import { ApiService, render } from 'src/services/api.service';
-
-describe(ApiService.name, () => {
-  describe('render', () => {
-    it('should correctly render open graph tags', () => {
-      const output = render('<!-- metadata:tags -->', {
-        title: 'title',
-        description: 'description',
-        imageUrl: 'https://demo.immich.app/api/assets/123',
-      });
-      expect(output).toContain('<meta property="og:title" content="title" />');
-      expect(output).toContain('<meta property="og:description" content="description" />');
-      expect(output).toContain('<meta property="og:image" content="https://demo.immich.app/api/assets/123" />');
-    });
-
-    it('should escape html tags', () => {
-      expect(
-        render('<!-- metadata:tags -->', {
-          title: "<script>console.log('hello')</script>Test",
-          description: 'description',
-        }),
-      ).toContain(
-        '<meta property="og:title" content="&lt;script&gt;console.log(&#39;hello&#39;)&lt;/script&gt;Test" />',
-      );
-    });
-
-    it('should escape quotes', () => {
-      expect(
-        render('<!-- metadata:tags -->', {
-          title: `0;url=https://example.com" http-equiv="refresh`,
-          description: 'description',
-        }),
-      ).toContain('<meta property="og:title" content="0;url=https://example.com&quot; http-equiv=&quot;refresh" />');
-    });
-  });
-});

server/src/services/api.service.ts

@@ -1,7 +1,7 @@
 import { Injectable, NotAcceptableException } from '@nestjs/common';
 import { NextFunction, Request, Response } from 'express';
-import { escape } from 'lodash';
 import { readFileSync } from 'node:fs';
+import sanitizeHtml from 'sanitize-html';
 import { ConfigRepository } from 'src/repositories/config.repository';
 import { LoggingRepository } from 'src/repositories/logging.repository';
 import { AuthService } from 'src/services/auth.service';
@@ -10,7 +10,7 @@ import { OpenGraphTags } from 'src/utils/misc';
 
 export const render = (index: string, meta: OpenGraphTags) => {
   const [title, description, imageUrl] = [meta.title, meta.description, meta.imageUrl].map((item) =>
-    item ? escape(item) : '',
+    item ? sanitizeHtml(item, { allowedTags: [] }) : '',
   );
 
   const tags = `

server/src/utils/access.ts

@@ -223,16 +223,6 @@ const checkOtherAccess = async (access: AccessRepository, request: OtherAccessRe
       return setUnion(isOwner, isShared);
     }
 
-    case Permission.AlbumAssetDelete: {
-      const isOwner = await access.album.checkOwnerAccess(auth.user.id, ids);
-      const isShared = await access.album.checkSharedAlbumAccess(
-        auth.user.id,
-        setDifference(ids, isOwner),
-        AlbumUserRole.Editor,
-      );
-      return setUnion(isOwner, isShared);
-    }
-
     case Permission.AssetUpload: {
       return ids.has(auth.user.id) ? new Set([auth.user.id]) : new Set<string>();
     }

web/package.json

@@ -1,6 +1,6 @@
 {
   "name": "immich-web",
-  "version": "2.7.3",
+  "version": "2.7.2",
   "license": "GNU Affero General Public License version 3",
   "type": "module",
   "scripts": {

web/src/lib/components/faces-page/people-search.svelte

@@ -70,12 +70,7 @@
       reset();
       return;
     }
-    if (
-      !force &&
-      searchedPeople.length > 0 &&
-      searchedPeople.length < maximumLengthSearchPeople &&
-      searchName.startsWith(searchWord)
-    ) {
+    if (!force && searchedPeople.length < maximumLengthSearchPeople && searchName.startsWith(searchWord)) {
       search();
       return;
     }