feat: inline storage columns in remote and local tables

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

.devcontainer/.gitignore

@@ -1,2 +0,0 @@
-.env
-library

.devcontainer/Dockerfile

@@ -1,16 +0,0 @@
-ARG BASEIMAGE=mcr.microsoft.com/devcontainers/typescript-node:22@sha256:2ef23730ec68d8511ec8e6e0b82550ca728b256805d81f60ed890f3bfb21cfb9
-FROM ${BASEIMAGE}
-
-# Flutter SDK
-# https://flutter.dev/docs/development/tools/sdk/releases?tab=linux
-ENV FLUTTER_CHANNEL="stable"
-ENV FLUTTER_VERSION="3.29.1"
-ENV FLUTTER_HOME=/flutter
-ENV PATH=${PATH}:${FLUTTER_HOME}/bin
-
-# Flutter SDK
-RUN mkdir -p ${FLUTTER_HOME} \
-  && curl -C - --output flutter.tar.xz https://storage.googleapis.com/flutter_infra_release/releases/${FLUTTER_CHANNEL}/linux/flutter_linux_${FLUTTER_VERSION}-${FLUTTER_CHANNEL}.tar.xz \
-  && tar -xf flutter.tar.xz --strip-components=1 -C ${FLUTTER_HOME} \
-  && rm flutter.tar.xz \
-  && chown -R 1000:1000 ${FLUTTER_HOME}

.devcontainer/devcontainer.json

@@ -1,26 +1,67 @@
 {
-  "name": "Immich",
-  "service": "immich-devcontainer",
+  "name": "Immich - Backend, Frontend and ML",
+  "service": "immich-server",
+  "runServices": [
+    "immich-server",
+    "redis",
+    "database",
+    "immich-machine-learning"
+  ],
   "dockerComposeFile": [
-    "docker-compose.yml",
-    "../docker/docker-compose.dev.yml"
+    "../docker/docker-compose.dev.yml",
+    "./server/container-compose-overrides.yml"
   ],
   "customizations": {
     "vscode": {
       "extensions": [
-        "Dart-Code.dart-code",
-        "Dart-Code.flutter",
         "dbaeumer.vscode-eslint",
-        "dcmdev.dcm-vscode-extension",
         "esbenp.prettier-vscode",
-        "svelte.svelte-vscode"
+        "svelte.svelte-vscode",
+        "ms-vscode-remote.remote-containers",
+        "foxundermoon.shell-format",
+        "timonwong.shellcheck",
+        "rvest.vs-code-prettier-eslint",
+        "bluebrown.yamlfmt",
+        "vkrishna04.cspell-sync",
+        "vitest.explorer",
+        "ms-playwright.playwright",
+        "ms-azuretools.vscode-docker"
       ]
     }
   },
-  "forwardPorts": [],
-  "initializeCommand": "bash .devcontainer/scripts/initializeCommand.sh",
-  "onCreateCommand": "bash .devcontainer/scripts/onCreateCommand.sh",
+  "forwardPorts": [3000, 9231, 9230, 2283],
+  "portsAttributes": {
+    "3000": {
+      "label": "Immich - Frontend HTTP",
+      "description": "The frontend of the Immich project",
+      "onAutoForward": "openBrowserOnce"
+    },
+    "2283": {
+      "label": "Immich - API Server - HTTP",
+      "description": "The API server of the Immich project"
+    },
+    "9231": {
+      "label": "Immich - API Server - DEBUG",
+      "description": "The API server of the Immich project"
+    },
+    "9230": {
+      "label": "Immich - Workers - DEBUG",
+      "description": "The workers of the Immich project"
+    }
+  },
   "overrideCommand": true,
-  "workspaceFolder": "/immich",
-  "remoteUser": "node"
+  "workspaceFolder": "/workspaces/immich",
+  "remoteUser": "node",
+  "userEnvProbe": "loginInteractiveShell",
+  "remoteEnv": {
+    // The location where your uploaded files are stored
+    "UPLOAD_LOCATION": "${localEnv:UPLOAD_LOCATION:./library}",
+    //  Connection secret for postgres. You should change it to a random password
+    //  Please use only the characters `A-Za-z0-9`, without special characters or spaces
+    "DB_PASSWORD": "${localEnv:DB_PASSWORD:postgres}",
+    //  The database username
+    "DB_USERNAME": "${localEnv:DB_USERNAME:postgres}",
+    //  The database name
+    "DB_DATABASE_NAME": "${localEnv:DB_DATABASE_NAME:immich}"
+  }
 }

.devcontainer/docker-compose.yml

@@ -1,8 +0,0 @@
-services:
-  immich-devcontainer:
-    build:
-      dockerfile: Dockerfile
-    extra_hosts:
-      - 'host.docker.internal:host-gateway'
-    volumes:
-      - ..:/immich:cached

.devcontainer/mobile/container-compose-overrides.yml

@@ -0,0 +1,34 @@
+services:
+  immich-server:
+    build:
+      target: dev-container-mobile
+    environment:
+      - IMMICH_SERVER_URL=http://127.0.0.1:2283/
+    volumes: !override # bind mount host to /workspaces/immich
+      - ..:/workspaces/immich
+      - cli_node_modules:/workspaces/immich/cli/node_modules
+      - e2e_node_modules:/workspaces/immich/e2e/node_modules
+      - open_api_node_modules:/workspaces/immich/open-api/typescript-sdk/node_modules
+      - server_node_modules:/workspaces/immich/server/node_modules
+      - web_node_modules:/workspaces/immich/web/node_modules
+      - ${UPLOAD_LOCATION}/photos:/workspaces/immich/server/upload
+      - ${UPLOAD_LOCATION}/photos/upload:/workspaces/immich/server/upload/upload
+      - /etc/localtime:/etc/localtime:ro
+
+  database:
+    volumes:
+      - ${UPLOAD_LOCATION}/postgres:/var/lib/postgresql/data
+
+volumes:
+  # Node modules for each service to avoid conflicts and ensure consistent dependencies
+  cli_node_modules:
+  e2e_node_modules:
+  open_api_node_modules:
+  server_node_modules:
+  web_node_modules:
+
+  # UPLOAD_LOCATION must be set to a absolute path or vol-upload
+  vol-upload:
+
+  # DB_DATA_LOCATION must be set to a absolute path or vol-database
+  vol-database:

.devcontainer/mobile/devcontainer.json

@@ -0,0 +1,52 @@
+{
+  "name": "Immich - Mobile",
+  "service": "immich-server",
+  "runServices": [
+    "immich-server",
+    "redis",
+    "database",
+    "immich-machine-learning"
+  ],
+  "dockerComposeFile": [
+    "../../docker/docker-compose.dev.yml",
+    "./container-compose-overrides.yml"
+  ],
+  "customizations": {
+    "vscode": {
+      "extensions": [
+        "Dart-Code.dart-code",
+        "Dart-Code.flutter",
+        "dcmdev.dcm-vscode-extension",
+        "esbenp.prettier-vscode",
+        "dbaeumer.vscode-eslint",
+        "esbenp.prettier-vscode",
+        "svelte.svelte-vscode",
+        "ms-vscode-remote.remote-containers",
+        "foxundermoon.shell-format",
+        "timonwong.shellcheck",
+        "rvest.vs-code-prettier-eslint",
+        "bluebrown.yamlfmt",
+        "vkrishna04.cspell-sync",
+        "vitest.explorer",
+        "ms-playwright.playwright",
+        "ms-azuretools.vscode-docker"
+      ]
+    }
+  },
+  "forwardPorts": [],
+  "overrideCommand": true,
+  "workspaceFolder": "/workspaces/immich",
+  "remoteUser": "node",
+  "userEnvProbe": "loginInteractiveShell",
+  "remoteEnv": {
+    // The location where your uploaded files are stored
+    "UPLOAD_LOCATION": "${localEnv:UPLOAD_LOCATION:./Library}",
+    //  Connection secret for postgres. You should change it to a random password
+    //  Please use only the characters `A-Za-z0-9`, without special characters or spaces
+    "DB_PASSWORD": "${localEnv:DB_PASSWORD:postgres}",
+    //  The database username
+    "DB_USERNAME": "${localEnv:DB_USERNAME:postgres}",
+    //  The database name
+    "DB_DATABASE_NAME": "${localEnv:DB_DATABASE_NAME:immich}"
+  }
+}

.devcontainer/scripts/initializeCommand.sh

@@ -1,6 +0,0 @@
-#!/bin/bash
-
-# If .env file does not exist, create it by copying example.env from the docker folder
-if [ ! -f ".devcontainer/.env" ]; then
-    cp docker/example.env .devcontainer/.env
-fi

.devcontainer/scripts/onCreateCommand.sh

@@ -1,25 +0,0 @@
-#!/bin/bash
-
-# Enable multiarch for arm64 if necessary
-if [ "$(dpkg --print-architecture)" = "arm64" ]; then
-    sudo dpkg --add-architecture amd64 && \
-    sudo apt-get update && \
-    sudo apt-get install -y --no-install-recommends \
-        qemu-user-static \
-        libc6:amd64 \
-        libstdc++6:amd64 \
-        libgcc1:amd64
-fi
-
-# Install DCM
-wget -qO- https://dcm.dev/pgp-key.public | sudo gpg --dearmor -o /usr/share/keyrings/dcm.gpg
-sudo echo 'deb [signed-by=/usr/share/keyrings/dcm.gpg arch=amd64] https://dcm.dev/debian stable main' | sudo tee /etc/apt/sources.list.d/dart_stable.list
-
-sudo apt-get update
-sudo apt-get install dcm
-
-dart --disable-analytics
-
-# Install immich
-cd /immich || exit
-make install-all

.devcontainer/server/container-common.sh

@@ -0,0 +1,80 @@
+#!/bin/bash
+export IMMICH_PORT="${DEV_SERVER_PORT:-2283}"
+export DEV_PORT="${DEV_PORT:-3000}"
+
+# search for immich directory inside workspace.
+# /workspaces/immich is the bind mount, but other directories can be mounted if runing
+# Devcontainer: Clone [repository|pull request] in container volumne
+WORKSPACES_DIR="/workspaces"
+IMMICH_DIR="$WORKSPACES_DIR/immich"
+IMMICH_DEVCONTAINER_LOG="$HOME/immich-devcontainer.log"
+
+log() {
+    # Display command on console, log with timestamp to file
+    echo "$*"
+    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $*" >>"$IMMICH_DEVCONTAINER_LOG"
+}
+
+run_cmd() {
+    # Ensure log directory exists
+    mkdir -p "$(dirname "$IMMICH_DEVCONTAINER_LOG")"
+
+    log "$@"
+
+    # Execute command: display normally on console, log with timestamps to file
+    "$@" 2>&1 | tee >(while IFS= read -r line; do
+        echo "[$(date '+%Y-%m-%d %H:%M:%S')] $line" >>"$IMMICH_DEVCONTAINER_LOG"
+    done)
+
+    # Preserve exit status
+    return "${PIPESTATUS[0]}"
+}
+
+# Find directories excluding /workspaces/immich
+mapfile -t other_dirs < <(find "$WORKSPACES_DIR" -mindepth 1 -maxdepth 1 -type d ! -path "$IMMICH_DIR" ! -name ".*")
+
+if [ ${#other_dirs[@]} -gt 1 ]; then
+    log "Error: More than one directory found in $WORKSPACES_DIR other than $IMMICH_DIR."
+    exit 1
+elif [ ${#other_dirs[@]} -eq 1 ]; then
+    export IMMICH_WORKSPACE="${other_dirs[0]}"
+else
+    export IMMICH_WORKSPACE="$IMMICH_DIR"
+fi
+
+log "Found immich workspace in $IMMICH_WORKSPACE"
+log ""
+
+fix_permissions() {
+
+    log "Fixing permissions for ${IMMICH_WORKSPACE}"
+
+    run_cmd sudo find "${IMMICH_WORKSPACE}/server/upload" -not -path "${IMMICH_WORKSPACE}/server/upload/postgres/*" -not -path "${IMMICH_WORKSPACE}/server/upload/postgres" -exec chown node {} +
+
+    # Change ownership for directories that exist
+    for dir in "${IMMICH_WORKSPACE}/.vscode" \
+        "${IMMICH_WORKSPACE}/cli/node_modules" \
+        "${IMMICH_WORKSPACE}/e2e/node_modules" \
+        "${IMMICH_WORKSPACE}/open-api/typescript-sdk/node_modules" \
+        "${IMMICH_WORKSPACE}/server/node_modules" \
+        "${IMMICH_WORKSPACE}/server/dist" \
+        "${IMMICH_WORKSPACE}/web/node_modules" \
+        "${IMMICH_WORKSPACE}/web/dist"; do
+        if [ -d "$dir" ]; then
+            run_cmd sudo chown node -R "$dir"
+        fi
+    done
+
+    log ""
+}
+
+install_dependencies() {
+
+    log "Installing dependencies"
+    (
+        cd "${IMMICH_WORKSPACE}" || exit 1
+        export CI=1 FROZEN=1 OFFLINE=1
+        run_cmd make setup-dev
+    )
+    log ""
+}

.devcontainer/server/container-compose-overrides.yml

@@ -0,0 +1,49 @@
+services:
+  immich-server:
+    build:
+      target: dev-container-server
+    env_file: !reset []
+    hostname: immich-dev
+    environment:
+      - IMMICH_SERVER_URL=http://127.0.0.1:2283/
+    volumes: !override
+      - ..:/workspaces/immich
+      - cli_node_modules:/workspaces/immich/cli/node_modules
+      - e2e_node_modules:/workspaces/immich/e2e/node_modules
+      - open_api_node_modules:/workspaces/immich/open-api/typescript-sdk/node_modules
+      - server_node_modules:/workspaces/immich/server/node_modules
+      - web_node_modules:/workspaces/immich/web/node_modules
+      - ${UPLOAD_LOCATION:-upload1-devcontainer-volume}${UPLOAD_LOCATION:+/photos}:/workspaces/immich/server/upload
+      - ${UPLOAD_LOCATION:-upload2-devcontainer-volume}${UPLOAD_LOCATION:+/photos/upload}:/workspaces/immich/server/upload/upload
+      - /etc/localtime:/etc/localtime:ro
+
+  immich-web:
+    env_file: !reset []
+
+  immich-machine-learning:
+    env_file: !reset []
+
+  database:
+    env_file: !reset []
+    environment: !override
+      POSTGRES_PASSWORD: ${DB_PASSWORD-postgres}
+      POSTGRES_USER: ${DB_USERNAME-postgres}
+      POSTGRES_DB: ${DB_DATABASE_NAME-immich}
+      POSTGRES_INITDB_ARGS: '--data-checksums'
+      POSTGRES_HOST_AUTH_METHOD: md5
+    volumes:
+      - ${UPLOAD_LOCATION:-postgres-devcontainer-volume}${UPLOAD_LOCATION:+/postgres}:/var/lib/postgresql/data
+
+  redis:
+    env_file: !reset []
+
+volumes:
+  # Node modules for each service to avoid conflicts and ensure consistent dependencies
+  cli_node_modules:
+  e2e_node_modules:
+  open_api_node_modules:
+  server_node_modules:
+  web_node_modules:
+  upload1-devcontainer-volume:
+  upload2-devcontainer-volume:
+  postgres-devcontainer-volume:

.devcontainer/server/container-start-backend.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+# shellcheck source=common.sh
+# shellcheck disable=SC1091
+source /immich-devcontainer/container-common.sh
+
+log "Starting Nest API Server"
+log ""
+cd "${IMMICH_WORKSPACE}/server" || (
+    log "Immich workspace not found"
+    exit 1
+)
+
+while true; do
+    run_cmd node ./node_modules/.bin/nest start --debug "0.0.0.0:9230" --watch
+    log "Nest API Server crashed with exit code $?.  Respawning in 3s ..."
+    sleep 3
+done

.devcontainer/server/container-start-frontend.sh

@@ -0,0 +1,22 @@
+#!/bin/bash
+# shellcheck source=common.sh
+# shellcheck disable=SC1091
+source /immich-devcontainer/container-common.sh
+
+log "Starting Immich Web Frontend"
+log ""
+cd "${IMMICH_WORKSPACE}/web" || (
+    log "Immich Workspace not found"
+    exit 1
+)
+
+until curl --output /dev/null --silent --head --fail "http://127.0.0.1:${IMMICH_PORT}/api/server/config"; do
+    log "Waiting for api server..."
+    sleep 1
+done
+
+while true; do
+    run_cmd node ./node_modules/.bin/vite dev --host 0.0.0.0 --port "${DEV_PORT}"
+    log "Web crashed with exit code $?.  Respawning in 3s ..."
+    sleep 3
+done

.devcontainer/server/container-start.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+# shellcheck source=common.sh
+# shellcheck disable=SC1091
+source /immich-devcontainer/container-common.sh
+
+log "Setting up Immich dev container..."
+fix_permissions
+
+log "Installing npm dependencies (node_modules)..."
+install_dependencies
+
+log "Setup complete, please wait while backend and frontend services automatically start"
+log
+log "If necessary, the services may be manually started using"
+log
+log "$ /immich-devcontainer/container-start-backend.sh"
+log "$ /immich-devcontainer/container-start-frontend.sh"
+log
+log "From different terminal windows, as these scripts automatically restart the server"
+log "on error, and will continuously run in a loop"

.dockerignore

@@ -4,9 +4,14 @@
 
 design/
 docker/
+Dockerfile
 !docker/scripts
 docs/
+!docs/package.json
+!docs/package-lock.json
 e2e/
+!e2e/package.json
+!e2e/package-lock.json
 fastlane/
 machine-learning/
 misc/
@@ -15,6 +20,7 @@ mobile/
 cli/coverage/
 cli/dist/
 cli/node_modules/
+cli/Dockerfile
 
 open-api/typescript-sdk/build/
 open-api/typescript-sdk/node_modules/
@@ -25,9 +31,11 @@ server/upload/
 server/src/queries
 server/dist/
 server/www/
+server/Dockerfile
 
 web/node_modules/
 web/coverage/
 web/.svelte-kit
 web/build/
 web/.env
+web/Dockerfile

.gitattributes

@@ -6,6 +6,12 @@ mobile/openapi/**/*.dart linguist-generated=true
 mobile/lib/**/*.g.dart -diff -merge
 mobile/lib/**/*.g.dart linguist-generated=true
 
+mobile/lib/**/*.drift.dart -diff -merge
+mobile/lib/**/*.drift.dart linguist-generated=true
+
+mobile/drift_schemas/main/drift_schema_*.json -diff -merge
+mobile/drift_schemas/main/drift_schema_*.json linguist-generated=true
+
 open-api/typescript-sdk/fetch-client.ts -diff -merge
 open-api/typescript-sdk/fetch-client.ts linguist-generated=true
 

.github/.nvmrc

@@ -1 +1 @@
-22.14.0
+22.17.0

.github/.prettierignore

@@ -0,0 +1,4 @@
+# Ignore files for PNPM, NPM and YARN
+pnpm-lock.yaml
+package-lock.json
+yarn.lock

.github/DISCUSSION_TEMPLATE/feature-request.yaml

@@ -14,7 +14,6 @@ body:
       label: I have searched the existing feature requests, both open and closed, to make sure this is not a duplicate request.
       options:
         - label: 'Yes'
-          required: true
 
   - type: textarea
     id: feature

.github/ISSUE_TEMPLATE/bug_report.yaml

@@ -6,7 +6,6 @@ body:
       label: I have searched the existing issues, both open and closed, to make sure this is not a duplicate report.
       options:
         - label: 'Yes'
-          required: true
 
   - type: markdown
     attributes:

.github/package-lock.json

@@ -9,9 +9,9 @@
       }
     },
     "node_modules/prettier": {
-      "version": "3.5.3",
-      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.5.3.tgz",
-      "integrity": "sha512-QQtaxnoDJeAkDvDKWCLiwIXkTgRhwYDEQCghU9Z6q03iyek/rxRh/2lC3HB7P8sWT2xC/y5JDctPLBIGzHKbhw==",
+      "version": "3.6.2",
+      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.6.2.tgz",
+      "integrity": "sha512-I7AIg5boAr5R0FFtJ6rCfD+LFsWHp81dolrFD8S79U9tb8Az2nGrJncnMSnys+bpQJfRUzqs9hnA81OAA3hCuQ==",
       "dev": true,
       "license": "MIT",
       "bin": {

.github/workflows/build-mobile.yml

@@ -7,6 +7,15 @@ on:
       ref:
         required: false
         type: string
+    secrets:
+      KEY_JKS:
+        required: true
+      ALIAS:
+        required: true
+      ANDROID_KEY_PASSWORD:
+        required: true
+      ANDROID_STORE_PASSWORD:
+        required: true
   pull_request:
   push:
     branches: [main]
@@ -15,16 +24,23 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   pre-job:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
       should_run: ${{ steps.found_paths.outputs.mobile == 'true' || steps.should_force.outputs.should_force == 'true' }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
       - id: found_paths
-        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
+        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
         with:
           filters: |
             mobile:
@@ -38,58 +54,95 @@ jobs:
   build-sign-android:
     name: Build and sign Android
     needs: pre-job
+    permissions:
+      contents: read
     # Skip when PR from a fork
     if: ${{ !github.event.pull_request.head.repo.fork && github.actor != 'dependabot[bot]' && needs.pre-job.outputs.should_run == 'true' }}
-    runs-on: macos-14
+    runs-on: mich
 
     steps:
-      - name: Determine ref
-        id: get-ref
-        run: |
-          input_ref="${{ inputs.ref }}"
-          github_ref="${{ github.sha }}"
-          ref="${input_ref:-$github_ref}"
-          echo "ref=$ref" >> $GITHUB_OUTPUT
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ steps.get-ref.outputs.ref }}
-
-      - uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4
-        with:
-          distribution: 'zulu'
-          java-version: '17'
-          cache: 'gradle'
-
-      - name: Setup Flutter SDK
-        uses: subosito/flutter-action@44ac965b96f18d999802d4b807e3256d5a3f9fa1 # v2
-        with:
-          channel: 'stable'
-          flutter-version-file: ./mobile/pubspec.yaml
-          cache: true
+          ref: ${{ inputs.ref || github.sha }}
+          persist-credentials: false
 
       - name: Create the Keystore
         env:
           KEY_JKS: ${{ secrets.KEY_JKS }}
         working-directory: ./mobile
-        run: echo $KEY_JKS | base64 -d > android/key.jks
+        run: printf "%s" $KEY_JKS | base64 -d > android/key.jks
+
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+        with:
+          distribution: 'zulu'
+          java-version: '17'
+
+      - name: Restore Gradle Cache
+        id: cache-gradle-restore
+        uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 # v4
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+            ~/.android/sdk
+            mobile/android/.gradle
+            mobile/.dart_tool
+          key: build-mobile-gradle-${{ runner.os }}-main
+
+      - name: Setup Flutter SDK
+        uses: subosito/flutter-action@fd55f4c5af5b953cc57a2be44cb082c8f6635e8e # v2.21.0
+        with:
+          channel: 'stable'
+          flutter-version-file: ./mobile/pubspec.yaml
+          cache: true
+
+      - name: Setup Android SDK
+        uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3.2.2
+        with:
+          packages: ''
 
       - name: Get Packages
         working-directory: ./mobile
         run: flutter pub get
 
+      - name: Generate translation file
+        run: make translation
+        working-directory: ./mobile
+
+      - name: Generate platform APIs
+        run: make pigeon
+        working-directory: ./mobile
+
       - name: Build Android App Bundle
         working-directory: ./mobile
         env:
           ALIAS: ${{ secrets.ALIAS }}
           ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
           ANDROID_STORE_PASSWORD: ${{ secrets.ANDROID_STORE_PASSWORD }}
+          IS_MAIN: ${{ github.ref == 'refs/heads/main' }}
         run: |
-          flutter build apk --release
-          flutter build apk --release --split-per-abi --target-platform android-arm,android-arm64,android-x64
+          if [[ $IS_MAIN == 'true' ]]; then
+            flutter build apk --release
+            flutter build apk --release --split-per-abi --target-platform android-arm,android-arm64,android-x64
+          else
+            flutter build apk --debug --split-per-abi --target-platform android-arm64
+          fi
 
       - name: Publish Android Artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: release-apk-signed
           path: mobile/build/app/outputs/flutter-apk/*.apk
+
+      - name: Save Gradle Cache
+        id: cache-gradle-save
+        uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684 # v4
+        if: github.ref == 'refs/heads/main'
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+            ~/.android/sdk
+            mobile/android/.gradle
+            mobile/.dart_tool
+          key: ${{ steps.cache-gradle-restore.outputs.cache-primary-key }}

.github/workflows/cache-cleanup.yml

@@ -8,31 +8,38 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   cleanup:
     name: Cleanup
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: write
     steps:
       - name: Check out code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Cleanup
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REF: ${{ github.ref }}
         run: |
           gh extension install actions/gh-actions-cache
 
           REPO=${{ github.repository }}
-          BRANCH=${{ github.ref }}
 
           echo "Fetching list of cache keys"
-          cacheKeysForPR=$(gh actions-cache list -R $REPO -B $BRANCH -L 100 | cut -f 1 )
+          cacheKeysForPR=$(gh actions-cache list -R $REPO -B ${REF} -L 100 | cut -f 1 )
 
           ## Setting this to not fail the workflow while deleting cache keys.
           set +e
           echo "Deleting caches..."
           for cacheKey in $cacheKeysForPR
           do
-              gh actions-cache delete $cacheKey -R $REPO -B $BRANCH --confirm
+              gh actions-cache delete $cacheKey -R "$REPO" -B "${REF}" --confirm
           done
           echo "Done"
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/cli.yml

@@ -16,24 +16,31 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions:
-  packages: write
+permissions: {}
 
 jobs:
   publish:
     name: CLI Publish
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     defaults:
       run:
         working-directory: ./cli
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
       # Setup .npmrc file to publish to npm
-      - uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: './cli/.nvmrc'
           registry-url: 'https://registry.npmjs.org'
+          cache: 'npm'
+          cache-dependency-path: '**/package-lock.json'
+
       - name: Prepare SDK
         run: npm ci --prefix ../open-api/typescript-sdk/
       - name: Build SDK
@@ -48,20 +55,25 @@ jobs:
   docker:
     name: Docker
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
     needs: publish
 
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
         if: ${{ !github.event.pull_request.head.repo.fork }}
         with:
           registry: ghcr.io
@@ -76,7 +88,7 @@ jobs:
 
       - name: Generate docker image tags
         id: metadata
-        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
         with:
           flavor: |
             latest=false
@@ -87,7 +99,7 @@ jobs:
             type=raw,value=latest,enable=${{ github.event_name == 'release' }}
 
       - name: Build and push image
-        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           file: cli/Dockerfile
           platforms: linux/amd64,linux/arm64

.github/workflows/codeql-analysis.yml

@@ -24,6 +24,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   analyze:
     name: Analyze
@@ -42,11 +44,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@5f8171a638ada777af81d42b55959a643bb29017 # v3
+        uses: github/codeql-action/init@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -59,7 +63,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@5f8171a638ada777af81d42b55959a643bb29017 # v3
+        uses: github/codeql-action/autobuild@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -72,6 +76,6 @@ jobs:
       #   ./location_of_script_within_repo/buildscript.sh
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@5f8171a638ada777af81d42b55959a643bb29017 # v3
+        uses: github/codeql-action/analyze@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
         with:
           category: '/language:${{matrix.language}}'

.github/workflows/docker.yml

@@ -12,20 +12,23 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions:
-  packages: write
+permissions: {}
 
 jobs:
   pre-job:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
       should_run_server: ${{ steps.found_paths.outputs.server == 'true' || steps.should_force.outputs.should_force == 'true' }}
       should_run_ml: ${{ steps.found_paths.outputs.machine-learning == 'true' || steps.should_force.outputs.should_force == 'true' }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
       - id: found_paths
-        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
+        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
         with:
           filters: |
             server:
@@ -37,6 +40,8 @@ jobs:
               - 'machine-learning/**'
             workflow:
               - '.github/workflows/docker.yml'
+              - '.github/workflows/multi-runner-build.yml'
+              - '.github/actions/image-build'
 
       - name: Check if we should force jobs to run
         id: should_force
@@ -45,6 +50,9 @@ jobs:
   retag_ml:
     name: Re-Tag ML
     needs: pre-job
+    permissions:
+      contents: read
+      packages: write
     if: ${{ needs.pre-job.outputs.should_run_ml == 'false' && !github.event.pull_request.head.repo.fork }}
     runs-on: ubuntu-latest
     strategy:
@@ -52,24 +60,28 @@ jobs:
         suffix: ['', '-cuda', '-rocm', '-openvino', '-armnn', '-rknn']
     steps:
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Re-tag image
+        env:
+          REGISTRY_NAME: 'ghcr.io'
+          REPOSITORY: ${{ github.repository_owner }}/immich-machine-learning
+          TAG_OLD: main${{ matrix.suffix }}
+          TAG_PR: ${{ github.event.number == 0 && github.ref_name || format('pr-{0}', github.event.number) }}${{ matrix.suffix }}
+          TAG_COMMIT: commit-${{ github.event_name != 'pull_request' && github.sha || github.event.pull_request.head.sha }}${{ matrix.suffix }}
         run: |
-          REGISTRY_NAME="ghcr.io"
-          REPOSITORY=${{ github.repository_owner }}/immich-machine-learning
-          TAG_OLD=main${{ matrix.suffix }}
-          TAG_PR=${{ github.event.number == 0 && github.ref_name ||  format('pr-{0}', github.event.number)  }}${{ matrix.suffix }}
-          TAG_COMMIT=commit-${{ github.event_name != 'pull_request' && github.sha || github.event.pull_request.head.sha }}${{ matrix.suffix }}
-          docker buildx imagetools create -t $REGISTRY_NAME/$REPOSITORY:$TAG_PR $REGISTRY_NAME/$REPOSITORY:$TAG_OLD
-          docker buildx imagetools create -t $REGISTRY_NAME/$REPOSITORY:$TAG_COMMIT $REGISTRY_NAME/$REPOSITORY:$TAG_OLD
+          docker buildx imagetools create -t "${REGISTRY_NAME}/${REPOSITORY}:${TAG_PR}" "${REGISTRY_NAME}/${REPOSITORY}:${TAG_OLD}"
+          docker buildx imagetools create -t "${REGISTRY_NAME}/${REPOSITORY}:${TAG_COMMIT}" "${REGISTRY_NAME}/${REPOSITORY}:${TAG_OLD}"
 
   retag_server:
     name: Re-Tag Server
     needs: pre-job
+    permissions:
+      contents: read
+      packages: write
     if: ${{ needs.pre-job.outputs.should_run_server == 'false' && !github.event.pull_request.head.repo.fork }}
     runs-on: ubuntu-latest
     strategy:
@@ -77,395 +89,105 @@ jobs:
         suffix: ['']
     steps:
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Re-tag image
+        env:
+          REGISTRY_NAME: 'ghcr.io'
+          REPOSITORY: ${{ github.repository_owner }}/immich-server
+          TAG_OLD: main${{ matrix.suffix }}
+          TAG_PR: ${{ github.event.number == 0 && github.ref_name || format('pr-{0}', github.event.number) }}${{ matrix.suffix }}
+          TAG_COMMIT: commit-${{ github.event_name != 'pull_request' && github.sha || github.event.pull_request.head.sha }}${{ matrix.suffix }}
         run: |
-          REGISTRY_NAME="ghcr.io"
-          REPOSITORY=${{ github.repository_owner }}/immich-server
-          TAG_OLD=main${{ matrix.suffix }}
-          TAG_PR=${{ github.event.number == 0 && github.ref_name ||  format('pr-{0}', github.event.number)  }}${{ matrix.suffix }}
-          TAG_COMMIT=commit-${{ github.event_name != 'pull_request' && github.sha || github.event.pull_request.head.sha }}${{ matrix.suffix }}
-          docker buildx imagetools create -t $REGISTRY_NAME/$REPOSITORY:$TAG_PR $REGISTRY_NAME/$REPOSITORY:$TAG_OLD
-          docker buildx imagetools create -t $REGISTRY_NAME/$REPOSITORY:$TAG_COMMIT $REGISTRY_NAME/$REPOSITORY:$TAG_OLD
+          docker buildx imagetools create -t "${REGISTRY_NAME}/${REPOSITORY}:${TAG_PR}" "${REGISTRY_NAME}/${REPOSITORY}:${TAG_OLD}"
+          docker buildx imagetools create -t "${REGISTRY_NAME}/${REPOSITORY}:${TAG_COMMIT}" "${REGISTRY_NAME}/${REPOSITORY}:${TAG_OLD}"
 
-  build_and_push_ml:
+  machine-learning:
     name: Build and Push ML
     needs: pre-job
     if: ${{ needs.pre-job.outputs.should_run_ml == 'true' }}
-    runs-on: ${{ matrix.runner }}
-    env:
-      image: immich-machine-learning
-      context: machine-learning
-      file: machine-learning/Dockerfile
-      GHCR_REPO: ghcr.io/${{ github.repository_owner }}/immich-machine-learning
     strategy:
-      # Prevent a failure in one image from stopping the other builds
       fail-fast: false
-      matrix:
-        include:
-          - platform: linux/amd64
-            runner: ubuntu-latest
-            device: cpu
-
-          - platform: linux/arm64
-            runner: ubuntu-24.04-arm
-            device: cpu
-
-          - platform: linux/amd64
-            runner: ubuntu-latest
-            device: cuda
-            suffix: -cuda
-
-          - platform: linux/amd64
-            runner: mich
-            device: rocm
-            suffix: -rocm
-
-          - platform: linux/amd64
-            runner: ubuntu-latest
-            device: openvino
-            suffix: -openvino
-
-          - platform: linux/arm64
-            runner: ubuntu-24.04-arm
-            device: armnn
-            suffix: -armnn
-
-          - platform: linux/arm64
-            runner: ubuntu-24.04-arm
-            device: rknn
-            suffix: -rknn
-
-    steps:
-      - name: Prepare
-        run: |
-          platform=${{ matrix.platform }}
-          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
-
-      - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
-        if: ${{ !github.event.pull_request.head.repo.fork }}
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Generate cache key suffix
-        run: |
-          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
-            echo "CACHE_KEY_SUFFIX=pr-${{ github.event.number }}" >> $GITHUB_ENV
-          else
-            echo "CACHE_KEY_SUFFIX=$(echo ${{ github.ref_name }} | sed 's/[^a-zA-Z0-9]/-/g')" >> $GITHUB_ENV
-          fi
-
-      - name: Generate cache target
-        id: cache-target
-        run: |
-          if [[ "${{ github.event.pull_request.head.repo.fork }}" == "true" ]]; then
-            # Essentially just ignore the cache output (forks can't write to registry cache)
-            echo "cache-to=type=local,dest=/tmp/discard,ignore-error=true" >> $GITHUB_OUTPUT
-          else
-            echo "cache-to=type=registry,ref=${{ env.GHCR_REPO }}-build-cache:${{ env.PLATFORM_PAIR }}-${{ matrix.device }}-${{ env.CACHE_KEY_SUFFIX }},mode=max,compression=zstd" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Build and push image
-        id: build
-        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
-        with:
-          context: ${{ env.context }}
-          file: ${{ env.file }}
-          platforms: ${{ matrix.platforms }}
-          labels: ${{ steps.metadata.outputs.labels }}
-          cache-to: ${{ steps.cache-target.outputs.cache-to }}
-          cache-from: |
-            type=registry,ref=${{ env.GHCR_REPO }}-build-cache:${{ env.PLATFORM_PAIR }}-${{ matrix.device }}-${{ env.CACHE_KEY_SUFFIX }}
-            type=registry,ref=${{ env.GHCR_REPO }}-build-cache:${{ env.PLATFORM_PAIR }}-${{ matrix.device }}-main
-          outputs: type=image,"name=${{ env.GHCR_REPO }}",push-by-digest=true,name-canonical=true,push=${{ !github.event.pull_request.head.repo.fork }}
-          build-args: |
-            DEVICE=${{ matrix.device }}
-            BUILD_ID=${{ github.run_id }}
-            BUILD_IMAGE=${{ github.event_name == 'release' && github.ref_name || steps.metadata.outputs.tags }}
-            BUILD_SOURCE_REF=${{ github.ref_name }}
-            BUILD_SOURCE_COMMIT=${{ github.sha }}
-
-      - name: Export digest
-        run: |
-          mkdir -p ${{ runner.temp }}/digests
-          digest="${{ steps.build.outputs.digest }}"
-          touch "${{ runner.temp }}/digests/${digest#sha256:}"
-
-      - name: Upload digest
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: ml-digests-${{ matrix.device }}-${{ env.PLATFORM_PAIR }}
-          path: ${{ runner.temp }}/digests/*
-          if-no-files-found: error
-          retention-days: 1
-
-  merge_ml:
-    name: Merge & Push ML
-    runs-on: ubuntu-latest
-    if: ${{ needs.pre-job.outputs.should_run_ml == 'true' && !github.event.pull_request.head.repo.fork }}
-    env:
-      GHCR_REPO: ghcr.io/${{ github.repository_owner }}/immich-machine-learning
-      DOCKER_REPO: altran1502/immich-machine-learning
-    strategy:
       matrix:
         include:
           - device: cpu
+            tag-suffix: ''
           - device: cuda
-            suffix: -cuda
-          - device: rocm
-            suffix: -rocm
+            tag-suffix: '-cuda'
+            platforms: linux/amd64
           - device: openvino
-            suffix: -openvino
+            tag-suffix: '-openvino'
+            platforms: linux/amd64
           - device: armnn
-            suffix: -armnn
+            tag-suffix: '-armnn'
+            platforms: linux/arm64
           - device: rknn
-            suffix: -rknn
-    needs:
-      - build_and_push_ml
-    steps:
-      - name: Download digests
-        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4
-        with:
-          path: ${{ runner.temp }}/digests
-          pattern: ml-digests-${{ matrix.device }}-*
-          merge-multiple: true
+            tag-suffix: '-rknn'
+            platforms: linux/arm64
+          - device: rocm
+            tag-suffix: '-rocm'
+            platforms: linux/amd64
+            runner-mapping: '{"linux/amd64": "mich"}'
+    uses: immich-app/devtools/.github/workflows/multi-runner-build.yml@094bfb927b8cd75b343abaac27b3241be0fccfe9 # multi-runner-build-workflow-0.1.0
+    permissions:
+      contents: read
+      actions: read
+      packages: write
+    secrets:
+      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+    with:
+      image: immich-machine-learning
+      context: machine-learning
+      dockerfile: machine-learning/Dockerfile
+      platforms: ${{ matrix.platforms }}
+      runner-mapping: ${{ matrix.runner-mapping }}
+      tag-suffix: ${{ matrix.tag-suffix }}
+      dockerhub-push: ${{ github.event_name == 'release' }}
+      build-args: |
+        DEVICE=${{ matrix.device }}
 
-      - name: Login to Docker Hub
-        if: ${{ github.event_name == 'release' }}
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Login to GHCR
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3
-
-      - name: Generate docker image tags
-        id: meta
-        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5
-        env:
-          DOCKER_METADATA_PR_HEAD_SHA: 'true'
-        with:
-          flavor: |
-            # Disable latest tag
-            latest=false
-            suffix=${{ matrix.suffix }}
-          images: |
-            name=${{ env.GHCR_REPO }}
-            name=${{ env.DOCKER_REPO }},enable=${{ github.event_name == 'release' }}
-          tags: |
-            # Tag with branch name
-            type=ref,event=branch
-            # Tag with pr-number
-            type=ref,event=pr
-            # Tag with long commit sha hash
-            type=sha,format=long,prefix=commit-
-            # Tag with git tag on release
-            type=ref,event=tag
-            type=raw,value=release,enable=${{ github.event_name == 'release' }}
-
-      - name: Create manifest list and push
-        working-directory: ${{ runner.temp }}/digests
-        run: |
-          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
-            $(printf '${{ env.GHCR_REPO }}@sha256:%s ' *)
-
-  build_and_push_server:
+  server:
     name: Build and Push Server
-    runs-on: ${{ matrix.runner }}
     needs: pre-job
     if: ${{ needs.pre-job.outputs.should_run_server == 'true' }}
-    env:
+    uses: immich-app/devtools/.github/workflows/multi-runner-build.yml@094bfb927b8cd75b343abaac27b3241be0fccfe9 # multi-runner-build-workflow-0.1.0
+    permissions:
+      contents: read
+      actions: read
+      packages: write
+    secrets:
+      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+    with:
       image: immich-server
       context: .
-      file: server/Dockerfile
-      GHCR_REPO: ghcr.io/${{ github.repository_owner }}/immich-server
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - platform: linux/amd64
-            runner: ubuntu-latest
-          - platform: linux/arm64
-            runner: ubuntu-24.04-arm
-    steps:
-      - name: Prepare
-        run: |
-          platform=${{ matrix.platform }}
-          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
-
-      - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
-        if: ${{ !github.event.pull_request.head.repo.fork }}
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Generate cache key suffix
-        run: |
-          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
-            echo "CACHE_KEY_SUFFIX=pr-${{ github.event.number }}" >> $GITHUB_ENV
-          else
-            echo "CACHE_KEY_SUFFIX=$(echo ${{ github.ref_name }} | sed 's/[^a-zA-Z0-9]/-/g')" >> $GITHUB_ENV
-          fi
-
-      - name: Generate cache target
-        id: cache-target
-        run: |
-          if [[ "${{ github.event.pull_request.head.repo.fork }}" == "true" ]]; then
-            # Essentially just ignore the cache output (forks can't write to registry cache)
-            echo "cache-to=type=local,dest=/tmp/discard,ignore-error=true" >> $GITHUB_OUTPUT
-          else
-            echo "cache-to=type=registry,ref=${{ env.GHCR_REPO }}-build-cache:${{ env.PLATFORM_PAIR }}-${{ matrix.device }}-${{ env.CACHE_KEY_SUFFIX }},mode=max,compression=zstd" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Build and push image
-        id: build
-        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
-        with:
-          context: ${{ env.context }}
-          file: ${{ env.file }}
-          platforms: ${{ matrix.platform }}
-          labels: ${{ steps.metadata.outputs.labels }}
-          cache-to: ${{ steps.cache-target.outputs.cache-to }}
-          cache-from: |
-            type=registry,ref=${{ env.GHCR_REPO }}-build-cache:${{ env.PLATFORM_PAIR }}-${{ env.CACHE_KEY_SUFFIX }}
-            type=registry,ref=${{ env.GHCR_REPO }}-build-cache:${{ env.PLATFORM_PAIR }}-main
-          outputs: type=image,"name=${{ env.GHCR_REPO }}",push-by-digest=true,name-canonical=true,push=${{ !github.event.pull_request.head.repo.fork }}
-          build-args: |
-            DEVICE=cpu
-            BUILD_ID=${{ github.run_id }}
-            BUILD_IMAGE=${{ github.event_name == 'release' && github.ref_name || steps.metadata.outputs.tags }}
-            BUILD_SOURCE_REF=${{ github.ref_name }}
-            BUILD_SOURCE_COMMIT=${{ github.sha }}
-
-      - name: Export digest
-        run: |
-          mkdir -p ${{ runner.temp }}/digests
-          digest="${{ steps.build.outputs.digest }}"
-          touch "${{ runner.temp }}/digests/${digest#sha256:}"
-
-      - name: Upload digest
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: server-digests-${{ env.PLATFORM_PAIR }}
-          path: ${{ runner.temp }}/digests/*
-          if-no-files-found: error
-          retention-days: 1
-
-  merge_server:
-    name: Merge & Push Server
-    runs-on: ubuntu-latest
-    if: ${{ needs.pre-job.outputs.should_run_server == 'true' && !github.event.pull_request.head.repo.fork }}
-    env:
-      GHCR_REPO: ghcr.io/${{ github.repository_owner }}/immich-server
-      DOCKER_REPO: altran1502/immich-server
-    needs:
-      - build_and_push_server
-    steps:
-      - name: Download digests
-        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4
-        with:
-          path: ${{ runner.temp }}/digests
-          pattern: server-digests-*
-          merge-multiple: true
-
-      - name: Login to Docker Hub
-        if: ${{ github.event_name == 'release' }}
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Login to GHCR
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3
-
-      - name: Generate docker image tags
-        id: meta
-        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5
-        env:
-          DOCKER_METADATA_PR_HEAD_SHA: 'true'
-        with:
-          flavor: |
-            # Disable latest tag
-            latest=false
-            suffix=${{ matrix.suffix }}
-          images: |
-            name=${{ env.GHCR_REPO }}
-            name=${{ env.DOCKER_REPO }},enable=${{ github.event_name == 'release' }}
-          tags: |
-            # Tag with branch name
-            type=ref,event=branch
-            # Tag with pr-number
-            type=ref,event=pr
-            # Tag with long commit sha hash
-            type=sha,format=long,prefix=commit-
-            # Tag with git tag on release
-            type=ref,event=tag
-            type=raw,value=release,enable=${{ github.event_name == 'release' }}
-
-      - name: Create manifest list and push
-        working-directory: ${{ runner.temp }}/digests
-        run: |
-          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
-            $(printf '${{ env.GHCR_REPO }}@sha256:%s ' *)
+      dockerfile: server/Dockerfile
+      dockerhub-push: ${{ github.event_name == 'release' }}
+      build-args: |
+        DEVICE=cpu
 
   success-check-server:
     name: Docker Build & Push Server Success
-    needs: [merge_server, retag_server]
+    needs: [server, retag_server]
+    permissions: {}
     runs-on: ubuntu-latest
     if: always()
     steps:
-      - name: Any jobs failed?
-        if: ${{ contains(needs.*.result, 'failure') }}
-        run: exit 1
-      - name: All jobs passed or skipped
-        if: ${{ !(contains(needs.*.result, 'failure')) }}
-        run: echo "All jobs passed or skipped" && echo "${{ toJSON(needs.*.result) }}"
+      - uses: immich-app/devtools/actions/success-check@68f10eb389bb02a3cf9d1156111964c549eb421b # 0.0.4
+        with:
+          needs: ${{ toJSON(needs) }}
 
   success-check-ml:
     name: Docker Build & Push ML Success
-    needs: [merge_ml, retag_ml]
+    needs: [machine-learning, retag_ml]
+    permissions: {}
     runs-on: ubuntu-latest
     if: always()
     steps:
-      - name: Any jobs failed?
-        if: ${{ contains(needs.*.result, 'failure') }}
-        run: exit 1
-      - name: All jobs passed or skipped
-        if: ${{ !(contains(needs.*.result, 'failure')) }}
-        run: echo "All jobs passed or skipped" && echo "${{ toJSON(needs.*.result) }}"
+      - uses: immich-app/devtools/actions/success-check@68f10eb389bb02a3cf9d1156111964c549eb421b # 0.0.4
+        with:
+          needs: ${{ toJSON(needs) }}

.github/workflows/docs-build.yml

@@ -10,16 +10,22 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   pre-job:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
       should_run: ${{ steps.found_paths.outputs.docs == 'true' ||  steps.should_force.outputs.should_force == 'true' }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
       - id: found_paths
-        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
+        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
         with:
           filters: |
             docs:
@@ -33,6 +39,8 @@ jobs:
   build:
     name: Docs Build
     needs: pre-job
+    permissions:
+      contents: read
     if: ${{ needs.pre-job.outputs.should_run == 'true' }}
     runs-on: ubuntu-latest
     defaults:
@@ -41,12 +49,16 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: './docs/.nvmrc'
+          cache: 'npm'
+          cache-dependency-path: '**/package-lock.json'
 
       - name: Run npm install
         run: npm ci
@@ -58,8 +70,9 @@ jobs:
         run: npm run build
 
       - name: Upload build output
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: docs-build-output
           path: docs/build/
+          include-hidden-files: true
           retention-days: 1

.github/workflows/docs-deploy.yml

@@ -1,6 +1,6 @@
 name: Docs deploy
 on:
-  workflow_run:
+  workflow_run: # zizmor: ignore[dangerous-triggers] no attacker inputs are used here
     workflows: ['Docs build']
     types:
       - completed
@@ -9,6 +9,9 @@ jobs:
   checks:
     name: Docs Deploy Checks
     runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      pull-requests: read
     outputs:
       parameters: ${{ steps.parameters.outputs.result }}
       artifact: ${{ steps.get-artifact.outputs.result }}
@@ -17,7 +20,7 @@ jobs:
         run: echo 'The triggering workflow did not succeed' && exit 1
       - name: Get artifact
         id: get-artifact
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           script: |
             let allArtifacts = await github.rest.actions.listWorkflowRunArtifacts({
@@ -35,7 +38,9 @@ jobs:
             return { found: true, id: matchArtifact.id };
       - name: Determine deploy parameters
         id: parameters
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        env:
+          HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
         with:
           script: |
             const eventType = context.payload.workflow_run.event;
@@ -57,7 +62,8 @@ jobs:
             } else if (eventType == "pull_request") {
               let pull_number = context.payload.workflow_run.pull_requests[0]?.number;
               if(!pull_number) {
-                const response = await github.rest.search.issuesAndPullRequests({q: 'repo:${{ github.repository }} is:pr sha:${{ github.event.workflow_run.head_sha }}',per_page: 1,})
+                const {HEAD_SHA} = process.env;
+                const response = await github.rest.search.issuesAndPullRequests({q: `repo:${{ github.repository }} is:pr sha:${HEAD_SHA}`,per_page: 1,})
                 const items = response.data.items
                 if (items.length < 1) {
                   throw new Error("No pull request found for the commit")
@@ -95,30 +101,36 @@ jobs:
     name: Docs Deploy
     runs-on: ubuntu-latest
     needs: checks
+    permissions:
+      contents: read
+      actions: read
+      pull-requests: write
     if: ${{ fromJson(needs.checks.outputs.artifact).found && fromJson(needs.checks.outputs.parameters).shouldDeploy }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Load parameters
         id: parameters
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        env:
+          PARAM_JSON: ${{ needs.checks.outputs.parameters }}
         with:
           script: |
-            const json = `${{ needs.checks.outputs.parameters }}`;
-            const parameters = JSON.parse(json);
+            const parameters = JSON.parse(process.env.PARAM_JSON);
             core.setOutput("event", parameters.event);
             core.setOutput("name", parameters.name);
             core.setOutput("shouldDeploy", parameters.shouldDeploy);
 
-      - run: |
-          echo "Starting docs deployment for ${{ steps.parameters.outputs.event }} ${{ steps.parameters.outputs.name }}"
-
       - name: Download artifact
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        env:
+          ARTIFACT_JSON: ${{ needs.checks.outputs.artifact }}
         with:
           script: |
-            let artifact = ${{ needs.checks.outputs.artifact }};
+            let artifact = JSON.parse(process.env.ARTIFACT_JSON);
             let download = await github.rest.actions.downloadArtifact({
                owner: context.repo.owner,
                repo: context.repo.repo,
@@ -138,7 +150,7 @@ jobs:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
           TF_STATE_POSTGRES_CONN_STR: ${{ secrets.TF_STATE_POSTGRES_CONN_STR }}
-        uses: gruntwork-io/terragrunt-action@9559e51d05873b0ea467c42bbabcb5c067642ccc # v2
+        uses: gruntwork-io/terragrunt-action@aee21a7df999be8b471c2a8564c6cd853cb674e1 # v2.1.8
         with:
           tg_version: '0.58.12'
           tofu_version: '1.7.1'
@@ -153,7 +165,7 @@ jobs:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
           TF_STATE_POSTGRES_CONN_STR: ${{ secrets.TF_STATE_POSTGRES_CONN_STR }}
-        uses: gruntwork-io/terragrunt-action@9559e51d05873b0ea467c42bbabcb5c067642ccc # v2
+        uses: gruntwork-io/terragrunt-action@aee21a7df999be8b471c2a8564c6cd853cb674e1 # v2.1.8
         with:
           tg_version: '0.58.12'
           tofu_version: '1.7.1'
@@ -162,12 +174,15 @@ jobs:
 
       - name: Output Cleaning
         id: clean
+        env:
+          TG_OUTPUT: ${{ steps.docs-output.outputs.tg_action_output }}
         run: |
-          TG_OUT=$(echo '${{ steps.docs-output.outputs.tg_action_output }}' | sed 's|%0A|\n|g ; s|%3C|<|g' | jq -c .)
-          echo "output=$TG_OUT" >> $GITHUB_OUTPUT
+          CLEANED=$(echo "$TG_OUTPUT" | sed 's|%0A|\n|g ; s|%3C|<|g' | jq -c .)
+          echo "output=$CLEANED" >> $GITHUB_OUTPUT
 
       - name: Publish to Cloudflare Pages
-        uses: cloudflare/pages-action@f0a1cd58cd66095dee69bfa18fa5efd1dde93bca # v1
+        # TODO: Action is deprecated
+        uses: cloudflare/pages-action@f0a1cd58cd66095dee69bfa18fa5efd1dde93bca # v1.5.0
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN_PAGES_UPLOAD }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
@@ -184,7 +199,7 @@ jobs:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
           TF_STATE_POSTGRES_CONN_STR: ${{ secrets.TF_STATE_POSTGRES_CONN_STR }}
-        uses: gruntwork-io/terragrunt-action@9559e51d05873b0ea467c42bbabcb5c067642ccc # v2
+        uses: gruntwork-io/terragrunt-action@aee21a7df999be8b471c2a8564c6cd853cb674e1 # v2.1.8
         with:
           tg_version: '0.58.12'
           tofu_version: '1.7.1'
@@ -192,7 +207,7 @@ jobs:
           tg_command: 'apply'
 
       - name: Comment
-        uses: actions-cool/maintain-one-comment@4b2dbf086015f892dcb5e8c1106f5fccd6c1476b # v3
+        uses: actions-cool/maintain-one-comment@4b2dbf086015f892dcb5e8c1106f5fccd6c1476b # v3.2.0
         if: ${{ steps.parameters.outputs.event == 'pr' }}
         with:
           number: ${{ fromJson(needs.checks.outputs.parameters).pr_number }}

.github/workflows/docs-destroy.yml

@@ -1,15 +1,22 @@
 name: Docs destroy
 on:
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers] no attacker inputs are used here
     types: [closed]
 
+permissions: {}
+
 jobs:
   deploy:
     name: Docs Destroy
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Destroy Docs Subdomain
         env:
@@ -18,7 +25,7 @@ jobs:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
           TF_STATE_POSTGRES_CONN_STR: ${{ secrets.TF_STATE_POSTGRES_CONN_STR }}
-        uses: gruntwork-io/terragrunt-action@9559e51d05873b0ea467c42bbabcb5c067642ccc # v2
+        uses: gruntwork-io/terragrunt-action@aee21a7df999be8b471c2a8564c6cd853cb674e1 # v2.1.8
         with:
           tg_version: '0.58.12'
           tofu_version: '1.7.1'
@@ -26,7 +33,7 @@ jobs:
           tg_command: 'destroy -refresh=false'
 
       - name: Comment
-        uses: actions-cool/maintain-one-comment@4b2dbf086015f892dcb5e8c1106f5fccd6c1476b # v3
+        uses: actions-cool/maintain-one-comment@4b2dbf086015f892dcb5e8c1106f5fccd6c1476b # v3.2.0
         with:
           number: ${{ github.event.number }}
           delete: true

.github/workflows/fix-format.yml

@@ -4,42 +4,48 @@ on:
   pull_request:
     types: [labeled]
 
+permissions: {}
+
 jobs:
   fix-formatting:
     runs-on: ubuntu-latest
     if: ${{ github.event.label.name == 'fix:formatting' }}
     permissions:
+      contents: write
       pull-requests: write
     steps:
       - name: Generate a token
         id: generate-token
-        uses: actions/create-github-app-token@af35edadc00be37caa72ed9f3e6d5f7801bfdf09 # v1
+        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
         with:
           app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
 
       - name: 'Checkout'
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ref: ${{ github.event.pull_request.head.ref }}
           token: ${{ steps.generate-token.outputs.token }}
+          persist-credentials: true
 
       - name: Setup Node
-        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: './server/.nvmrc'
+          cache: 'npm'
+          cache-dependency-path: '**/package-lock.json'
 
       - name: Fix formatting
         run: make install-all && make format-all
 
       - name: Commit and push
-        uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9
+        uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9.1.4
         with:
           default_author: github_actions
           message: 'chore: fix formatting'
 
       - name: Remove label
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         if: always()
         with:
           script: |

.github/workflows/pr-label-validation.yml

@@ -1,9 +1,11 @@
 name: PR Label Validation
 
 on:
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers] no attacker inputs are used here
     types: [opened, labeled, unlabeled, synchronize]
 
+permissions: {}
+
 jobs:
   validate-release-label:
     runs-on: ubuntu-latest
@@ -12,7 +14,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Require PR to have a changelog label
-        uses: mheap/github-action-required-labels@388fd6af37b34cdfe5a23b37060e763217e58b03 # v5
+        uses: mheap/github-action-required-labels@8afbe8ae6ab7647d0c9f0cfa7c2f939650d22509 # v5.5.1
         with:
           mode: exactly
           count: 1

.github/workflows/pr-labeler.yml

@@ -1,6 +1,8 @@
 name: 'Pull Request Labeler'
 on:
-  - pull_request_target
+  - pull_request_target # zizmor: ignore[dangerous-triggers] no attacker inputs are used here
+
+permissions: {}
 
 jobs:
   labeler:
@@ -9,4 +11,4 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5
+      - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0

.github/workflows/pr-require-conventional-commit.yml

@@ -4,12 +4,16 @@ on:
   pull_request:
     types: [opened, synchronize, reopened, edited]
 
+permissions: {}
+
 jobs:
   validate-pr-title:
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
     steps:
       - name: PR Conventional Commit Validation
-        uses: ytanikin/PRConventionalCommits@1.3.0
+        uses: ytanikin/PRConventionalCommits@b628c5a234cc32513014b7bfdd1e47b532124d98 # 1.3.0
         with:
           task_types: '["feat","fix","docs","test","ci","refactor","perf","chore","revert"]'
           add_label: 'false'

.github/workflows/prepare-release.yml

@@ -21,35 +21,40 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}-root
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   bump_version:
     runs-on: ubuntu-latest
-
     outputs:
       ref: ${{ steps.push-tag.outputs.commit_long_sha }}
-
+    permissions: {} # No job-level permissions are needed because it uses the app-token
     steps:
       - name: Generate a token
         id: generate-token
-        uses: actions/create-github-app-token@af35edadc00be37caa72ed9f3e6d5f7801bfdf09 # v1
+        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
         with:
           app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
 
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           token: ${{ steps.generate-token.outputs.token }}
+          persist-credentials: true
 
       - name: Install uv
-        uses: astral-sh/setup-uv@f94ec6bedd8674c4426838e6b50417d36b6ab231 # v5
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
 
       - name: Bump version
-        run: misc/release/pump-version.sh -s "${{ inputs.serverBump }}" -m "${{ inputs.mobileBump }}"
+        env:
+          SERVER_BUMP: ${{ inputs.serverBump }}
+          MOBILE_BUMP: ${{ inputs.mobileBump }}
+        run: misc/release/pump-version.sh -s "${SERVER_BUMP}" -m "${MOBILE_BUMP}"
 
       - name: Commit and tag
         id: push-tag
-        uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9
+        uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9.1.4
         with:
           default_author: github_actions
           message: 'chore: version ${{ env.IMMICH_VERSION }}'
@@ -59,37 +64,47 @@ jobs:
   build_mobile:
     uses: ./.github/workflows/build-mobile.yml
     needs: bump_version
-    secrets: inherit
+    permissions:
+      contents: read
+    secrets:
+      KEY_JKS: ${{ secrets.KEY_JKS }}
+      ALIAS: ${{ secrets.ALIAS }}
+      ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
+      ANDROID_STORE_PASSWORD: ${{ secrets.ANDROID_STORE_PASSWORD }}
     with:
       ref: ${{ needs.bump_version.outputs.ref }}
 
   prepare_release:
     runs-on: ubuntu-latest
     needs: build_mobile
-
+    permissions:
+      actions: read # To download the app artifact
+      # No content permissions are needed because it uses the app-token
     steps:
       - name: Generate a token
         id: generate-token
-        uses: actions/create-github-app-token@af35edadc00be37caa72ed9f3e6d5f7801bfdf09 # v1
+        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
         with:
           app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
           private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
 
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           token: ${{ steps.generate-token.outputs.token }}
+          persist-credentials: false
 
       - name: Download APK
-        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: release-apk-signed
 
       - name: Create draft release
-        uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda # v2
+        uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2.3.2
         with:
           draft: true
           tag_name: ${{ env.IMMICH_VERSION }}
+          token: ${{ steps.generate-token.outputs.token }}
           generate_release_notes: true
           body_path: misc/release/notes.tmpl
           files: |

.github/workflows/preview-label.yaml

@@ -4,6 +4,8 @@ on:
   pull_request:
     types: [labeled, closed]
 
+permissions: {}
+
 jobs:
   comment-status:
     runs-on: ubuntu-latest
@@ -11,7 +13,7 @@ jobs:
     permissions:
       pull-requests: write
     steps:
-      - uses: mshick/add-pr-comment@b8f338c590a895d50bcbfa6c5859251edc8952fc # v2
+      - uses: mshick/add-pr-comment@b8f338c590a895d50bcbfa6c5859251edc8952fc # v2.8.2
         with:
           message-id: 'preview-status'
           message: 'Deploying preview environment to https://pr-${{ github.event.pull_request.number }}.preview.internal.immich.cloud/'
@@ -22,7 +24,7 @@ jobs:
     permissions:
       pull-requests: write
     steps:
-      - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
+      - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           script: |
             github.rest.issues.removeLabel({

.github/workflows/sdk.yml

@@ -4,23 +4,29 @@ on:
   release:
     types: [published]
 
-permissions:
-  packages: write
+permissions: {}
 
 jobs:
   publish:
     name: Publish `@immich/sdk`
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     defaults:
       run:
         working-directory: ./open-api/typescript-sdk
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
       # Setup .npmrc file to publish to npm
-      - uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: './open-api/typescript-sdk/.nvmrc'
           registry-url: 'https://registry.npmjs.org'
+          cache: 'npm'
+          cache-dependency-path: '**/package-lock.json'
       - name: Install deps
         run: npm ci
       - name: Build

.github/workflows/static_analysis.yml

@@ -9,16 +9,22 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   pre-job:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
       should_run: ${{ steps.found_paths.outputs.mobile == 'true' || steps.should_force.outputs.should_force == 'true' }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
       - id: found_paths
-        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
+        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
         with:
           filters: |
             mobile:
@@ -33,29 +39,46 @@ jobs:
     name: Run Dart Code Analysis
     needs: pre-job
     if: ${{ needs.pre-job.outputs.should_run == 'true' }}
-
     runs-on: ubuntu-latest
-
+    permissions:
+      contents: read
+    defaults:
+      run:
+        working-directory: ./mobile
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Setup Flutter SDK
-        uses: subosito/flutter-action@44ac965b96f18d999802d4b807e3256d5a3f9fa1 # v2
+        uses: subosito/flutter-action@fd55f4c5af5b953cc57a2be44cb082c8f6635e8e # v2.21.0
         with:
           channel: 'stable'
           flutter-version-file: ./mobile/pubspec.yaml
 
       - name: Install dependencies
         run: dart pub get
-        working-directory: ./mobile
+
+      - name: Install DCM
+        # TODO: Move to upstream after https://github.com/CQLabs/setup-dcm/pull/235 merges
+        uses: bo0tzz/setup-dcm@b4952ab813659c03513b57bd78bfe3f634171f8a
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          version: auto
+          working-directory: ./mobile
+
+      - name: Generate translation file
+        run: make translation
 
       - name: Run Build Runner
         run: make build
-        working-directory: ./mobile
+
+      - name: Generate platform API
+        run: make pigeon
 
       - name: Find file changes
-        uses: tj-actions/verify-changed-files@6ed7632824d235029086612d4330d659005af687 # v20
+        uses: tj-actions/verify-changed-files@a1c6acee9df209257a246f2cc6ae8cb6581c1edf # v20.0.4
         id: verify-changed-files
         with:
           files: |
@@ -65,19 +88,49 @@ jobs:
 
       - name: Verify files have not changed
         if: steps.verify-changed-files.outputs.files_changed == 'true'
+        env:
+          CHANGED_FILES: ${{ steps.verify-changed-files.outputs.changed_files }}
         run: |
           echo "ERROR: Generated files not up to date! Run make_build inside the mobile directory"
-          echo "Changed files: ${{ steps.verify-changed-files.outputs.changed_files }}"
+          echo "Changed files: ${CHANGED_FILES}"
           exit 1
 
       - name: Run dart analyze
         run: dart analyze --fatal-infos
-        working-directory: ./mobile
 
       - name: Run dart format
         run: dart format lib/ --set-exit-if-changed
-        working-directory: ./mobile
 
       - name: Run dart custom_lint
         run: dart run custom_lint
-        working-directory: ./mobile
+
+      # TODO: Use https://github.com/CQLabs/dcm-action
+      - name: Run DCM
+        run: dcm analyze lib --fatal-style --fatal-warnings
+
+  zizmor:
+    name: zizmor
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: Install the latest version of uv
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
+
+      - name: Run zizmor 🌈
+        run: uvx zizmor --format=sarif . > results.sarif
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Upload SARIF file
+        uses: github/codeql-action/upload-sarif@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
+        with:
+          sarif_file: results.sarif
+          category: zizmor

.github/workflows/test.yml

@@ -9,10 +9,15 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   pre-job:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
+      should_run_i18n: ${{ steps.found_paths.outputs.i18n == 'true' || steps.should_force.outputs.should_force == 'true' }}
       should_run_web: ${{ steps.found_paths.outputs.web == 'true' || steps.should_force.outputs.should_force == 'true' }}
       should_run_server: ${{ steps.found_paths.outputs.server == 'true' || steps.should_force.outputs.should_force == 'true' }}
       should_run_cli: ${{ steps.found_paths.outputs.cli == 'true' || steps.should_force.outputs.should_force == 'true' }}
@@ -24,11 +29,16 @@ jobs:
       should_run_.github: ${{ steps.found_paths.outputs['.github'] == 'true' || steps.should_force.outputs.should_force == 'true' }} # redundant to have should_force but if someone changes the trigger then this won't have to be changed
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
       - id: found_paths
-        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
+        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
         with:
           filters: |
+            i18n:
+              - 'i18n/**'
             web:
               - 'web/**'
               - 'i18n/**'
@@ -58,18 +68,24 @@ jobs:
     needs: pre-job
     if: ${{ needs.pre-job.outputs.should_run_server == 'true' }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     defaults:
       run:
         working-directory: ./server
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: './server/.nvmrc'
+          cache: 'npm'
+          cache-dependency-path: '**/package-lock.json'
 
       - name: Run npm install
         run: npm ci
@@ -87,7 +103,7 @@ jobs:
         if: ${{ !cancelled() }}
 
       - name: Run small tests & coverage
-        run: npm run test:cov
+        run: npm test
         if: ${{ !cancelled() }}
 
   cli-unit-tests:
@@ -95,18 +111,24 @@ jobs:
     needs: pre-job
     if: ${{ needs.pre-job.outputs.should_run_cli == 'true' }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     defaults:
       run:
         working-directory: ./cli
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: './cli/.nvmrc'
+          cache: 'npm'
+          cache-dependency-path: '**/package-lock.json'
 
       - name: Setup typescript-sdk
         run: npm ci && npm run build
@@ -128,7 +150,7 @@ jobs:
         if: ${{ !cancelled() }}
 
       - name: Run unit tests & coverage
-        run: npm run test:cov
+        run: npm run test
         if: ${{ !cancelled() }}
 
   cli-unit-tests-win:
@@ -136,18 +158,24 @@ jobs:
     needs: pre-job
     if: ${{ needs.pre-job.outputs.should_run_cli == 'true' }}
     runs-on: windows-latest
+    permissions:
+      contents: read
     defaults:
       run:
         working-directory: ./cli
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: './cli/.nvmrc'
+          cache: 'npm'
+          cache-dependency-path: '**/package-lock.json'
 
       - name: Setup typescript-sdk
         run: npm ci && npm run build
@@ -162,26 +190,32 @@ jobs:
         if: ${{ !cancelled() }}
 
       - name: Run unit tests & coverage
-        run: npm run test:cov
+        run: npm run test
         if: ${{ !cancelled() }}
 
-  web-unit-tests:
-    name: Test & Lint Web
+  web-lint:
+    name: Lint Web
     needs: pre-job
     if: ${{ needs.pre-job.outputs.should_run_web == 'true' }}
-    runs-on: ubuntu-latest
+    runs-on: mich
+    permissions:
+      contents: read
     defaults:
       run:
         working-directory: ./web
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: './web/.nvmrc'
+          cache: 'npm'
+          cache-dependency-path: '**/package-lock.json'
 
       - name: Run setup typescript-sdk
         run: npm ci && npm run build
@@ -191,7 +225,7 @@ jobs:
         run: npm ci
 
       - name: Run linter
-        run: npm run lint
+        run: npm run lint:p
         if: ${{ !cancelled() }}
 
       - name: Run formatter
@@ -202,31 +236,110 @@ jobs:
         run: npm run check:svelte
         if: ${{ !cancelled() }}
 
+  web-unit-tests:
+    name: Test Web
+    needs: pre-job
+    if: ${{ needs.pre-job.outputs.should_run_web == 'true' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    defaults:
+      run:
+        working-directory: ./web
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: Setup Node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version-file: './web/.nvmrc'
+          cache: 'npm'
+          cache-dependency-path: '**/package-lock.json'
+
+      - name: Run setup typescript-sdk
+        run: npm ci && npm run build
+        working-directory: ./open-api/typescript-sdk
+
+      - name: Run npm install
+        run: npm ci
+
       - name: Run tsc
         run: npm run check:typescript
         if: ${{ !cancelled() }}
 
       - name: Run unit tests & coverage
-        run: npm run test:cov
+        run: npm run test
         if: ${{ !cancelled() }}
 
+  i18n-tests:
+    name: Test i18n
+    needs: pre-job
+    if: ${{ needs.pre-job.outputs.should_run_i18n == 'true' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: Setup Node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version-file: './web/.nvmrc'
+          cache: 'npm'
+          cache-dependency-path: '**/package-lock.json'
+
+      - name: Install dependencies
+        run: npm --prefix=web ci
+
+      - name: Format
+        run: npm --prefix=web run format:i18n
+
+      - name: Find file changes
+        uses: tj-actions/verify-changed-files@a1c6acee9df209257a246f2cc6ae8cb6581c1edf # v20.0.4
+        id: verify-changed-files
+        with:
+          files: |
+            i18n/**
+
+      - name: Verify files have not changed
+        if: steps.verify-changed-files.outputs.files_changed == 'true'
+        env:
+          CHANGED_FILES: ${{ steps.verify-changed-files.outputs.changed_files }}
+        run: |
+          echo "ERROR: i18n files not up to date!"
+          echo "Changed files: ${CHANGED_FILES}"
+          exit 1
+
   e2e-tests-lint:
     name: End-to-End Lint
     needs: pre-job
     if: ${{ needs.pre-job.outputs.should_run_e2e == 'true' }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     defaults:
       run:
         working-directory: ./e2e
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: './e2e/.nvmrc'
+          cache: 'npm'
+          cache-dependency-path: '**/package-lock.json'
 
       - name: Run setup typescript-sdk
         run: npm ci && npm run build
@@ -254,18 +367,24 @@ jobs:
     needs: pre-job
     if: ${{ needs.pre-job.outputs.should_run_server == 'true' }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     defaults:
       run:
         working-directory: ./server
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: './server/.nvmrc'
+          cache: 'npm'
+          cache-dependency-path: '**/package-lock.json'
 
       - name: Run npm install
         run: npm ci
@@ -278,21 +397,29 @@ jobs:
     name: End-to-End Tests (Server & CLI)
     needs: pre-job
     if: ${{ needs.pre-job.outputs.should_run_e2e_server_cli == 'true' }}
-    runs-on: mich
+    runs-on: ${{ matrix.runner }}
+    permissions:
+      contents: read
     defaults:
       run:
         working-directory: ./e2e
+    strategy:
+      matrix:
+        runner: [ubuntu-latest, ubuntu-24.04-arm]
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
+          persist-credentials: false
           submodules: 'recursive'
 
       - name: Setup Node
-        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: './e2e/.nvmrc'
+          cache: 'npm'
+          cache-dependency-path: '**/package-lock.json'
 
       - name: Run setup typescript-sdk
         run: npm ci && npm run build
@@ -320,21 +447,29 @@ jobs:
     name: End-to-End Tests (Web)
     needs: pre-job
     if: ${{ needs.pre-job.outputs.should_run_e2e_web == 'true' }}
-    runs-on: mich
+    runs-on: ${{ matrix.runner }}
+    permissions:
+      contents: read
     defaults:
       run:
         working-directory: ./e2e
+    strategy:
+      matrix:
+        runner: [ubuntu-latest, ubuntu-24.04-arm]
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
+          persist-credentials: false
           submodules: 'recursive'
 
       - name: Setup Node
-        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: './e2e/.nvmrc'
+          cache: 'npm'
+          cache-dependency-path: '**/package-lock.json'
 
       - name: Run setup typescript-sdk
         run: npm ci && npm run build
@@ -346,7 +481,7 @@ jobs:
         if: ${{ !cancelled() }}
 
       - name: Install Playwright Browsers
-        run: npx playwright install --with-deps chromium
+        run: npx playwright install chromium --only-shell
         if: ${{ !cancelled() }}
 
       - name: Docker build
@@ -357,18 +492,39 @@ jobs:
         run: npx playwright test
         if: ${{ !cancelled() }}
 
+  success-check-e2e:
+    name: End-to-End Tests Success
+    needs: [e2e-tests-server-cli, e2e-tests-web]
+    permissions: {}
+    runs-on: ubuntu-latest
+    if: always()
+    steps:
+      - uses: immich-app/devtools/actions/success-check@68f10eb389bb02a3cf9d1156111964c549eb421b # 0.0.4
+        with:
+          needs: ${{ toJSON(needs) }}
+
   mobile-unit-tests:
     name: Unit Test Mobile
     needs: pre-job
     if: ${{ needs.pre-job.outputs.should_run_mobile == 'true' }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
       - name: Setup Flutter SDK
-        uses: subosito/flutter-action@44ac965b96f18d999802d4b807e3256d5a3f9fa1 # v2
+        uses: subosito/flutter-action@fd55f4c5af5b953cc57a2be44cb082c8f6635e8e # v2.21.0
         with:
           channel: 'stable'
           flutter-version-file: ./mobile/pubspec.yaml
+
+      - name: Generate translation file
+        run: make translation
+        working-directory: ./mobile
+
       - name: Run tests
         working-directory: ./mobile
         run: flutter test -j 1
@@ -378,14 +534,19 @@ jobs:
     needs: pre-job
     if: ${{ needs.pre-job.outputs.should_run_ml == 'true' }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     defaults:
       run:
         working-directory: ./machine-learning
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
       - name: Install uv
-        uses: astral-sh/setup-uv@f94ec6bedd8674c4426838e6b50417d36b6ab231 # v5
-      - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         # TODO: add caching when supported (https://github.com/actions/setup-python/pull/818)
         # with:
         #   python-version: 3.11
@@ -395,34 +556,40 @@ jobs:
           uv sync --extra cpu
       - name: Lint with ruff
         run: |
-          uv run ruff check --output-format=github app export
+          uv run ruff check --output-format=github immich_ml
       - name: Check black formatting
         run: |
-          uv run black --check app export
+          uv run black --check immich_ml
       - name: Run mypy type checking
         run: |
-          uv run mypy --strict app/
+          uv run mypy --strict immich_ml/
       - name: Run tests and coverage
         run: |
-          uv run pytest app --cov=app --cov-report term-missing
+          uv run pytest --cov=immich_ml --cov-report term-missing
 
   github-files-formatting:
     name: .github Files Formatting
     needs: pre-job
     if: ${{ needs.pre-job.outputs['should_run_.github'] == 'true' }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     defaults:
       run:
         working-directory: ./.github
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: './.github/.nvmrc'
+          cache: 'npm'
+          cache-dependency-path: '**/package-lock.json'
 
       - name: Run npm install
         run: npm ci
@@ -434,27 +601,38 @@ jobs:
   shellcheck:
     name: ShellCheck
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
       - name: Run ShellCheck
-        uses: ludeeus/action-shellcheck@master
+        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # 2.0.0
         with:
           ignore_paths: >-
             **/open-api/**
-            **/openapi/**
+            **/openapi**
             **/node_modules/**
 
   generated-api-up-to-date:
     name: OpenAPI Clients
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: './server/.nvmrc'
+          cache: 'npm'
+          cache-dependency-path: '**/package-lock.json'
 
       - name: Install server dependencies
         run: npm --prefix=server ci
@@ -466,7 +644,7 @@ jobs:
         run: make open-api
 
       - name: Find file changes
-        uses: tj-actions/verify-changed-files@6ed7632824d235029086612d4330d659005af687 # v20
+        uses: tj-actions/verify-changed-files@a1c6acee9df209257a246f2cc6ae8cb6581c1edf # v20.0.4
         id: verify-changed-files
         with:
           files: |
@@ -476,17 +654,21 @@ jobs:
 
       - name: Verify files have not changed
         if: steps.verify-changed-files.outputs.files_changed == 'true'
+        env:
+          CHANGED_FILES: ${{ steps.verify-changed-files.outputs.changed_files }}
         run: |
           echo "ERROR: Generated files not up to date!"
-          echo "Changed files: ${{ steps.verify-changed-files.outputs.changed_files }}"
+          echo "Changed files: ${CHANGED_FILES}"
           exit 1
 
-  generated-typeorm-migrations-up-to-date:
-    name: TypeORM Checks
+  sql-schema-up-to-date:
+    name: SQL Schema Checks
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     services:
       postgres:
-        image: tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:739cdd626151ff1f796dc95a6591b55a714f341c737e27f045019ceabf8e8c52
+        image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3@sha256:1f5583fe3397210a0fbc7f11b0cec18bacc4a99e3e8ea0548e9bd6bcf26ec37a
         env:
           POSTGRES_PASSWORD: postgres
           POSTGRES_USER: postgres
@@ -504,12 +686,16 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: './server/.nvmrc'
+          cache: 'npm'
+          cache-dependency-path: '**/package-lock.json'
 
       - name: Install server dependencies
         run: npm ci
@@ -518,27 +704,29 @@ jobs:
         run: npm run build
 
       - name: Run existing migrations
-        run: npm run typeorm:migrations:run
+        run: npm run migrations:run
 
       - name: Test npm run schema:reset command works
-        run: npm run typeorm:schema:reset
+        run: npm run schema:reset
 
       - name: Generate new migrations
         continue-on-error: true
-        run: npm run typeorm:migrations:generate ./src/migrations/TestMigration
+        run: npm run migrations:generate src/TestMigration
 
       - name: Find file changes
-        uses: tj-actions/verify-changed-files@6ed7632824d235029086612d4330d659005af687 # v20
+        uses: tj-actions/verify-changed-files@a1c6acee9df209257a246f2cc6ae8cb6581c1edf # v20.0.4
         id: verify-changed-files
         with:
           files: |
-            server/src/migrations/
+            server/src
       - name: Verify migration files have not changed
         if: steps.verify-changed-files.outputs.files_changed == 'true'
+        env:
+          CHANGED_FILES: ${{ steps.verify-changed-files.outputs.changed_files }}
         run: |
           echo "ERROR: Generated migration files not up to date!"
-          echo "Changed files: ${{ steps.verify-changed-files.outputs.changed_files }}"
-          cat ./src/migrations/*-TestMigration.ts
+          echo "Changed files: ${CHANGED_FILES}"
+          cat ./src/*-TestMigration.ts
           exit 1
 
       - name: Run SQL generation
@@ -547,7 +735,7 @@ jobs:
           DB_URL: postgres://postgres:postgres@localhost:5432/immich
 
       - name: Find file changes
-        uses: tj-actions/verify-changed-files@6ed7632824d235029086612d4330d659005af687 # v20
+        uses: tj-actions/verify-changed-files@a1c6acee9df209257a246f2cc6ae8cb6581c1edf # v20.0.4
         id: verify-changed-sql-files
         with:
           files: |
@@ -555,9 +743,12 @@ jobs:
 
       - name: Verify SQL files have not changed
         if: steps.verify-changed-sql-files.outputs.files_changed == 'true'
+        env:
+          CHANGED_FILES: ${{ steps.verify-changed-sql-files.outputs.changed_files }}
         run: |
           echo "ERROR: Generated SQL files not up to date!"
-          echo "Changed files: ${{ steps.verify-changed-sql-files.outputs.changed_files }}"
+          echo "Changed files: ${CHANGED_FILES}"
+          git diff
           exit 1
 
   # mobile-integration-tests:

.github/workflows/weblate-lock.yml

@@ -4,30 +4,32 @@ on:
   pull_request:
     branches: [main]
 
+permissions: {}
+
 jobs:
   pre-job:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
       should_run: ${{ steps.found_paths.outputs.i18n == 'true' && github.head_ref != 'chore/translations'}}
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
       - id: found_paths
-        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
+        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
         with:
           filters: |
             i18n:
               - 'i18n/!(en)**\.json'
-      - name: Debug
-        run: |
-          echo "Should run: ${{ steps.found_paths.outputs.i18n == 'true' && github.head_ref != 'chore/translations'}}"
-          echo "Found i18n paths: ${{ steps.found_paths.outputs.i18n }}"
-          echo "Head ref: ${{ github.head_ref }}"
 
   enforce-lock:
     name: Check Weblate Lock
     needs: [pre-job]
     runs-on: ubuntu-latest
+    permissions: {}
     if: ${{ needs.pre-job.outputs.should_run == 'true' }}
     steps:
       - name: Check weblate lock
@@ -36,7 +38,7 @@ jobs:
             exit 1
           fi
       - name: Find Pull Request
-        uses: juliangruber/find-pull-request-action@48b6133aa6c826f267ebd33aa2d29470f9d9e7d0 # v1
+        uses: juliangruber/find-pull-request-action@48b6133aa6c826f267ebd33aa2d29470f9d9e7d0 # v1.9.0
         id: find-pr
         with:
           branch: chore/translations
@@ -47,11 +49,9 @@ jobs:
     name: Weblate Lock Check Success
     needs: [enforce-lock]
     runs-on: ubuntu-latest
+    permissions: {}
     if: always()
     steps:
-      - name: Any jobs failed?
-        if: ${{ contains(needs.*.result, 'failure') }}
-        run: exit 1
-      - name: All jobs passed or skipped
-        if: ${{ !(contains(needs.*.result, 'failure')) }}
-        run: echo "All jobs passed or skipped" && echo "${{ toJSON(needs.*.result) }}"
+      - uses: immich-app/devtools/actions/success-check@68f10eb389bb02a3cf9d1156111964c549eb421b # 0.0.4
+        with:
+          needs: ${{ toJSON(needs) }}

.gitignore

@@ -3,6 +3,7 @@
 .DS_Store
 .vscode/*
 !.vscode/launch.json
+!.vscode/extensions.json
 .idea
 
 docker/upload

.vscode/extensions.json

@@ -0,0 +1,10 @@
+{
+  "recommendations": [
+    "esbenp.prettier-vscode",
+    "svelte.svelte-vscode",
+    "dbaeumer.vscode-eslint",
+    "dart-code.flutter",
+    "dart-code.dart-code",
+    "dcmdev.dcm-vscode-extension"
+  ]
+}

.vscode/settings.json

@@ -1,44 +1,63 @@
 {
-  "editor.formatOnSave": true,
-  "[javascript]": {
-    "editor.defaultFormatter": "esbenp.prettier-vscode",
-    "editor.tabSize": 2,
-    "editor.formatOnSave": true
-  },
-  "[typescript]": {
-    "editor.defaultFormatter": "esbenp.prettier-vscode",
-    "editor.tabSize": 2,
-    "editor.formatOnSave": true
-  },
   "[css]": {
     "editor.defaultFormatter": "esbenp.prettier-vscode",
-    "editor.tabSize": 2,
-    "editor.formatOnSave": true
-  },
-  "[svelte]": {
-    "editor.defaultFormatter": "svelte.svelte-vscode",
+    "editor.formatOnSave": true,
     "editor.tabSize": 2
   },
-  "svelte.enable-ts-plugin": true,
-  "eslint.validate": [
-    "javascript",
-    "svelte"
-  ],
-  "typescript.preferences.importModuleSpecifier": "non-relative",
   "[dart]": {
+    "editor.defaultFormatter": "Dart-Code.dart-code",
     "editor.formatOnSave": true,
     "editor.selectionHighlight": false,
     "editor.suggest.snippetsPreventQuickSuggestions": false,
     "editor.suggestSelection": "first",
     "editor.tabCompletion": "onlySnippets",
-    "editor.wordBasedSuggestions": "off",
-    "editor.defaultFormatter": "Dart-Code.dart-code"
+    "editor.wordBasedSuggestions": "off"
   },
-  "cSpell.words": [
-    "immich"
-  ],
+  "[javascript]": {
+    "editor.codeActionsOnSave": {
+      "source.organizeImports": "explicit",
+      "source.removeUnusedImports": "explicit"
+    },
+    "editor.defaultFormatter": "esbenp.prettier-vscode",
+    "editor.formatOnSave": true,
+    "editor.tabSize": 2
+  },
+  "[json]": {
+    "editor.defaultFormatter": "esbenp.prettier-vscode",
+    "editor.formatOnSave": true,
+    "editor.tabSize": 2
+  },
+  "[jsonc]": {
+    "editor.defaultFormatter": "esbenp.prettier-vscode",
+    "editor.formatOnSave": true,
+    "editor.tabSize": 2
+  },
+  "[svelte]": {
+    "editor.codeActionsOnSave": {
+      "source.organizeImports": "explicit",
+      "source.removeUnusedImports": "explicit"
+    },
+    "editor.defaultFormatter": "svelte.svelte-vscode",
+    "editor.formatOnSave": true,
+    "editor.tabSize": 2
+  },
+  "[typescript]": {
+    "editor.codeActionsOnSave": {
+      "source.organizeImports": "explicit",
+      "source.removeUnusedImports": "explicit"
+    },
+    "editor.defaultFormatter": "esbenp.prettier-vscode",
+    "editor.formatOnSave": true,
+    "editor.tabSize": 2
+  },
+  "cSpell.words": ["immich"],
+  "editor.formatOnSave": true,
+  "eslint.validate": ["javascript", "svelte"],
   "explorer.fileNesting.enabled": true,
   "explorer.fileNesting.patterns": {
+    "*.dart": "${capture}.g.dart,${capture}.gr.dart,${capture}.drift.dart",
     "*.ts": "${capture}.spec.ts,${capture}.mock.ts"
-  }
-}
+  },
+  "svelte.enable-ts-plugin": true,
+  "typescript.preferences.importModuleSpecifier": "non-relative"
+}

.vscode/tasks.json

@@ -0,0 +1,72 @@
+{
+  "version": "2.0.0",
+  "tasks": [
+    {
+      "label": "Fix Permissions, Install Dependencies",
+      "type": "shell",
+      "command": "[ -f /immich-devcontainer/container-start.sh ] && /immich-devcontainer/container-start.sh || exit 0",
+      "presentation": {
+        "echo": true,
+        "reveal": "always",
+        "focus": false,
+        "panel": "dedicated",
+        "showReuseMessage": true,
+        "clear": false,
+        "group": "Devcontainer tasks",
+        "close": true
+      },
+      "runOptions": {
+        "runOn": "default"
+      },
+      "problemMatcher": []
+    },
+    {
+      "label": "Immich API Server (Nest)",
+      "dependsOn": ["Fix Permissions, Install Dependencies"],
+      "type": "shell",
+      "command": "[ -f /immich-devcontainer/container-start-backend.sh ] && /immich-devcontainer/container-start-backend.sh || exit 0",
+      "presentation": {
+        "echo": true,
+        "reveal": "always",
+        "focus": false,
+        "panel": "dedicated",
+        "showReuseMessage": true,
+        "clear": false,
+        "group": "Devcontainer tasks",
+        "close": true
+      },
+      "runOptions": {
+        "runOn": "default"
+      },
+      "problemMatcher": []
+    },
+    {
+      "label": "Immich Web Server (Vite)",
+      "dependsOn": ["Fix Permissions, Install Dependencies"],
+      "type": "shell",
+      "command": "[ -f /immich-devcontainer/container-start-frontend.sh ] && /immich-devcontainer/container-start-frontend.sh || exit 0",
+      "presentation": {
+        "echo": true,
+        "reveal": "always",
+        "focus": false,
+        "panel": "dedicated",
+        "showReuseMessage": true,
+        "clear": false,
+        "group": "Devcontainer tasks",
+        "close": true
+      },
+      "runOptions": {
+        "runOn": "default"
+      },
+      "problemMatcher": []
+    },
+    {
+      "label": "Immich Server and Web",
+      "dependsOn": ["Immich Web Server (Vite)", "Immich API Server (Nest)"],
+      "runOptions": {
+        "runOn": "folderOpen"
+      },
+      "problemMatcher": []
+    }
+  ]
+}

Makefile

@@ -1,24 +1,33 @@
 dev:
-	docker compose -f ./docker/docker-compose.dev.yml up --remove-orphans || make dev-down
+	@trap 'make dev-down' EXIT; COMPOSE_BAKE=true docker compose -f ./docker/docker-compose.dev.yml up --remove-orphans
 
 dev-down:
 	docker compose -f ./docker/docker-compose.dev.yml down --remove-orphans
 
 dev-update:
-	docker compose -f ./docker/docker-compose.dev.yml up --build -V --remove-orphans
+	@trap 'make dev-down' EXIT; COMPOSE_BAKE=true docker compose -f ./docker/docker-compose.dev.yml up --build -V --remove-orphans
 
 dev-scale:
-	docker compose -f ./docker/docker-compose.dev.yml up --build -V  --scale immich-server=3 --remove-orphans
+	@trap 'make dev-down' EXIT; COMPOSE_BAKE=true docker compose -f ./docker/docker-compose.dev.yml up --build -V  --scale immich-server=3 --remove-orphans
 
 .PHONY: e2e
 e2e:
-	docker compose -f ./e2e/docker-compose.yml up --build -V --remove-orphans
+	@trap 'make e2e-down' EXIT; COMPOSE_BAKE=true docker compose -f ./e2e/docker-compose.yml up --build -V --remove-orphans
+
+e2e-update:
+	@trap 'make e2e-down' EXIT; COMPOSE_BAKE=true docker compose -f ./e2e/docker-compose.yml up --build -V --remove-orphans
+
+e2e-down:
+	docker compose -f ./e2e/docker-compose.yml down --remove-orphans
 
 prod:
-	docker compose -f ./docker/docker-compose.prod.yml up --build -V --remove-orphans
+	@trap 'make prod-down' EXIT; COMPOSE_BAKE=true docker compose -f ./docker/docker-compose.prod.yml up --build -V --remove-orphans
+
+prod-down:
+	docker compose -f ./docker/docker-compose.prod.yml down --remove-orphans
 
 prod-scale:
-	docker compose -f ./docker/docker-compose.prod.yml up --build -V --scale immich-server=3 --scale immich-microservices=3 --remove-orphans
+	@trap 'make prod-down' EXIT; COMPOSE_BAKE=true docker compose -f ./docker/docker-compose.prod.yml up --build -V --scale immich-server=3 --scale immich-microservices=3 --remove-orphans
 
 .PHONY: open-api
 open-api:
@@ -45,6 +54,8 @@ audit-%:
 	npm --prefix $(subst sdk,open-api/typescript-sdk,$*) audit fix
 install-%:
 	npm --prefix $(subst sdk,open-api/typescript-sdk,$*) i
+ci-%:
+	npm --prefix $(subst sdk,open-api/typescript-sdk,$*) ci
 build-cli: build-sdk
 build-web: build-sdk
 build-%: install-%
@@ -78,7 +89,8 @@ test-medium-dev:
 	docker exec -it immich_server /bin/sh -c "npm run test:medium"
 
 build-all: $(foreach M,$(filter-out e2e .github,$(MODULES)),build-$M) ;
-install-all: $(foreach M,$(MODULES),install-$M) ;
+install-all: $(foreach M,$(MODULES),install-$M) ;  
+ci-all: $(foreach M,$(filter-out .github,$(MODULES)),ci-$M) ;
 check-all: $(foreach M,$(filter-out sdk cli docs .github,$(MODULES)),check-$M) ;
 lint-all: $(foreach M,$(filter-out sdk docs .github,$(MODULES)),lint-$M) ;
 format-all: $(foreach M,$(filter-out sdk,$(MODULES)),format-$M) ;
@@ -87,9 +99,11 @@ hygiene-all: lint-all format-all check-all sql audit-all;
 test-all: $(foreach M,$(filter-out sdk docs .github,$(MODULES)),test-$M) ;
 
 clean:
-	find . -name "node_modules" -type d -prune -exec rm -rf '{}' +
+	find . -name "node_modules" -type d -prune -exec rm -rf {} +
 	find . -name "dist" -type d -prune -exec rm -rf '{}' +
 	find . -name "build" -type d -prune -exec rm -rf '{}' +
 	find . -name "svelte-kit" -type d -prune -exec rm -rf '{}' +
-	docker compose -f ./docker/docker-compose.dev.yml rm -v -f || true
-	docker compose -f ./e2e/docker-compose.yml rm -v -f || true
+	command -v docker >/dev/null 2>&1 && docker compose -f ./docker/docker-compose.dev.yml rm -v -f || true
+	command -v docker >/dev/null 2>&1 && docker compose -f ./e2e/docker-compose.yml rm -v -f || true
+
+setup-dev: install-server install-sdk build-sdk install-web

README.md

@@ -61,9 +61,7 @@
 
 ## Demo
 
-Access the demo [here](https://demo.immich.app). The demo is running on a Free-tier Oracle VM in Amsterdam with a 2.4Ghz quad-core ARM64 CPU and 24GB RAM.
-
-For the mobile app, you can use `https://demo.immich.app` for the `Server Endpoint URL`
+Access the demo [here](https://demo.immich.app). For the mobile app, you can use `https://demo.immich.app` for the `Server Endpoint URL`.
 
 ### Login credentials
 
@@ -104,7 +102,7 @@ For the mobile app, you can use `https://demo.immich.app` for the `Server Endpoi
 | Read-only gallery                            | Yes    | Yes |
 | Stacked Photos                               | Yes    | Yes |
 | Tags                                         | No     | Yes |
-| Folder View                                  | No     | Yes |
+| Folder View                                  | Yes    | Yes |
 
 ## Translations
 

cli/.nvmrc

@@ -1 +1 @@
-22.14.0
+22.17.0

cli/Dockerfile

@@ -1,4 +1,4 @@
-FROM node:22.14.0-alpine3.20@sha256:40be979442621049f40b1d51a26b55e281246b5de4e5f51a18da7beb6e17e3f9 AS core
+FROM node:22.16.0-alpine3.20@sha256:2289fb1fba0f4633b08ec47b94a89c7e20b829fc5679f9b7b298eaa2f1ed8b7e AS core
 
 WORKDIR /usr/src/open-api/typescript-sdk
 COPY open-api/typescript-sdk/package*.json open-api/typescript-sdk/tsconfig*.json ./

cli/bin/immich

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import '../dist/index.js';

cli/eslint.config.mjs

@@ -1,39 +1,29 @@
-import { FlatCompat } from '@eslint/eslintrc';
 import js from '@eslint/js';
-import typescriptEslint from '@typescript-eslint/eslint-plugin';
-import tsParser from '@typescript-eslint/parser';
+import eslintPluginPrettierRecommended from 'eslint-plugin-prettier/recommended';
+import eslintPluginUnicorn from 'eslint-plugin-unicorn';
 import globals from 'globals';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import typescriptEslint from 'typescript-eslint';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
-const compat = new FlatCompat({
-  baseDirectory: __dirname,
-  recommendedConfig: js.configs.recommended,
-  allConfig: js.configs.all,
-});
 
-export default [
+export default typescriptEslint.config([
+  eslintPluginUnicorn.configs.recommended,
+  eslintPluginPrettierRecommended,
+  js.configs.recommended,
+  typescriptEslint.configs.recommended,
   {
     ignores: ['eslint.config.mjs', 'dist'],
   },
-  ...compat.extends(
-    'plugin:@typescript-eslint/recommended',
-    'plugin:prettier/recommended',
-    'plugin:unicorn/recommended',
-  ),
   {
-    plugins: {
-      '@typescript-eslint': typescriptEslint,
-    },
-
     languageOptions: {
       globals: {
         ...globals.node,
       },
 
-      parser: tsParser,
+      parser: typescriptEslint.parser,
       ecmaVersion: 5,
       sourceType: 'module',
 
@@ -58,4 +48,4 @@ export default [
       'object-shorthand': ['error', 'always'],
     },
   },
-];
+]);

cli/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@immich/cli",
-  "version": "2.2.54",
+  "version": "2.2.72",
   "description": "Command Line Interface (CLI) for Immich",
   "type": "module",
   "exports": "./dist/index.js",
   "bin": {
-    "immich": "dist/index.js"
+    "immich": "./bin/immich"
   },
   "license": "GNU Affero General Public License version 3",
   "keywords": [
@@ -21,9 +21,7 @@
     "@types/lodash-es": "^4.17.12",
     "@types/micromatch": "^4.0.9",
     "@types/mock-fs": "^4.13.1",
-    "@types/node": "^22.13.10",
-    "@typescript-eslint/eslint-plugin": "^8.15.0",
-    "@typescript-eslint/parser": "^8.15.0",
+    "@types/node": "^22.15.33",
     "@vitest/coverage-v8": "^3.0.0",
     "byte-size": "^9.0.0",
     "cli-progress": "^3.12.0",
@@ -31,12 +29,13 @@
     "eslint": "^9.14.0",
     "eslint-config-prettier": "^10.0.0",
     "eslint-plugin-prettier": "^5.1.3",
-    "eslint-plugin-unicorn": "^56.0.1",
+    "eslint-plugin-unicorn": "^59.0.0",
     "globals": "^16.0.0",
     "mock-fs": "^5.2.0",
     "prettier": "^3.2.5",
     "prettier-plugin-organize-imports": "^4.0.0",
     "typescript": "^5.3.3",
+    "typescript-eslint": "^8.28.0",
     "vite": "^6.0.0",
     "vite-tsconfig-paths": "^5.0.0",
     "vitest": "^3.0.0",
@@ -70,6 +69,6 @@
     "micromatch": "^4.0.8"
   },
   "volta": {
-    "node": "22.14.0"
+    "node": "22.17.0"
   }
 }

cli/src/commands/asset.ts

@@ -43,6 +43,7 @@ export interface UploadOptionsDto {
   concurrency: number;
   progress?: boolean;
   watch?: boolean;
+  jsonOutput?: boolean;
 }
 
 class UploadFile extends File {
@@ -65,8 +66,14 @@ class UploadFile extends File {
 const uploadBatch = async (files: string[], options: UploadOptionsDto) => {
   const { newFiles, duplicates } = await checkForDuplicates(files, options);
   const newAssets = await uploadFiles(newFiles, options);
+  if (options.jsonOutput) {
+    console.log(JSON.stringify({ newFiles, duplicates, newAssets }, undefined, 4));
+  }
   await updateAlbums([...newAssets, ...duplicates], options);
-  await deleteFiles(newFiles, options);
+  await deleteFiles(
+    newAssets.map(({ filepath }) => filepath),
+    options,
+  );
 };
 
 export const startWatch = async (

cli/src/index.ts

@@ -68,6 +68,11 @@ program
       .env('IMMICH_UPLOAD_CONCURRENCY')
       .default(4),
   )
+  .addOption(
+    new Option('-j, --json-output', 'Output detailed information in json format')
+      .env('IMMICH_JSON_OUTPUT')
+      .default(false),
+  )
   .addOption(new Option('--delete', 'Delete local assets after upload').env('IMMICH_DELETE_ASSETS'))
   .addOption(new Option('--no-progress', 'Hide progress bars').env('IMMICH_PROGRESS_BAR').default(true))
   .addOption(

docker/docker-compose.dev.yml

@@ -48,7 +48,7 @@ services:
       IMMICH_THIRD_PARTY_SOURCE_URL: https://github.com/immich-app/immich/
       IMMICH_THIRD_PARTY_BUG_FEATURE_URL: https://github.com/immich-app/immich/issues
       IMMICH_THIRD_PARTY_DOCUMENTATION_URL: https://immich.app/docs
-      IMMICH_THIRD_PARTY_SUPPORT_URL: https://immich.app/docs/third-party
+      IMMICH_THIRD_PARTY_SUPPORT_URL: https://immich.app/docs/community-guides
     ulimits:
       nofile:
         soft: 1048576
@@ -116,13 +116,13 @@ services:
 
   redis:
     container_name: immich_redis
-    image: redis:6.2-alpine@sha256:148bb5411c184abd288d9aaed139c98123eeb8824c5d3fce03cf721db58066d8
+    image: docker.io/valkey/valkey:8-bookworm@sha256:fec42f399876eb6faf9e008570597741c87ff7662a54185593e74b09ce83d177
     healthcheck:
       test: redis-cli ping || exit 1
 
   database:
     container_name: immich_postgres
-    image: tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:739cdd626151ff1f796dc95a6591b55a714f341c737e27f045019ceabf8e8c52
+    image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:5f6a838e4e44c8e0e019d0ebfe3ee8952b69afc2809b2c25f7b0119641978e91
     env_file:
       - .env
     environment:
@@ -134,25 +134,7 @@ services:
       - ${UPLOAD_LOCATION}/postgres:/var/lib/postgresql/data
     ports:
       - 5432:5432
-    healthcheck:
-      test: >-
-        pg_isready --dbname="$${POSTGRES_DB}" --username="$${POSTGRES_USER}" || exit 1;
-        Chksum="$$(psql --dbname="$${POSTGRES_DB}" --username="$${POSTGRES_USER}" --tuples-only --no-align
-        --command='SELECT COALESCE(SUM(checksum_failures), 0) FROM pg_stat_database')";
-        echo "checksum failure count is $$Chksum";
-        [ "$$Chksum" = '0' ] || exit 1
-      interval: 5m
-      start_interval: 30s
-      start_period: 5m
-    command: >-
-      postgres
-      -c shared_preload_libraries=vectors.so
-      -c 'search_path="$$user", public, vectors'
-      -c logging_collector=on
-      -c max_wal_size=2GB
-      -c shared_buffers=512MB
-      -c wal_compression=on
-
+    shm_size: 128mb
   # set IMMICH_TELEMETRY_INCLUDE=all in .env to enable metrics
   # immich-prometheus:
   #   container_name: immich_prometheus

docker/docker-compose.prod.yml

@@ -56,14 +56,14 @@ services:
 
   redis:
     container_name: immich_redis
-    image: redis:6.2-alpine@sha256:148bb5411c184abd288d9aaed139c98123eeb8824c5d3fce03cf721db58066d8
+    image: docker.io/valkey/valkey:8-bookworm@sha256:fec42f399876eb6faf9e008570597741c87ff7662a54185593e74b09ce83d177
     healthcheck:
       test: redis-cli ping || exit 1
     restart: always
 
   database:
     container_name: immich_postgres
-    image: tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:739cdd626151ff1f796dc95a6591b55a714f341c737e27f045019ceabf8e8c52
+    image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:5f6a838e4e44c8e0e019d0ebfe3ee8952b69afc2809b2c25f7b0119641978e91
     env_file:
       - .env
     environment:
@@ -75,14 +75,7 @@ services:
       - ${UPLOAD_LOCATION}/postgres:/var/lib/postgresql/data
     ports:
       - 5432:5432
-    healthcheck:
-      test: >-
-        pg_isready --dbname="$${POSTGRES_DB}" --username="$${POSTGRES_USER}" || exit 1; Chksum="$$(psql --dbname="$${POSTGRES_DB}" --username="$${POSTGRES_USER}" --tuples-only --no-align --command='SELECT COALESCE(SUM(checksum_failures), 0) FROM pg_stat_database')"; echo "checksum failure count is $$Chksum"; [ "$$Chksum" = '0' ] || exit 1
-      interval: 5m
-      start_interval: 30s
-      start_period: 5m
-    command: >-
-      postgres -c shared_preload_libraries=vectors.so -c 'search_path="$$user", public, vectors' -c logging_collector=on -c max_wal_size=2GB -c shared_buffers=512MB -c wal_compression=on
+    shm_size: 128mb
     restart: always
 
   # set IMMICH_TELEMETRY_INCLUDE=all in .env to enable metrics
@@ -90,7 +83,7 @@ services:
     container_name: immich_prometheus
     ports:
       - 9090:9090
-    image: prom/prometheus@sha256:502ad90314c7485892ce696cb14a99fceab9fc27af29f4b427f41bd39701a199
+    image: prom/prometheus@sha256:7a34573f0b9c952286b33d537f233cd5b708e12263733aa646e50c33f598f16c
     volumes:
       - ./prometheus.yml:/etc/prometheus/prometheus.yml
       - prometheus-data:/prometheus
@@ -99,10 +92,10 @@ services:
   # add data source for http://immich-prometheus:9090 to get started
   immich-grafana:
     container_name: immich_grafana
-    command: [ './run.sh', '-disable-reporting' ]
+    command: ['./run.sh', '-disable-reporting']
     ports:
       - 3000:3000
-    image: grafana/grafana:11.5.2-ubuntu@sha256:8b5858c447e06fd7a89006b562ba7bba7c4d5813600c7982374c41852adefaeb
+    image: grafana/grafana:12.0.2-ubuntu@sha256:0512d81cdeaaff0e370a9aa66027b465d1f1f04379c3a9c801a905fabbdbc7a5
     volumes:
       - grafana-data:/var/lib/grafana
 

docker/docker-compose.yml

@@ -49,30 +49,25 @@ services:
 
   redis:
     container_name: immich_redis
-    image: docker.io/redis:6.2-alpine@sha256:148bb5411c184abd288d9aaed139c98123eeb8824c5d3fce03cf721db58066d8
+    image: docker.io/valkey/valkey:8-bookworm@sha256:fec42f399876eb6faf9e008570597741c87ff7662a54185593e74b09ce83d177
     healthcheck:
       test: redis-cli ping || exit 1
     restart: always
 
   database:
     container_name: immich_postgres
-    image: docker.io/tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:739cdd626151ff1f796dc95a6591b55a714f341c737e27f045019ceabf8e8c52
+    image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:5f6a838e4e44c8e0e019d0ebfe3ee8952b69afc2809b2c25f7b0119641978e91
     environment:
       POSTGRES_PASSWORD: ${DB_PASSWORD}
       POSTGRES_USER: ${DB_USERNAME}
       POSTGRES_DB: ${DB_DATABASE_NAME}
       POSTGRES_INITDB_ARGS: '--data-checksums'
+      # Uncomment the DB_STORAGE_TYPE: 'HDD' var if your database isn't stored on SSDs
+      # DB_STORAGE_TYPE: 'HDD'
     volumes:
       # Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the .env file
       - ${DB_DATA_LOCATION}:/var/lib/postgresql/data
-    healthcheck:
-      test: >-
-        pg_isready --dbname="$${POSTGRES_DB}" --username="$${POSTGRES_USER}" || exit 1; Chksum="$$(psql --dbname="$${POSTGRES_DB}" --username="$${POSTGRES_USER}" --tuples-only --no-align --command='SELECT COALESCE(SUM(checksum_failures), 0) FROM pg_stat_database')"; echo "checksum failure count is $$Chksum"; [ "$$Chksum" = '0' ] || exit 1
-      interval: 5m
-      start_interval: 30s
-      start_period: 5m
-    command: >-
-      postgres -c shared_preload_libraries=vectors.so -c 'search_path="$$user", public, vectors' -c logging_collector=on -c max_wal_size=2GB -c shared_buffers=512MB -c wal_compression=on
+    shm_size: 128mb
     restart: always
 
 volumes:

docker/example.env

@@ -2,7 +2,8 @@
 
 # The location where your uploaded files are stored
 UPLOAD_LOCATION=./library
-# The location where your database files are stored
+
+# The location where your database files are stored. Network shares are not supported for the database
 DB_DATA_LOCATION=./postgres
 
 # To set a timezone, uncomment the next line and change Etc/UTC to a TZ identifier from this list: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List

docs/.nvmrc

@@ -1 +1 @@
-22.14.0
+22.17.0

docs/docs/FAQ.mdx

@@ -490,7 +490,7 @@ You can also scan the Postgres database file structure for errors:
 <details>
 <summary>Scan for file structure errors</summary>
 ```bash
-docker exec -it immich_postgres pg_amcheck --username=postgres --heapallindexed --parent-check --rootdescend --progress --all --install-missing
+docker exec -it immich_postgres pg_amcheck --username=<DB_USERNAME> --heapallindexed --parent-check --rootdescend --progress --all --install-missing
 ```
 
 A normal result will end something like this and return with an exit code of `0`:

docs/docs/administration/backup-and-restore.md

@@ -23,23 +23,32 @@ Refer to the official [postgres documentation](https://www.postgresql.org/docs/c
 It is not recommended to directly backup the `DB_DATA_LOCATION` folder. Doing so while the database is running can lead to a corrupted backup that cannot be restored.
 :::
 
-### Automatic Database Backups
+### Automatic Database Dumps
 
-For convenience, Immich will automatically create database backups by default. The backups are stored in `UPLOAD_LOCATION/backups`.  
-As mentioned above, you should make your own backup of these together with the asset folders as noted below.  
-You can adjust the schedule and amount of kept backups in the [admin settings](http://my.immich.app/admin/system-settings?isOpen=backup).  
-By default, Immich will keep the last 14 backups and create a new backup every day at 2:00 AM.
+:::warning
+The automatic database dumps can be used to restore the database in the event of damage to the Postgres database files.
+There is no monitoring for these dumps and you will not be notified if they are unsuccessful.
+:::
 
-#### Trigger Backup
+:::caution
+The database dumps do **NOT** contain any pictures or videos, only metadata. They are only usable with a copy of the other files in `UPLOAD_LOCATION` as outlined below.
+:::
 
-You are able to trigger a backup in the [admin job status page](http://my.immich.app/admin/jobs-status).
-Visit the page, open the "Create job" modal from the top right, select "Backup Database" and click "Confirm".
-A job will run and trigger a backup, you can verify this worked correctly by checking the logs or the backup folder.
-This backup will count towards the last X backups that will be kept based on your settings.
+For disaster-recovery purposes, Immich will automatically create database dumps. The dumps are stored in `UPLOAD_LOCATION/backups`.
+Please be sure to make your own, independent backup of the database together with the asset folders as noted below.
+You can adjust the schedule and amount of kept database dumps in the [admin settings](http://my.immich.app/admin/system-settings?isOpen=backup).
+By default, Immich will keep the last 14 database dumps and create a new dump every day at 2:00 AM.
+
+#### Trigger Dump
+
+You are able to trigger a database dump in the [admin job status page](http://my.immich.app/admin/jobs-status).
+Visit the page, open the "Create job" modal from the top right, select "Create Database Dump" and click "Confirm".
+A job will run and trigger a dump, you can verify this worked correctly by checking the logs or the `backups/` folder.
+This dumps will count towards the last `X` dumps that will be kept based on your settings.
 
 #### Restoring
 
-We hope to make restoring simpler in future versions, for now you can find the backups in the `UPLOAD_LOCATION/backups` folder on your host.  
+We hope to make restoring simpler in future versions, for now you can find the database dumps in the `UPLOAD_LOCATION/backups` folder on your host.
 Then please follow the steps in the following section for restoring the database.
 
 ### Manual Backup and Restore
@@ -48,7 +57,7 @@ Then please follow the steps in the following section for restoring the database
   <TabItem value="Linux system" label="Linux system" default>
 
 ```bash title='Backup'
-docker exec -t immich_postgres pg_dumpall --clean --if-exists --username=postgres | gzip > "/path/to/backup/dump.sql.gz"
+docker exec -t immich_postgres pg_dumpall --clean --if-exists --username=<DB_USERNAME> | gzip > "/path/to/backup/dump.sql.gz"
 ```
 
 ```bash title='Restore'
@@ -70,7 +79,7 @@ docker compose up -d            # Start remainder of Immich apps
   <TabItem value="Windows system (PowerShell)" label="Windows system (PowerShell)">
 
 ```powershell title='Backup'
-[System.IO.File]::WriteAllLines("C:\absolute\path\to\backup\dump.sql", (docker exec -t immich_postgres pg_dumpall --clean --if-exists --username=postgres))
+[System.IO.File]::WriteAllLines("C:\absolute\path\to\backup\dump.sql", (docker exec -t immich_postgres pg_dumpall --clean --if-exists --username=<DB_USERNAME>))
 ```
 
 ```powershell title='Restore'
@@ -141,12 +150,10 @@ for more info read the [release notes](https://github.com/immich-app/immich/rele
   - Preview images (small thumbnails and large previews) for each asset and thumbnails for recognized faces.
   - Stored in `UPLOAD_LOCATION/thumbs/<userID>`.
 - **Encoded Assets:**
-
   - Videos that have been re-encoded from the original for wider compatibility. The original is not removed.
   - Stored in `UPLOAD_LOCATION/encoded-video/<userID>`.
 
 - **Postgres**
-
   - The Immich database containing all the information to allow the system to function properly.  
     **Note:** This folder will only appear to users who have made the changes mentioned in [v1.102.0](https://github.com/immich-app/immich/discussions/8930) (an optional, non-mandatory change) or who started with this version.
   - Stored in `DB_DATA_LOCATION`.
@@ -192,7 +199,6 @@ When you turn off the storage template engine, it will leave the assets in `UPLO
   - Temporarily located in `UPLOAD_LOCATION/upload/<userID>`.
   - Transferred to `UPLOAD_LOCATION/library/<userID>` upon successful upload.
 - **Postgres**
-
   - The Immich database containing all the information to allow the system to function properly.  
     **Note:** This folder will only appear to users who have made the changes mentioned in [v1.102.0](https://github.com/immich-app/immich/discussions/8930) (an optional, non-mandatory change) or who started with this version.
   - Stored in `DB_DATA_LOCATION`.
@@ -210,3 +216,10 @@ When you turn off the storage template engine, it will leave the assets in `UPLO
 Do not touch the files inside these folders under any circumstances except taking a backup. Changing or removing an asset can cause untracked and missing files.
 You can think of it as App-Which-Must-Not-Be-Named, the only access to viewing, changing and deleting assets is only through the mobile or browser interface.
 :::
+
+## Backup ordering
+
+A backup of Immich should contain both the database and the asset files. When backing these up it's possible for them to get out of sync, potentially resulting in broken assets after you restore.  
+The best way of dealing with this is to stop the immich-server container while you take a backup. If nothing is changing then the backup will always be in sync.
+
+If stopping the container is not an option, then the recommended order is to back up the database first, and the filesystem second. This way, the worst case scenario is that there are files on the filesystem that the database doesn't know about. If necessary, these can be (re)uploaded manually after a restore. If the backup is done the other way around, with the filesystem first and the database second, it's possible for the restored database to reference files that aren't in the filesystem backup, thus resulting in broken assets.

docs/docs/administration/oauth.md

@@ -20,7 +20,6 @@ Immich supports 3rd party authentication via [OpenID Connect][oidc] (OIDC), an i
 Before enabling OAuth in Immich, a new client application needs to be configured in the 3rd-party authentication server. While the specifics of this setup vary from provider to provider, the general approach should be the same.
 
 1. Create a new (Client) Application
-
    1. The **Provider** type should be `OpenID Connect` or `OAuth2`
    2. The **Client type** should be `Confidential`
    3. The **Application** type should be `Web`
@@ -29,7 +28,6 @@ Before enabling OAuth in Immich, a new client application needs to be configured
 2. Configure Redirect URIs/Origins
 
    The **Sign-in redirect URIs** should include:
-
    - `app.immich:///oauth-callback` - for logging in with OAuth from the [Mobile App](/docs/features/mobile-app.mdx)
    - `http://DOMAIN:PORT/auth/login` - for logging in with OAuth from the Web Client
    - `http://DOMAIN:PORT/user-settings` - for manually linking OAuth in the Web Client
@@ -37,21 +35,17 @@ Before enabling OAuth in Immich, a new client application needs to be configured
    Redirect URIs should contain all the domains you will be using to access Immich. Some examples include:
 
    Mobile
-
    - `app.immich:///oauth-callback` (You **MUST** include this for iOS and Android mobile apps to work properly)
 
    Localhost
-
    - `http://localhost:2283/auth/login`
    - `http://localhost:2283/user-settings`
 
    Local IP
-
    - `http://192.168.0.200:2283/auth/login`
    - `http://192.168.0.200:2283/user-settings`
 
    Hostname
-
    - `https://immich.example.com/auth/login`
    - `https://immich.example.com/user-settings`
 
@@ -68,6 +62,7 @@ Once you have a new OAuth client application configured, Immich can be configure
 | Scope                                                | string  | openid email profile | Full list of scopes to send with the request (space delimited)                      |
 | Signing Algorithm                                    | string  | RS256                | The algorithm used to sign the id token (examples: RS256, HS256)                    |
 | Storage Label Claim                                  | string  | preferred_username   | Claim mapping for the user's storage label**¹**                                     |
+| Role Claim                                           | string  | immich_role          | Claim mapping for the user's role. (should return "user" or "admin")**¹**           |
 | Storage Quota Claim                                  | string  | immich_quota         | Claim mapping for the user's storage**¹**                                           |
 | Default Storage Quota (GiB)                          | number  | 0                    | Default quota for user without storage quota claim (Enter 0 for unlimited quota)    |
 | Button Text                                          | string  | Login with OAuth     | Text for the OAuth button on the web                                                |
@@ -93,6 +88,7 @@ The `.well-known/openid-configuration` part of the url is optional and will be a
 ## Auto Launch
 
 When Auto Launch is enabled, the login page will automatically redirect the user to the OAuth authorization url, to login with OAuth. To access the login screen again, use the browser's back button, or navigate directly to `/auth/login?autoLaunch=0`.
+Auto Launch can also be enabled on a per-request basis by navigating to `/auth/login?authLaunch=1`, this can be useful in situations where Immich is called from e.g. Nextcloud using the _External sites_ app and the _oidc_ app so as to enable users to directly interact with a logged-in instance of Immich.
 
 ## Mobile Redirect URI
 

docs/docs/administration/postgres-standalone.md

@@ -10,12 +10,16 @@ Running with a pre-existing Postgres server can unlock powerful administrative f
 
 ## Prerequisites
 
-You must install pgvecto.rs into your instance of Postgres using their [instructions][vectors-install]. After installation, add `shared_preload_libraries = 'vectors.so'` to your `postgresql.conf`. If you already have some `shared_preload_libraries` set, you can separate each extension with a comma. For example, `shared_preload_libraries = 'pg_stat_statements, vectors.so'`.
+You must install `pgvector` (`>= 0.7.0, < 1.0.0`), as it is a prerequisite for `vchord`.
+The easiest way to do this on Debian/Ubuntu is by adding the [PostgreSQL Apt repository][pg-apt] and then
+running `apt install postgresql-NN-pgvector`, where `NN` is your Postgres version (e.g., `16`).
+
+You must install VectorChord into your instance of Postgres using their [instructions][vchord-install]. After installation, add `shared_preload_libraries = 'vchord.so'` to your `postgresql.conf`. If you already have some `shared_preload_libraries` set, you can separate each extension with a comma. For example, `shared_preload_libraries = 'pg_stat_statements, vchord.so'`.
 
 :::note
-Immich is known to work with Postgres versions 14, 15, and 16. Earlier versions are unsupported. Postgres 17 is nominally compatible, but pgvecto.rs does not have prebuilt images or packages for it as of writing.
+Immich is known to work with Postgres versions `>= 14, < 18`.
 
-Make sure the installed version of pgvecto.rs is compatible with your version of Immich. The current accepted range for pgvecto.rs is `>= 0.2.0, < 0.4.0`.
+Make sure the installed version of VectorChord is compatible with your version of Immich. The current accepted range for VectorChord is `>= 0.3.0, < 0.5.0`.
 :::
 
 ## Specifying the connection URL
@@ -53,21 +57,99 @@ CREATE DATABASE <immichdatabasename>;
 \c <immichdatabasename>
 BEGIN;
 ALTER DATABASE <immichdatabasename> OWNER TO <immichdbusername>;
-CREATE EXTENSION vectors;
+CREATE EXTENSION vchord CASCADE;
 CREATE EXTENSION earthdistance CASCADE;
-ALTER DATABASE <immichdatabasename> SET search_path TO "$user", public, vectors;
-ALTER SCHEMA vectors OWNER TO <immichdbusername>;
 COMMIT;
 ```
 
-### Updating pgvecto.rs
+### Updating VectorChord
 
-When installing a new version of pgvecto.rs, you will need to manually update the extension by connecting to the Immich database and running `ALTER EXTENSION vectors UPDATE;`.
+When installing a new version of VectorChord, you will need to manually update the extension and reindex by connecting to the Immich database and running:
 
-### Common errors
+```
+ALTER EXTENSION vchord UPDATE;
+REINDEX INDEX face_index;
+REINDEX INDEX clip_index;
+```
 
-#### Permission denied for view
+## Migrating to VectorChord
 
-If you get the error `driverError: error: permission denied for view pg_vector_index_stat`, you can fix this by connecting to the Immich database and running `GRANT SELECT ON TABLE pg_vector_index_stat TO <immichdbusername>;`.
+VectorChord is the successor extension to pgvecto.rs, allowing for higher performance, lower memory usage and higher quality results for smart search and facial recognition.
 
-[vectors-install]: https://docs.vectorchord.ai/getting-started/installation.html
+### Migrating from pgvecto.rs
+
+Support for pgvecto.rs will be dropped in a later release, hence we recommend all users currently using pgvecto.rs to migrate to VectorChord at their convenience. There are two primary approaches to do so.
+
+The easiest option is to have both extensions installed during the migration:
+
+<details>
+<summary>Migration steps (automatic)</summary>
+1. Ensure you still have pgvecto.rs installed
+2. Install `pgvector` (`>= 0.7.0, < 1.0.0`). The easiest way to do this is on Debian/Ubuntu by adding the [PostgreSQL Apt repository][pg-apt] and then running `apt install postgresql-NN-pgvector`, where `NN` is your Postgres version (e.g., `16`)
+3. [Install VectorChord][vchord-install]
+4. Add `shared_preload_libraries= 'vchord.so, vectors.so'` to your `postgresql.conf`, making sure to include _both_ `vchord.so` and `vectors.so`. You may include other libraries here as well if needed
+5. Restart the Postgres database
+6. If Immich does not have superuser permissions, run the SQL command `CREATE EXTENSION vchord CASCADE;` using psql or your choice of database client
+7. Start Immich and wait for the logs `Reindexed face_index` and `Reindexed clip_index` to be output
+8. If Immich does not have superuser permissions, run the SQL command `DROP EXTENSION vectors;`
+9. Drop the old schema by running `DROP SCHEMA vectors;`
+10. Remove the `vectors.so` entry from the `shared_preload_libraries` setting
+11. Restart the Postgres database
+12. Uninstall pgvecto.rs (e.g. `apt-get purge vectors-pg14` on Debian-based environments, replacing `pg14` as appropriate). `pgvector` must remain installed as it provides the data types used by `vchord`
+
+</details>
+
+If it is not possible to have both VectorChord and pgvecto.rs installed at the same time, you can perform the migration with more manual steps:
+
+<details>
+<summary>Migration steps (manual)</summary>
+1. While pgvecto.rs is still installed, run the following SQL command using psql or your choice of database client. Take note of the number outputted by this command as you will need it later
+
+```sql
+SELECT atttypmod as dimsize
+    FROM pg_attribute f
+    JOIN pg_class c ON c.oid = f.attrelid
+    WHERE c.relkind = 'r'::char
+    AND f.attnum > 0
+    AND c.relname = 'smart_search'::text
+    AND f.attname = 'embedding'::text;
+```
+
+2. Remove references to pgvecto.rs using the below SQL commands
+
+```sql
+DROP INDEX IF EXISTS clip_index;
+DROP INDEX IF EXISTS face_index;
+ALTER TABLE smart_search ALTER COLUMN embedding SET DATA TYPE real[];
+ALTER TABLE face_search ALTER COLUMN embedding SET DATA TYPE real[];
+```
+
+3. [Install VectorChord][vchord-install]
+4. Change the columns back to the appropriate vector types, replacing `<number>` with the number from step 1
+
+```sql
+CREATE EXTENSION IF NOT EXISTS vchord CASCADE;
+ALTER TABLE smart_search ALTER COLUMN embedding SET DATA TYPE vector(<number>);
+ALTER TABLE face_search ALTER COLUMN embedding SET DATA TYPE vector(512);
+```
+
+5. Start Immich and let it create new indices using VectorChord
+
+</details>
+
+### Migrating from pgvector
+
+<details>
+<summary>Migration steps</summary>
+1. Ensure you have at least 0.7.0 of pgvector installed. If it is below that, please upgrade it and run the SQL command `ALTER EXTENSION vector UPDATE;` using psql or your choice of database client
+2. Follow the Prerequisites to install VectorChord
+3. If Immich does not have superuser permissions, run the SQL command `CREATE EXTENSION vchord CASCADE;`
+4. Remove the `DB_VECTOR_EXTENSION=pgvector` environmental variable as it will make Immich still use pgvector if set
+5. Start Immich and let it create new indices using VectorChord
+
+</details>
+
+Note that VectorChord itself uses pgvector types, so you should not uninstall pgvector after following these steps.
+
+[vchord-install]: https://docs.vectorchord.ai/vectorchord/getting-started/installation.html
+[pg-apt]: https://www.postgresql.org/download/linux/#generic

docs/docs/administration/reverse-proxy.md

@@ -22,7 +22,7 @@ server {
     client_max_body_size 50000M;
 
     # Set headers
-    proxy_set_header Host              $http_host;
+    proxy_set_header Host              $host;
     proxy_set_header X-Real-IP         $remote_addr;
     proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
     proxy_set_header X-Forwarded-Proto $scheme;

docs/docs/administration/user-management.mdx

@@ -31,7 +31,7 @@ Admin can send a welcome email if the Email option is set, you can learn here ho
 
 Admin can specify the storage quota for the user as the instance's admin; once the limit is reached, the user won't be able to upload to the instance anymore.
 
-In order to select a storage quota, click on the pencil icon and enter the storage quota in GiB. You can choose an unlimited quota using the value 0 (default).
+In order to select a storage quota, click on the pencil icon and enter the storage quota in GiB. You can choose an unlimited quota by leaving it empty (default).
 
 :::tip
 The system administrator can see the usage quota percentage of all users in Server Stats page.

docs/docs/developer/database-migrations.md

@@ -1,14 +1,14 @@
 # Database Migrations
 
-After making any changes in the `server/src/entities`, a database migration need to run in order to register the changes in the database. Follow the steps below to create a new migration.
+After making any changes in the `server/src/schema`, a database migration need to run in order to register the changes in the database. Follow the steps below to create a new migration.
 
 1. Run the command
 
 ```bash
-npm run typeorm:migrations:generate <migration-name>
+npm run migrations:generate <migration-name>
 ```
 
 2. Check if the migration file makes sense.
-3. Move the migration file to folder `./server/src/migrations` in your code editor.
+3. Move the migration file to folder `./server/src/schema/migrations` in your code editor.
 
 The server will automatically detect `*.ts` file changes and restart. Part of the server start-up process includes running any new migrations, so it will be applied immediately.

docs/docs/developer/devcontainers.md

@@ -0,0 +1,476 @@
+---
+title: Devcontainers
+sidebar_position: 3
+---
+
+# Development with Dev Containers
+
+Dev Containers provide a consistent, reproducible development environment using Docker containers. With a single click, you can get started with an Immich development environment on Mac, Linux, Windows, or in the cloud using GitHub Codespaces.
+
+[![Open in VSCode Containers](https://img.shields.io/static/v1?label=VSCode%20DevContainer&message=Immich&color=blue)](https://vscode.dev/redirect?url=vscode://ms-vscode-remote.remote-containers/cloneInVolume?url=https://github.com/immich-app/immich/)
+
+[![Open in GitHub Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/immich-app/immich/)
+
+[Learn more about Dev Containers](https://docs.github.com/en/codespaces/setting-up-your-project-for-codespaces/adding-a-dev-container-configuration/introduction-to-dev-containers)
+
+## Prerequisites
+
+Before getting started, ensure you have:
+
+- **Docker Desktop** (latest version)
+  - [Mac](https://docs.docker.com/desktop/install/mac-install/)
+  - [Windows](https://docs.docker.com/desktop/install/windows-install/) (with WSL2 backend recommended)
+  - [Linux](https://docs.docker.com/desktop/install/linux-install/)
+- **Visual Studio Code** with the [Dev Containers extension](https://marketplace.visualstudio.com/items?itemName=ms-vscode-remote.remote-containers)
+- **Git** for cloning the repository
+- At least **8GB of RAM** (16GB recommended)
+- **20GB of free disk space**
+
+:::tip Alternative Development Environments
+While this guide focuses on VS Code, you have many options for Dev Container development:
+
+**Local Editors:**
+
+- [IntelliJ IDEA](https://www.jetbrains.com/help/idea/connect-to-devcontainer.html) - Full JetBrains IDE support
+- [neovim](https://github.com/jamestthompson3/nvim-remote-containers) - Lightweight terminal-based editor
+- [Emacs](https://github.com/emacs-lsp/lsp-docker) - Extensible text editor
+- [DevContainer CLI](https://github.com/devcontainers/cli) - Command-line interface
+
+**Cloud-Based Solutions:**
+
+- [GitHub Codespaces](https://github.com/features/codespaces) - Fully integrated with GitHub, excellent devcontainer.json support
+- [GitPod](https://www.gitpod.io) - SaaS platform with recent Dev Container support (historically used gitpod.yml)
+
+**Self-Hostable Options:**
+
+- [Coder](https://coder.com) - Enterprise-focused, requires Terraform knowledge, self-managed
+- [DevPod](https://devpod.sh) - Client-only tool with excellent devcontainer.json support, works with any provider (local, cloud, or on-premise)
+  :::
+
+## Dev Container Services
+
+The Dev Container environment consists of the following services:
+
+| Service          | Container Name            | Description                                               | Ports                                                                   |
+| ---------------- | ------------------------- | --------------------------------------------------------- | ----------------------------------------------------------------------- |
+| Server & Web     | `immich-server`           | Runs both API server and web frontend in development mode | 2283 (API)<br/>3000 (Web)<br/>9230 (Workers Debug)<br/>9231 (API Debug) |
+| Database         | `database`                | PostgreSQL database                                       | 5432                                                                    |
+| Cache            | `redis`                   | Valkey cache server                                       | 6379                                                                    |
+| Machine Learning | `immich-machine-learning` | Immich ML model inference server                          | 3003                                                                    |
+
+## Getting Started
+
+### Step 1: Clone the Repository
+
+```bash
+git clone https://github.com/immich-app/immich.git
+cd immich
+```
+
+### Step 2: Configure Environment Variables
+
+The immich dev containers read environment variables from your shell environment, not from `.env` files. This allows them to work in cloud environments without pre-configuration.
+
+:::important Required Configuration
+When running locally, and if you want to create (or use an existing) DB and/or photo storage folder, you must set the `UPLOAD_LOCATION` variable in your shell environment before launching the Dev Container. This determines where uploaded files are stored and also where the DB stores it data.
+
+```bash
+# Set temporarily for current session
+export UPLOAD_LOCATION=/opt/dev_upload_folder
+
+# Or add to your shell profile for persistence
+# (~/.bashrc, ~/.zshrc, ~/.bash_profile, etc.)
+echo 'export UPLOAD_LOCATION=/opt/dev_upload_folder' >> ~/.bashrc
+source ~/.bashrc
+```
+
+:::
+
+### Step 3: Launch the Dev Container
+
+#### Using VS Code UI:
+
+1. Open the cloned repository in VS Code
+2. Press `F1` or `Ctrl/Cmd+Shift+P` to open the command palette
+3. Type and select "Dev Containers: Rebuild and Reopen in Container"
+4. Select "Immich - Backend, Frontend and ML" from the list
+5. Wait for the container to build and start (this may take several minutes on first run)
+
+#### Using VS Code Quick Actions:
+
+1. Open the repository in VS Code
+2. You should see a popup asking if you want to reopen in a container
+3. Click "Reopen in Container"
+
+#### Using Command Line:
+
+```bash
+# Using the DevContainer CLI
+devcontainer up --workspace-folder .
+```
+
+## Environment Variable Details
+
+### How Dev Containers Handle Environment Variables
+
+Unlike the Immich developer setup based on Docker Compose which uses `.env` files, Immich Dev Containers read environment variables from your shell environment. This is configured in `.devcontainer/devcontainer.json`:
+
+```json
+"remoteEnv": {
+    "UPLOAD_LOCATION": "${localEnv:UPLOAD_LOCATION:./Library}",
+    "DB_PASSWORD": "${localEnv:DB_PASSWORD:postgres}",
+    "DB_USERNAME": "${localEnv:DB_USERNAME:postgres}",
+    "DB_DATABASE_NAME": "${localEnv:DB_DATABASE_NAME:immich}"
+}
+```
+
+The `${localEnv:VARIABLE:default}` syntax reads from your shell environment with optional defaults.
+
+### Upload Location Path Resolution
+
+The `UPLOAD_LOCATION` environment variable controls where files are stored:
+
+**Default:** `./Library` (relative to the `docker` directory)
+**Resolved to:** `<immich-root>/docker/Library`
+
+**Bind Mounts Created:**
+
+```yaml
+# From .devcontainer/server/container-compose-overrides.yml
+- ${UPLOAD_LOCATION-./Library}/photos:/workspaces/immich/server/upload
+- ${UPLOAD_LOCATION-./Library}/postgres:/var/lib/postgresql/data
+```
+
+### Database Configuration
+
+These variables have sensible defaults (for development) but can be customized:
+
+| Variable           | Default    | Description         |
+| ------------------ | ---------- | ------------------- |
+| `DB_PASSWORD`      | `postgres` | PostgreSQL password |
+| `DB_USERNAME`      | `postgres` | PostgreSQL username |
+| `DB_DATABASE_NAME` | `immich`   | Database name       |
+
+### Setting Environment Variables
+
+Add these to your shell profile (`~/.bashrc`, `~/.zshrc`, `~/.bash_profile`, etc.):
+
+```bash
+# Required
+export UPLOAD_LOCATION=./Library  # or absolute path
+
+# Optional (only if using non-default values)
+export DB_PASSWORD=your_password
+export DB_USERNAME=your_username
+export DB_DATABASE_NAME=your_database
+```
+
+Remember to reload your shell configuration:
+
+```bash
+source ~/.bashrc  # or ~/.zshrc, etc.
+```
+
+## Git Configuration
+
+### SSH Keys and Authentication
+
+To use your SSH keys for GitHub access inside the Dev Container:
+
+1. **Start SSH Agent** on your host machine:
+
+   ```bash
+   eval "$(ssh-agent -s)"
+   ssh-add ~/.ssh/id_rsa  # or your key path
+   ```
+
+2. **VS Code automatically forwards your SSH agent** to the container
+
+For detailed instructions, see the [VS Code guide on sharing Git credentials](https://code.visualstudio.com/remote/advancedcontainers/sharing-git-credentials).
+
+### Commit Signing
+
+To use your SSH key for commit signing, see the [GitHub guide on SSH commit signing](https://docs.github.com/en/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key#telling-git-about-your-ssh-key).
+
+## Development Workflow
+
+### Automatic Setup
+
+When the Dev Container starts, it automatically:
+
+1. **Runs post-create script** (`container-server-post-create.sh`):
+   - Adjusts file permissions for the `node` user
+   - Installs dependencies: `npm install` in all packages
+   - Builds TypeScript SDK: `npm run build` in `open-api/typescript-sdk`
+
+2. **Starts development servers** via VS Code tasks:
+   - `Immich API Server (Nest)` - API server with hot-reloading on port 2283
+   - `Immich Web Server (Vite)` - Web frontend with hot-reloading on port 3000
+   - Both servers watch for file changes and recompile automatically
+
+3. **Configures port forwarding**:
+   - Web UI: http://localhost:3000 (opens automatically)
+   - API: http://localhost:2283
+   - Debug ports: 9230 (workers), 9231 (API)
+
+:::info
+The Dev Container setup replaces the `make dev` command from the traditional setup. All services start automatically when you open the container.
+:::
+
+### Accessing Services
+
+Once running, you can access:
+
+| Service  | URL                   | Description                                                                                    |
+| -------- | --------------------- | ---------------------------------------------------------------------------------------------- |
+| Web UI   | http://localhost:3000 | Main web interface                                                                             |
+| API      | http://localhost:2283 | REST API endpoints (Not used directly, web UI will expose this over http://localhost:3000/api) |
+| Database | localhost:5432        | PostgreSQL (username: `postgres`) (Not used directly)                                          |
+
+### Connecting Mobile Apps
+
+To connect the mobile app to your Dev Container:
+
+1. Find your machine's IP address
+2. In the mobile app, use: `http://YOUR_IP:3000/api`
+3. Ensure your firewall allows connections on port 2283
+
+### Making Code Changes
+
+- **Server code** (`/server`): Changes trigger automatic restart
+- **Web code** (`/web`): Changes trigger hot module replacement
+- **Database migrations**: Run `npm run sync:sql` in the server directory
+- **API changes**: Regenerate TypeScript SDK with `make open-api`
+
+## Testing
+
+### Running Tests
+
+The Dev Container supports multiple ways to run tests:
+
+#### Using Make Commands (Recommended)
+
+```bash
+# Run tests for specific components
+make test-server         # Server unit tests
+make test-web           # Web unit tests
+make test-e2e           # End-to-end tests
+make test-cli           # CLI tests
+
+# Run all tests
+make test-all           # Runs tests for all components
+
+# Medium tests (integration tests)
+make test-medium-dev    # End-to-end tests
+```
+
+#### Using NPM Directly
+
+```bash
+# Server tests
+cd /workspaces/immich/server
+npm test                # Run all tests
+npm run test:watch     # Watch mode
+npm run test:cov       # Coverage report
+
+# Web tests
+cd /workspaces/immich/web
+npm test               # Run all tests
+npm run test:watch     # Watch mode
+
+# E2E tests
+cd /workspaces/immich/e2e
+npm run test           # Run API tests
+npm run test:web       # Run web UI tests
+```
+
+### Code Quality Commands
+
+```bash
+# Linting
+make lint-server        # Lint server code
+make lint-web          # Lint web code
+make lint-all          # Lint all components
+
+# Formatting
+make format-server      # Format server code
+make format-web        # Format web code
+make format-all        # Format all code
+
+# Type checking
+make check-server       # Type check server
+make check-web         # Type check web
+make check-all         # Check all components
+
+# Complete hygiene check
+make hygiene-all       # Runs lint, format, check, SQL sync, and audit
+```
+
+### Additional Make Commands
+
+```bash
+# Build commands
+make build-server       # Build server
+make build-web         # Build web app
+make build-all         # Build everything
+
+# API generation
+make open-api          # Generate OpenAPI specs
+make open-api-typescript # Generate TypeScript SDK
+make open-api-dart     # Generate Dart SDK
+
+# Database
+make sql               # Sync database schema
+
+# Dependencies
+make install-server    # Install server dependencies
+make install-web      # Install web dependencies
+make install-all      # Install all dependencies
+```
+
+### Debugging
+
+The Dev Container is pre-configured for debugging:
+
+1. **API Server Debugging**:
+   - Set breakpoints in VS Code
+   - Press `F5` or use "Run and Debug" panel
+   - Select "Attach to Server" configuration
+   - Debug port: 9231
+
+2. **Worker Debugging**:
+   - Use "Attach to Workers" configuration
+   - Debug port: 9230
+
+3. **Web Debugging**:
+   - Use browser DevTools
+   - VS Code debugger for Chrome/Edge extensions supported
+
+## Troubleshooting
+
+### Common Issues
+
+#### Permission Errors
+
+**Problem**: `EACCES` or permission denied errors  
+**Solution**:
+
+- The Dev Container runs as the `node` user (UID 1000)
+- If your host UID differs, you may see permission issues
+- Try rebuilding the container: "Dev Containers: Rebuild Container"
+
+#### Container Won't Start
+
+**Problem**: Dev Container fails to start or build  
+**Solution**:
+
+1. Check Docker is running: `docker ps`
+2. Clean Docker resources: `docker system prune -a`
+3. Check available disk space
+4. Review Docker Desktop resource limits
+
+#### Port Already in Use
+
+**Problem**: "Port 3000/2283 is already in use"  
+**Solution**:
+
+1. Check for conflicting services: `lsof -i :3000` (macOS/Linux)
+2. Stop conflicting services or change port mappings
+3. Restart Docker Desktop
+
+#### Upload Location Not Set
+
+**Problem**: Errors about missing UPLOAD_LOCATION  
+**Solution**:
+
+1. Set the environment variable: `export UPLOAD_LOCATION=./Library`
+2. Add to your shell profile for persistence
+3. Restart your terminal and VS Code
+
+#### Database Connection Failed
+
+**Problem**: Cannot connect to PostgreSQL  
+**Solution**:
+
+1. Ensure all containers are running: `docker ps`
+2. Check logs: "Dev Containers: Show Container Log"
+3. Verify database credentials match environment variables
+
+### Getting Help
+
+If you encounter issues:
+
+1. Check container logs: View → Output → Select "Dev Containers"
+2. Rebuild without cache: "Dev Containers: Rebuild Container Without Cache"
+3. Review [common Docker issues](https://docs.docker.com/desktop/troubleshoot/)
+4. Ask in [Discord](https://discord.immich.app) `#help-desk-support` channel
+
+## Mobile Development
+
+While the Dev Container focuses on server and web development, you can connect mobile apps for testing:
+
+### Connecting iOS/Android Apps
+
+1. **Ensure API is accessible**:
+
+   ```bash
+   # Find your machine's IP
+   # macOS
+   ipconfig getifaddr en0
+   # Linux
+   hostname -I
+   # Windows (in WSL2)
+   ip addr show eth0
+   ```
+
+2. **Configure mobile app**:
+   - Server URL: `http://YOUR_IP:2283/api`
+   - Ensure firewall allows port 2283
+
+3. **For full mobile development**, see the [mobile development guide](/docs/developer/setup) which covers:
+   - Flutter setup
+   - Running on simulators/devices
+   - Mobile-specific debugging
+
+## Advanced Configuration
+
+### Custom VS Code Extensions
+
+Add extensions to `.devcontainer/devcontainer.json`:
+
+```json
+"customizations": {
+  "vscode": {
+    "extensions": [
+      "your.extension-id"
+    ]
+  }
+}
+```
+
+### Additional Services
+
+To add services (e.g., Redis Commander), modify:
+
+1. `/docker/docker-compose.dev.yml` - Add service definition
+2. `/.devcontainer/server/container-compose-overrides.yml` - Add overrides if needed
+
+### Resource Limits
+
+Adjust Docker Desktop resources:
+
+- **macOS/Windows**: Docker Desktop → Settings → Resources
+- **Linux**: Modify Docker daemon configuration
+
+Recommended minimums:
+
+- CPU: 4 cores
+- Memory: 8GB
+- Disk: 20GB
+
+## Next Steps
+
+- Read the [architecture overview](/docs/developer/architecture)
+- Learn about [database migrations](/docs/developer/database-migrations)
+- Explore [API documentation](/docs/api)
+- Join `#immich` on [Discord](https://discord.immich.app)

docs/docs/developer/setup.md

@@ -63,22 +63,41 @@ If you only want to do web development connected to an existing, remote backend,
 IMMICH_SERVER_URL=https://demo.immich.app/ npm run dev
 ```
 
+If you're using PowerShell on Windows you may need to set the env var separately like so:
+
+```powershell
+$env:IMMICH_SERVER_URL = "https://demo.immich.app/"
+npm run dev
+```
+
 #### `@immich/ui`
 
 To see local changes to `@immich/ui` in Immich, do the following:
 
 1. Install `@immich/ui` as a sibling to `immich/`, for example `/home/user/immich` and `/home/user/ui`
-1. Build the `@immich/ui` project via `npm run build`
-1. Uncomment the corresponding volume in web service of the `docker/docker-compose.dev.yaml` file (`../../ui:/usr/ui`)
-1. Uncomment the corresponding alias in the `web/vite.config.js` file (`'@immich/ui': path.resolve(\_\_dirname, '../../ui')`)
-1. Start up the stack via `make dev`
-1. After making changes in `@immich/ui`, rebuild it (`npm run build`)
+2. Build the `@immich/ui` project via `npm run build`
+3. Uncomment the corresponding volume in web service of the `docker/docker-compose.dev.yaml` file (`../../ui:/usr/ui`)
+4. Uncomment the corresponding alias in the `web/vite.config.js` file (`'@immich/ui': path.resolve(\_\_dirname, '../../ui')`)
+5. Uncomment the import statement in `web/src/app.css` file `@import '/usr/ui/dist/theme/default.css';` and comment out `@import '@immich/ui/theme/default.css';`
+6. Start up the stack via `make dev`
+7. After making changes in `@immich/ui`, rebuild it (`npm run build`)
 
 ### Mobile app
 
-The mobile app `(/mobile)` will required Flutter toolchain 3.13.x and FVM to be installed on your system.
+#### Setup
 
-Please refer to the [Flutter's official documentation](https://flutter.dev/docs/get-started/install) for more information on setting up the toolchain on your machine.
+1. Setup Flutter toolchain using FVM.
+2. Run `flutter pub get` to install the dependencies.
+3. Run `make translation` to generate the translation file.
+4. Run `fvm flutter run` to start the app.
+
+#### Translation
+
+To add a new translation text, enter the key-value pair in the `i18n/en.json` in the root of the immich project. Then, from the `mobile/` directory, run
+
+```bash
+make translation
+```
 
 The mobile app asks you what backend to connect to. You can utilize the demo backend (https://demo.immich.app/) if you don't need to change server code or upload photos. Alternatively, you can run the server yourself per the instructions above.
 
@@ -96,32 +115,72 @@ Note: Activating the license is not required.
 
 ### VSCode
 
-Install `Flutter`, `DCM`, `Prettier`, `ESLint` and `Svelte` extensions.
+Install `Flutter`, `DCM`, `Prettier`, `ESLint` and `Svelte` extensions. These extensions are listed in the `extensions.json` file under `.vscode/` and should appear as workspace recommendations.
 
-in User `settings.json` (`cmd + shift + p` and search for `Open User Settings JSON`) add the following:
+Here are the settings we use, they should be active as workspace settings (`settings.json`):
 
 ```json title="settings.json"
 {
-  "editor.formatOnSave": true,
-  "[javascript][typescript][css]": {
+  "[css]": {
     "editor.defaultFormatter": "esbenp.prettier-vscode",
-    "editor.tabSize": 2,
-    "editor.formatOnSave": true
-  },
-  "[svelte]": {
-    "editor.defaultFormatter": "svelte.svelte-vscode",
+    "editor.formatOnSave": true,
     "editor.tabSize": 2
   },
-  "svelte.enable-ts-plugin": true,
-  "eslint.validate": ["javascript", "svelte"],
   "[dart]": {
+    "editor.defaultFormatter": "Dart-Code.dart-code",
     "editor.formatOnSave": true,
     "editor.selectionHighlight": false,
     "editor.suggest.snippetsPreventQuickSuggestions": false,
     "editor.suggestSelection": "first",
     "editor.tabCompletion": "onlySnippets",
-    "editor.wordBasedSuggestions": "off",
-    "editor.defaultFormatter": "Dart-Code.dart-code"
-  }
+    "editor.wordBasedSuggestions": "off"
+  },
+  "[javascript]": {
+    "editor.codeActionsOnSave": {
+      "source.organizeImports": "explicit",
+      "source.removeUnusedImports": "explicit"
+    },
+    "editor.defaultFormatter": "esbenp.prettier-vscode",
+    "editor.formatOnSave": true,
+    "editor.tabSize": 2
+  },
+  "[json]": {
+    "editor.defaultFormatter": "esbenp.prettier-vscode",
+    "editor.formatOnSave": true,
+    "editor.tabSize": 2
+  },
+  "[jsonc]": {
+    "editor.defaultFormatter": "esbenp.prettier-vscode",
+    "editor.formatOnSave": true,
+    "editor.tabSize": 2
+  },
+  "[svelte]": {
+    "editor.codeActionsOnSave": {
+      "source.organizeImports": "explicit",
+      "source.removeUnusedImports": "explicit"
+    },
+    "editor.defaultFormatter": "svelte.svelte-vscode",
+    "editor.formatOnSave": true,
+    "editor.tabSize": 2
+  },
+  "[typescript]": {
+    "editor.codeActionsOnSave": {
+      "source.organizeImports": "explicit",
+      "source.removeUnusedImports": "explicit"
+    },
+    "editor.defaultFormatter": "esbenp.prettier-vscode",
+    "editor.formatOnSave": true,
+    "editor.tabSize": 2
+  },
+  "cSpell.words": ["immich"],
+  "editor.formatOnSave": true,
+  "eslint.validate": ["javascript", "svelte"],
+  "explorer.fileNesting.enabled": true,
+  "explorer.fileNesting.patterns": {
+    "*.dart": "${capture}.g.dart,${capture}.gr.dart,${capture}.drift.dart",
+    "*.ts": "${capture}.spec.ts,${capture}.mock.ts"
+  },
+  "svelte.enable-ts-plugin": true,
+  "typescript.preferences.importModuleSpecifier": "non-relative"
 }
 ```

docs/docs/features/casting.md

@@ -0,0 +1,19 @@
+# Chromecast support
+
+Immich supports the Google's Cast protocol so that photos and videos can be cast to devices such as a Chromecast and a Nest Hub. This feature is considered experimental and has several important limitations listed below. Currently, this feature is only supported by the web client, support on Android and iOS is planned for the future.
+
+## Enable Google Cast Support
+
+Google Cast support is disabled by default. The web UI uses Google-provided scripts and must retreive them from Google servers when the page loads. This is a privacy concern for some and is thus opt-in.
+
+You can enable Google Cast support through `Account Settings > Features > Cast > Google Cast`
+
+<img src={require('./img/gcast-enable.webp').default} width="70%" title='Enable Google Cast Support' />
+
+## Limitations
+
+To use casting with Immich, there are a few prerequisites:
+
+1. Your instance must be accessed via an HTTPS connection in order for the casting menu to show.
+2. Your instance must be publicly accessible via HTTPS and a DNS record for the server must be accessible via Google's DNS servers (`8.8.8.8` and `8.8.4.4`)
+3. Videos must be in a format that is compatible with Google Cast. For more info, check out [Google's documentation](https://developers.google.com/cast/docs/media)

docs/docs/features/command-line-interface.md

@@ -42,6 +42,12 @@ docker run -it -v "$(pwd)":/import:ro -e IMMICH_INSTANCE_URL=https://your-immich
 
 Please modify the `IMMICH_INSTANCE_URL` and `IMMICH_API_KEY` environment variables as suitable. You can also use a Docker env file to store your sensitive API key.
 
+This `docker run` command will directly run the command `immich` inside the container. You can directly append the desired parameters (see under "usage") to the commandline like this:
+
+```bash
+docker run -it -v "$(pwd)":/import:ro -e IMMICH_INSTANCE_URL=https://your-immich-instance/api -e IMMICH_API_KEY=your-api-key ghcr.io/immich-app/immich-cli:latest upload -a -c 5 --recursive directory/
+```
+
 ## Usage
 
 <details>
@@ -84,19 +90,22 @@ Usage: immich upload [paths...] [options]
 Upload assets
 
 Arguments:
-paths                       One or more paths to assets to be uploaded
+  paths                       One or more paths to assets to be uploaded
 
 Options:
--r, --recursive             Recursive (default: false, env: IMMICH_RECURSIVE)
--i, --ignore [paths...]     Paths to ignore (default: [], env: IMMICH_IGNORE_PATHS)
--h, --skip-hash             Don't hash files before upload (default: false, env: IMMICH_SKIP_HASH)
--H, --include-hidden        Include hidden folders (default: false, env: IMMICH_INCLUDE_HIDDEN)
--a, --album                 Automatically create albums based on folder name (default: false, env: IMMICH_AUTO_CREATE_ALBUM)
--A, --album-name <name>     Add all assets to specified album (env: IMMICH_ALBUM_NAME)
--n, --dry-run               Don't perform any actions, just show what will be done (default: false, env: IMMICH_DRY_RUN)
--c, --concurrency <number>  Number of assets to upload at the same time (default: 4, env: IMMICH_UPLOAD_CONCURRENCY)
---delete                    Delete local assets after upload (env: IMMICH_DELETE_ASSETS)
---help                      display help for command
+  -r, --recursive             Recursive (default: false, env: IMMICH_RECURSIVE)
+  -i, --ignore <pattern>      Pattern to ignore (env: IMMICH_IGNORE_PATHS)
+  -h, --skip-hash             Don't hash files before upload (default: false, env: IMMICH_SKIP_HASH)
+  -H, --include-hidden        Include hidden folders (default: false, env: IMMICH_INCLUDE_HIDDEN)
+  -a, --album                 Automatically create albums based on folder name (default: false, env: IMMICH_AUTO_CREATE_ALBUM)
+  -A, --album-name <name>     Add all assets to specified album (env: IMMICH_ALBUM_NAME)
+  -n, --dry-run               Don't perform any actions, just show what will be done (default: false, env: IMMICH_DRY_RUN)
+  -c, --concurrency <number>  Number of assets to upload at the same time (default: 4, env: IMMICH_UPLOAD_CONCURRENCY)
+  -j, --json-output           Output detailed information in json format (default: false, env: IMMICH_JSON_OUTPUT)
+  --delete                    Delete local assets after upload (env: IMMICH_DELETE_ASSETS)
+  --no-progress               Hide progress bars (env: IMMICH_PROGRESS_BAR)
+  --watch                     Watch for changes and upload automatically (default: false, env: IMMICH_WATCH_CHANGES)
+  --help                      display help for command
 ```
 
 </details>
@@ -112,7 +121,7 @@ You begin by authenticating to your Immich server. For instance:
 immich login http://192.168.1.216:2283/api HFEJ38DNSDUEG
 ```
 
-This will store your credentials in a `auth.yml` file in the configuration directory which defaults to `~/.config/`. The directory can be set with the `-d` option or the environment variable `IMMICH_CONFIG_DIR`. Please keep the file secure, either by performing the logout command after you are done, or deleting it manually.
+This will store your credentials in a `auth.yml` file in the configuration directory which defaults to `~/.config/immich/`. The directory can be set with the `-d` option or the environment variable `IMMICH_CONFIG_DIR`. Please keep the file secure, either by performing the logout command after you are done, or deleting it manually.
 
 Once you are authenticated, you can upload assets to your Immich server.
 
@@ -166,6 +175,16 @@ By default, hidden files are skipped. If you want to include hidden files, use t
 immich upload --include-hidden --recursive directory/
 ```
 
+You can use the `--json-output` option to get a json printed which includes
+three keys: `newFiles`, `duplicates` and `newAssets`. Due to some logging
+output you will need to strip the first three lines of output to get the json.
+For example to get a list of files that would be uploaded for further
+processing:
+
+```bash
+immich upload --dry-run . | tail -n +4 | jq .newFiles[]
+```
+
 ### Obtain the API Key
 
 The API key can be obtained in the user setting panel on the web interface.

docs/docs/features/hardware-transcoding.md

@@ -121,6 +121,6 @@ Once this is done, you can continue to step 3 of "Basic Setup".
 
 [hw-file]: https://github.com/immich-app/immich/releases/latest/download/hwaccel.transcoding.yml
 [nvct]: https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/latest/install-guide.html
-[jellyfin-lp]: https://jellyfin.org/docs/general/administration/hardware-acceleration/intel/#configure-and-verify-lp-mode-on-linux
-[jellyfin-kernel-bug]: https://jellyfin.org/docs/general/administration/hardware-acceleration/intel/#known-issues-and-limitations
+[jellyfin-lp]: https://jellyfin.org/docs/general/post-install/transcoding/hardware-acceleration/intel#low-power-encoding
+[jellyfin-kernel-bug]: https://jellyfin.org/docs/general/post-install/transcoding/hardware-acceleration/intel#known-issues-and-limitations-on-linux
 [libmali-rockchip]: https://github.com/tsukumijima/libmali-rockchip/releases

docs/docs/features/libraries.md

@@ -72,7 +72,7 @@ In rare cases, the library watcher can hang, preventing Immich from starting up.
 
 ### Nightly job
 
-There is an automatic scan job that is scheduled to run once a day. This job also cleans up any libraries stuck in deletion. It is possible to trigger the cleanup by clicking "Scan all libraries" in the library managment page.
+There is an automatic scan job that is scheduled to run once a day. This job also cleans up any libraries stuck in deletion. It is possible to trigger the cleanup by clicking "Scan all libraries" in the library management page.
 
 ## Usage
 
@@ -112,12 +112,15 @@ _Remember to run `docker compose up -d` to register the changes. Make sure you c
 
 These actions must be performed by the Immich administrator.
 
-- Click on Administration -> Libraries
-- Click on Create External Library
+- Click on your avatar on the upper right corner
+- Click on Administration -> External Libraries
+- Click on Create an external library…
 - Select which user owns the library, this can not be changed later
 - Enter `/mnt/media/christmas-trip` then click Add
 - Click on Save
 - Click the drop-down menu on the newly created library
+- Click on Scan
+- Click the drop-down menu on the newly created library
 - Click on Rename Library and rename it to "Christmas Trip"
 
 NOTE: We have to use the `/mnt/media/christmas-trip` path and not the `/mnt/nas/christmas-trip` path since all paths have to be what the Docker containers see.

docs/docs/features/ml-hardware-acceleration.md

@@ -42,7 +42,7 @@ You do not need to redo any machine learning jobs after enabling hardware accele
 
 - The GPU must have compute capability 5.2 or greater.
 - The server must have the official NVIDIA driver installed.
-- The installed driver must be >= 535 (it must support CUDA 12.2).
+- The installed driver must be >= 545 (it must support CUDA 12.3).
 - On Linux (except for WSL2), you also need to have [NVIDIA Container Toolkit][nvct] installed.
 
 #### ROCm
@@ -71,7 +71,7 @@ You do not need to redo any machine learning jobs after enabling hardware accele
 
 1. If you do not already have it, download the latest [`hwaccel.ml.yml`][hw-file] file and ensure it's in the same folder as the `docker-compose.yml`.
 2. In the `docker-compose.yml` under `immich-machine-learning`, uncomment the `extends` section and change `cpu` to the appropriate backend.
-3. Still in `immich-machine-learning`, add one of -[armnn, cuda, rocm, openvino] to the `image` section's tag at the end of the line.
+3. Still in `immich-machine-learning`, add one of -[armnn, cuda, rocm, openvino, rknn] to the `image` section's tag at the end of the line.
 4. Redeploy the `immich-machine-learning` container with these updated settings.
 
 ### Confirming Device Usage

docs/docs/features/searching.md

@@ -5,7 +5,7 @@ import TabItem from '@theme/TabItem';
 
 Immich uses Postgres as its search database for both metadata and contextual CLIP search.
 
-Contextual CLIP search is powered by the [pgvecto.rs](https://github.com/tensorchord/pgvecto.rs) extension, utilizing machine learning models like [CLIP](https://openai.com/research/clip) to provide relevant search results. This allows for freeform searches without requiring specific keywords in the image or video metadata.
+Contextual CLIP search is powered by the [VectorChord](https://github.com/tensorchord/VectorChord) extension, utilizing machine learning models like [CLIP](https://openai.com/research/clip) to provide relevant search results. This allows for freeform searches without requiring specific keywords in the image or video metadata.
 
 ## Advanced Search Filters
 
@@ -45,7 +45,7 @@ Some search examples:
 </TabItem>
   <TabItem value="Mobile" label="Mobile">
 
-<img src={require('./img/moblie-smart-serach.webp').default} width="30%" title='Smart search on mobile' />
+<img src={require('./img/mobile-smart-search.webp').default} width="30%" title='Smart search on mobile' />
 
 </TabItem>
 </Tabs>
@@ -56,7 +56,20 @@ Navigating to `Administration > Settings > Machine Learning Settings > Smart Sea
 
 ### CLIP models
 
-More powerful models can be used for more accurate search results, but are slower and can require more server resources. Check the dropdowns below to see how they compare in memory usage, speed and quality by language.
+The default search model is fast, but there are many other options that can provide better search results. The tradeoff of using these models is that they're slower and/or use more memory (both when indexing images with background Smart Search jobs and when searching).
+
+The first step of choosing the right model for you is to know which languages your users will search in.
+
+If your users will only search in English, then the [CLIP][huggingface-clip] section is the first place to look. This is a curated list of the models that generally perform the best for their size class. The models here are ordered from higher to lower quality. This means that the top models will generally rank the most relevant results higher and have a higher capacity to understand descriptive, detailed, and/or niche queries. The models are also generally ordered from larger to smaller, so consider the impact on memory usage, job processing and search speed when deciding on one. The smaller models in this list are not too different in quality and many times faster.
+
+[Multilingual models][huggingface-multilingual-clip] are also available so users can search in their native language. Use these models if you expect non-English searches to be common. They can be separated into two search patterns:
+
+- `nllb` models expect the search query to be in the language specified in the user settings
+- `xlm` and `siglip2` models understand search text regardless of the current language setting
+
+`nllb` models tend to perform the best and are recommended when users primarily searches in their native, non-English language. `xlm` and `siglip2` models are more flexible and are recommended for mixed language search, where the same user might search in different languages at different times.
+
+For more details, check the tables below to see how they compare in memory usage, speed and quality by language.
 
 Once you've chosen a model, follow these steps:
 
@@ -79,9 +92,9 @@ Memory and execution time estimates were obtained without acceleration on a 7800
 
 **Execution Time (ms)**: After warming up the model with one pass, the mean execution time of 100 passes with the same input.
 
-**Memory (MiB)**: The peak RSS usage of the process afer performing the above timing benchmark. Does not include image decoding, concurrent processing, the web server, etc., which are relatively constant factors.
+**Memory (MiB)**: The peak RSS usage of the process after performing the above timing benchmark. Does not include image decoding, concurrent processing, the web server, etc., which are relatively constant factors.
 
-**Recall (%)**: Evaluated on Crossmodal-3600, the average of the recall@1, recall@5 and recall@10 results for zeroshot image retrieval.
+**Recall (%)**: Evaluated on Crossmodal-3600, the average of the recall@1, recall@5 and recall@10 results for zeroshot image retrieval. Chinese (Simplified), English, French, German, Italian, Japanese, Korean, Polish, Russian, Spanish and Turkish are additionally tested on XTD-10. Chinese (Simplified) and English are additionally tested on Flickr30k. The recall metrics are the average across all tested datasets.
 
 **Pareto Optimal**: Whether the model is not completely outclassed by another model. Try to use models that are optimal for the languages relevant to you. Specifically, for a given model and language, if there's another model that's better for that language in at least one respect (memory usage, execution time, recall) while being at least as good for that language in every other way, then the model is not optimal for that language.
 
@@ -93,59 +106,59 @@ Memory and execution time estimates were obtained without acceleration on a 7800
 <summary>English</summary>
 | Model                                                | Memory (MiB) | Execution Time (ms) | Recall (%) | Pareto Optimal |
 |------------------------------------------------------|--------------|---------------------|------------|----------------|
-| ViT-H-14-378-quickgelu__dfn5b                        | 5049         | 108.4               | 75.73      | ✅             |
-| ViT-L-16-SigLIP2-512__webli                          | 3358         | 92.59               | 75.44      | ✅             |
-| ViT-B-16-SigLIP2__webli                              | 3038         | 5.81                | 75.19      | ✅             |
-| ViT-SO400M-16-SigLIP2-384__webli                     | 3854         | 56.57               | 75.09      | ❌             |
-| ViT-SO400M-16-SigLIP2-512__webli                     | 4050         | 107.67              | 75.07      | ❌             |
-| ViT-H-14-quickgelu__dfn5b                            | 4701         | 38.74               | 75.01      | ❌             |
-| ViT-L-16-SigLIP2-384__webli                          | 3057         | 51.7                | 74.92      | ❌             |
-| ViT-gopt-16-SigLIP2-384__webli                       | 6585         | 146.84              | 74.9       | ❌             |
-| ViT-SO400M-14-SigLIP2-378__webli                     | 3940         | 72.25               | 74.87      | ❌             |
-| ViT-SO400M-16-SigLIP2-256__webli                     | 3611         | 27.84               | 74.87      | ❌             |
-| ViT-SO400M-14-SigLIP2__webli                         | 3622         | 27.63               | 74.77      | ❌             |
-| ViT-gopt-16-SigLIP2-256__webli                       | 6475         | 64.51               | 74.28      | ❌             |
-| ViT-L-16-SigLIP2-256__webli                          | 2830         | 23.77               | 74.26      | ✅             |
-| ViT-B-32-SigLIP2-256__webli                          | 3061         | 3.31                | 73.15      | ✅             |
-| ViT-L-14-quickgelu__dfn2b                            | 2212         | 20.49               | 72.78      | ✅             |
-| ViT-SO400M-14-SigLIP-384__webli                      | 4417         | 72.19               | 72.58      | ❌             |
-| ViT-L-16-SigLIP-384__webli                           | 3396         | 47.6                | 72.57      | ❌             |
-| ViT-B-16-SigLIP-512__webli                           | 1828         | 26.17               | 72.47      | ✅             |
-| ViT-B-16-SigLIP-384__webli                           | 1128         | 13.53               | 72.45      | ✅             |
-| ViT-L-16-SigLIP-256__webli                           | 3160         | 23.84               | 72.44      | ❌             |
-| nllb-clip-large-siglip__mrl                          | 4248         | 75.44               | 72.37      | ❌             |
-| ViT-B-16-SigLIP__webli                               | 1081         | 5.77                | 71.64      | ✅             |
-| ViT-B-16-SigLIP-256__webli                           | 1102         | 7.11                | 71.63      | ❌             |
-| XLM-Roberta-Large-ViT-H-14__frozen_laion5b_s13b_b90k | 4014         | 39.14               | 71.45      | ❌             |
-| ViT-H-14__laion2b-s32b-b79k                          | 4676         | 39.06               | 71.33      | ❌             |
-| nllb-clip-large-siglip__v1                           | 4226         | 75.05               | 71.19      | ❌             |
-| ViT-L-14__laion2b-s32b-b82k                          | 2233         | 20.56               | 69.86      | ❌             |
-| nllb-clip-base-siglip__mrl                           | 4696         | 16.95               | 69.66      | ❌             |
-| ViT-B-16-SigLIP-i18n-256__webli                      | 3029         | 6.87                | 69.38      | ❌             |
-| ViT-B-32__laion2b-s34b-b79k                          | 1001         | 2.29                | 68.78      | ✅             |
-| ViT-L-14__laion400m_e31                              | 2183         | 19.87               | 68.53      | ❌             |
-| ViT-B-16-plus-240__laion400m_e32                     | 1246         | 6.95                | 68.53      | ❌             |
-| ViT-B-16-plus-240__laion400m_e31                     | 1263         | 6.94                | 68.53      | ❌             |
-| ViT-L-14__laion400m_e32                              | 2218         | 19.73               | 68.51      | ❌             |
-| nllb-clip-base-siglip__v1                            | 4675         | 15.17               | 68.41      | ❌             |
-| ViT-B-32__laion2b_e16                                | 1004         | 2.38                | 68.41      | ❌             |
-| XLM-Roberta-Base-ViT-B-32__laion5b_s13b_b90k         | 3030         | 3.2                 | 68.33      | ❌             |
-| ViT-B-16__laion400m_e31                              | 991          | 5.04                | 66.96      | ✅             |
-| ViT-B-16__laion400m_e32                              | 975          | 4.98                | 66.95      | ✅             |
-| ViT-B-32__laion400m_e31                              | 999          | 2.28                | 65.65      | ✅             |
-| ViT-B-32__laion400m_e32                              | 1003         | 2.35                | 65.49      | ❌             |
-| ViT-L-14__openai                                     | 2212         | 19.91               | 60.12      | ❌             |
-| ViT-B-32__openai                                     | 1004         | 2.26                | 59.37      | ✅             |
-| RN50x64__openai                                      | 5079         | 48.79               | 59.36      | ❌             |
-| RN50x16__openai                                      | 2221         | 15.87               | 59.17      | ❌             |
-| ViT-L-14-336__openai                                 | 2616         | 43.45               | 59.09      | ❌             |
-| RN50__openai                                         | 913          | 2.39                | 58.32      | ✅             |
-| ViT-B-16__openai                                     | 985          | 5.03                | 58.27      | ❌             |
-| RN50x4__openai                                       | 1416         | 5.85                | 57.88      | ❌             |
-| RN50__cc12m                                          | 914          | 2.37                | 57.75      | ✅             |
-| RN101__openai                                        | 1111         | 3.21                | 57.7       | ❌             |
-| RN101__yfcc15m                                       | 1111         | 3.22                | 50.11      | ❌             |
-| RN50__yfcc15m                                        | 908          | 2.34                | 48.28      | ✅             |
+| ViT-SO400M-16-SigLIP2-384__webli                     | 3854         | 56.57               | 85.99      | ✅             |
+| ViT-SO400M-14-SigLIP2-378__webli                     | 3940         | 72.25               | 85.96      | ❌             |
+| ViT-gopt-16-SigLIP2-384__webli                       | 6585         | 146.84              | 85.96      | ❌             |
+| ViT-SO400M-16-SigLIP2-512__webli                     | 4050         | 107.67              | 85.93      | ❌             |
+| ViT-H-14-378-quickgelu__dfn5b                        | 5049         | 108.4               | 85.78      | ❌             |
+| ViT-L-16-SigLIP2-512__webli                          | 3358         | 92.59               | 85.75      | ✅             |
+| ViT-SO400M-16-SigLIP2-256__webli                     | 3611         | 27.84               | 85.62      | ✅             |
+| ViT-SO400M-14-SigLIP2__webli                         | 3622         | 27.63               | 85.53      | ✅             |
+| ViT-gopt-16-SigLIP2-256__webli                       | 6475         | 64.51               | 85.48      | ❌             |
+| ViT-L-16-SigLIP2-384__webli                          | 3057         | 51.7                | 85.47      | ✅             |
+| ViT-H-14-quickgelu__dfn5b                            | 4701         | 38.74               | 85.09      | ❌             |
+| ViT-L-16-SigLIP2-256__webli                          | 2830         | 23.77               | 85.03      | ✅             |
+| ViT-B-16-SigLIP2__webli                              | 3038         | 5.81                | 84.86      | ✅             |
+| ViT-SO400M-14-SigLIP-384__webli                      | 4417         | 72.19               | 84.61      | ❌             |
+| ViT-L-16-SigLIP-384__webli                           | 3396         | 47.6                | 84.17      | ❌             |
+| ViT-L-16-SigLIP-256__webli                           | 3160         | 23.84               | 83.51      | ❌             |
+| ViT-B-16-SigLIP-512__webli                           | 1828         | 26.17               | 83.28      | ✅             |
+| nllb-clip-large-siglip__v1                           | 4226         | 75.05               | 83.24      | ❌             |
+| nllb-clip-large-siglip__mrl                          | 4248         | 75.44               | 83.23      | ❌             |
+| ViT-B-16-SigLIP-384__webli                           | 1128         | 13.53               | 83.19      | ✅             |
+| ViT-L-14-quickgelu__dfn2b                            | 2212         | 20.49               | 82.54      | ❌             |
+| XLM-Roberta-Large-ViT-H-14__frozen_laion5b_s13b_b90k | 4014         | 39.14               | 82.43      | ❌             |
+| ViT-H-14__laion2b-s32b-b79k                          | 4676         | 39.06               | 82.36      | ❌             |
+| ViT-B-32-SigLIP2-256__webli                          | 3061         | 3.31                | 82.28      | ✅             |
+| ViT-B-16-SigLIP__webli                               | 1081         | 5.77                | 81.9       | ✅             |
+| ViT-B-16-SigLIP-256__webli                           | 1102         | 7.11                | 81.9       | ❌             |
+| ViT-L-14__laion2b-s32b-b82k                          | 2233         | 20.56               | 80.82      | ❌             |
+| nllb-clip-base-siglip__mrl                           | 4696         | 16.95               | 80.65      | ❌             |
+| nllb-clip-base-siglip__v1                            | 4675         | 15.17               | 80.16      | ❌             |
+| ViT-B-16-SigLIP-i18n-256__webli                      | 3029         | 6.87                | 79.78      | ❌             |
+| ViT-L-14__laion400m_e31                              | 2183         | 19.87               | 78.64      | ❌             |
+| ViT-L-14__laion400m_e32                              | 2218         | 19.73               | 78.6       | ❌             |
+| ViT-B-16-plus-240__laion400m_e32                     | 1246         | 6.95                | 78.06      | ❌             |
+| ViT-B-16-plus-240__laion400m_e31                     | 1263         | 6.94                | 78.06      | ❌             |
+| ViT-B-32__laion2b-s34b-b79k                          | 1001         | 2.29                | 77.62      | ✅             |
+| ViT-B-32__laion2b_e16                                | 1004         | 2.38                | 77.47      | ❌             |
+| XLM-Roberta-Base-ViT-B-32__laion5b_s13b_b90k         | 3030         | 3.2                 | 76.91      | ❌             |
+| ViT-B-16__laion400m_e32                              | 975          | 4.98                | 76.43      | ✅             |
+| ViT-B-16__laion400m_e31                              | 991          | 5.04                | 76.35      | ❌             |
+| ViT-B-32__laion400m_e31                              | 999          | 2.28                | 73.83      | ✅             |
+| ViT-B-32__laion400m_e32                              | 1003         | 2.35                | 73.62      | ❌             |
+| RN50x64__openai                                      | 5079         | 48.79               | 73.34      | ❌             |
+| ViT-L-14__openai                                     | 2212         | 19.91               | 72.99      | ❌             |
+| ViT-L-14-336__openai                                 | 2616         | 43.45               | 72.76      | ❌             |
+| RN50x16__openai                                      | 2221         | 15.87               | 72.59      | ❌             |
+| RN50x4__openai                                       | 1416         | 5.85                | 70.8       | ❌             |
+| ViT-B-16__openai                                     | 985          | 5.03                | 70.01      | ❌             |
+| ViT-B-32__openai                                     | 1004         | 2.26                | 69.9       | ✅             |
+| RN101__openai                                        | 1111         | 3.21                | 69.3       | ❌             |
+| RN50__openai                                         | 913          | 2.39                | 69.02      | ✅             |
+| RN50__cc12m                                          | 914          | 2.37                | 64.59      | ✅             |
+| RN101__yfcc15m                                       | 1111         | 3.22                | 55.21      | ❌             |
+| RN50__yfcc15m                                        | 908          | 2.34                | 53.63      | ✅             |
 </details>
 <details>
 <summary>Arabic</summary>
@@ -156,8 +169,8 @@ Memory and execution time estimates were obtained without acceleration on a 7800
 | nllb-clip-base-siglip__mrl                           | 4696         | 16.95               | 74.03      | ✅             |
 | nllb-clip-base-siglip__v1                            | 4675         | 15.17               | 73.19      | ✅             |
 | ViT-SO400M-16-SigLIP2-384__webli                     | 3854         | 56.57               | 69.31      | ✅             |
-| ViT-SO400M-16-SigLIP2-512__webli                     | 4050         | 107.67              | 69.29      | ❌             |
 | ViT-SO400M-14-SigLIP2-378__webli                     | 3940         | 72.25               | 69.29      | ❌             |
+| ViT-SO400M-16-SigLIP2-512__webli                     | 4050         | 107.67              | 69.29      | ❌             |
 | ViT-SO400M-16-SigLIP2-256__webli                     | 3611         | 27.84               | 68.64      | ✅             |
 | ViT-L-16-SigLIP2-512__webli                          | 3358         | 92.59               | 68.35      | ✅             |
 | ViT-L-16-SigLIP2-384__webli                          | 3057         | 51.7                | 68.25      | ✅             |
@@ -195,25 +208,25 @@ Memory and execution time estimates were obtained without acceleration on a 7800
 <summary>Chinese (Simplified)</summary>
 | Model                                                | Memory (MiB) | Execution Time (ms) | Recall (%) | Pareto Optimal |
 |------------------------------------------------------|--------------|---------------------|------------|----------------|
-| nllb-clip-large-siglip__v1                           | 4226         | 75.05               | 77.49      | ✅             |
-| XLM-Roberta-Large-ViT-H-14__frozen_laion5b_s13b_b90k | 4014         | 39.14               | 77.19      | ✅             |
-| nllb-clip-large-siglip__mrl                          | 4248         | 75.44               | 76.98      | ❌             |
-| nllb-clip-base-siglip__mrl                           | 4696         | 16.95               | 72.89      | ✅             |
-| nllb-clip-base-siglip__v1                            | 4675         | 15.17               | 72.65      | ✅             |
-| XLM-Roberta-Base-ViT-B-32__laion5b_s13b_b90k         | 3030         | 3.2                 | 72.52      | ✅             |
-| ViT-gopt-16-SigLIP2-384__webli                       | 6585         | 146.84              | 67.83      | ❌             |
-| ViT-SO400M-16-SigLIP2-512__webli                     | 4050         | 107.67              | 67.81      | ❌             |
-| ViT-gopt-16-SigLIP2-256__webli                       | 6475         | 64.51               | 67.51      | ❌             |
-| ViT-L-16-SigLIP2-512__webli                          | 3358         | 92.59               | 67.39      | ❌             |
-| ViT-SO400M-16-SigLIP2-384__webli                     | 3854         | 56.57               | 67.33      | ❌             |
-| ViT-SO400M-14-SigLIP2-378__webli                     | 3940         | 72.25               | 67.23      | ❌             |
-| ViT-L-16-SigLIP2-384__webli                          | 3057         | 51.7                | 67.05      | ❌             |
-| ViT-B-16-SigLIP-i18n-256__webli                      | 3029         | 6.87                | 66.87      | ✅             |
-| ViT-SO400M-16-SigLIP2-256__webli                     | 3611         | 27.84               | 66.24      | ❌             |
-| ViT-L-16-SigLIP2-256__webli                          | 2830         | 23.77               | 66.1       | ✅             |
-| ViT-SO400M-14-SigLIP2__webli                         | 3622         | 27.63               | 65.56      | ❌             |
-| ViT-B-16-SigLIP2__webli                              | 3038         | 5.81                | 64.39      | ❌             |
-| ViT-B-32-SigLIP2-256__webli                          | 3061         | 3.31                | 62.56      | ❌             |
+| nllb-clip-large-siglip__v1                           | 4226         | 75.05               | 79.7       | ✅             |
+| nllb-clip-large-siglip__mrl                          | 4248         | 75.44               | 78.94      | ❌             |
+| XLM-Roberta-Large-ViT-H-14__frozen_laion5b_s13b_b90k | 4014         | 39.14               | 75.22      | ✅             |
+| nllb-clip-base-siglip__v1                            | 4675         | 15.17               | 74.8       | ✅             |
+| nllb-clip-base-siglip__mrl                           | 4696         | 16.95               | 73.91      | ❌             |
+| ViT-gopt-16-SigLIP2-384__webli                       | 6585         | 146.84              | 72.8       | ❌             |
+| ViT-SO400M-16-SigLIP2-512__webli                     | 4050         | 107.67              | 72.77      | ❌             |
+| ViT-SO400M-14-SigLIP2-378__webli                     | 3940         | 72.25               | 72.41      | ✅             |
+| ViT-SO400M-16-SigLIP2-384__webli                     | 3854         | 56.57               | 72.36      | ✅             |
+| ViT-gopt-16-SigLIP2-256__webli                       | 6475         | 64.51               | 71.59      | ❌             |
+| ViT-L-16-SigLIP2-512__webli                          | 3358         | 92.59               | 71.37      | ✅             |
+| ViT-SO400M-16-SigLIP2-256__webli                     | 3611         | 27.84               | 71.3       | ✅             |
+| ViT-L-16-SigLIP2-384__webli                          | 3057         | 51.7                | 71.11      | ✅             |
+| ViT-SO400M-14-SigLIP2__webli                         | 3622         | 27.63               | 70.95      | ✅             |
+| ViT-L-16-SigLIP2-256__webli                          | 2830         | 23.77               | 70.51      | ✅             |
+| ViT-B-16-SigLIP-i18n-256__webli                      | 3029         | 6.87                | 67.48      | ✅             |
+| ViT-B-16-SigLIP2__webli                              | 3038         | 5.81                | 66.84      | ✅             |
+| XLM-Roberta-Base-ViT-B-32__laion5b_s13b_b90k         | 3030         | 3.2                 | 65.7       | ✅             |
+| ViT-B-32-SigLIP2-256__webli                          | 3061         | 3.31                | 63.38      | ❌             |
 </details>
 <details>
 <summary>Croatian</summary>
@@ -324,8 +337,8 @@ Memory and execution time estimates were obtained without acceleration on a 7800
 |------------------------------------------------------|--------------|---------------------|------------|----------------|
 | ViT-SO400M-16-SigLIP2-512__webli                     | 4050         | 107.67              | 80.05      | ✅             |
 | ViT-gopt-16-SigLIP2-384__webli                       | 6585         | 146.84              | 79.81      | ❌             |
-| ViT-SO400M-14-SigLIP2-378__webli                     | 3940         | 72.25               | 79.72      | ❌             |
 | ViT-SO400M-16-SigLIP2-384__webli                     | 3854         | 56.57               | 79.72      | ✅             |
+| ViT-SO400M-14-SigLIP2-378__webli                     | 3940         | 72.25               | 79.72      | ❌             |
 | ViT-L-16-SigLIP2-512__webli                          | 3358         | 92.59               | 79.64      | ✅             |
 | ViT-L-16-SigLIP2-384__webli                          | 3057         | 51.7                | 79.49      | ✅             |
 | nllb-clip-large-siglip__mrl                          | 4248         | 75.44               | 79.41      | ❌             |
@@ -357,8 +370,8 @@ Memory and execution time estimates were obtained without acceleration on a 7800
 | ViT-L-14__laion400m_e32                              | 2218         | 19.73               | 29.56      | ❌             |
 | ViT-B-32__laion2b-s34b-b79k                          | 1001         | 2.29                | 29.54      | ✅             |
 | ViT-B-32__laion2b_e16                                | 1004         | 2.38                | 29.36      | ❌             |
-| ViT-B-16-plus-240__laion400m_e31                     | 1263         | 6.94                | 27.76      | ❌             |
 | ViT-B-16-plus-240__laion400m_e32                     | 1246         | 6.95                | 27.76      | ❌             |
+| ViT-B-16-plus-240__laion400m_e31                     | 1263         | 6.94                | 27.76      | ❌             |
 | ViT-B-16__laion400m_e32                              | 975          | 4.98                | 25.67      | ✅             |
 | ViT-B-32__laion400m_e32                              | 1003         | 2.35                | 25.59      | ❌             |
 | ViT-B-16__laion400m_e31                              | 991          | 5.04                | 25.53      | ❌             |
@@ -384,8 +397,8 @@ Memory and execution time estimates were obtained without acceleration on a 7800
 | ViT-SO400M-16-SigLIP2-384__webli | 3854         | 56.57               | 34.27      | ❌             |
 | ViT-SO400M-14-SigLIP2__webli     | 3622         | 27.63               | 34.14      | ❌             |
 | ViT-SO400M-16-SigLIP2-256__webli | 3611         | 27.84               | 33.98      | ❌             |
-| ViT-L-16-SigLIP2-512__webli      | 3358         | 92.59               | 30.57      | ❌             |
 | ViT-L-16-SigLIP2-384__webli      | 3057         | 51.7                | 30.57      | ❌             |
+| ViT-L-16-SigLIP2-512__webli      | 3358         | 92.59               | 30.57      | ❌             |
 | ViT-L-16-SigLIP2-256__webli      | 2830         | 23.77               | 30.05      | ✅             |
 | ViT-L-16-SigLIP-384__webli       | 3396         | 47.6                | 24.92      | ❌             |
 | ViT-L-16-SigLIP-256__webli       | 3160         | 23.84               | 24.02      | ❌             |
@@ -422,110 +435,111 @@ Memory and execution time estimates were obtained without acceleration on a 7800
 <summary>French</summary>
 | Model                                                | Memory (MiB) | Execution Time (ms) | Recall (%) | Pareto Optimal |
 |------------------------------------------------------|--------------|---------------------|------------|----------------|
-| ViT-SO400M-16-SigLIP2-512__webli                     | 4050         | 107.67              | 88.01      | ✅             |
-| ViT-H-14-378-quickgelu__dfn5b                        | 5049         | 108.4               | 87.74      | ❌             |
-| ViT-SO400M-14-SigLIP2-378__webli                     | 3940         | 72.25               | 87.69      | ✅             |
-| ViT-SO400M-16-SigLIP2-384__webli                     | 3854         | 56.57               | 87.6       | ✅             |
-| ViT-H-14-quickgelu__dfn5b                            | 4701         | 38.74               | 87.58      | ✅             |
-| ViT-L-16-SigLIP2-512__webli                          | 3358         | 92.59               | 87.51      | ✅             |
-| ViT-gopt-16-SigLIP2-384__webli                       | 6585         | 146.84              | 87.23      | ❌             |
-| ViT-L-16-SigLIP2-384__webli                          | 3057         | 51.7                | 86.9       | ✅             |
-| ViT-SO400M-16-SigLIP2-256__webli                     | 3611         | 27.84               | 86.9       | ✅             |
-| ViT-SO400M-14-SigLIP2__webli                         | 3622         | 27.63               | 86.44      | ✅             |
-| ViT-gopt-16-SigLIP2-256__webli                       | 6475         | 64.51               | 86.44      | ❌             |
-| nllb-clip-large-siglip__mrl                          | 4248         | 75.44               | 86.28      | ❌             |
-| nllb-clip-large-siglip__v1                           | 4226         | 75.05               | 86.11      | ❌             |
-| ViT-L-16-SigLIP2-256__webli                          | 2830         | 23.77               | 86.08      | ✅             |
-| XLM-Roberta-Large-ViT-H-14__frozen_laion5b_s13b_b90k | 4014         | 39.14               | 84.49      | ❌             |
-| ViT-B-16-SigLIP2__webli                              | 3038         | 5.81                | 84.3       | ✅             |
-| ViT-L-14-quickgelu__dfn2b                            | 2212         | 20.49               | 83.03      | ✅             |
-| nllb-clip-base-siglip__mrl                           | 4696         | 16.95               | 82.93      | ❌             |
-| ViT-B-32-SigLIP2-256__webli                          | 3061         | 3.31                | 82.27      | ✅             |
-| nllb-clip-base-siglip__v1                            | 4675         | 15.17               | 82.14      | ❌             |
-| ViT-L-16-SigLIP-384__webli                           | 3396         | 47.6                | 80.96      | ❌             |
-| ViT-L-16-SigLIP-256__webli                           | 3160         | 23.84               | 80.64      | ❌             |
-| ViT-B-16-SigLIP-i18n-256__webli                      | 3029         | 6.87                | 80.28      | ✅             |
-| XLM-Roberta-Base-ViT-B-32__laion5b_s13b_b90k         | 3030         | 3.2                 | 79.65      | ✅             |
-| ViT-B-16-SigLIP-512__webli                           | 1828         | 26.17               | 77.4       | ✅             |
-| ViT-B-16-SigLIP-384__webli                           | 1128         | 13.53               | 76.88      | ✅             |
-| ViT-B-16-SigLIP__webli                               | 1081         | 5.77                | 76.3       | ✅             |
-| ViT-B-16-SigLIP-256__webli                           | 1102         | 7.11                | 75.68      | ❌             |
-| ViT-SO400M-14-SigLIP-384__webli                      | 4417         | 72.19               | 69.59      | ❌             |
-| ViT-H-14__laion2b-s32b-b79k                          | 4676         | 39.06               | 68.36      | ❌             |
-| ViT-L-14__laion2b-s32b-b82k                          | 2233         | 20.56               | 61.78      | ❌             |
-| ViT-L-14__laion400m_e32                              | 2218         | 19.73               | 58.4       | ❌             |
-| ViT-L-14__laion400m_e31                              | 2183         | 19.87               | 58.35      | ❌             |
-| ViT-B-16-plus-240__laion400m_e31                     | 1263         | 6.94                | 57.17      | ❌             |
-| ViT-B-16-plus-240__laion400m_e32                     | 1246         | 6.95                | 57.17      | ❌             |
-| ViT-B-32__laion2b_e16                                | 1004         | 2.38                | 57.05      | ✅             |
-| ViT-B-32__laion2b-s34b-b79k                          | 1001         | 2.29                | 56.08      | ✅             |
-| ViT-B-16__laion400m_e31                              | 991          | 5.04                | 52.96      | ✅             |
-| ViT-B-16__laion400m_e32                              | 975          | 4.98                | 52.83      | ✅             |
-| ViT-B-32__laion400m_e32                              | 1003         | 2.35                | 51.88      | ❌             |
-| ViT-B-32__laion400m_e31                              | 999          | 2.28                | 51.82      | ✅             |
-| RN50x64__openai                                      | 5079         | 48.79               | 42.86      | ❌             |
-| ViT-L-14-336__openai                                 | 2616         | 43.45               | 42.81      | ❌             |
-| ViT-L-14__openai                                     | 2212         | 19.91               | 42.54      | ❌             |
-| RN50x16__openai                                      | 2221         | 15.87               | 41.72      | ❌             |
-| RN50x4__openai                                       | 1416         | 5.85                | 38.85      | ❌             |
-| RN101__openai                                        | 1111         | 3.21                | 36.79      | ❌             |
-| ViT-B-16__openai                                     | 985          | 5.03                | 36.47      | ❌             |
-| ViT-B-32__openai                                     | 1004         | 2.26                | 35.17      | ✅             |
-| RN50__openai                                         | 913          | 2.39                | 34.44      | ✅             |
+| ViT-SO400M-16-SigLIP2-384__webli                     | 3854         | 56.57               | 86.5       | ✅             |
+| ViT-SO400M-16-SigLIP2-512__webli                     | 4050         | 107.67              | 86.5       | ❌             |
+| ViT-SO400M-14-SigLIP2-378__webli                     | 3940         | 72.25               | 86.39      | ❌             |
+| ViT-gopt-16-SigLIP2-384__webli                       | 6585         | 146.84              | 86.15      | ❌             |
+| ViT-H-14-378-quickgelu__dfn5b                        | 5049         | 108.4               | 86.1       | ❌             |
+| nllb-clip-large-siglip__mrl                          | 4248         | 75.44               | 86.07      | ❌             |
+| nllb-clip-large-siglip__v1                           | 4226         | 75.05               | 86.06      | ❌             |
+| ViT-H-14-quickgelu__dfn5b                            | 4701         | 38.74               | 85.89      | ✅             |
+| ViT-L-16-SigLIP2-512__webli                          | 3358         | 92.59               | 85.67      | ✅             |
+| ViT-SO400M-16-SigLIP2-256__webli                     | 3611         | 27.84               | 85.67      | ✅             |
+| ViT-gopt-16-SigLIP2-256__webli                       | 6475         | 64.51               | 85.63      | ❌             |
+| ViT-SO400M-14-SigLIP2__webli                         | 3622         | 27.63               | 85.39      | ✅             |
+| ViT-L-16-SigLIP2-384__webli                          | 3057         | 51.7                | 85.35      | ✅             |
+| ViT-L-16-SigLIP2-256__webli                          | 2830         | 23.77               | 84.97      | ✅             |
+| nllb-clip-base-siglip__mrl                           | 4696         | 16.95               | 83.8       | ✅             |
+| XLM-Roberta-Large-ViT-H-14__frozen_laion5b_s13b_b90k | 4014         | 39.14               | 82.96      | ❌             |
+| ViT-B-16-SigLIP2__webli                              | 3038         | 5.81                | 82.91      | ✅             |
+| nllb-clip-base-siglip__v1                            | 4675         | 15.17               | 82.52      | ❌             |
+| ViT-L-14-quickgelu__dfn2b                            | 2212         | 20.49               | 81.21      | ✅             |
+| ViT-B-32-SigLIP2-256__webli                          | 3061         | 3.31                | 80.23      | ✅             |
+| ViT-L-16-SigLIP-384__webli                           | 3396         | 47.6                | 79.85      | ❌             |
+| ViT-B-16-SigLIP-i18n-256__webli                      | 3029         | 6.87                | 79.47      | ✅             |
+| ViT-L-16-SigLIP-256__webli                           | 3160         | 23.84               | 79.3       | ❌             |
+| XLM-Roberta-Base-ViT-B-32__laion5b_s13b_b90k         | 3030         | 3.2                 | 77.49      | ✅             |
+| ViT-B-16-SigLIP-512__webli                           | 1828         | 26.17               | 76.82      | ✅             |
+| ViT-B-16-SigLIP-384__webli                           | 1128         | 13.53               | 75.94      | ✅             |
+| ViT-B-16-SigLIP__webli                               | 1081         | 5.77                | 75.3       | ✅             |
+| ViT-B-16-SigLIP-256__webli                           | 1102         | 7.11                | 75.24      | ❌             |
+| ViT-H-14__laion2b-s32b-b79k                          | 4676         | 39.06               | 69.33      | ❌             |
+| ViT-SO400M-14-SigLIP-384__webli                      | 4417         | 72.19               | 64.41      | ❌             |
+| ViT-L-14__laion2b-s32b-b82k                          | 2233         | 20.56               | 62.86      | ❌             |
+| ViT-L-14__laion400m_e32                              | 2218         | 19.73               | 59.27      | ❌             |
+| ViT-L-14__laion400m_e31                              | 2183         | 19.87               | 59.09      | ❌             |
+| ViT-B-16-plus-240__laion400m_e32                     | 1246         | 6.95                | 58.25      | ❌             |
+| ViT-B-16-plus-240__laion400m_e31                     | 1263         | 6.94                | 58.25      | ❌             |
+| ViT-B-32__laion2b_e16                                | 1004         | 2.38                | 56.97      | ✅             |
+| ViT-B-32__laion2b-s34b-b79k                          | 1001         | 2.29                | 56.21      | ✅             |
+| ViT-B-32__laion400m_e31                              | 999          | 2.28                | 53.36      | ✅             |
+| ViT-B-16__laion400m_e32                              | 975          | 4.98                | 53.33      | ✅             |
+| ViT-B-16__laion400m_e31                              | 991          | 5.04                | 53.26      | ❌             |
+| ViT-B-32__laion400m_e32                              | 1003         | 2.35                | 53.22      | ❌             |
+| ViT-L-14__openai                                     | 2212         | 19.91               | 46.34      | ❌             |
+| RN50x64__openai                                      | 5079         | 48.79               | 46.3       | ❌             |
+| ViT-L-14-336__openai                                 | 2616         | 43.45               | 45.95      | ❌             |
+| RN50x16__openai                                      | 2221         | 15.87               | 45.69      | ❌             |
+| RN50x4__openai                                       | 1416         | 5.85                | 42.48      | ❌             |
+| RN101__openai                                        | 1111         | 3.21                | 40.16      | ❌             |
+| ViT-B-16__openai                                     | 985          | 5.03                | 40.1       | ❌             |
+| ViT-B-32__openai                                     | 1004         | 2.26                | 38.27      | ✅             |
+| RN50__openai                                         | 913          | 2.39                | 37.8       | ✅             |
 </details>
 <details>
 <summary>German</summary>
 | Model                                                | Memory (MiB) | Execution Time (ms) | Recall (%) | Pareto Optimal |
 |------------------------------------------------------|--------------|---------------------|------------|----------------|
-| ViT-SO400M-16-SigLIP2-512__webli                     | 4050         | 107.67              | 90.04      | ✅             |
-| ViT-SO400M-14-SigLIP2-378__webli                     | 3940         | 72.25               | 89.97      | ✅             |
-| ViT-gopt-16-SigLIP2-384__webli                       | 6585         | 146.84              | 89.85      | ❌             |
-| ViT-SO400M-16-SigLIP2-384__webli                     | 3854         | 56.57               | 89.81      | ✅             |
-| ViT-H-14-378-quickgelu__dfn5b                        | 5049         | 108.4               | 89.77      | ❌             |
-| ViT-L-16-SigLIP2-512__webli                          | 3358         | 92.59               | 89.69      | ✅             |
-| ViT-SO400M-16-SigLIP2-256__webli                     | 3611         | 27.84               | 89.45      | ✅             |
-| ViT-H-14-quickgelu__dfn5b                            | 4701         | 38.74               | 89.44      | ❌             |
-| ViT-L-16-SigLIP2-384__webli                          | 3057         | 51.7                | 89.39      | ✅             |
-| ViT-SO400M-14-SigLIP2__webli                         | 3622         | 27.63               | 89.35      | ✅             |
-| ViT-gopt-16-SigLIP2-256__webli                       | 6475         | 64.51               | 89.03      | ❌             |
-| ViT-L-16-SigLIP2-256__webli                          | 2830         | 23.77               | 88.82      | ✅             |
-| nllb-clip-large-siglip__mrl                          | 4248         | 75.44               | 88.55      | ❌             |
-| nllb-clip-large-siglip__v1                           | 4226         | 75.05               | 88.42      | ❌             |
-| XLM-Roberta-Large-ViT-H-14__frozen_laion5b_s13b_b90k | 4014         | 39.14               | 87.19      | ❌             |
-| ViT-B-16-SigLIP2__webli                              | 3038         | 5.81                | 86.44      | ✅             |
-| ViT-L-14-quickgelu__dfn2b                            | 2212         | 20.49               | 84.81      | ✅             |
-| nllb-clip-base-siglip__v1                            | 4675         | 15.17               | 84.81      | ❌             |
-| nllb-clip-base-siglip__mrl                           | 4696         | 16.95               | 84.58      | ❌             |
-| ViT-B-32-SigLIP2-256__webli                          | 3061         | 3.31                | 84.44      | ✅             |
-| ViT-B-16-SigLIP-i18n-256__webli                      | 3029         | 6.87                | 83.33      | ✅             |
-| ViT-L-16-SigLIP-384__webli                           | 3396         | 47.6                | 82.75      | ❌             |
-| ViT-L-16-SigLIP-256__webli                           | 3160         | 23.84               | 82.32      | ❌             |
-| XLM-Roberta-Base-ViT-B-32__laion5b_s13b_b90k         | 3030         | 3.2                 | 81.63      | ✅             |
-| ViT-B-16-SigLIP-512__webli                           | 1828         | 26.17               | 76.76      | ✅             |
-| ViT-B-16-SigLIP-384__webli                           | 1128         | 13.53               | 76.33      | ✅             |
-| ViT-B-16-SigLIP__webli                               | 1081         | 5.77                | 75.19      | ✅             |
-| ViT-B-16-SigLIP-256__webli                           | 1102         | 7.11                | 75.07      | ❌             |
-| ViT-SO400M-14-SigLIP-384__webli                      | 4417         | 72.19               | 64.61      | ❌             |
-| ViT-H-14__laion2b-s32b-b79k                          | 4676         | 39.06               | 52.81      | ❌             |
-| ViT-L-14__laion2b-s32b-b82k                          | 2233         | 20.56               | 42.88      | ❌             |
-| ViT-L-14__laion400m_e32                              | 2218         | 19.73               | 38.65      | ❌             |
-| ViT-L-14__laion400m_e31                              | 2183         | 19.87               | 38.37      | ❌             |
-| ViT-B-32__laion2b_e16                                | 1004         | 2.38                | 37.65      | ✅             |
-| ViT-B-32__laion2b-s34b-b79k                          | 1001         | 2.29                | 36.6       | ✅             |
-| ViT-B-16-plus-240__laion400m_e31                     | 1263         | 6.94                | 35.44      | ❌             |
-| ViT-B-16-plus-240__laion400m_e32                     | 1246         | 6.95                | 35.44      | ❌             |
-| ViT-B-16__laion400m_e31                              | 991          | 5.04                | 32.46      | ✅             |
-| ViT-B-16__laion400m_e32                              | 975          | 4.98                | 32.31      | ✅             |
-| ViT-B-32__laion400m_e31                              | 999          | 2.28                | 31.85      | ✅             |
-| ViT-B-32__laion400m_e32                              | 1003         | 2.35                | 31.81      | ❌             |
-| RN50x64__openai                                      | 5079         | 48.79               | 28.41      | ❌             |
-| ViT-L-14__openai                                     | 2212         | 19.91               | 27.63      | ❌             |
-| ViT-L-14-336__openai                                 | 2616         | 43.45               | 27.09      | ❌             |
-| RN50x16__openai                                      | 2221         | 15.87               | 24.48      | ❌             |
-| RN50x4__openai                                       | 1416         | 5.85                | 23.49      | ❌             |
-| RN50__openai                                         | 913          | 2.39                | 20.91      | ✅             |
-| ViT-B-16__openai                                     | 985          | 5.03                | 20.83      | ❌             |
-| RN101__openai                                        | 1111         | 3.21                | 20.39      | ❌             |
+| ViT-SO400M-14-SigLIP2-378__webli                     | 3940         | 72.25               | 87.32      | ✅             |
+| ViT-SO400M-16-SigLIP2-512__webli                     | 4050         | 107.67              | 87.29      | ❌             |
+| ViT-gopt-16-SigLIP2-384__webli                       | 6585         | 146.84              | 87.29      | ❌             |
+| ViT-SO400M-16-SigLIP2-384__webli                     | 3854         | 56.57               | 87.21      | ✅             |
+| ViT-H-14-378-quickgelu__dfn5b                        | 5049         | 108.4               | 87.18      | ❌             |
+| nllb-clip-large-siglip__mrl                          | 4248         | 75.44               | 87.14      | ❌             |
+| nllb-clip-large-siglip__v1                           | 4226         | 75.05               | 87.07      | ❌             |
+| ViT-gopt-16-SigLIP2-256__webli                       | 6475         | 64.51               | 86.83      | ❌             |
+| ViT-SO400M-14-SigLIP2__webli                         | 3622         | 27.63               | 86.81      | ✅             |
+| ViT-L-16-SigLIP2-512__webli                          | 3358         | 92.59               | 86.75      | ✅             |
+| ViT-SO400M-16-SigLIP2-256__webli                     | 3611         | 27.84               | 86.74      | ✅             |
+| ViT-H-14-quickgelu__dfn5b                            | 4701         | 38.74               | 86.68      | ❌             |
+| ViT-L-16-SigLIP2-384__webli                          | 3057         | 51.7                | 86.56      | ✅             |
+| ViT-L-16-SigLIP2-256__webli                          | 2830         | 23.77               | 86.16      | ✅             |
+| XLM-Roberta-Large-ViT-H-14__frozen_laion5b_s13b_b90k | 4014         | 39.14               | 84.54      | ❌             |
+| nllb-clip-base-siglip__mrl                           | 4696         | 16.95               | 84.41      | ✅             |
+| ViT-B-16-SigLIP2__webli                              | 3038         | 5.81                | 84.25      | ✅             |
+| nllb-clip-base-siglip__v1                            | 4675         | 15.17               | 83.8       | ❌             |
+| ViT-L-14-quickgelu__dfn2b                            | 2212         | 20.49               | 82.59      | ✅             |
+| ViT-B-32-SigLIP2-256__webli                          | 3061         | 3.31                | 81.53      | ✅             |
+| ViT-L-16-SigLIP-384__webli                           | 3396         | 47.6                | 81.34      | ❌             |
+| ViT-B-16-SigLIP-i18n-256__webli                      | 3029         | 6.87                | 81.15      | ✅             |
+| ViT-L-16-SigLIP-256__webli                           | 3160         | 23.84               | 81.05      | ❌             |
+| XLM-Roberta-Base-ViT-B-32__laion5b_s13b_b90k         | 3030         | 3.2                 | 78.35      | ✅             |
+| ViT-B-16-SigLIP-512__webli                           | 1828         | 26.17               | 76.56      | ✅             |
+| ViT-B-16-SigLIP-384__webli                           | 1128         | 13.53               | 76.0       | ✅             |
+| ViT-B-16-SigLIP__webli                               | 1081         | 5.77                | 75.21      | ✅             |
+| ViT-B-16-SigLIP-256__webli                           | 1102         | 7.11                | 75.14      | ❌             |
+| ViT-SO400M-14-SigLIP-384__webli                      | 4417         | 72.19               | 65.86      | ❌             |
+| ViT-H-14__laion2b-s32b-b79k                          | 4676         | 39.06               | 56.87      | ❌             |
+| ViT-L-14__laion2b-s32b-b82k                          | 2233         | 20.56               | 47.19      | ❌             |
+| ViT-L-14__laion400m_e32                              | 2218         | 19.73               | 43.36      | ❌             |
+| ViT-L-14__laion400m_e31                              | 2183         | 19.87               | 43.0       | ❌             |
+| ViT-B-32__laion2b_e16                                | 1004         | 2.38                | 41.81      | ✅             |
+| ViT-B-32__laion2b-s34b-b79k                          | 1001         | 2.29                | 40.43      | ✅             |
+| ViT-B-16-plus-240__laion400m_e32                     | 1246         | 6.95                | 40.41      | ❌             |
+| ViT-B-16-plus-240__laion400m_e31                     | 1263         | 6.94                | 40.41      | ❌             |
+| ViT-B-16__laion400m_e31                              | 991          | 5.04                | 37.71      | ✅             |
+| ViT-B-16__laion400m_e32                              | 975          | 4.98                | 37.64      | ✅             |
+| ViT-B-32__laion400m_e31                              | 999          | 2.28                | 36.04      | ✅             |
+| ViT-B-32__laion400m_e32                              | 1003         | 2.35                | 35.9       | ❌             |
+| RN50x64__openai                                      | 5079         | 48.79               | 34.19      | ❌             |
+| ViT-L-14__openai                                     | 2212         | 19.91               | 33.1       | ❌             |
+| ViT-L-14-336__openai                                 | 2616         | 43.45               | 32.25      | ❌             |
+| RN50x16__openai                                      | 2221         | 15.87               | 30.56      | ❌             |
+| RN50x4__openai                                       | 1416         | 5.85                | 29.2       | ❌             |
+| ViT-B-16__openai                                     | 985          | 5.03                | 25.77      | ❌             |
+| RN101__openai                                        | 1111         | 3.21                | 25.46      | ❌             |
+| RN50__openai                                         | 913          | 2.39                | 24.92      | ✅             |
+| ViT-B-32__openai                                     | 1004         | 2.26                | 24.13      | ✅             |
 </details>
 <details>
 <summary>Greek</summary>
@@ -542,10 +556,10 @@ Memory and execution time estimates were obtained without acceleration on a 7800
 | ViT-SO400M-16-SigLIP2-384__webli                     | 3854         | 56.57               | 60.63      | ❌             |
 | ViT-SO400M-14-SigLIP2-378__webli                     | 3940         | 72.25               | 60.41      | ❌             |
 | ViT-SO400M-16-SigLIP2-512__webli                     | 4050         | 107.67              | 60.1       | ❌             |
-| ViT-SO400M-14-SigLIP2__webli                         | 3622         | 27.63               | 60.06      | ❌             |
 | ViT-SO400M-16-SigLIP2-256__webli                     | 3611         | 27.84               | 60.06      | ❌             |
-| ViT-L-16-SigLIP2-512__webli                          | 3358         | 92.59               | 59.44      | ❌             |
+| ViT-SO400M-14-SigLIP2__webli                         | 3622         | 27.63               | 60.06      | ❌             |
 | ViT-L-16-SigLIP2-384__webli                          | 3057         | 51.7                | 59.44      | ❌             |
+| ViT-L-16-SigLIP2-512__webli                          | 3358         | 92.59               | 59.44      | ❌             |
 | ViT-L-16-SigLIP2-256__webli                          | 2830         | 23.77               | 59.43      | ✅             |
 | ViT-B-16-SigLIP-i18n-256__webli                      | 3029         | 6.87                | 58.78      | ✅             |
 | ViT-B-16-SigLIP2__webli                              | 3038         | 5.81                | 53.42      | ❌             |
@@ -670,99 +684,104 @@ Memory and execution time estimates were obtained without acceleration on a 7800
 <summary>Italian</summary>
 | Model                                                | Memory (MiB) | Execution Time (ms) | Recall (%) | Pareto Optimal |
 |------------------------------------------------------|--------------|---------------------|------------|----------------|
-| ViT-SO400M-16-SigLIP2-512__webli                     | 4050         | 107.67              | 88.6       | ✅             |
-| ViT-L-16-SigLIP2-512__webli                          | 3358         | 92.59               | 88.25      | ✅             |
-| ViT-SO400M-14-SigLIP2-378__webli                     | 3940         | 72.25               | 88.12      | ✅             |
-| ViT-L-16-SigLIP2-384__webli                          | 3057         | 51.7                | 88.04      | ✅             |
-| ViT-SO400M-16-SigLIP2-384__webli                     | 3854         | 56.57               | 87.97      | ❌             |
-| ViT-gopt-16-SigLIP2-384__webli                       | 6585         | 146.84              | 87.69      | ❌             |
-| ViT-SO400M-16-SigLIP2-256__webli                     | 3611         | 27.84               | 87.29      | ✅             |
-| ViT-gopt-16-SigLIP2-256__webli                       | 6475         | 64.51               | 87.06      | ❌             |
-| ViT-H-14-378-quickgelu__dfn5b                        | 5049         | 108.4               | 86.91      | ❌             |
-| ViT-SO400M-14-SigLIP2__webli                         | 3622         | 27.63               | 86.88      | ✅             |
-| ViT-L-16-SigLIP2-256__webli                          | 2830         | 23.77               | 86.68      | ✅             |
-| ViT-H-14-quickgelu__dfn5b                            | 4701         | 38.74               | 86.61      | ❌             |
-| nllb-clip-large-siglip__v1                           | 4226         | 75.05               | 85.55      | ❌             |
-| nllb-clip-large-siglip__mrl                          | 4248         | 75.44               | 85.37      | ❌             |
-| ViT-B-16-SigLIP2__webli                              | 3038         | 5.81                | 83.78      | ✅             |
-| XLM-Roberta-Large-ViT-H-14__frozen_laion5b_s13b_b90k | 4014         | 39.14               | 83.0       | ❌             |
-| ViT-B-32-SigLIP2-256__webli                          | 3061         | 3.31                | 81.81      | ✅             |
-| nllb-clip-base-siglip__v1                            | 4675         | 15.17               | 81.77      | ❌             |
-| nllb-clip-base-siglip__mrl                           | 4696         | 16.95               | 81.32      | ❌             |
-| ViT-L-16-SigLIP-384__webli                           | 3396         | 47.6                | 80.97      | ❌             |
-| ViT-L-14-quickgelu__dfn2b                            | 2212         | 20.49               | 80.53      | ✅             |
-| ViT-L-16-SigLIP-256__webli                           | 3160         | 23.84               | 80.1       | ❌             |
-| ViT-B-16-SigLIP-i18n-256__webli                      | 3029         | 6.87                | 79.71      | ✅             |
-| XLM-Roberta-Base-ViT-B-32__laion5b_s13b_b90k         | 3030         | 3.2                 | 77.31      | ✅             |
-| ViT-B-16-SigLIP-512__webli                           | 1828         | 26.17               | 75.19      | ✅             |
-| ViT-B-16-SigLIP-384__webli                           | 1128         | 13.53               | 74.49      | ✅             |
-| ViT-SO400M-14-SigLIP-384__webli                      | 4417         | 72.19               | 74.04      | ❌             |
-| ViT-B-16-SigLIP-256__webli                           | 1102         | 7.11                | 73.68      | ✅             |
-| ViT-B-16-SigLIP__webli                               | 1081         | 5.77                | 73.57      | ✅             |
-| ViT-H-14__laion2b-s32b-b79k                          | 4676         | 39.06               | 51.04      | ❌             |
-| ViT-L-14__laion2b-s32b-b82k                          | 2233         | 20.56               | 41.73      | ❌             |
-| ViT-L-14__laion400m_e32                              | 2218         | 19.73               | 36.87      | ❌             |
-| ViT-L-14__laion400m_e31                              | 2183         | 19.87               | 36.84      | ❌             |
-| ViT-B-16-plus-240__laion400m_e31                     | 1263         | 6.94                | 34.68      | ❌             |
-| ViT-B-16-plus-240__laion400m_e32                     | 1246         | 6.95                | 34.68      | ❌             |
-| ViT-B-32__laion2b_e16                                | 1004         | 2.38                | 34.64      | ✅             |
-| ViT-B-32__laion2b-s34b-b79k                          | 1001         | 2.29                | 33.8       | ✅             |
-| ViT-B-16__laion400m_e32                              | 975          | 4.98                | 30.11      | ✅             |
-| ViT-B-16__laion400m_e31                              | 991          | 5.04                | 30.04      | ❌             |
-| ViT-B-32__laion400m_e32                              | 1003         | 2.35                | 29.89      | ❌             |
-| ViT-B-32__laion400m_e31                              | 999          | 2.28                | 29.88      | ✅             |
-| RN50x64__openai                                      | 5079         | 48.79               | 26.67      | ❌             |
-| ViT-L-14__openai                                     | 2212         | 19.91               | 25.51      | ❌             |
-| ViT-L-14-336__openai                                 | 2616         | 43.45               | 25.3       | ❌             |
-| RN50x16__openai                                      | 2221         | 15.87               | 21.37      | ❌             |
+| ViT-SO400M-16-SigLIP2-512__webli                     | 4050         | 107.67              | 87.17      | ✅             |
+| ViT-SO400M-14-SigLIP2-378__webli                     | 3940         | 72.25               | 86.91      | ✅             |
+| ViT-gopt-16-SigLIP2-384__webli                       | 6585         | 146.84              | 86.83      | ❌             |
+| ViT-SO400M-16-SigLIP2-384__webli                     | 3854         | 56.57               | 86.77      | ✅             |
+| ViT-L-16-SigLIP2-512__webli                          | 3358         | 92.59               | 86.67      | ✅             |
+| ViT-gopt-16-SigLIP2-256__webli                       | 6475         | 64.51               | 86.42      | ❌             |
+| ViT-L-16-SigLIP2-384__webli                          | 3057         | 51.7                | 86.35      | ✅             |
+| ViT-H-14-378-quickgelu__dfn5b                        | 5049         | 108.4               | 86.34      | ❌             |
+| ViT-SO400M-16-SigLIP2-256__webli                     | 3611         | 27.84               | 86.18      | ✅             |
+| nllb-clip-large-siglip__v1                           | 4226         | 75.05               | 86.17      | ❌             |
+| ViT-SO400M-14-SigLIP2__webli                         | 3622         | 27.63               | 85.84      | ✅             |
+| nllb-clip-large-siglip__mrl                          | 4248         | 75.44               | 85.8       | ❌             |
+| ViT-L-16-SigLIP2-256__webli                          | 2830         | 23.77               | 85.7       | ✅             |
+| ViT-H-14-quickgelu__dfn5b                            | 4701         | 38.74               | 85.67      | ❌             |
+| ViT-B-16-SigLIP2__webli                              | 3038         | 5.81                | 83.32      | ✅             |
+| nllb-clip-base-siglip__mrl                           | 4696         | 16.95               | 82.95      | ❌             |
+| XLM-Roberta-Large-ViT-H-14__frozen_laion5b_s13b_b90k | 4014         | 39.14               | 82.73      | ❌             |
+| nllb-clip-base-siglip__v1                            | 4675         | 15.17               | 82.72      | ❌             |
+| ViT-L-16-SigLIP-384__webli                           | 3396         | 47.6                | 81.07      | ❌             |
+| ViT-B-32-SigLIP2-256__webli                          | 3061         | 3.31                | 80.8       | ✅             |
+| ViT-L-14-quickgelu__dfn2b                            | 2212         | 20.49               | 80.6       | ✅             |
+| ViT-L-16-SigLIP-256__webli                           | 3160         | 23.84               | 80.35      | ❌             |
+| ViT-B-16-SigLIP-i18n-256__webli                      | 3029         | 6.87                | 78.79      | ✅             |
+| XLM-Roberta-Base-ViT-B-32__laion5b_s13b_b90k         | 3030         | 3.2                 | 76.62      | ✅             |
+| ViT-B-16-SigLIP-512__webli                           | 1828         | 26.17               | 76.51      | ✅             |
+| ViT-B-16-SigLIP-384__webli                           | 1128         | 13.53               | 76.08      | ✅             |
+| ViT-B-16-SigLIP__webli                               | 1081         | 5.77                | 75.29      | ✅             |
+| ViT-B-16-SigLIP-256__webli                           | 1102         | 7.11                | 75.29      | ❌             |
+| ViT-SO400M-14-SigLIP-384__webli                      | 4417         | 72.19               | 74.84      | ❌             |
+| ViT-H-14__laion2b-s32b-b79k                          | 4676         | 39.06               | 56.32      | ❌             |
+| ViT-L-14__laion2b-s32b-b82k                          | 2233         | 20.56               | 47.25      | ❌             |
+| ViT-L-14__laion400m_e32                              | 2218         | 19.73               | 43.09      | ❌             |
+| ViT-L-14__laion400m_e31                              | 2183         | 19.87               | 42.99      | ❌             |
+| ViT-B-16-plus-240__laion400m_e32                     | 1246         | 6.95                | 40.29      | ❌             |
+| ViT-B-16-plus-240__laion400m_e31                     | 1263         | 6.94                | 40.29      | ❌             |
+| ViT-B-32__laion2b_e16                                | 1004         | 2.38                | 39.67      | ✅             |
+| ViT-B-32__laion2b-s34b-b79k                          | 1001         | 2.29                | 39.03      | ✅             |
+| ViT-B-16__laion400m_e32                              | 975          | 4.98                | 36.14      | ✅             |
+| ViT-B-16__laion400m_e31                              | 991          | 5.04                | 35.89      | ❌             |
+| ViT-B-32__laion400m_e32                              | 1003         | 2.35                | 35.59      | ❌             |
+| ViT-B-32__laion400m_e31                              | 999          | 2.28                | 35.56      | ✅             |
+| RN50x64__openai                                      | 5079         | 48.79               | 33.53      | ❌             |
+| ViT-L-14__openai                                     | 2212         | 19.91               | 32.19      | ❌             |
+| ViT-L-14-336__openai                                 | 2616         | 43.45               | 30.95      | ❌             |
+| RN50x16__openai                                      | 2221         | 15.87               | 28.85      | ❌             |
+| RN50x4__openai                                       | 1416         | 5.85                | 25.75      | ❌             |
+| ViT-B-16__openai                                     | 985          | 5.03                | 25.18      | ❌             |
+| RN101__openai                                        | 1111         | 3.21                | 24.48      | ❌             |
+| RN50__openai                                         | 913          | 2.39                | 23.89      | ✅             |
+| ViT-B-32__openai                                     | 1004         | 2.26                | 23.39      | ✅             |
 </details>
 <details>
 <summary>Japanese</summary>
 | Model                                                | Memory (MiB) | Execution Time (ms) | Recall (%) | Pareto Optimal |
 |------------------------------------------------------|--------------|---------------------|------------|----------------|
-| XLM-Roberta-Large-ViT-H-14__frozen_laion5b_s13b_b90k | 4014         | 39.14               | 86.97      | ✅             |
-| nllb-clip-large-siglip__v1                           | 4226         | 75.05               | 85.15      | ❌             |
-| nllb-clip-large-siglip__mrl                          | 4248         | 75.44               | 84.69      | ❌             |
-| nllb-clip-base-siglip__v1                            | 4675         | 15.17               | 81.77      | ✅             |
-| nllb-clip-base-siglip__mrl                           | 4696         | 16.95               | 81.26      | ❌             |
-| XLM-Roberta-Base-ViT-B-32__laion5b_s13b_b90k         | 3030         | 3.2                 | 81.19      | ✅             |
-| ViT-gopt-16-SigLIP2-384__webli                       | 6585         | 146.84              | 69.99      | ❌             |
-| ViT-SO400M-14-SigLIP2-378__webli                     | 3940         | 72.25               | 68.58      | ❌             |
-| ViT-SO400M-16-SigLIP2-512__webli                     | 4050         | 107.67              | 68.35      | ❌             |
-| ViT-SO400M-16-SigLIP2-384__webli                     | 3854         | 56.57               | 68.29      | ❌             |
-| ViT-L-16-SigLIP2-384__webli                          | 3057         | 51.7                | 67.99      | ❌             |
-| ViT-gopt-16-SigLIP2-256__webli                       | 6475         | 64.51               | 67.68      | ❌             |
-| ViT-L-16-SigLIP2-512__webli                          | 3358         | 92.59               | 67.67      | ❌             |
-| ViT-L-16-SigLIP2-256__webli                          | 2830         | 23.77               | 66.85      | ✅             |
-| ViT-SO400M-16-SigLIP2-256__webli                     | 3611         | 27.84               | 66.54      | ❌             |
-| ViT-SO400M-14-SigLIP2__webli                         | 3622         | 27.63               | 65.77      | ❌             |
-| ViT-B-16-SigLIP-i18n-256__webli                      | 3029         | 6.87                | 61.48      | ✅             |
-| ViT-B-16-SigLIP2__webli                              | 3038         | 5.81                | 58.1       | ❌             |
-| ViT-B-32-SigLIP2-256__webli                          | 3061         | 3.31                | 55.31      | ❌             |
+| XLM-Roberta-Large-ViT-H-14__frozen_laion5b_s13b_b90k | 4014         | 39.14               | 83.95      | ✅             |
+| nllb-clip-large-siglip__v1                           | 4226         | 75.05               | 82.21      | ❌             |
+| nllb-clip-large-siglip__mrl                          | 4248         | 75.44               | 81.55      | ❌             |
+| nllb-clip-base-siglip__v1                            | 4675         | 15.17               | 78.72      | ✅             |
+| nllb-clip-base-siglip__mrl                           | 4696         | 16.95               | 78.53      | ❌             |
+| XLM-Roberta-Base-ViT-B-32__laion5b_s13b_b90k         | 3030         | 3.2                 | 75.93      | ✅             |
+| ViT-gopt-16-SigLIP2-384__webli                       | 6585         | 146.84              | 66.86      | ❌             |
+| ViT-SO400M-16-SigLIP2-384__webli                     | 3854         | 56.57               | 65.59      | ❌             |
+| ViT-SO400M-16-SigLIP2-512__webli                     | 4050         | 107.67              | 65.48      | ❌             |
+| ViT-SO400M-14-SigLIP2-378__webli                     | 3940         | 72.25               | 65.36      | ❌             |
+| ViT-gopt-16-SigLIP2-256__webli                       | 6475         | 64.51               | 64.47      | ❌             |
+| ViT-SO400M-16-SigLIP2-256__webli                     | 3611         | 27.84               | 64.17      | ❌             |
+| ViT-L-16-SigLIP2-384__webli                          | 3057         | 51.7                | 64.08      | ❌             |
+| ViT-L-16-SigLIP2-256__webli                          | 2830         | 23.77               | 63.69      | ✅             |
+| ViT-L-16-SigLIP2-512__webli                          | 3358         | 92.59               | 63.33      | ❌             |
+| ViT-SO400M-14-SigLIP2__webli                         | 3622         | 27.63               | 63.02      | ❌             |
+| ViT-B-16-SigLIP-i18n-256__webli                      | 3029         | 6.87                | 58.39      | ✅             |
+| ViT-B-16-SigLIP2__webli                              | 3038         | 5.81                | 56.38      | ❌             |
+| ViT-B-32-SigLIP2-256__webli                          | 3061         | 3.31                | 53.16      | ❌             |
 </details>
 <details>
 <summary>Korean</summary>
 | Model                                                | Memory (MiB) | Execution Time (ms) | Recall (%) | Pareto Optimal |
 |------------------------------------------------------|--------------|---------------------|------------|----------------|
-| nllb-clip-large-siglip__mrl                          | 4248         | 75.44               | 77.21      | ✅             |
-| nllb-clip-large-siglip__v1                           | 4226         | 75.05               | 76.89      | ✅             |
-| ViT-SO400M-14-SigLIP2-378__webli                     | 3940         | 72.25               | 75.72      | ✅             |
-| ViT-SO400M-16-SigLIP2-384__webli                     | 3854         | 56.57               | 75.06      | ✅             |
-| ViT-SO400M-16-SigLIP2-512__webli                     | 4050         | 107.67              | 74.94      | ❌             |
-| ViT-SO400M-16-SigLIP2-256__webli                     | 3611         | 27.84               | 74.36      | ✅             |
-| ViT-SO400M-14-SigLIP2__webli                         | 3622         | 27.63               | 74.09      | ✅             |
-| ViT-gopt-16-SigLIP2-384__webli                       | 6585         | 146.84              | 73.61      | ❌             |
-| ViT-L-16-SigLIP2-512__webli                          | 3358         | 92.59               | 73.55      | ✅             |
-| ViT-L-16-SigLIP2-384__webli                          | 3057         | 51.7                | 73.41      | ✅             |
-| nllb-clip-base-siglip__mrl                           | 4696         | 16.95               | 73.18      | ✅             |
-| nllb-clip-base-siglip__v1                            | 4675         | 15.17               | 72.79      | ✅             |
-| ViT-gopt-16-SigLIP2-256__webli                       | 6475         | 64.51               | 72.27      | ❌             |
-| ViT-L-16-SigLIP2-256__webli                          | 2830         | 23.77               | 71.73      | ✅             |
-| XLM-Roberta-Large-ViT-H-14__frozen_laion5b_s13b_b90k | 4014         | 39.14               | 71.12      | ❌             |
-| ViT-B-16-SigLIP2__webli                              | 3038         | 5.81                | 70.25      | ✅             |
-| ViT-B-32-SigLIP2-256__webli                          | 3061         | 3.31                | 67.54      | ✅             |
-| ViT-B-16-SigLIP-i18n-256__webli                      | 3029         | 6.87                | 67.37      | ✅             |
-| XLM-Roberta-Base-ViT-B-32__laion5b_s13b_b90k         | 3030         | 3.2                 | 65.44      | ✅             |
+| nllb-clip-large-siglip__mrl                          | 4248         | 75.44               | 80.56      | ✅             |
+| nllb-clip-large-siglip__v1                           | 4226         | 75.05               | 80.53      | ✅             |
+| nllb-clip-base-siglip__mrl                           | 4696         | 16.95               | 77.09      | ✅             |
+| ViT-SO400M-14-SigLIP2-378__webli                     | 3940         | 72.25               | 77.08      | ✅             |
+| ViT-SO400M-16-SigLIP2-512__webli                     | 4050         | 107.67              | 76.97      | ❌             |
+| ViT-SO400M-16-SigLIP2-384__webli                     | 3854         | 56.57               | 76.92      | ✅             |
+| nllb-clip-base-siglip__v1                            | 4675         | 15.17               | 76.58      | ✅             |
+| ViT-SO400M-16-SigLIP2-256__webli                     | 3611         | 27.84               | 76.2       | ✅             |
+| ViT-SO400M-14-SigLIP2__webli                         | 3622         | 27.63               | 75.95      | ✅             |
+| ViT-L-16-SigLIP2-512__webli                          | 3358         | 92.59               | 75.86      | ✅             |
+| ViT-L-16-SigLIP2-384__webli                          | 3057         | 51.7                | 75.67      | ✅             |
+| ViT-gopt-16-SigLIP2-384__webli                       | 6585         | 146.84              | 75.49      | ❌             |
+| ViT-gopt-16-SigLIP2-256__webli                       | 6475         | 64.51               | 74.6       | ❌             |
+| ViT-L-16-SigLIP2-256__webli                          | 2830         | 23.77               | 74.52      | ✅             |
+| XLM-Roberta-Large-ViT-H-14__frozen_laion5b_s13b_b90k | 4014         | 39.14               | 73.88      | ❌             |
+| ViT-B-16-SigLIP2__webli                              | 3038         | 5.81                | 71.09      | ✅             |
+| ViT-B-16-SigLIP-i18n-256__webli                      | 3029         | 6.87                | 68.87      | ✅             |
+| ViT-B-32-SigLIP2-256__webli                          | 3061         | 3.31                | 67.94      | ✅             |
+| XLM-Roberta-Base-ViT-B-32__laion5b_s13b_b90k         | 3030         | 3.2                 | 66.39      | ✅             |
 </details>
 <details>
 <summary>Maori</summary>
@@ -834,34 +853,34 @@ Memory and execution time estimates were obtained without acceleration on a 7800
 <summary>Polish</summary>
 | Model                                                | Memory (MiB) | Execution Time (ms) | Recall (%) | Pareto Optimal |
 |------------------------------------------------------|--------------|---------------------|------------|----------------|
-| ViT-gopt-16-SigLIP2-384__webli                       | 6585         | 146.84              | 80.6       | ✅             |
-| ViT-SO400M-14-SigLIP2-378__webli                     | 3940         | 72.25               | 80.17      | ✅             |
-| ViT-SO400M-16-SigLIP2-512__webli                     | 4050         | 107.67              | 80.06      | ❌             |
-| ViT-SO400M-16-SigLIP2-384__webli                     | 3854         | 56.57               | 80.04      | ✅             |
-| nllb-clip-large-siglip__mrl                          | 4248         | 75.44               | 79.98      | ❌             |
-| XLM-Roberta-Large-ViT-H-14__frozen_laion5b_s13b_b90k | 4014         | 39.14               | 79.8       | ✅             |
-| ViT-L-16-SigLIP2-384__webli                          | 3057         | 51.7                | 79.72      | ✅             |
-| ViT-L-16-SigLIP2-512__webli                          | 3358         | 92.59               | 79.66      | ❌             |
-| ViT-SO400M-16-SigLIP2-256__webli                     | 3611         | 27.84               | 79.45      | ✅             |
-| ViT-gopt-16-SigLIP2-256__webli                       | 6475         | 64.51               | 79.26      | ❌             |
-| nllb-clip-large-siglip__v1                           | 4226         | 75.05               | 79.21      | ❌             |
-| ViT-SO400M-14-SigLIP2__webli                         | 3622         | 27.63               | 79.14      | ✅             |
-| ViT-L-16-SigLIP2-256__webli                          | 2830         | 23.77               | 78.23      | ✅             |
-| nllb-clip-base-siglip__mrl                           | 4696         | 16.95               | 75.33      | ✅             |
-| ViT-B-16-SigLIP-i18n-256__webli                      | 3029         | 6.87                | 74.7       | ✅             |
-| nllb-clip-base-siglip__v1                            | 4675         | 15.17               | 74.63      | ❌             |
-| XLM-Roberta-Base-ViT-B-32__laion5b_s13b_b90k         | 3030         | 3.2                 | 73.69      | ✅             |
-| ViT-B-16-SigLIP2__webli                              | 3038         | 5.81                | 73.44      | ❌             |
-| ViT-B-32-SigLIP2-256__webli                          | 3061         | 3.31                | 70.34      | ❌             |
-| ViT-H-14-378-quickgelu__dfn5b                        | 5049         | 108.4               | 59.4       | ❌             |
-| ViT-H-14-quickgelu__dfn5b                            | 4701         | 38.74               | 59.14      | ❌             |
-| ViT-L-16-SigLIP-256__webli                           | 3160         | 23.84               | 48.74      | ❌             |
-| ViT-L-16-SigLIP-384__webli                           | 3396         | 47.6                | 48.35      | ❌             |
-| ViT-L-14-quickgelu__dfn2b                            | 2212         | 20.49               | 40.76      | ✅             |
-| ViT-B-16-SigLIP__webli                               | 1081         | 5.77                | 39.13      | ✅             |
-| ViT-B-16-SigLIP-512__webli                           | 1828         | 26.17               | 39.09      | ❌             |
-| ViT-B-16-SigLIP-384__webli                           | 1128         | 13.53               | 38.55      | ❌             |
-| ViT-B-16-SigLIP-256__webli                           | 1102         | 7.11                | 38.46      | ❌             |
+| nllb-clip-large-siglip__mrl                          | 4248         | 75.44               | 83.49      | ✅             |
+| ViT-gopt-16-SigLIP2-384__webli                       | 6585         | 146.84              | 83.45      | ❌             |
+| nllb-clip-large-siglip__v1                           | 4226         | 75.05               | 83.11      | ✅             |
+| ViT-SO400M-16-SigLIP2-384__webli                     | 3854         | 56.57               | 82.99      | ✅             |
+| ViT-SO400M-16-SigLIP2-512__webli                     | 4050         | 107.67              | 82.96      | ❌             |
+| ViT-SO400M-14-SigLIP2-378__webli                     | 3940         | 72.25               | 82.93      | ❌             |
+| ViT-gopt-16-SigLIP2-256__webli                       | 6475         | 64.51               | 82.61      | ❌             |
+| ViT-L-16-SigLIP2-512__webli                          | 3358         | 92.59               | 82.26      | ✅             |
+| ViT-SO400M-16-SigLIP2-256__webli                     | 3611         | 27.84               | 82.24      | ✅             |
+| ViT-L-16-SigLIP2-384__webli                          | 3057         | 51.7                | 82.03      | ✅             |
+| XLM-Roberta-Large-ViT-H-14__frozen_laion5b_s13b_b90k | 4014         | 39.14               | 82.03      | ❌             |
+| ViT-SO400M-14-SigLIP2__webli                         | 3622         | 27.63               | 81.92      | ✅             |
+| ViT-L-16-SigLIP2-256__webli                          | 2830         | 23.77               | 81.27      | ✅             |
+| nllb-clip-base-siglip__mrl                           | 4696         | 16.95               | 80.0       | ✅             |
+| nllb-clip-base-siglip__v1                            | 4675         | 15.17               | 79.65      | ✅             |
+| ViT-B-16-SigLIP-i18n-256__webli                      | 3029         | 6.87                | 76.75      | ✅             |
+| ViT-B-16-SigLIP2__webli                              | 3038         | 5.81                | 76.52      | ✅             |
+| XLM-Roberta-Base-ViT-B-32__laion5b_s13b_b90k         | 3030         | 3.2                 | 75.1       | ✅             |
+| ViT-B-32-SigLIP2-256__webli                          | 3061         | 3.31                | 73.9       | ❌             |
+| ViT-H-14-378-quickgelu__dfn5b                        | 5049         | 108.4               | 65.03      | ❌             |
+| ViT-H-14-quickgelu__dfn5b                            | 4701         | 38.74               | 64.89      | ❌             |
+| ViT-L-16-SigLIP-256__webli                           | 3160         | 23.84               | 51.6       | ❌             |
+| ViT-L-16-SigLIP-384__webli                           | 3396         | 47.6                | 51.29      | ❌             |
+| ViT-L-14-quickgelu__dfn2b                            | 2212         | 20.49               | 46.15      | ✅             |
+| ViT-B-16-SigLIP-512__webli                           | 1828         | 26.17               | 41.55      | ✅             |
+| ViT-B-16-SigLIP-384__webli                           | 1128         | 13.53               | 41.17      | ✅             |
+| ViT-B-16-SigLIP-256__webli                           | 1102         | 7.11                | 40.9       | ✅             |
+| ViT-B-16-SigLIP__webli                               | 1081         | 5.77                | 40.76      | ✅             |
 </details>
 <details>
 <summary>Portuguese</summary>
@@ -955,84 +974,87 @@ Memory and execution time estimates were obtained without acceleration on a 7800
 <summary>Russian</summary>
 | Model                                                | Memory (MiB) | Execution Time (ms) | Recall (%) | Pareto Optimal |
 |------------------------------------------------------|--------------|---------------------|------------|----------------|
-| ViT-SO400M-16-SigLIP2-384__webli                     | 3854         | 56.57               | 87.65      | ✅             |
-| ViT-SO400M-14-SigLIP2-378__webli                     | 3940         | 72.25               | 87.62      | ❌             |
-| ViT-L-16-SigLIP2-512__webli                          | 3358         | 92.59               | 87.4       | ✅             |
-| ViT-SO400M-16-SigLIP2-512__webli                     | 4050         | 107.67              | 87.39      | ❌             |
-| ViT-gopt-16-SigLIP2-384__webli                       | 6585         | 146.84              | 86.88      | ❌             |
-| ViT-L-16-SigLIP2-384__webli                          | 3057         | 51.7                | 86.87      | ✅             |
-| ViT-SO400M-16-SigLIP2-256__webli                     | 3611         | 27.84               | 86.74      | ✅             |
-| ViT-SO400M-14-SigLIP2__webli                         | 3622         | 27.63               | 86.26      | ✅             |
-| ViT-L-16-SigLIP2-256__webli                          | 2830         | 23.77               | 85.98      | ✅             |
-| ViT-gopt-16-SigLIP2-256__webli                       | 6475         | 64.51               | 85.66      | ❌             |
-| XLM-Roberta-Large-ViT-H-14__frozen_laion5b_s13b_b90k | 4014         | 39.14               | 85.54      | ❌             |
-| nllb-clip-large-siglip__mrl                          | 4248         | 75.44               | 84.69      | ❌             |
-| ViT-B-16-SigLIP2__webli                              | 3038         | 5.81                | 84.29      | ✅             |
-| nllb-clip-large-siglip__v1                           | 4226         | 75.05               | 84.24      | ❌             |
-| ViT-B-16-SigLIP-i18n-256__webli                      | 3029         | 6.87                | 82.86      | ✅             |
-| ViT-B-32-SigLIP2-256__webli                          | 3061         | 3.31                | 81.59      | ✅             |
-| XLM-Roberta-Base-ViT-B-32__laion5b_s13b_b90k         | 3030         | 3.2                 | 80.56      | ✅             |
-| nllb-clip-base-siglip__mrl                           | 4696         | 16.95               | 80.44      | ❌             |
-| nllb-clip-base-siglip__v1                            | 4675         | 15.17               | 79.99      | ❌             |
-| ViT-H-14-quickgelu__dfn5b                            | 4701         | 38.74               | 39.51      | ❌             |
-| ViT-H-14-378-quickgelu__dfn5b                        | 5049         | 108.4               | 39.16      | ❌             |
-| ViT-L-16-SigLIP-256__webli                           | 3160         | 23.84               | 23.33      | ❌             |
-| ViT-L-16-SigLIP-384__webli                           | 3396         | 47.6                | 22.4       | ❌             |
+| ViT-SO400M-16-SigLIP2-384__webli                     | 3854         | 56.57               | 84.54      | ✅             |
+| ViT-SO400M-14-SigLIP2-378__webli                     | 3940         | 72.25               | 84.41      | ❌             |
+| ViT-SO400M-16-SigLIP2-512__webli                     | 4050         | 107.67              | 84.36      | ❌             |
+| ViT-gopt-16-SigLIP2-384__webli                       | 6585         | 146.84              | 84.31      | ❌             |
+| ViT-L-16-SigLIP2-512__webli                          | 3358         | 92.59               | 84.22      | ✅             |
+| ViT-SO400M-16-SigLIP2-256__webli                     | 3611         | 27.84               | 83.9       | ✅             |
+| ViT-L-16-SigLIP2-384__webli                          | 3057         | 51.7                | 83.69      | ✅             |
+| ViT-SO400M-14-SigLIP2__webli                         | 3622         | 27.63               | 83.5       | ✅             |
+| nllb-clip-large-siglip__mrl                          | 4248         | 75.44               | 83.31      | ❌             |
+| ViT-gopt-16-SigLIP2-256__webli                       | 6475         | 64.51               | 83.21      | ❌             |
+| ViT-L-16-SigLIP2-256__webli                          | 2830         | 23.77               | 83.11      | ✅             |
+| nllb-clip-large-siglip__v1                           | 4226         | 75.05               | 82.7       | ❌             |
+| XLM-Roberta-Large-ViT-H-14__frozen_laion5b_s13b_b90k | 4014         | 39.14               | 82.69      | ❌             |
+| ViT-B-16-SigLIP2__webli                              | 3038         | 5.81                | 80.91      | ✅             |
+| nllb-clip-base-siglip__mrl                           | 4696         | 16.95               | 79.75      | ❌             |
+| ViT-B-16-SigLIP-i18n-256__webli                      | 3029         | 6.87                | 79.35      | ✅             |
+| nllb-clip-base-siglip__v1                            | 4675         | 15.17               | 78.91      | ❌             |
+| ViT-B-32-SigLIP2-256__webli                          | 3061         | 3.31                | 78.06      | ✅             |
+| XLM-Roberta-Base-ViT-B-32__laion5b_s13b_b90k         | 3030         | 3.2                 | 76.44      | ✅             |
+| ViT-H-14-378-quickgelu__dfn5b                        | 5049         | 108.4               | 42.81      | ❌             |
+| ViT-H-14-quickgelu__dfn5b                            | 4701         | 38.74               | 42.1       | ❌             |
+| ViT-L-16-SigLIP-256__webli                           | 3160         | 23.84               | 24.95      | ❌             |
+| ViT-L-16-SigLIP-384__webli                           | 3396         | 47.6                | 24.25      | ❌             |
+| ViT-B-16-SigLIP-256__webli                           | 1102         | 7.11                | 20.85      | ✅             |
+| ViT-B-16-SigLIP__webli                               | 1081         | 5.77                | 20.44      | ✅             |
+| ViT-B-16-SigLIP-512__webli                           | 1828         | 26.17               | 20.41      | ❌             |
 </details>
 <details>
 <summary>Spanish</summary>
 | Model                                                | Memory (MiB) | Execution Time (ms) | Recall (%) | Pareto Optimal |
 |------------------------------------------------------|--------------|---------------------|------------|----------------|
-| ViT-L-16-SigLIP2-512__webli                          | 3358         | 92.59               | 84.24      | ✅             |
-| ViT-SO400M-14-SigLIP2-378__webli                     | 3940         | 72.25               | 83.94      | ✅             |
-| ViT-SO400M-16-SigLIP2-512__webli                     | 4050         | 107.67              | 83.91      | ❌             |
-| ViT-SO400M-16-SigLIP2-384__webli                     | 3854         | 56.57               | 83.78      | ✅             |
-| ViT-L-16-SigLIP2-384__webli                          | 3057         | 51.7                | 83.71      | ✅             |
-| ViT-gopt-16-SigLIP2-384__webli                       | 6585         | 146.84              | 83.59      | ❌             |
-| ViT-SO400M-16-SigLIP2-256__webli                     | 3611         | 27.84               | 83.2       | ✅             |
-| ViT-H-14-378-quickgelu__dfn5b                        | 5049         | 108.4               | 83.0       | ❌             |
-| ViT-SO400M-14-SigLIP2__webli                         | 3622         | 27.63               | 82.91      | ✅             |
-| ViT-gopt-16-SigLIP2-256__webli                       | 6475         | 64.51               | 82.58      | ❌             |
-| ViT-L-16-SigLIP2-256__webli                          | 2830         | 23.77               | 82.5       | ✅             |
-| ViT-H-14-quickgelu__dfn5b                            | 4701         | 38.74               | 82.48      | ❌             |
-| ViT-B-16-SigLIP2__webli                              | 3038         | 5.81                | 82.22      | ✅             |
-| nllb-clip-large-siglip__mrl                          | 4248         | 75.44               | 81.34      | ❌             |
-| XLM-Roberta-Large-ViT-H-14__frozen_laion5b_s13b_b90k | 4014         | 39.14               | 80.18      | ❌             |
-| nllb-clip-large-siglip__v1                           | 4226         | 75.05               | 80.14      | ❌             |
-| ViT-B-32-SigLIP2-256__webli                          | 3061         | 3.31                | 78.99      | ✅             |
-| ViT-L-14-quickgelu__dfn2b                            | 2212         | 20.49               | 78.19      | ✅             |
-| ViT-L-16-SigLIP-384__webli                           | 3396         | 47.6                | 78.15      | ❌             |
-| ViT-B-16-SigLIP-i18n-256__webli                      | 3029         | 6.87                | 77.93      | ✅             |
-| ViT-L-16-SigLIP-256__webli                           | 3160         | 23.84               | 77.64      | ❌             |
-| nllb-clip-base-siglip__mrl                           | 4696         | 16.95               | 77.21      | ❌             |
-| nllb-clip-base-siglip__v1                            | 4675         | 15.17               | 76.36      | ❌             |
-| ViT-B-16-SigLIP-512__webli                           | 1828         | 26.17               | 75.73      | ✅             |
-| ViT-B-16-SigLIP-384__webli                           | 1128         | 13.53               | 75.56      | ✅             |
-| XLM-Roberta-Base-ViT-B-32__laion5b_s13b_b90k         | 3030         | 3.2                 | 75.01      | ✅             |
-| ViT-B-16-SigLIP-256__webli                           | 1102         | 7.11                | 74.62      | ✅             |
-| ViT-B-16-SigLIP__webli                               | 1081         | 5.77                | 74.6       | ✅             |
-| ViT-SO400M-14-SigLIP-384__webli                      | 4417         | 72.19               | 70.31      | ❌             |
-| ViT-H-14__laion2b-s32b-b79k                          | 4676         | 39.06               | 58.31      | ❌             |
-| ViT-L-14__laion2b-s32b-b82k                          | 2233         | 20.56               | 49.56      | ❌             |
-| ViT-L-14__laion400m_e32                              | 2218         | 19.73               | 46.69      | ❌             |
-| ViT-L-14__laion400m_e31                              | 2183         | 19.87               | 46.53      | ❌             |
-| ViT-B-16-plus-240__laion400m_e32                     | 1246         | 6.95                | 44.05      | ❌             |
-| ViT-B-16-plus-240__laion400m_e31                     | 1263         | 6.94                | 44.05      | ❌             |
-| ViT-B-32__laion2b_e16                                | 1004         | 2.38                | 43.67      | ✅             |
-| ViT-B-32__laion2b-s34b-b79k                          | 1001         | 2.29                | 42.5       | ✅             |
-| ViT-B-16__laion400m_e32                              | 975          | 4.98                | 41.03      | ✅             |
-| ViT-B-16__laion400m_e31                              | 991          | 5.04                | 40.91      | ❌             |
-| ViT-B-32__laion400m_e31                              | 999          | 2.28                | 40.3       | ✅             |
-| ViT-B-32__laion400m_e32                              | 1003         | 2.35                | 40.3       | ❌             |
-| RN50x64__openai                                      | 5079         | 48.79               | 37.92      | ❌             |
-| ViT-L-14-336__openai                                 | 2616         | 43.45               | 37.7       | ❌             |
-| ViT-L-14__openai                                     | 2212         | 19.91               | 37.59      | ❌             |
-| RN50x16__openai                                      | 2221         | 15.87               | 34.75      | ❌             |
-| ViT-B-16__openai                                     | 985          | 5.03                | 32.1       | ❌             |
-| RN50x4__openai                                       | 1416         | 5.85                | 32.08      | ❌             |
-| RN101__openai                                        | 1111         | 3.21                | 30.77      | ❌             |
-| RN50__openai                                         | 913          | 2.39                | 30.2       | ✅             |
-| ViT-B-32__openai                                     | 1004         | 2.26                | 29.84      | ✅             |
+| ViT-SO400M-14-SigLIP2-378__webli                     | 3940         | 72.25               | 85.47      | ✅             |
+| ViT-SO400M-16-SigLIP2-384__webli                     | 3854         | 56.57               | 85.44      | ✅             |
+| ViT-L-16-SigLIP2-512__webli                          | 3358         | 92.59               | 85.32      | ✅             |
+| ViT-SO400M-16-SigLIP2-512__webli                     | 4050         | 107.67              | 85.22      | ❌             |
+| ViT-gopt-16-SigLIP2-384__webli                       | 6585         | 146.84              | 85.15      | ❌             |
+| ViT-L-16-SigLIP2-384__webli                          | 3057         | 51.7                | 84.81      | ✅             |
+| ViT-gopt-16-SigLIP2-256__webli                       | 6475         | 64.51               | 84.68      | ❌             |
+| ViT-SO400M-16-SigLIP2-256__webli                     | 3611         | 27.84               | 84.6       | ✅             |
+| ViT-SO400M-14-SigLIP2__webli                         | 3622         | 27.63               | 84.55      | ✅             |
+| ViT-H-14-378-quickgelu__dfn5b                        | 5049         | 108.4               | 84.27      | ❌             |
+| ViT-L-16-SigLIP2-256__webli                          | 2830         | 23.77               | 84.15      | ✅             |
+| ViT-H-14-quickgelu__dfn5b                            | 4701         | 38.74               | 83.87      | ❌             |
+| nllb-clip-large-siglip__mrl                          | 4248         | 75.44               | 83.74      | ❌             |
+| ViT-B-16-SigLIP2__webli                              | 3038         | 5.81                | 83.61      | ✅             |
+| nllb-clip-large-siglip__v1                           | 4226         | 75.05               | 83.15      | ❌             |
+| XLM-Roberta-Large-ViT-H-14__frozen_laion5b_s13b_b90k | 4014         | 39.14               | 81.7       | ❌             |
+| nllb-clip-base-siglip__mrl                           | 4696         | 16.95               | 80.91      | ❌             |
+| ViT-B-32-SigLIP2-256__webli                          | 3061         | 3.31                | 80.73      | ✅             |
+| ViT-L-16-SigLIP-384__webli                           | 3396         | 47.6                | 80.69      | ❌             |
+| ViT-L-16-SigLIP-256__webli                           | 3160         | 23.84               | 80.3       | ❌             |
+| nllb-clip-base-siglip__v1                            | 4675         | 15.17               | 79.8       | ❌             |
+| ViT-B-16-SigLIP-i18n-256__webli                      | 3029         | 6.87                | 79.71      | ✅             |
+| ViT-L-14-quickgelu__dfn2b                            | 2212         | 20.49               | 79.64      | ✅             |
+| ViT-B-16-SigLIP-384__webli                           | 1128         | 13.53               | 78.0       | ✅             |
+| ViT-B-16-SigLIP-512__webli                           | 1828         | 26.17               | 77.83      | ❌             |
+| ViT-B-16-SigLIP__webli                               | 1081         | 5.77                | 76.87      | ✅             |
+| ViT-B-16-SigLIP-256__webli                           | 1102         | 7.11                | 76.66      | ❌             |
+| XLM-Roberta-Base-ViT-B-32__laion5b_s13b_b90k         | 3030         | 3.2                 | 75.99      | ✅             |
+| ViT-SO400M-14-SigLIP-384__webli                      | 4417         | 72.19               | 71.96      | ❌             |
+| ViT-H-14__laion2b-s32b-b79k                          | 4676         | 39.06               | 62.06      | ❌             |
+| ViT-L-14__laion2b-s32b-b82k                          | 2233         | 20.56               | 53.78      | ❌             |
+| ViT-L-14__laion400m_e32                              | 2218         | 19.73               | 50.13      | ❌             |
+| ViT-L-14__laion400m_e31                              | 2183         | 19.87               | 50.0       | ❌             |
+| ViT-B-16-plus-240__laion400m_e32                     | 1246         | 6.95                | 47.39      | ❌             |
+| ViT-B-16-plus-240__laion400m_e31                     | 1263         | 6.94                | 47.39      | ❌             |
+| ViT-B-32__laion2b_e16                                | 1004         | 2.38                | 46.47      | ✅             |
+| ViT-B-32__laion2b-s34b-b79k                          | 1001         | 2.29                | 45.68      | ✅             |
+| ViT-B-16__laion400m_e31                              | 991          | 5.04                | 44.0       | ✅             |
+| ViT-B-16__laion400m_e32                              | 975          | 4.98                | 43.98      | ✅             |
+| ViT-B-32__laion400m_e32                              | 1003         | 2.35                | 43.8       | ❌             |
+| ViT-B-32__laion400m_e31                              | 999          | 2.28                | 43.73      | ✅             |
+| RN50x64__openai                                      | 5079         | 48.79               | 43.01      | ❌             |
+| ViT-L-14__openai                                     | 2212         | 19.91               | 42.96      | ❌             |
+| ViT-L-14-336__openai                                 | 2616         | 43.45               | 41.67      | ❌             |
+| RN50x16__openai                                      | 2221         | 15.87               | 40.21      | ❌             |
+| RN50x4__openai                                       | 1416         | 5.85                | 36.06      | ❌             |
+| ViT-B-16__openai                                     | 985          | 5.03                | 35.67      | ❌             |
+| RN101__openai                                        | 1111         | 3.21                | 34.62      | ❌             |
+| ViT-B-32__openai                                     | 1004         | 2.26                | 32.6       | ✅             |
+| RN50__openai                                         | 913          | 2.39                | 31.79      | ✅             |
 </details>
 <details>
 <summary>Swahili</summary>
@@ -1057,8 +1079,8 @@ Memory and execution time estimates were obtained without acceleration on a 7800
 | ViT-SO400M-14-SigLIP2-378__webli                     | 3940         | 72.25               | 72.1       | ✅             |
 | ViT-SO400M-16-SigLIP2-384__webli                     | 3854         | 56.57               | 72.06      | ✅             |
 | ViT-L-16-SigLIP2-512__webli                          | 3358         | 92.59               | 71.84      | ✅             |
-| ViT-SO400M-16-SigLIP2-256__webli                     | 3611         | 27.84               | 71.7       | ✅             |
 | ViT-L-16-SigLIP2-384__webli                          | 3057         | 51.7                | 71.7       | ✅             |
+| ViT-SO400M-16-SigLIP2-256__webli                     | 3611         | 27.84               | 71.7       | ✅             |
 | ViT-SO400M-16-SigLIP2-512__webli                     | 4050         | 107.67              | 71.61      | ❌             |
 | nllb-clip-base-siglip__v1                            | 4675         | 15.17               | 71.51      | ✅             |
 | ViT-SO400M-14-SigLIP2__webli                         | 3622         | 27.63               | 71.45      | ✅             |
@@ -1115,31 +1137,34 @@ Memory and execution time estimates were obtained without acceleration on a 7800
 <summary>Turkish</summary>
 | Model                                                | Memory (MiB) | Execution Time (ms) | Recall (%) | Pareto Optimal |
 |------------------------------------------------------|--------------|---------------------|------------|----------------|
-| nllb-clip-large-siglip__mrl                          | 4248         | 75.44               | 81.15      | ✅             |
-| nllb-clip-large-siglip__v1                           | 4226         | 75.05               | 80.89      | ✅             |
-| nllb-clip-base-siglip__mrl                           | 4696         | 16.95               | 78.11      | ✅             |
-| ViT-SO400M-14-SigLIP2-378__webli                     | 3940         | 72.25               | 77.51      | ✅             |
-| nllb-clip-base-siglip__v1                            | 4675         | 15.17               | 77.36      | ✅             |
-| ViT-SO400M-16-SigLIP2-512__webli                     | 4050         | 107.67              | 77.28      | ❌             |
-| XLM-Roberta-Large-ViT-H-14__frozen_laion5b_s13b_b90k | 4014         | 39.14               | 77.24      | ✅             |
-| ViT-SO400M-16-SigLIP2-384__webli                     | 3854         | 56.57               | 77.01      | ✅             |
-| ViT-gopt-16-SigLIP2-384__webli                       | 6585         | 146.84              | 76.37      | ❌             |
-| ViT-SO400M-16-SigLIP2-256__webli                     | 3611         | 27.84               | 75.92      | ✅             |
-| ViT-SO400M-14-SigLIP2__webli                         | 3622         | 27.63               | 75.69      | ✅             |
-| ViT-gopt-16-SigLIP2-256__webli                       | 6475         | 64.51               | 75.68      | ❌             |
-| ViT-L-16-SigLIP2-512__webli                          | 3358         | 92.59               | 75.54      | ✅             |
-| ViT-L-16-SigLIP2-384__webli                          | 3057         | 51.7                | 75.16      | ✅             |
-| ViT-L-16-SigLIP2-256__webli                          | 2830         | 23.77               | 73.83      | ✅             |
-| ViT-B-16-SigLIP-i18n-256__webli                      | 3029         | 6.87                | 70.15      | ✅             |
-| XLM-Roberta-Base-ViT-B-32__laion5b_s13b_b90k         | 3030         | 3.2                 | 69.19      | ✅             |
-| ViT-B-16-SigLIP2__webli                              | 3038         | 5.81                | 66.72      | ❌             |
-| ViT-B-32-SigLIP2-256__webli                          | 3061         | 3.31                | 64.76      | ❌             |
-| ViT-H-14-378-quickgelu__dfn5b                        | 5049         | 108.4               | 38.8       | ❌             |
-| ViT-H-14-quickgelu__dfn5b                            | 4701         | 38.74               | 38.48      | ❌             |
-| ViT-L-16-SigLIP-384__webli                           | 3396         | 47.6                | 30.83      | ❌             |
-| ViT-L-16-SigLIP-256__webli                           | 3160         | 23.84               | 30.28      | ❌             |
-| ViT-L-14-quickgelu__dfn2b                            | 2212         | 20.49               | 21.31      | ✅             |
-| ViT-B-16-SigLIP__webli                               | 1081         | 5.77                | 20.08      | ✅             |
+| nllb-clip-large-siglip__mrl                          | 4248         | 75.44               | 83.91      | ✅             |
+| nllb-clip-large-siglip__v1                           | 4226         | 75.05               | 83.74      | ✅             |
+| nllb-clip-base-siglip__mrl                           | 4696         | 16.95               | 81.26      | ✅             |
+| nllb-clip-base-siglip__v1                            | 4675         | 15.17               | 80.21      | ✅             |
+| ViT-SO400M-16-SigLIP2-512__webli                     | 4050         | 107.67              | 79.34      | ✅             |
+| ViT-SO400M-14-SigLIP2-378__webli                     | 3940         | 72.25               | 79.22      | ✅             |
+| XLM-Roberta-Large-ViT-H-14__frozen_laion5b_s13b_b90k | 4014         | 39.14               | 78.9       | ✅             |
+| ViT-SO400M-16-SigLIP2-384__webli                     | 3854         | 56.57               | 78.85      | ✅             |
+| ViT-SO400M-16-SigLIP2-256__webli                     | 3611         | 27.84               | 78.29      | ✅             |
+| ViT-gopt-16-SigLIP2-384__webli                       | 6585         | 146.84              | 78.27      | ❌             |
+| ViT-gopt-16-SigLIP2-256__webli                       | 6475         | 64.51               | 78.0       | ❌             |
+| ViT-SO400M-14-SigLIP2__webli                         | 3622         | 27.63               | 77.81      | ✅             |
+| ViT-L-16-SigLIP2-512__webli                          | 3358         | 92.59               | 77.67      | ✅             |
+| ViT-L-16-SigLIP2-384__webli                          | 3057         | 51.7                | 77.33      | ✅             |
+| ViT-L-16-SigLIP2-256__webli                          | 2830         | 23.77               | 76.42      | ✅             |
+| ViT-B-16-SigLIP-i18n-256__webli                      | 3029         | 6.87                | 72.44      | ✅             |
+| XLM-Roberta-Base-ViT-B-32__laion5b_s13b_b90k         | 3030         | 3.2                 | 69.84      | ✅             |
+| ViT-B-16-SigLIP2__webli                              | 3038         | 5.81                | 69.83      | ❌             |
+| ViT-B-32-SigLIP2-256__webli                          | 3061         | 3.31                | 67.13      | ❌             |
+| ViT-H-14-378-quickgelu__dfn5b                        | 5049         | 108.4               | 44.43      | ❌             |
+| ViT-H-14-quickgelu__dfn5b                            | 4701         | 38.74               | 43.87      | ❌             |
+| ViT-L-16-SigLIP-384__webli                           | 3396         | 47.6                | 35.1       | ❌             |
+| ViT-L-16-SigLIP-256__webli                           | 3160         | 23.84               | 34.92      | ❌             |
+| ViT-L-14-quickgelu__dfn2b                            | 2212         | 20.49               | 25.2       | ✅             |
+| ViT-B-16-SigLIP-512__webli                           | 1828         | 26.17               | 24.55      | ✅             |
+| ViT-B-16-SigLIP__webli                               | 1081         | 5.77                | 24.13      | ✅             |
+| ViT-B-16-SigLIP-384__webli                           | 1128         | 13.53               | 24.08      | ❌             |
+| ViT-B-16-SigLIP-256__webli                           | 1102         | 7.11                | 23.95      | ❌             |
 </details>
 <details>
 <summary>Ukrainian</summary>

docs/docs/features/supported-formats.md

@@ -16,7 +16,7 @@ For the full list, refer to the [Immich source code](https://github.com/immich-a
 | `HEIC`      | `.heic`                       | :white_check_mark: |                 |
 | `HEIF`      | `.heif`                       | :white_check_mark: |                 |
 | `JPEG 2000` | `.jp2`                        | :white_check_mark: |                 |
-| `JPEG`      | `.webp` `.jpg` `.jpe` `.insp` | :white_check_mark: |                 |
+| `JPEG`      | `.jpeg` `.jpg` `.jpe` `.insp` | :white_check_mark: |                 |
 | `JPEG XL`   | `.jxl`                        | :white_check_mark: |                 |
 | `PNG`       | `.png`                        | :white_check_mark: |                 |
 | `PSD`       | `.psd`                        | :white_check_mark: | Adobe Photoshop |

docs/docs/guides/custom-map-styles.md

@@ -14,14 +14,14 @@ online generators you can use.
 2. Paste the link to your JSON style in either the **Light Style** or **Dark Style**. (You can add different styles which will help make the map style more appropriate depending on whether you set **Immich** to Light or Dark mode.)
 3. Save your selections. Reload the map, and enjoy your custom map style!
 
-## Use Maptiler to build a custom style
+## Use MapTiler to build a custom style
 
-Customizing the map style can be done easily using Maptiler, if you do not want to write an entire JSON document by hand.
+Customizing the map style can be done easily using MapTiler, if you do not want to write an entire JSON document by hand.
 
 1. Create a free account at https://cloud.maptiler.com
 2. Once logged in, you can either create a brand new map by clicking on **New Map**, selecting a starter map, and then clicking **Customize**, OR by selecting a **Standard Map** and customizing it from there.
 3. The **editor** interface is self-explanatory. You can change colors, remove visible layers, or add optional layers (e.g., administrative, topo, hydro, etc.) in the composer.
 4. Once you have your map composed, click on **Save** at the top right. Give it a unique name to save it to your account.
-5. Next, **Publish** your style using the **Publish** button at the top right. This will deploy it to production, which means it is able to be exposed over the Internet. Maptiler will present an interactive side-by-side map with the original and your changes prior to publication.<br/>![Maptiler Publication Settings](img/immich_map_styles_publish.webp)
-6. Maptiler will warn you that changing the map will change it across all apps using the map. Since no apps are using the map yet, this is okay.
-7. Clicking on the name of your new map at the top left will bring you to the item's **details** page. From here, copy the link to the JSON style under **Use vector style**. This link will automatically contain your personal API key to Maptiler.
+5. Next, **Publish** your style using the **Publish** button at the top right. This will deploy it to production, which means it is able to be exposed over the Internet. MapTiler will present an interactive side-by-side map with the original and your changes prior to publication.<br/>![MapTiler Publication Settings](img/immich_map_styles_publish.webp)
+6. MapTiler will warn you that changing the map will change it across all apps using the map. Since no apps are using the map yet, this is okay.
+7. Clicking on the name of your new map at the top left will bring you to the item's **details** page. From here, copy the link to the JSON style under **Use vector style**. This link will automatically contain your personal API key to MapTiler.

docs/docs/guides/database-queries.md

@@ -1,7 +1,7 @@
 # Database Queries
 
 :::danger
-Keep in mind that mucking around in the database might set the moon on fire. Avoid modifying the database directly when possible, and always have current backups.
+Keep in mind that mucking around in the database might set the Moon on fire. Avoid modifying the database directly when possible, and always have current backups.
 :::
 
 :::tip

docs/docs/guides/remote-machine-learning.md

@@ -23,12 +23,12 @@ name: immich_remote_ml
 services:
   immich-machine-learning:
     container_name: immich_machine_learning
-    # For hardware acceleration, add one of -[armnn, cuda, rocm, openvino] to the image tag.
+    # For hardware acceleration, add one of -[armnn, cuda, rocm, openvino, rknn] to the image tag.
     # Example tag: ${IMMICH_VERSION:-release}-cuda
     image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
     # extends:
     #   file: hwaccel.ml.yml
-    #   service: # set to one of [armnn, cuda, rocm, openvino, openvino-wsl] for accelerated inference - use the `-wsl` version for WSL2 where applicable
+    #   service: # set to one of [armnn, cuda, rocm, openvino, openvino-wsl, rknn] for accelerated inference - use the `-wsl` version for WSL2 where applicable
     volumes:
       - model-cache:/cache
     restart: always

docs/docs/guides/template-backup-script.md

@@ -52,9 +52,9 @@ REMOTE_BACKUP_PATH="/path/to/remote/backup/directory"
 ### Local
 
 # Backup Immich database
-docker exec -t immich_postgres pg_dumpall --clean --if-exists --username=postgres > "$UPLOAD_LOCATION"/database-backup/immich-database.sql
+docker exec -t immich_postgres pg_dumpall --clean --if-exists --username=<DB_USERNAME> > "$UPLOAD_LOCATION"/database-backup/immich-database.sql
 # For deduplicating backup programs such as Borg or Restic, compressing the content can increase backup size by making it harder to deduplicate. If you are using a different program or still prefer to compress, you can use the following command instead:
-# docker exec -t immich_postgres pg_dumpall --clean --if-exists --username=postgres | /usr/bin/gzip --rsyncable > "$UPLOAD_LOCATION"/database-backup/immich-database.sql.gz
+# docker exec -t immich_postgres pg_dumpall --clean --if-exists --username=<DB_USERNAME> | /usr/bin/gzip --rsyncable > "$UPLOAD_LOCATION"/database-backup/immich-database.sql.gz
 
 ### Append to local Borg repository
 borg create "$BACKUP_PATH/immich-borg::{now}" "$UPLOAD_LOCATION" --exclude "$UPLOAD_LOCATION"/thumbs/ --exclude "$UPLOAD_LOCATION"/encoded-video/

docs/docs/install/config-file.md

@@ -1,3 +1,7 @@
+---
+sidebar_position: 100
+---
+
 # Config File
 
 A config file can be provided as an alternative to the UI configuration.
@@ -119,7 +123,7 @@ The default configuration looks like this:
     "buttonText": "Login with OAuth",
     "clientId": "",
     "clientSecret": "",
-    "defaultStorageQuota": 0,
+    "defaultStorageQuota": null,
     "enabled": false,
     "issuerUrl": "",
     "mobileOverrideEnabled": false,

docs/docs/install/docker-compose.mdx

@@ -2,53 +2,13 @@
 sidebar_position: 30
 ---
 
-import CodeBlock from '@theme/CodeBlock';
-import ExampleEnv from '!!raw-loader!../../../docker/example.env';
-
 # Docker Compose [Recommended]
 
 Docker Compose is the recommended method to run Immich in production. Below are the steps to deploy Immich with Docker Compose.
 
-## Step 1 - Download the required files
+import DockerComposeSteps from '/docs/partials/_docker-compose-install-steps.mdx';
 
-Create a directory of your choice (e.g. `./immich-app`) to hold the `docker-compose.yml` and `.env` files.
-
-```bash title="Move to the directory you created"
-mkdir ./immich-app
-cd ./immich-app
-```
-
-Download [`docker-compose.yml`][compose-file] and [`example.env`][env-file] by running the following commands:
-
-```bash title="Get docker-compose.yml file"
-wget -O docker-compose.yml https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml
-```
-
-```bash title="Get .env file"
-wget -O .env https://github.com/immich-app/immich/releases/latest/download/example.env
-```
-
-You can alternatively download these two files from your browser and move them to the directory that you created, in which case ensure that you rename `example.env` to `.env`.
-
-## Step 2 - Populate the .env file with custom values
-
-<CodeBlock language="bash" title="Default environmental variable content">
-  {ExampleEnv}
-</CodeBlock>
-
-- Populate `UPLOAD_LOCATION` with your preferred location for storing backup assets. It should be a new directory on the server with enough free space.
-- Consider changing `DB_PASSWORD` to a custom value. Postgres is not publicly exposed, so this password is only used for local authentication.
-  To avoid issues with Docker parsing this value, it is best to use only the characters `A-Za-z0-9`. `pwgen` is a handy utility for this.
-- Set your timezone by uncommenting the `TZ=` line.
-- Populate custom database information if necessary.
-
-## Step 3 - Start the containers
-
-From the directory you created in Step 1 (which should now contain your customized `docker-compose.yml` and `.env` files), run the following command to start Immich as a background service:
-
-```bash title="Start the containers"
-docker compose up -d
-```
+<DockerComposeSteps />
 
 :::info Docker version
 If you get an error such as `unknown shorthand flag: 'd' in -d` or `open <location of your .env file>: permission denied`, you are probably running the wrong Docker version. (This happens, for example, with the docker.io package in Ubuntu 22.04.3 LTS.) You can correct the problem by following the complete [Docker Engine install](https://docs.docker.com/engine/install/) procedure for your distribution, crucially the "Uninstall old versions" and "Install using the apt/rpm repository" sections. These replace the distro's Docker packages with Docker's official ones.
@@ -69,39 +29,4 @@ If you get an error `can't set healthcheck.start_interval as feature require Doc
 
 ## Next Steps
 
-Read the [Post Installation](/docs/install/post-install.mdx) steps or setup optional features below.
-
-### Setting up optional features
-
-- [External Libraries](/docs/features/libraries.md): Adding your existing photo library to Immich
-- [Hardware Transcoding](/docs/features/hardware-transcoding.md): Speeding up video transcoding
-- [Hardware-Accelerated Machine Learning](/docs/features/ml-hardware-acceleration.md): Speeding up various machine learning tasks in Immich
-
-### Upgrading
-
-:::danger Read the release notes
-Immich is currently under heavy development, which means you can expect [breaking changes][breaking] and bugs. Therefore, we recommend reading the release notes prior to updating and to take special care when using automated tools like [Watchtower][watchtower].
-
-You can see versions that had breaking changes [here][breaking].
-:::
-
-If `IMMICH_VERSION` is set, it will need to be updated to the latest or desired version.
-
-When a new version of Immich is [released][releases], the application can be upgraded and restarted with the following commands, run in the directory with the `docker-compose.yml` file:
-
-```bash title="Upgrade and restart Immich"
-docker compose pull && docker compose up -d
-```
-
-To clean up disk space, the old version's obsolete container images can be deleted with the following command:
-
-```bash title="Clean up unused Docker images"
-docker image prune
-```
-
-[compose-file]: https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml
-[env-file]: https://github.com/immich-app/immich/releases/latest/download/example.env
-[watchtower]: https://containrrr.dev/watchtower/
-[breaking]: https://github.com/immich-app/immich/discussions?discussions_q=label%3Achangelog%3Abreaking-change+sort%3Adate_created
-[container-auth]: https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry#authenticating-to-the-container-registry
-[releases]: https://github.com/immich-app/immich/releases
+Read the [Post Installation](/docs/install/post-install.mdx) steps and [upgrade instructions](/docs/install/upgrading.md).

docs/docs/install/environment-variables.md

@@ -72,20 +72,24 @@ Information on the current workers can be found [here](/docs/administration/jobs
 
 ## Database
 
-| Variable                            | Description                                                              |   Default    | Containers                     |
-| :---------------------------------- | :----------------------------------------------------------------------- | :----------: | :----------------------------- |
-| `DB_URL`                            | Database URL                                                             |              | server                         |
-| `DB_HOSTNAME`                       | Database host                                                            |  `database`  | server                         |
-| `DB_PORT`                           | Database port                                                            |    `5432`    | server                         |
-| `DB_USERNAME`                       | Database user                                                            |  `postgres`  | server, database<sup>\*1</sup> |
-| `DB_PASSWORD`                       | Database password                                                        |  `postgres`  | server, database<sup>\*1</sup> |
-| `DB_DATABASE_NAME`                  | Database name                                                            |   `immich`   | server, database<sup>\*1</sup> |
-| `DB_VECTOR_EXTENSION`<sup>\*2</sup> | Database vector extension (one of [`pgvector`, `pgvecto.rs`])            | `pgvecto.rs` | server                         |
-| `DB_SKIP_MIGRATIONS`                | Whether to skip running migrations on startup (one of [`true`, `false`]) |   `false`    | server                         |
+| Variable                            | Description                                                                            |  Default   | Containers                     |
+| :---------------------------------- | :------------------------------------------------------------------------------------- | :--------: | :----------------------------- |
+| `DB_URL`                            | Database URL                                                                           |            | server                         |
+| `DB_HOSTNAME`                       | Database host                                                                          | `database` | server                         |
+| `DB_PORT`                           | Database port                                                                          |   `5432`   | server                         |
+| `DB_USERNAME`                       | Database user                                                                          | `postgres` | server, database<sup>\*1</sup> |
+| `DB_PASSWORD`                       | Database password                                                                      | `postgres` | server, database<sup>\*1</sup> |
+| `DB_DATABASE_NAME`                  | Database name                                                                          |  `immich`  | server, database<sup>\*1</sup> |
+| `DB_SSL_MODE`                       | Database SSL mode                                                                      |            | server                         |
+| `DB_VECTOR_EXTENSION`<sup>\*2</sup> | Database vector extension (one of [`vectorchord`, `pgvector`, `pgvecto.rs`])           |            | server                         |
+| `DB_SKIP_MIGRATIONS`                | Whether to skip running migrations on startup (one of [`true`, `false`])               |  `false`   | server                         |
+| `DB_STORAGE_TYPE`                   | Optimize concurrent IO on SSDs or sequential IO on HDDs ([`SSD`, `HDD`])<sup>\*3</sup> |   `SSD`    | server                         |
 
 \*1: The values of `DB_USERNAME`, `DB_PASSWORD`, and `DB_DATABASE_NAME` are passed to the Postgres container as the variables `POSTGRES_USER`, `POSTGRES_PASSWORD`, and `POSTGRES_DB` in `docker-compose.yml`.
 
-\*2: This setting cannot be changed after the server has successfully started up.
+\*2: If not provided, the appropriate extension to use is auto-detected at startup by introspecting the database. When multiple extensions are installed, the order of preference is VectorChord, pgvecto.rs, pgvector.
+
+\*3: Uses either [`postgresql.ssd.conf`](https://github.com/immich-app/base-images/blob/main/postgres/postgresql.ssd.conf) or [`postgresql.hdd.conf`](https://github.com/immich-app/base-images/blob/main/postgres/postgresql.hdd.conf) which mainly controls the Postgres `effective_io_concurrency` setting to allow for concurrenct IO on SSDs and sequential IO on HDDs.
 
 :::info
 

docs/docs/install/portainer.md

@@ -39,8 +39,8 @@ alt="Dot Env Example"
 />
 
 - Change the default `DB_PASSWORD`, and add custom database connection information if necessary.
-- Change `DB_DATA_LOCATION` to a folder where the database will be saved to disk.
-- Change `UPLOAD_LOCATION` to a folder where media (uploaded and generated) will be stored.
+- Change `DB_DATA_LOCATION` to a folder (absolute path) where the database will be saved to disk.
+- Change `UPLOAD_LOCATION` to a folder (absolute path) where media (uploaded and generated) will be stored.
 
 11. Click on "**Deploy the stack**".
 

docs/docs/install/post-install.mdx

@@ -41,3 +41,9 @@ A list of common steps to take after installing Immich include:
 ## Step 7 - Setup Server Backups
 
 <ServerBackup />
+
+## Setting up optional features
+
+- [External Libraries](/docs/features/libraries.md): Adding your existing photo library to Immich
+- [Hardware Transcoding](/docs/features/hardware-transcoding.md): Speeding up video transcoding
+- [Hardware-Accelerated Machine Learning](/docs/features/ml-hardware-acceleration.md): Speeding up various machine learning tasks in Immich

docs/docs/install/synology.md

@@ -25,11 +25,11 @@ When you're all done, you should have the following:
 - `./docker/immich-app/postgres`
 - `./docker/immich-app/library`
 
-Download [`docker-compose.yml`](https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml) and [`example.env`](https://github.com/immich-app/immich/releases/latest/download/example.env) to your computer. Upload the files to the `./docker/immich-app` directory.
+Download [`docker-compose.yml`](https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml) and [`example.env`](https://github.com/immich-app/immich/releases/latest/download/example.env) to your computer. Upload the files to the `./docker/immich-app` directory, and rename `example.env` to `.env`.
 
 ## Step 2 - Populate the .env file with custom values
 
-Follow [Step 2 in Docker Compose](./docker-compose#step-2---populate-the-env-file-with-custom-values) for instructions on customizing the `.env` file, and then return back to this guide to continue.
+Follow [Step 2 in Docker Compose](/docs/install/docker-compose#step-2---populate-the-env-file-with-custom-values) for instructions on customizing the `.env` file, and then return back to this guide to continue.
 
 ## Step 3 - Create a new project in Container Manager
 
@@ -67,10 +67,4 @@ Click "**Edit Rules**" and add the following firewall rules:
 
 ## Next Steps
 
-Read the [Post Installation](/docs/install/post-install.mdx) steps or setup optional features below.
-
-### Setting up optional features
-
-- [External Libraries](/docs/features/libraries.md): Adding your existing photo library to Immich
-- [Hardware Transcoding](/docs/features/hardware-transcoding.md): Speeding up video transcoding
-- [Hardware-Accelerated Machine Learning](/docs/features/ml-hardware-acceleration.md): Speeding up various machine learning tasks in Immich
+Read the [Post Installation](/docs/install/post-install.mdx) steps and [upgrade instructions](/docs/install/upgrading.md).

docs/docs/install/truenas.md

@@ -2,27 +2,27 @@
 sidebar_position: 80
 ---
 
-# TrueNAS SCALE [Community]
+# TrueNAS [Community]
 
 :::note
 This is a community contribution and not officially supported by the Immich team, but included here for convenience.
 
 Community support can be found in the dedicated channel on the [Discord Server](https://discord.immich.app/).
 
-**Please report app issues to the corresponding [Github Repository](https://github.com/truenas/charts/tree/master/community/immich).**
+**Please report app issues to the corresponding [Github Repository](https://github.com/truenas/apps/tree/master/trains/community/immich).**
 :::
 
-Immich can easily be installed on TrueNAS SCALE via the **Community** train application.
-Consider reviewing the TrueNAS [Apps tutorial](https://www.truenas.com/docs/scale/scaletutorials/apps/) if you have not previously configured applications on your system.
+Immich can easily be installed on TrueNAS Community Edition via the **Community** train application.
+Consider reviewing the TrueNAS [Apps resources](https://apps.truenas.com/getting-started/) if you have not previously configured applications on your system.
 
-TrueNAS SCALE makes installing and updating Immich easy, but you must use the Immich web portal and mobile app to configure accounts and access libraries.
+TrueNAS Community Edition makes installing and updating Immich easy, but you must use the Immich web portal and mobile app to configure accounts and access libraries.
 
 ## First Steps
 
-The Immich app in TrueNAS SCALE installs, completes the initial configuration, then starts the Immich web portal.
-When updates become available, SCALE alerts and provides easy updates.
+The Immich app in TrueNAS Community Edition installs, completes the initial configuration, then starts the Immich web portal.
+When updates become available, TrueNAS alerts and provides easy updates.
 
-Before installing the Immich app in SCALE, review the [Environment Variables](#environment-variables) documentation to see if you want to configure any during installation.
+Before installing the Immich app in TrueNAS, review the [Environment Variables](#environment-variables) documentation to see if you want to configure any during installation.
 You may also configure environment variables at any time after deploying the application.
 
 ### Setting up Storage Datasets
@@ -126,9 +126,9 @@ className="border rounded-xl"
 
 Accept the default port `30041` in **WebUI Port** or enter a custom port number.
 :::info Allowed Port Numbers
-Only numbers within the range 9000-65535 may be used on SCALE versions below TrueNAS Scale 24.10 Electric Eel.
+Only numbers within the range 9000-65535 may be used on TrueNAS versions below TrueNAS Community Edition 24.10 Electric Eel.
 
-Regardless of version, to avoid port conflicts, don't use [ports on this list](https://www.truenas.com/docs/references/defaultports/).
+Regardless of version, to avoid port conflicts, don't use [ports on this list](https://www.truenas.com/docs/solutions/optimizations/security/#truenas-default-ports).
 :::
 
 ### Storage Configuration
@@ -173,7 +173,7 @@ className="border rounded-xl"
 
 You may configure [External Libraries](/docs/features/libraries) by mounting them using **Additional Storage**.
 The **Mount Path** is the location you will need to copy and paste into the External Library settings within Immich.
-The **Host Path** is the location on the TrueNAS SCALE server where your external library is located.
+The **Host Path** is the location on the TrueNAS Community Edition server where your external library is located.
 
 <!-- A section for Labels would go here but I don't know what they do. -->
 
@@ -188,17 +188,17 @@ className="border rounded-xl"
 
 Accept the default **CPU** limit of `2` threads or specify the number of threads (CPUs with Multi-/Hyper-threading have 2 threads per core).
 
-Accept the default **Memory** limit of `4096` MB or specify the number of MB of RAM. If you're using Machine Learning you should probably set this above 8000 MB.
+Specify the **Memory** limit in MB of RAM. Immich recommends at least 6000 MB (6GB). If you selected **Enable Machine Learning** in **Immich Configuration**, you should probably set this above 8000 MB.
 
-:::info Older SCALE Versions
-Before TrueNAS SCALE version 24.10 Electric Eel:
+:::info Older TrueNAS Versions
+Before TrueNAS Community Edition version 24.10 Electric Eel:
 
 The **CPU** value was specified in a different format with a default of `4000m` which is 4 threads.
 
 The **Memory** value was specified in a different format with a default of `8Gi` which is 8 GiB of RAM. The value was specified in bytes or a number with a measurement suffix. Examples: `129M`, `123Mi`, `1000000000`
 :::
 
-Enable **GPU Configuration** options if you have a GPU that you will use for [Hardware Transcoding](/docs/features/hardware-transcoding) and/or [Hardware-Accelerated Machine Learning](/docs/features/ml-hardware-acceleration.md). More info: [GPU Passthrough Docs for TrueNAS Apps](https://www.truenas.com/docs/truenasapps/#gpu-passthrough)
+Enable **GPU Configuration** options if you have a GPU that you will use for [Hardware Transcoding](/docs/features/hardware-transcoding) and/or [Hardware-Accelerated Machine Learning](/docs/features/ml-hardware-acceleration.md). More info: [GPU Passthrough Docs for TrueNAS Apps](https://apps.truenas.com/managing-apps/installing-apps/#gpu-passthrough)
 
 ### Install
 
@@ -240,14 +240,18 @@ className="border rounded-xl"
 />
 
 :::info
-Some Environment Variables are not available for the TrueNAS SCALE app. This is mainly because they can be configured through GUI options in the [Edit Immich screen](#edit-app-settings).
+Some Environment Variables are not available for the TrueNAS Community Edition app. This is mainly because they can be configured through GUI options in the [Edit Immich screen](#edit-app-settings).
 
 Some examples are: `IMMICH_VERSION`, `UPLOAD_LOCATION`, `DB_DATA_LOCATION`, `TZ`, `IMMICH_LOG_LEVEL`, `DB_PASSWORD`, `REDIS_PASSWORD`.
 :::
 
 ## Updating the App
 
-When updates become available, SCALE alerts and provides easy updates.
+:::danger
+Make sure to read the general [upgrade instructions](/docs/install/upgrading.md).
+:::
+
+When updates become available, TrueNAS alerts and provides easy updates.
 To update the app to the latest version:
 
 - Go to the **Installed Applications** screen and select Immich from the list of installed applications.

docs/docs/install/unraid.md

@@ -75,7 +75,6 @@ alt="Select Plugins > Compose.Manager > Add New Stack > Label it Immich"
 5.  Click "**Save Changes**", you will be prompted to edit stack UI labels, just leave this blank and click "**Ok**"
 6.  Select the cog ⚙️ next to Immich, click "**Edit Stack**", then click "**Env File**"
 7.  Paste the entire contents of the [Immich example.env](https://github.com/immich-app/immich/releases/latest/download/example.env) file into the Unraid editor, then **before saving** edit the following:
-
     - `UPLOAD_LOCATION`: Create a folder in your Images Unraid share and place the **absolute** location here > For example my _"images"_ share has a folder within it called _"immich"_. If I browse to this directory in the terminal and type `pwd` the output is `/mnt/user/images/immich`. This is the exact value I need to enter as my `UPLOAD_LOCATION`
     - `DB_DATA_LOCATION`: Change this to use an Unraid share (preferably a cache pool, e.g. `/mnt/user/appdata/postgresql/data`). This uses the `appdata` share. Do also create the `postgresql` folder, by running `mkdir /mnt/user/{share_location}/postgresql/data`. If left at default it will try to use Unraid's `/boot/config/plugins/compose.manager/projects/[stack_name]/postgres` folder which it doesn't have permissions to, resulting in this container continuously restarting.
 
@@ -131,6 +130,10 @@ For more information on how to use the application once installed, please refer
 
 ## Updating Steps
 
+:::danger
+Make sure to read the general [upgrade instructions](/docs/install/upgrading.md).
+:::
+
 Updating is extremely easy however it's important to be aware that containers managed via the Docker Compose Manager plugin do not integrate with Unraid's native dockerman UI, the label "_update ready_" will always be present on containers installed via the Docker Compose Manager.
 
 <img

docs/docs/install/upgrading.md

@@ -0,0 +1,29 @@
+---
+sidebar_position: 95
+---
+
+# Upgrading
+
+:::danger Read the release notes
+Immich is currently under heavy development, which means you can expect [breaking changes][breaking] and bugs. You should read the release notes prior to updating and take special care when using automated tools like [Watchtower][watchtower].
+
+You can see versions that had breaking changes [here][breaking].
+:::
+
+When a new version of Immich is [released][releases], you should read the release notes and account for any breaking changes noted (as mentioned above).
+If you use `IMMICH_VERSION` in your `.env` file, it will need to be updated to the latest or desired version.
+After that, the application can be upgraded and restarted with the following commands, run in the directory with the `docker-compose.yml` file:
+
+```bash title="Upgrade and restart Immich"
+docker compose pull && docker compose up -d
+```
+
+To clean up disk space, the old version's obsolete container images can be deleted with the following command:
+
+```bash title="Clean up unused Docker images"
+docker image prune
+```
+
+[watchtower]: https://containrrr.dev/watchtower/
+[breaking]: https://github.com/immich-app/immich/discussions?discussions_q=label%3Achangelog%3Abreaking-change+sort%3Adate_created
+[releases]: https://github.com/immich-app/immich/releases

docs/docs/overview/comparison.md

@@ -1,5 +1,5 @@
 ---
-sidebar_position: 2
+sidebar_position: 3
 ---
 
 # Comparison

docs/docs/overview/quick-start.mdx

@@ -1,5 +1,5 @@
 ---
-sidebar_position: 3
+sidebar_position: 2
 ---
 
 # Quick start
@@ -10,11 +10,20 @@ to install and use it.
 
 ## Requirements
 
-Check the [requirements page](/docs/install/requirements) to get started.
+- A system with at least 4GB of RAM and 2 CPU cores.
+- [Docker](https://docs.docker.com/engine/install/)
+
+> For a more detailed list of requirements, see the [requirements page](/docs/install/requirements).
+
+---
 
 ## Set up the server
 
-Follow the [Docker Compose (Recommended)](/docs/install/docker-compose) instructions to install the server.
+import DockerComposeSteps from '/docs/partials/_docker-compose-install-steps.mdx';
+
+<DockerComposeSteps />
+
+---
 
 ## Try the web app
 
@@ -26,6 +35,8 @@ Try uploading a picture from your browser.
 
 <img src={require('./img/upload-button.webp').default} title="Upload button" />
 
+---
+
 ## Try the mobile app
 
 ### Download the Mobile App
@@ -56,6 +67,8 @@ You can select the **Jobs** tab to see Immich processing your photos.
 
 <img src={require('/docs/guides/img/jobs-tab.webp').default} title="Jobs tab" width={300} />
 
+---
+
 ## Review the database backup and restore process
 
 Immich has built-in database backups. You can refer to the
@@ -65,6 +78,8 @@ Immich has built-in database backups. You can refer to the
 The database only contains metadata and user information. You must setup manual backups of the images and videos stored in `UPLOAD_LOCATION`.
 :::
 
+---
+
 ## Where to go from here?
 
 You may decide you'd like to install the server a different way; the Install category on the left menu provides many options.

docs/docs/overview/welcome.mdx

@@ -2,9 +2,13 @@
 sidebar_position: 1
 ---
 
-# Introduction
+# Welcome to Immich
 
-<img src={require('./img/feature-panel.webp').default} alt="Immich - Self-hosted photos and videos backup tool" />
+<img
+  src={require('./img/social-preview-light.webp').default}
+  alt="Immich - Self-hosted photos and videos backup tool"
+  data-theme="light"
+/>
 
 ## Welcome!
 

docs/docs/partials/_docker-compose-install-steps.mdx

@@ -0,0 +1,43 @@
+import CodeBlock from '@theme/CodeBlock';
+import ExampleEnv from '!!raw-loader!../../../docker/example.env';
+
+### Step 1 - Download the required files
+
+Create a directory of your choice (e.g. `./immich-app`) to hold the `docker-compose.yml` and `.env` files.
+
+```bash title="Move to the directory you created"
+mkdir ./immich-app
+cd ./immich-app
+```
+
+Download [`docker-compose.yml`](https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml) and [`example.env`](https://github.com/immich-app/immich/releases/latest/download/example.env) by running the following commands:
+
+```bash title="Get docker-compose.yml file"
+wget -O docker-compose.yml https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml
+```
+
+```bash title="Get .env file"
+wget -O .env https://github.com/immich-app/immich/releases/latest/download/example.env
+```
+
+You can alternatively download these two files from your browser and move them to the directory that you created, in which case ensure that you rename `example.env` to `.env`.
+
+### Step 2 - Populate the .env file with custom values
+
+<CodeBlock language="bash" title="Default environmental variable content">
+  {ExampleEnv}
+</CodeBlock>
+
+- Populate `UPLOAD_LOCATION` with your preferred location for storing backup assets. It should be a new directory on the server with enough free space.
+- Consider changing `DB_PASSWORD` to a custom value. Postgres is not publicly exposed, so this password is only used for local authentication.
+  To avoid issues with Docker parsing this value, it is best to use only the characters `A-Za-z0-9`. `pwgen` is a handy utility for this.
+- Set your timezone by uncommenting the `TZ=` line.
+- Populate custom database information if necessary.
+
+### Step 3 - Start the containers
+
+From the directory you created in Step 1 (which should now contain your customized `docker-compose.yml` and `.env` files), run the following command to start Immich as a background service:
+
+```bash title="Start the containers"
+docker compose up -d
+```

docs/docs/partials/_server-backup.md

@@ -1,2 +1,7 @@
 Now that you have imported some pictures, you should setup server backups to preserve your memories.
 You can do so by following our [backup guide](/docs/administration/backup-and-restore.md).
+
+:::danger
+Immich is still under heavy development _and_ handles very important data.
+It is essential that you set up good backups, and test them.
+:::

docs/docusaurus.config.js

@@ -95,7 +95,7 @@ const config = {
             position: 'right',
           },
           {
-            to: '/docs/overview/introduction',
+            to: '/docs/overview/welcome',
             position: 'right',
             label: 'Docs',
           },
@@ -124,6 +124,12 @@ const config = {
             label: 'Discord',
             position: 'right',
           },
+          {
+            type: 'html',
+            position: 'right',
+            value:
+              '<a href="https://buy.immich.app" target="_blank" class="no-underline hover:no-underline"><button class="buy-button bg-immich-primary dark:bg-immich-dark-primary text-white dark:text-black rounded-xl">Buy Immich</button></a>',
+          },
         ],
       },
       footer: {
@@ -134,7 +140,7 @@ const config = {
             items: [
               {
                 label: 'Welcome',
-                to: '/docs/overview/introduction',
+                to: '/docs/overview/welcome',
               },
               {
                 label: 'Installation',

docs/package.json

@@ -16,8 +16,9 @@
     "write-heading-ids": "docusaurus write-heading-ids"
   },
   "dependencies": {
-    "@docusaurus/core": "~3.7.0",
-    "@docusaurus/preset-classic": "~3.7.0",
+    "@docusaurus/core": "~3.8.0",
+    "@docusaurus/preset-classic": "~3.8.0",
+    "@docusaurus/theme-common": "~3.8.0",
     "@mdi/js": "^7.3.67",
     "@mdi/react": "^1.6.1",
     "@mdx-js/react": "^3.0.0",
@@ -26,6 +27,7 @@
     "clsx": "^2.0.0",
     "docusaurus-lunr-search": "^3.3.2",
     "docusaurus-preset-openapi": "^0.7.5",
+    "lunr": "^2.3.9",
     "postcss": "^8.4.25",
     "prism-react-renderer": "^2.3.1",
     "raw-loader": "^4.0.2",
@@ -35,7 +37,7 @@
     "url": "^0.11.0"
   },
   "devDependencies": {
-    "@docusaurus/module-type-aliases": "~3.7.0",
+    "@docusaurus/module-type-aliases": "~3.8.0",
     "@docusaurus/tsconfig": "^3.7.0",
     "@docusaurus/types": "^3.7.0",
     "prettier": "^3.2.4",
@@ -57,6 +59,6 @@
     "node": ">=20"
   },
   "volta": {
-    "node": "22.14.0"
+    "node": "22.17.0"
   }
 }

docs/src/components/community-guides.tsx

@@ -58,6 +58,12 @@ const guides: CommunityGuidesProps[] = [
     description: 'Access Immich with an end-to-end encrypted connection.',
     url: 'https://meshnet.nordvpn.com/how-to/remote-files-media-access/immich-remote-access',
   },
+  {
+    title: 'Trust Self Signed Certificates with Immich - OAuth Setup',
+    description:
+      'Set up Certificate Authority trust with Immich, and your private OAuth2/OpenID service, while using a private CA for HTTPS commication.',
+    url: 'https://github.com/immich-app/immich/discussions/18614',
+  },
 ];
 
 function CommunityGuide({ title, description, url }: CommunityGuidesProps): JSX.Element {