v2.7.0 #27586

alextran1502 · 2026-04-07T16:35:09Z

alextran1502
Apr 7, 2026
Maintainer

v2.7.0

Welcome to Immich v2.7.0!

This release includes enhancements to the asset viewer, security improvements, changes to the duplicate APIs and viewer, and a bunch of bug fixes. Keep reading below for the complete highlights and a note on the upcoming v3.0.0 release.

Note

We're working on a managed backup service for Immich with end-to-end encrypted backups of your library to a remote datacentre where only you hold the keys.

We've put together a quick survey (~5 mins) to get a better idea of how you're backing things up today and what you'd actually want from something like this. Your answers help us figure out what to prioritise, so we'd really appreciate it if you took a few minutes to fill it out.

Leave your email at the end if you're interested in joining our free closed beta when it's ready.

https://futo-backups-survey.immich.app/

Known limitations

The machine learning service on amd64 currently requires the >= x86-64-v2 microarchitecture. This will be patched in an upcoming patch release for backward compatibility with very old processors (before ~2010), but it will become a minimum requirement in 3.0. arm64 is not affected by this change.

Highlights

Remove from album (asset viewer)
Move to locked folder (folder page)
Editor shortcuts
Create a new face on-the-fly in the face tag editor
Resolve duplicates
Helmet configuration
Version check infrastructure
Notable fix: live photo and video download in Safari
Notable fix: escape HTML in the Panorama Photo Viewer

Remove from album

The web has a new action, "Remove from album," available in the asset viewer that makes it easier to remove an asset from an album. This action is available to both album and asset owners.

Move to locked folder in the Folder view

Similarly, the folder view now includes the "Move to locked folder" action.

Editor shortcuts

Users on the web can now edit with keyboard shortcuts. Press e to open the editor. Once in the editor, press [ or ] to rotate the asset +/- 90 degrees. Finally, save any changes and close the editor with ENTER.

slice.mp4

Create a new face on-the-fly in the face tag editor

You can now create a new face/person on the fly from the face tagging editor interface

Deduplication improvements

The duplicate screen has gone through a bunch of iterations since it was first introduced all the way back in May, 2024. The latest release moves a bunch of logic from the client to the server, which now automatically suggests which asset to keep based on image size and EXIF data. Additionally, the new server implementation will automatically synchronize metadata, including albums, favorite status, rating, description, visibility, location, and tags. For more information about this process, see the new documentation.

Helmet configuration

You can now opt in to using a Content Security Policy (CSP) in Immich. The new environment variant IMMICH_HELMET_FILE accepts a boolean or a path to a helmet configuration file.

Recommend action: The team recommends setting IMMICH_HELMET_FILE=true to enable the default policy. Then, please let us know if you run into any issues with it.

Background and details

Since Immich is deployed in so many different ways, it has been hard to figure out how to enable a CSP that would not conflict with or break existing installs that might use 3rd party map providers, custom CSS, embed Immich in an iframe, or other such features. In this release, we have added the ability to both opt in to a default policy and configure a custom one. To use the default policy, simply set the environment variable IMMICH_HELMET_FILE=true. To use a custom policy, set the environment variable to a path on disk (within the immich-server) that contains a valid helmet configuration (e.g. IMMICH_HELMET_FILE=/opt/immich/helmet.json). CSP can be used to control what scripts are allowed to run on the page, which domains to load images from, etc. Additionally, it can be used to configure headers for Referrer-Policy, X-Powered-By, X-Frame-Options, and others.

New version check infrastructure

Prior to this release, instances that used the automatic version check feature would send HTTP requests to github.com. Now, we have set up a small service at version.immich.cloud to handle these types of requests. This avoids any privacy implications of connecting to github.com , as well as moves the request load to our own infrastructure.

Notable fix: live photo and video download in Safari

When downloading files in Safari with the same name, it will simply overwrite the file instead of automatically renaming it. In this release, the still and motion parts of a live photo are now named differently to prevent this from happening.

Notable fix: escape HTML in panorama photo viewer

In v2.6.0, we added the ability to show/view clip text in the panorama viewer, but introduced an XSS vulnerability, which has been fixed in this release. Interestingly, this was XSS using text in the image, which would then get read by OCR.

Notable fix: Immich User Agent for external requests

Similar to the mobile app, the server now sends a custom User Agent header. The format for the User Agent is immich-server/{version}. For example, immich-server/2.7.0.

`v3.0.0`

Just a heads up that this is the likely to be the last release before v3.0.0. Being a major release there will be a handful of breaking changes, although it's worth noting that nothing is currently planned that requires user intervention. It is mainly changes that impact 3rd party developers. More information and details should be available in the coming weeks.

Support Immich

If you find the project helpful, you can support Immich by purchasing a product key at https://buy.immich.app or our merchandise at https://immich.store

What's Changed

New Contributors

@Vogeluff made their first contribution in feat(web): add a seperate tooltip for switching from dark to light mode #27297
@updatemike made their first contribution in fix(web): preserve timezone when changing timestamp (Closes #25354) #27095
@diiogofer made their first contribution in fix(web): keep map view open after closing asset viewer #26980
@squishykid made their first contribution in feat(web): add shortcuts to rotate images #26927
@Phlogi made their first contribution in feat(server): resolve duplicates #25316
@saurav61091 made their first contribution in fix(web): prevent Safari from overwriting live photo image with video #26898
@putuprema made their first contribution in fix(mobile): mismatch between system and app color when using low-chroma system color scheme #27282
@ffchung made their first contribution in perf(server): optimize people page query #27346
@chanb22 made their first contribution in fix: detection of WebM container #24182
@robson90 made their first contribution in feat(docs): add keycloack example to oauth docs #27425
@okxint made their first contribution in fix(server): use substring matching for person name search #26903
@johnmaguire made their first contribution in feat: add preview button when selecting images #27305
@ray made their first contribution in feat(server): Add support for .ts files #27529
@AfonsoMendoncaRibeiro made their first contribution in fix: timestamp handling for database backup in Web UI #27359
@domints made their first contribution in fix: allow bots to access /s/ urls #27579

Full Changelog: v2.6.3...v2.7.0

This discussion was created from the release v2.7.0.

lo97 · 2026-04-07T17:04:59Z

lo97
Apr 7, 2026

Any news about migrating to postgres 18?

4 replies

alextran1502 Apr 7, 2026
Maintainer Author

Not yet, probably targeting this summer after v3 coming out

diogotcorreia Apr 7, 2026

@lo97 I've been using a PostgreSQL 18 database for a while 🤔 No issues here, you probably only need to update the db image and vectorchord. But I would recommend waiting for an official solution if you are uncomfortable with changing docker images

lo97 Apr 7, 2026

I also use pg18 without problems, that why I was asking when the official one was coming since it's already working fine for some months (but I didn't migrate, I started fresh on 18)

jrasm91 Apr 7, 2026
Maintainer

I think we're wanting to build an automated upgrade. Something like this where the user only has to do a 2-3 guided actions:

Click an upgrade button
The server does a database backup and goes into maintenance mode
The site prompts the user to make the docker compose change to pg18
The user clicks "continue"
The database is restored from the backup
The server exists maintenance mode and starts up again

stephen304 · 2026-04-07T18:04:46Z

stephen304
Apr 7, 2026

Does the default helmet config take into account the configured "external domain" set in server settings? I don't have a really complicated setup, just the default docker-compose with traefik with my own domain, but enabling helmet causes the timeline to not load. Presumably I just need to copy the default config and add in my own domain, but it would be nice if that was handled automatically, assuming that's what the issue is.

1 reply

jrasm91 Apr 7, 2026
Maintainer

It looks like there were some quote issues that have been fixed in #27592

1joneselliot · 2026-04-07T20:20:30Z

1joneselliot
Apr 7, 2026

Any word on whether the new face tagging feature works with pets that weren't recognized automatically? Excited to try it out.

3 replies

alextran1502 Apr 7, 2026
Maintainer Author

We still need to start the project of collecting pet image data to train a model 😅

stephen304 Apr 7, 2026

@alextran1502 Happy to contribute a bunch of pictures of the same cat if needed

1joneselliot Apr 8, 2026

@alextran1502, same here on the pet data :)

I'm curious how manual tagging affects future automatic tags. For example, I manually tagged my dog and created a new Person for them. Will this mean my dog (who was never automatically tagged before - I've heard some peoples' animals are tagged automatically) is more likely to be auto-tagged? Or would every tag need to be manual?

Assuming this manual tag doesn't affect the actual model and all future tags for this unrecognized pet would need to be manual as well.

godismyjudge95 · 2026-04-07T21:26:36Z

godismyjudge95
Apr 7, 2026

Serious suggestion, to avoid the "we just released and need to issue several patches" cycle maybe it would be wise to have a "nightly" and "stable" channel; so those who are willing can test and those that need their server stable can turn on auto updates without having to worry about stuff breaking? Maybe auto updates is always a bad idea, but I also don't think assuming people will not update immediately is a good plan for making sure releases are stable.

I personally never update until a few weeks have passed and there haven't been any patches, but I'd hate for someone new to Immich to fall into the trap of updating immediately on release only for things to break.

3 replies

etnoy Apr 7, 2026
Maintainer

Nightly already exists on main

jrasm91 Apr 7, 2026
Maintainer

Agreed. We have talked about this and would like to do it in the future. Mobile apps with beta versions and server release candidate builds. It just takes time to get that process set up and we haven't gotten around to it yet.

godismyjudge95 Apr 7, 2026

All good, just wanted to make sure it was on the roadmap :) Thanks for helping make such a great piece of software

Nordlicht-13 · 2026-04-07T21:52:02Z

Nordlicht-13
Apr 7, 2026

On F-Droid Immich is stuck on 2.5.6 with the old icon...

0 replies

Talhamehar007 · 2026-04-08T01:52:55Z

Talhamehar007
Apr 8, 2026

Why is there no v2.7.1

1 reply

alextran1502 Apr 8, 2026
Maintainer Author

sacrifice to the release god

adamzvolanek · 2026-04-08T01:54:49Z

adamzvolanek
Apr 8, 2026

Unsure why, but enabling IMMICH_HELMET_FILE=true now does not allow me to access my immich instance on my local IP and port. (http://IP:Port). Anyone else?

Errors read:

The Cross-Origin-Opener-Policy header has been ignored, because the URL's origin was untrustworthy. It was defined either in the final response or a redirect. Please deliver the response using the HTTPS protocol. You can also use the 'localhost' origin instead. See https://www.w3.org/TR/powerful-features/#potentially-trustworthy-origin and https://html.spec.whatwg.org/#the-cross-origin-opener-policy-header.

(index):1 The page requested an origin-keyed agent cluster using the Origin-Agent-Cluster header, but could not be origin-keyed since the origin 'http://IP:2283' had previously been placed in a site-keyed agent cluster. Update your headers to uniformly request origin-keying for all pages on the origin.

3 replies

M4Rv Apr 8, 2026

I might have the same issue...

M4Rv Apr 8, 2026

For ProxmoxVE community-script this might be the relevent issue ticket. A fix seems to be on the way for the script
community-scripts/ProxmoxVE#13597

1joneselliot Apr 8, 2026

For ProxmoxVE community-script this might be the relevent issue ticket. A fix seems to be on the way for the script

community-scripts/ProxmoxVE#13597

I ran into this too; updating /opt/immich/.env's helmet parameter to FALSE fixed it. Unclear why the default CORS policy doesn't work, but it was a quick fix. Seems like the script maintainers got it too but if you want a retroactive fix it's very easy.

adamzvolanek · 2026-04-08T02:08:09Z

adamzvolanek
Apr 8, 2026

For users using Cloudflare with Immich, an error still occurs using the helmet file that can be resolved by Immich updating the helmet.json file.

Loading the script 'https://static.cloudflareinsights.com/beacon.min.js/v8c78df7c7c0f484497ecbca7046644da1771523124516' violates the following Content Security Policy directive: "script-src 'self' 'wasm-unsafe-eval' 'unsafe-inline' https://www.gstatic.com". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback. The action has been blocked.

The fix:

{
  "contentSecurityPolicy": {
    "directives": {
      "script-src": [
        "'self'",
        "'unsafe-inline'",
        "'wasm-unsafe-eval'",
        "https://www.gstatic.com",
        "https://static.cloudflareinsights.com"
      ]
    }
  }
}

EDIT: I do not have access to my helmet file locally, this may be a me issue. But is this something Immich will add?

4 replies

jrasm91 Apr 8, 2026
Maintainer

You can put this file wherever you want on the host and mount it into the container using a volume. Then, set the env to the path on the container. Basically the file can be anywhere on the container and you can use the env to point to it.

adamzvolanek Apr 8, 2026

You can put this file wherever you want on the host and mount it into the container using a volume. Then, set the env to the path on the container. Basically the file can be anywhere on the container and you can use the env to point to it.

Pardon my ignorance. I set the flag to true, doing so pulls the default file from the docker image. Correct? Because I can't find said helmet file in any of my volumes for immich.

But explicitly pointing to a location will override said file. Correct?

The issue with the second point is I have yet to see the file in my local server/docker implementation. So either I set it to true and nothing was pulled down or a default exists and I can't find it.

jrasm91 Apr 8, 2026
Maintainer

The file is in the container at /usr/src/app/server/helmet.json I believe. Setting the env to true does the same thing as setting it to /usr/src/app/server/helmet.json.

jrasm91 Apr 8, 2026
Maintainer

I was just saying that you could add another volume like:

/path/on/host/helmet.json:/opt/immich/helmet.json

And then set the env IMMICH_HELMET_FILE=/opt/immich/helmet.json

srwareham · 2026-04-08T06:01:13Z

srwareham
Apr 8, 2026

For anyone else wondering if their hardware will be impacted by the forthcoming min version requirements ld.so --help | grep x86-64 answered the question for me

0 replies

LudwikO · 2026-04-08T08:06:25Z

LudwikO
Apr 8, 2026

Thank you guys for addressing the issue with ML service not working on older processors.
Even though I may need to upgrade the hardware to use v3.0, this time I know about the potential problem with my setup.

0 replies

Imnotcreativesoicantthinkofaname · 2026-04-08T09:46:45Z

Imnotcreativesoicantthinkofaname
Apr 8, 2026

Hi i may have an idea for the dublicates;

I think it would be nice if immich would stack dublicats automatically and just display the one with best resolution in the timeline with a link to the other version.

Im quite lazy and i have a lot due to missmanagement bevore using immich and that would clean my timeline without manual labor

1 reply

Phlogi Apr 8, 2026

Why not use de-deplication to clean it up?

thomastmaur · 2026-04-08T09:51:22Z

thomastmaur
Apr 8, 2026

Bonjour
Depuis la migration vers la 2.7.0, j'ai un souci avec les reconnaissances faciales : la recherche de personnes ne fonctionne plus. J'ai bien ma liste de ce qui a été renseigné avant, mais si je cherche un nom, dès la première lettre on voit qu'il ne trouve rien.

Merci pour votre aide

3 replies

thomastmaur Apr 8, 2026

Et ca ne fonctionne plus non plus dans la recherche de nom, quand on corrige un visage à la main, sans utiliser les miniatures suggérées.

Merci

thomastmaur Apr 9, 2026

nobody for help me ?

jrasm91 Apr 9, 2026
Maintainer

It'll be fixed later today in a patch release.

M4Rv · 2026-04-08T13:29:07Z

M4Rv
Apr 8, 2026

Somehow my webapp is not loading anymore.
In the browser console I see SSL protocol errors despite i don't use SSL in my scenario.

1 reply

adamzvolanek Apr 8, 2026

Like this?
#27586 (comment)

Blue-Code252 · 2026-04-08T20:19:53Z

Blue-Code252
Apr 8, 2026

Updating to 2.7.0 broke the TrueNAS immich app. It won't start anymore.
The Job states that the update failed.

This update is not stable.

1 reply

alextran1502 Apr 8, 2026
Maintainer Author

We don't manage the TrueNAS update route

Soukyuu · 2026-04-08T21:26:38Z

Soukyuu
Apr 8, 2026

Hmm are image editor shortcuts customizable? [ and ] are accessible via alt combination on my layout, so not very usable (as usual when the English kb layout is assumed).

On the duplicate editor, does it finally prefer duplicates in album versus those simply in the timeline? I have an external ro library with all my trips and some of those photos are also still in my normal timeline. Had to live with that so far, because deduplicating was a nightmare of immich randomly suggesting to remove the image which was in the ro album library... Can't test the currentbversion yet sadly.

2 replies

Phlogi Apr 9, 2026

It does the duplicate thing respecting album information.

Teiby Apr 12, 2026

I suggest to implement Shift+R to rotate counter-clockwise like Google Photos. Without pressing "E". It shall then be auto-saved after a 2s timeout or before going to next image.

OrbitingOcelot · 2026-04-14T11:52:09Z

OrbitingOcelot
Apr 14, 2026

I have updated to 2.7.5, enabled helmet, and am running into an issue where immich never loads, I just see the rotating flower only... I have a locally hosted instance via docker-compose, and am accessing from same LAN locally.
I have seen the other thread but that seems to be for proxmox which I dont have.

Server log does not say anything, browser console says:

The Cross-Origin-Opener-Policy header has been ignored, because the URL's origin was untrustworthy. It was defined either in the final response or a redirect. Please deliver the response using the HTTPS protocol. You can also use the 'localhost' origin instead. See https://www.w3.org/TR/powerful-features/#potentially-trustworthy-origin and https://html.spec.whatwg.org/#the-cross-origin-opener-policy-header.Understand this error
(index):1 The page requested an origin-keyed agent cluster using the Origin-Agent-Cluster header, but could not be origin-keyed since the origin 'http://192.168.XX.XX:2283' had previously been placed in a site-keyed agent cluster. Update your headers to uniformly request origin-keying for all pages on the origin.
Failed to load resource: net::ERR_SSL_PROTOCOL_ERROR    :2283/favicon-144.png:1  Failed to load resource: net::ERR_SSL_PROTOCOL_ERROR
(index):1 The resource https://192.168.XX.XX:2283/_app/immutable/assets/GoogleSansCode.a41q3NA0.ttf was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.Understand this warning
(index):1 The resource https://192.168.XX.XX:2283/_app/immutable/assets/GoogleSans.DGRbB7N7.ttf was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.Understand this warning
(index):1 Unsafe attempt to load URL https://192.168.XX.XX:2283/ from frame with URL http://192.168.XX.XX:2283/. Domains, protocols and ports must match.
Understand this error
(index):1 The resource https://192.168.XX.XX:2283/_app/immutable/assets/GoogleSansCode.a41q3NA0.ttf was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.Understand this warning
(index):1 The resource https://192.168.XX.XX:2283/_app/immutable/assets/GoogleSans.DGRbB7N7.ttf was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.

3 replies

jrasm91 Apr 14, 2026
Maintainer

You probably just want to disable helmet.

OrbitingOcelot Apr 14, 2026

You probably just want to disable helmet.

I have disabled it already, but the release notes mentioned to try and report back... So "I'm doing my part" 😄
Cheers!

jrasm91 Apr 14, 2026
Maintainer

Ah, ok. Perfect, thanks for the report.

Uh oh!

Uh oh!

v2.7.0 #27586

Uh oh!

Uh oh!

alextran1502 Apr 7, 2026 Maintainer

v2.7.0

Known limitations

Highlights

Remove from album

Move to locked folder in the Folder view

Editor shortcuts

Create a new face on-the-fly in the face tag editor

Deduplication improvements

Helmet configuration

Background and details

New version check infrastructure

Notable fix: live photo and video download in Safari

Notable fix: escape HTML in panorama photo viewer

Notable fix: Immich User Agent for external requests

v3.0.0

Support Immich

What's Changed

🚀 Features

🌟 Enhancements

🐛 Bug fixes

📚 Documentation

🌐 Translations

New Contributors

Replies: 16 comments · 30 replies

Uh oh!

Uh oh!

alextran1502 Apr 7, 2026 Maintainer Author

Uh oh!

Uh oh!

Uh oh!

jrasm91 Apr 7, 2026 Maintainer

Uh oh!

Uh oh!

jrasm91 Apr 7, 2026 Maintainer

Uh oh!

Uh oh!

alextran1502 Apr 7, 2026 Maintainer Author

Uh oh!

Uh oh!

Uh oh!

Uh oh!

etnoy Apr 7, 2026 Maintainer

Uh oh!

jrasm91 Apr 7, 2026 Maintainer

Uh oh!

Uh oh!

Uh oh!

Uh oh!

alextran1502 Apr 8, 2026 Maintainer Author

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jrasm91 Apr 8, 2026 Maintainer

Uh oh!

Uh oh!

alextran1502
Apr 7, 2026
Maintainer

`v3.0.0`

Replies: 16 comments 30 replies

alextran1502 Apr 7, 2026
Maintainer Author

jrasm91 Apr 7, 2026
Maintainer

jrasm91 Apr 7, 2026
Maintainer

alextran1502 Apr 7, 2026
Maintainer Author

etnoy Apr 7, 2026
Maintainer

jrasm91 Apr 7, 2026
Maintainer

alextran1502 Apr 8, 2026
Maintainer Author

jrasm91 Apr 8, 2026
Maintainer