fix: bump sharp to 0.35.1

* fix(ios-widget): send date-only value for memories query param

Server v3.0.3 (immich-app#29907) validates the /memories `for` query
param with a date-only schema (YYYY-MM-DD). The iOS widget still sent a
full ISO 8601 datetime, so every request 400s and the widget shows
"Unable to connect to your Immich instance" on any server >= v3.0.3.

Build the value from the local calendar day, matching what the web
client (memory-manager.svelte.ts) and Android already send, instead of
a UTC datetime.

Also fix a related bug in the timeline provider: fetchMemory was
called with a bare try inside a Task, so a failure silently dropped
the error and never called completion, leaving the widget in a stale
state instead of showing an error card. Wrap it in a guard/try?, same
pattern already used in getSnapshot.

Fixes immich-app#30044

Signed-off-by: ajuijas <189517297+ajuijas@users.noreply.github.com>

* address review: drop unrelated widget change and comment

Signed-off-by: ajuijas <189517297+ajuijas@users.noreply.github.com>

---------

Signed-off-by: ajuijas <189517297+ajuijas@users.noreply.github.com>
Co-authored-by: ajuijas <189517297+ajuijas@users.noreply.github.com>
Co-authored-by: Santo Shakil <santoshakil@users.noreply.github.com>

.github/workflows/build-mobile.yml

@@ -106,7 +106,7 @@ jobs:
         working-directory: ./mobile
         run: printf "%s" $KEY_JKS | base64 -d > android/key.jks
 
-      - uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0
+      - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
           distribution: 'zulu'
           java-version: '17'
@@ -241,7 +241,7 @@ jobs:
         run: flutter build ios --config-only --no-codesign
 
       - name: Setup Ruby
-        uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # v1.316.0
+        uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1.319.0
         with:
           ruby-version: '3.3'
           bundler-cache: true

.github/workflows/check-openapi.yml

@@ -25,7 +25,7 @@ jobs:
           persist-credentials: false
 
       - name: Check for breaking API changes
-        uses: oasdiff/oasdiff-action/breaking@291b6594ce617f22f49af5898ee038ed0b46e8fe # v0.1.5
+        uses: oasdiff/oasdiff-action/breaking@024f6c399f9a21ada1addb0f9a36ce1bfac995f1 # v0.1.6
         with:
           base: https://raw.githubusercontent.com/${{ github.repository }}/main/open-api/immich-openapi-specs.json
           revision: open-api/immich-openapi-specs.json

.github/workflows/close-duplicates.yml

@@ -39,7 +39,7 @@ jobs:
     needs: [get_body, should_run]
     if: ${{ needs.should_run.outputs.should_run == 'true' }}
     container:
-      image: ghcr.io/immich-app/mdq:main@sha256:e3fe456f346b02c2f479462100763aee3ba8245768dfeac3c4262acb068e5c62
+      image: ghcr.io/immich-app/mdq:main@sha256:d603f5618c1fc9f2b4d506ffed54ba6bcfec83d56b893b5fa8b3f899a402fa0a
     outputs:
       checked: ${{ steps.get_checkbox.outputs.checked }}
     steps:

.github/workflows/codeql-analysis.yml

@@ -58,7 +58,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -71,7 +71,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/autobuild@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -84,6 +84,6 @@ jobs:
       #   ./location_of_script_within_repo/buildscript.sh
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
         with:
           category: '/language:${{matrix.language}}'

.github/workflows/prepare-release.yml

@@ -3,11 +3,6 @@ name: Prepare new release
 on:
   workflow_dispatch:
     inputs:
-      sourceBranch:
-        description: 'Branch to release from'
-        required: false
-        default: 'main'
-        type: string
       releaseType:
         description: 'Release type'
         required: true
@@ -70,7 +65,7 @@ jobs:
         with:
           token: ${{ steps.token.outputs.token }}
           persist-credentials: true
-          ref: ${{ inputs.sourceBranch }}
+          ref: main
 
       - name: Setup Mise
         uses: immich-app/devtools/actions/use-mise@3bca63ca3c15020293b36b51737a3ee2c773340b # use-mise-action-v3.1.0
@@ -157,7 +152,7 @@ jobs:
           github-token: ${{ steps.generate-token.outputs.token }}
 
       - name: Create draft release
-        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
           draft: true
           prerelease: ${{ needs.bump_version.outputs.rc }}

.github/workflows/test.yml

@@ -733,7 +733,7 @@ jobs:
           github_token: ${{ steps.token.outputs.token }}
 
       - name: Install server dependencies
-        run: SHARP_IGNORE_GLOBAL_LIBVIPS=true pnpm --filter immich install --frozen-lockfile
+        run: pnpm --filter immich install --frozen-lockfile
       - name: Run API generation
         run: mise //:open-api
         working-directory: open-api
@@ -792,7 +792,7 @@ jobs:
           github_token: ${{ steps.token.outputs.token }}
 
       - name: Install server dependencies
-        run: SHARP_IGNORE_GLOBAL_LIBVIPS=true pnpm install --frozen-lockfile
+        run: pnpm install --frozen-lockfile
 
       - name: Build plugins
         run: mise //:plugins

e2e/package.json

@@ -48,7 +48,7 @@
     "pngjs": "^7.0.0",
     "prettier": "^3.7.4",
     "prettier-plugin-organize-imports": "^4.0.0",
-    "sharp": "^0.34.5",
+    "sharp": "^0.35.2",
     "socket.io-client": "^4.7.4",
     "supertest": "^7.0.0",
     "@typescript/native": "npm:typescript@^7.0.2",

mise.toml

@@ -65,7 +65,6 @@ dir = "open-api"
 run = "bash ./bin/generate-dart-sdk.sh"
 
 [tasks.open-api]
-env = { SHARP_IGNORE_GLOBAL_LIBVIPS = true }
 run = [
   { task = "//:plugins" },
   { task = "//server:install" },

mobile/ios/WidgetExtension/ImmichAPI.swift

@@ -203,7 +203,10 @@ class ImmichAPI {
 
   func fetchMemory(for date: Date) async throws -> [MemoryResult] {
     // get URL
-    let memoryParams = [URLQueryItem(name: "for", value: date.ISO8601Format())]
+    let localDay = date.formatted(
+      Date.ISO8601FormatStyle(timeZone: .current).year().month().day().dateSeparator(.dash)
+    )
+    let memoryParams = [URLQueryItem(name: "for", value: localDay)]
     guard
       let searchURL = buildRequestURL(
         serverConfig: serverConfig,

mobile/lib/domain/models/events.model.dart

@@ -24,6 +24,12 @@ class ViewerReloadAssetEvent extends Event {
   const ViewerReloadAssetEvent();
 }
 
+class ViewerStackAssetDeletedEvent extends Event {
+  final int stackIndex;
+
+  const ViewerStackAssetDeletedEvent({required this.stackIndex});
+}
+
 // Multi-Select Events
 class MultiSelectToggleEvent extends Event {
   final bool isEnabled;

mobile/lib/domain/models/settings_key.dart

@@ -1,17 +1,16 @@
-import 'dart:convert';
-
 import 'package:flutter/material.dart';
 import 'package:immich_mobile/constants/colors.dart';
 import 'package:immich_mobile/constants/enums.dart';
 import 'package:immich_mobile/domain/models/log.model.dart';
 import 'package:immich_mobile/domain/models/timeline.model.dart';
+import 'package:immich_mobile/domain/models/value_codec.dart';
 import 'package:immich_mobile/providers/album/album_sort_by_options.provider.dart';
 import 'package:immich_mobile/utils/semver.dart';
 
 enum SettingsKey<T> {
   // Theme
-  themePrimaryColor<ImmichColorPreset>(codec: _EnumCodec(ImmichColorPreset.values)),
-  themeMode<ThemeMode>(codec: _EnumCodec(ThemeMode.values)),
+  themePrimaryColor<ImmichColorPreset>(codec: EnumCodec(ImmichColorPreset.values)),
+  themeMode<ThemeMode>(codec: EnumCodec(ThemeMode.values)),
   themeDynamic<bool>(),
   themeColorfulInterface<bool>(),
 
@@ -27,13 +26,13 @@ enum SettingsKey<T> {
 
   // Network
   networkAutoEndpointSwitching<bool>(),
+  networkExternalEndpointList<List<String>>(codec: ListCodec(PrimitiveCodec.string)),
+  networkCustomHeaders<Map<String, String>>(codec: MapCodec(PrimitiveCodec.string, PrimitiveCodec.string)),
   networkPreferredWifiName<String?>(),
   networkLocalEndpoint<String?>(),
-  networkExternalEndpointList<List<String>>(codec: _ListCodec(_PrimitiveCodec.string)),
-  networkCustomHeaders<Map<String, String>>(codec: _MapCodec(_PrimitiveCodec.string, _PrimitiveCodec.string)),
 
   // Album
-  albumSortMode<AlbumSortMode>(codec: _EnumCodec(AlbumSortMode.values)),
+  albumSortMode<AlbumSortMode>(codec: EnumCodec(AlbumSortMode.values)),
   albumIsReverse<bool>(),
   albumIsGrid<bool>(),
 
@@ -47,195 +46,45 @@ enum SettingsKey<T> {
 
   // Timeline
   timelineTilesPerRow<int>(),
-  timelineGroupAssetsBy<GroupAssetsBy>(codec: _EnumCodec(GroupAssetsBy.values)),
+  timelineGroupAssetsBy<GroupAssetsBy>(codec: EnumCodec(GroupAssetsBy.values)),
   timelineStorageIndicator<bool>(),
 
   // Log
-  logLevel<LogLevel>(codec: _EnumCodec(LogLevel.values)),
+  logLevel<LogLevel>(codec: EnumCodec(LogLevel.values)),
 
   // Map
   mapShowFavoriteOnly<bool>(),
   mapRelativeDate<int>(),
   mapIncludeArchived<bool>(),
-  mapThemeMode<ThemeMode>(codec: _EnumCodec(ThemeMode.values)),
+  mapThemeMode<ThemeMode>(codec: EnumCodec(ThemeMode.values)),
   mapWithPartners<bool>(),
 
   // Cleanup
   cleanupKeepFavorites<bool>(),
-  cleanupKeepMediaType<AssetKeepType>(codec: _EnumCodec(AssetKeepType.values)),
-  cleanupKeepAlbumIds<List<String>>(codec: _ListCodec(_PrimitiveCodec.string)),
+  cleanupKeepMediaType<AssetKeepType>(codec: EnumCodec(AssetKeepType.values)),
+  cleanupKeepAlbumIds<List<String>>(codec: ListCodec(PrimitiveCodec.string)),
   cleanupCutoffDaysAgo<int>(),
   cleanupDefaultsInitialized<bool>(),
 
   // Share
-  shareFileType<ShareAssetType>(codec: _EnumCodec(ShareAssetType.values)),
+  shareFileType<ShareAssetType>(codec: EnumCodec(ShareAssetType.values)),
 
   // Slideshow
   slideshowRepeat<bool>(),
   slideshowDuration<int>(),
-  slideshowLook<SlideshowLook>(codec: _EnumCodec(SlideshowLook.values)),
-  slideshowDirection<SlideshowDirection>(codec: _EnumCodec(SlideshowDirection.values)),
+  slideshowLook<SlideshowLook>(codec: EnumCodec(SlideshowLook.values)),
+  slideshowDirection<SlideshowDirection>(codec: EnumCodec(SlideshowDirection.values)),
 
   // Feature message
-  featureMessageSeenRelease<SemVer>(codec: _SemVerCodec());
+  featureMessageSeenRelease<SemVer>(codec: SemVerCodec());
 
-  final _SettingsCodec<T>? _codecOverride;
+  final ValueCodec<T>? _codecOverride;
 
-  const SettingsKey({_SettingsCodec<T>? codec}) : _codecOverride = codec;
+  const SettingsKey({ValueCodec<T>? codec}) : _codecOverride = codec;
 
-  _SettingsCodec<T> get _codec => _codecOverride ?? _SettingsCodec.forType(T);
+  ValueCodec<T> get _codec => _codecOverride ?? ValueCodec.forType(T);
 
   String encode(T value) => _codec.encode(value);
 
   T decode(String raw) => _codec.decode(raw);
 }
-
-sealed class _SettingsCodec<T> {
-  const _SettingsCodec();
-
-  String encode(T value);
-  T decode(String raw);
-
-  static final Map<Type, _SettingsCodec<Object>> _primitives = {
-    ..._register<int>(_PrimitiveCodec.integer),
-    ..._register<double>(_PrimitiveCodec.real),
-    ..._register<bool>(_PrimitiveCodec.boolean),
-    ..._register<String>(_PrimitiveCodec.string),
-    ..._register<DateTime>(const _DateTimeCodec()),
-  };
-
-  static Map<Type, _SettingsCodec<Object>> _register<T>(_SettingsCodec<Object> codec) => {
-    T: codec,
-    // Reifies the nullable type T so it can be used as a key in the _primitives map
-    _typeOf<T?>(): codec,
-  };
-
-  static Type _typeOf<T>() => T;
-
-  static _SettingsCodec<T> forType<T>(Type runtimeType) {
-    final codec = _primitives[runtimeType];
-    if (codec == null) {
-      throw StateError('No primitive codec for $runtimeType. Provide an explicit codec when defining the SettingsKey.');
-    }
-    return codec as _SettingsCodec<T>;
-  }
-}
-
-final class _EnumCodec<T extends Enum> extends _SettingsCodec<T> {
-  final List<T> values;
-
-  const _EnumCodec(this.values);
-
-  @override
-  String encode(T value) => value.name;
-
-  @override
-  T decode(String raw) => values.firstWhere((v) => v.name == raw);
-}
-
-final class _DateTimeCodec extends _SettingsCodec<DateTime> {
-  const _DateTimeCodec();
-
-  @override
-  String encode(DateTime value) => value.toIso8601String();
-
-  @override
-  DateTime decode(String raw) => DateTime.parse(raw);
-}
-
-final class _SemVerCodec extends _SettingsCodec<SemVer> {
-  const _SemVerCodec();
-
-  @override
-  String encode(SemVer value) => value.toString();
-
-  @override
-  SemVer decode(String raw) => SemVer.fromString(raw);
-}
-
-final class _MapCodec<K extends Object, V extends Object> extends _SettingsCodec<Map<K, V>> {
-  final _SettingsCodec<K> _keyCodec;
-  final _SettingsCodec<V> _valueCodec;
-
-  const _MapCodec(this._keyCodec, this._valueCodec);
-
-  @override
-  String encode(Map<K, V> value) {
-    final entries = <String, String>{};
-    value.forEach((k, v) => entries[_keyCodec.encode(k)] = _valueCodec.encode(v));
-    return jsonEncode(entries);
-  }
-
-  @override
-  Map<K, V> decode(String raw) {
-    try {
-      final decoded = jsonDecode(raw);
-      if (decoded is! Map) {
-        return {};
-      }
-      final result = <K, V>{};
-      for (final entry in decoded.entries) {
-        final rawKey = entry.key;
-        final rawValue = entry.value;
-        if (rawKey is! String || rawValue is! String) {
-          return {};
-        }
-        final k = _keyCodec.decode(rawKey);
-        final v = _valueCodec.decode(rawValue);
-        result[k] = v;
-      }
-      return result;
-    } on FormatException {
-      return {};
-    }
-  }
-}
-
-final class _ListCodec<T extends Object> extends _SettingsCodec<List<T>> {
-  final _SettingsCodec<T> _elementCodec;
-
-  const _ListCodec(this._elementCodec);
-
-  @override
-  String encode(List<T> value) => jsonEncode(value.map(_elementCodec.encode).toList());
-
-  @override
-  List<T> decode(String raw) {
-    try {
-      final decoded = jsonDecode(raw);
-      if (decoded is! List) {
-        return [];
-      }
-      final result = <T>[];
-      for (final item in decoded) {
-        if (item is! String) {
-          return [];
-        }
-        final element = _elementCodec.decode(item);
-        result.add(element);
-      }
-      return result;
-    } on FormatException {
-      return [];
-    }
-  }
-}
-
-final class _PrimitiveCodec<T extends Object> extends _SettingsCodec<T> {
-  final T Function(String) _parse;
-
-  const _PrimitiveCodec._(this._parse);
-
-  @override
-  String encode(T value) => value.toString();
-
-  @override
-  T decode(String raw) => _parse(raw);
-
-  static const integer = _PrimitiveCodec<int>._(int.parse);
-  static const real = _PrimitiveCodec<double>._(double.parse);
-  static const boolean = _PrimitiveCodec<bool>._(bool.parse);
-  static const string = _PrimitiveCodec<String>._(_identity);
-
-  static String _identity(String s) => s;
-}

mobile/lib/domain/models/value_codec.dart

@@ -0,0 +1,153 @@
+import 'dart:convert';
+
+import 'package:immich_mobile/utils/semver.dart';
+
+sealed class ValueCodec<T> {
+  const ValueCodec();
+
+  String encode(T value);
+  T decode(String raw);
+
+  static final Map<Type, ValueCodec<Object>> _primitives = {
+    ..._register<int>(PrimitiveCodec.integer),
+    ..._register<double>(PrimitiveCodec.real),
+    ..._register<bool>(PrimitiveCodec.boolean),
+    ..._register<String>(PrimitiveCodec.string),
+    ..._register<DateTime>(const DateTimeCodec()),
+  };
+
+  static Map<Type, ValueCodec<Object>> _register<T>(ValueCodec<Object> codec) => {
+    T: codec,
+    // Reifies the nullable type T so it can be used as a key in the _primitives map
+    _typeOf<T?>(): codec,
+  };
+
+  static Type _typeOf<T>() => T;
+
+  static ValueCodec<T> forType<T>(Type runtimeType) {
+    final codec = _primitives[runtimeType];
+    if (codec == null) {
+      throw StateError('No primitive codec for $runtimeType. Provide an explicit codec when defining the key.');
+    }
+    return codec as ValueCodec<T>;
+  }
+}
+
+final class EnumCodec<T extends Enum> extends ValueCodec<T> {
+  final List<T> values;
+
+  const EnumCodec(this.values);
+
+  @override
+  String encode(T value) => value.name;
+
+  @override
+  T decode(String raw) => values.firstWhere((v) => v.name == raw);
+}
+
+final class DateTimeCodec extends ValueCodec<DateTime> {
+  const DateTimeCodec();
+
+  @override
+  String encode(DateTime value) => value.toIso8601String();
+
+  @override
+  DateTime decode(String raw) => DateTime.parse(raw);
+}
+
+final class SemVerCodec extends ValueCodec<SemVer> {
+  const SemVerCodec();
+
+  @override
+  String encode(SemVer value) => value.toString();
+
+  @override
+  SemVer decode(String raw) => SemVer.fromString(raw);
+}
+
+final class MapCodec<K extends Object, V extends Object> extends ValueCodec<Map<K, V>> {
+  final ValueCodec<K> _keyCodec;
+  final ValueCodec<V> _valueCodec;
+
+  const MapCodec(this._keyCodec, this._valueCodec);
+
+  @override
+  String encode(Map<K, V> value) {
+    final entries = <String, String>{};
+    value.forEach((k, v) => entries[_keyCodec.encode(k)] = _valueCodec.encode(v));
+    return jsonEncode(entries);
+  }
+
+  @override
+  Map<K, V> decode(String raw) {
+    try {
+      final decoded = jsonDecode(raw);
+      if (decoded is! Map) {
+        return {};
+      }
+      final result = <K, V>{};
+      for (final entry in decoded.entries) {
+        final rawKey = entry.key;
+        final rawValue = entry.value;
+        if (rawKey is! String || rawValue is! String) {
+          continue;
+        }
+        final k = _keyCodec.decode(rawKey);
+        final v = _valueCodec.decode(rawValue);
+        result[k] = v;
+      }
+      return result;
+    } on FormatException {
+      return {};
+    }
+  }
+}
+
+final class ListCodec<T extends Object> extends ValueCodec<List<T>> {
+  final ValueCodec<T> _elementCodec;
+
+  const ListCodec(this._elementCodec);
+
+  @override
+  String encode(List<T> value) => jsonEncode(value.map(_elementCodec.encode).toList());
+
+  @override
+  List<T> decode(String raw) {
+    try {
+      final decoded = jsonDecode(raw);
+      if (decoded is! List) {
+        return [];
+      }
+      final result = <T>[];
+      for (final item in decoded) {
+        if (item is! String) {
+          return [];
+        }
+        final element = _elementCodec.decode(item);
+        result.add(element);
+      }
+      return result;
+    } on FormatException {
+      return [];
+    }
+  }
+}
+
+final class PrimitiveCodec<T extends Object> extends ValueCodec<T> {
+  final T Function(String) _parse;
+
+  const PrimitiveCodec._(this._parse);
+
+  @override
+  String encode(T value) => value.toString();
+
+  @override
+  T decode(String raw) => _parse(raw);
+
+  static const integer = PrimitiveCodec<int>._(int.parse);
+  static const real = PrimitiveCodec<double>._(double.parse);
+  static const boolean = PrimitiveCodec<bool>._(bool.parse);
+  static const string = PrimitiveCodec<String>._(_identity);
+
+  static String _identity(String s) => s;
+}

mobile/lib/infrastructure/repositories/cached_key_value_repository.dart

@@ -0,0 +1,41 @@
+import 'package:collection/collection.dart';
+import 'package:drift/drift.dart';
+// ignore: depend_on_referenced_packages
+import 'package:meta/meta.dart';
+
+abstract class CachedKeyValueRepository<K extends Enum, S> {
+  CachedKeyValueRepository(this._snapshot);
+
+  S _snapshot;
+  S get snapshot => _snapshot;
+  @protected
+  set snapshot(S value) => _snapshot = value;
+
+  List<K> get keys;
+
+  Object decodeValue(K key, String raw);
+
+  S buildSnapshot(Map<K, Object?> overrides);
+
+  Selectable<({String key, String? value})> selectable();
+
+  Future<void> refresh() async => _snapshot = _build(await selectable().get());
+
+  Stream<S> watchSnapshot() => selectable().watch().map((rows) => _snapshot = _build(rows));
+
+  S _build(List<({String key, String? value})> rows) => buildSnapshot(
+    rows.fold({}, (overrides, row) {
+      final key = keys.firstWhereOrNull((key) => key.name == row.key);
+      if (key == null) {
+        return overrides;
+      }
+
+      Object? decodedValue;
+      if (row.value != null) {
+        decodedValue = decodeValue(key, row.value!);
+      }
+
+      return {...overrides, key: decodedValue};
+    }),
+  );
+}

mobile/lib/infrastructure/repositories/remote_asset.repository.dart

@@ -71,7 +71,13 @@ class RemoteAssetRepository extends DriftDatabaseRepository {
     }
 
     final query = _db.remoteAssetEntity.select()
-      ..where((row) => row.stackId.equals(stackId) & row.id.equals(asset.id).not())
+      ..where(
+        (row) =>
+            row.stackId.equals(stackId) &
+            row.id.equals(asset.id).not() &
+            row.deletedAt.isNull() &
+            row.visibility.equalsValue(AssetVisibility.timeline),
+      )
       ..orderBy([(row) => OrderingTerm.desc(row.createdAt)]);
 
     return query.map((row) => row.toDto()).get();

mobile/lib/infrastructure/repositories/settings.repository.dart

@@ -1,13 +1,14 @@
-import 'package:collection/collection.dart';
+import 'package:drift/drift.dart';
 import 'package:immich_mobile/domain/models/config/app_config.dart';
 import 'package:immich_mobile/domain/models/settings_key.dart';
 import 'package:immich_mobile/infrastructure/entities/settings.entity.drift.dart';
+import 'package:immich_mobile/infrastructure/repositories/cached_key_value_repository.dart';
 import 'package:immich_mobile/infrastructure/repositories/db.repository.dart';
 
-class SettingsRepository extends DriftDatabaseRepository {
+class SettingsRepository extends CachedKeyValueRepository<SettingsKey, AppConfig> {
   final Drift _db;
 
-  SettingsRepository._(this._db) : super(_db);
+  SettingsRepository._(this._db) : super(const .new());
 
   static SettingsRepository? _instance;
 
@@ -19,9 +20,6 @@ class SettingsRepository extends DriftDatabaseRepository {
     return instance;
   }
 
-  AppConfig _appConfig = const .new();
-  AppConfig get appConfig => _appConfig;
-
   static Future<SettingsRepository> ensureInitialized(Drift db) async {
     if (_instance == null) {
       final instance = SettingsRepository._(db);
@@ -31,7 +29,20 @@ class SettingsRepository extends DriftDatabaseRepository {
     return _instance!;
   }
 
-  Future<void> refresh() async => _applyOverrides(await _db.select(_db.settingsEntity).get());
+  @override
+  List<SettingsKey> get keys => SettingsKey.values;
+
+  @override
+  Object decodeValue(SettingsKey key, String raw) => key.decode(raw);
+
+  @override
+  AppConfig buildSnapshot(Map<SettingsKey, Object?> overrides) => AppConfig.fromEntries(overrides);
+
+  @override
+  Selectable<({String key, String? value})> selectable() =>
+      _db.select(_db.settingsEntity).map((row) => (key: row.key, value: row.value));
+
+  AppConfig get appConfig => snapshot;
 
   Future<void> clear(Iterable<SettingsKey> keys) async {
     if (keys.isEmpty) {
@@ -41,13 +52,15 @@ class SettingsRepository extends DriftDatabaseRepository {
     final names = keys.map((key) => key.name).toList();
     await (_db.delete(_db.settingsEntity)..where((row) => row.key.isIn(names))).go();
 
+    var config = snapshot;
     for (final key in keys) {
-      _appConfig = _appConfig.write(key, defaultConfig.read(key));
+      config = config.write(key, defaultConfig.read(key));
     }
+    snapshot = config;
   }
 
   Future<void> write<T, U extends T>(SettingsKey<T> key, U value) async {
-    if (value == _appConfig.read(key)) {
+    if (value == snapshot.read(key)) {
       return;
     }
 
@@ -65,29 +78,8 @@ class SettingsRepository extends DriftDatabaseRepository {
         .insertOnConflictUpdate(
           SettingsEntityCompanion.insert(key: key.name, value: .new(resolvedValue), updatedAt: .new(DateTime.now())),
         );
-    _appConfig = _appConfig.write(key, value);
+    snapshot = snapshot.write(key, value);
   }
 
-  Stream<AppConfig> watchConfig() => _db.select(_db.settingsEntity).watch().map((rows) {
-    _applyOverrides(rows);
-    return _appConfig;
-  });
-
-  void _applyOverrides(List<SettingsEntityData> rows) {
-    _appConfig = AppConfig.fromEntries(
-      rows.fold({}, (overrides, row) {
-        final metadataKey = SettingsKey.values.firstWhereOrNull((key) => key.name == row.key);
-        if (metadataKey == null) {
-          return overrides;
-        }
-
-        Object? decodedValue;
-        if (row.value != null) {
-          decodedValue = metadataKey.decode(row.value!);
-        }
-
-        return {...overrides, metadataKey: decodedValue};
-      }),
-    );
-  }
+  Stream<AppConfig> watchConfig() => watchSnapshot();
 }

mobile/lib/presentation/pages/drift_slideshow.page.dart

@@ -51,6 +51,7 @@ class _DriftSlideshowPageState extends ConsumerState<DriftSlideshowPage> with Si
   int? _crossfadeFromIndex;
   int? _crossfadeToIndex;
   int _zoomCycle = 0;
+  bool _disableAnimations = false;
 
   @override
   initState() {
@@ -70,6 +71,12 @@ class _DriftSlideshowPageState extends ConsumerState<DriftSlideshowPage> with Si
     unawaited(WakelockPlus.enable());
   }
 
+  @override
+  void didChangeDependencies() {
+    super.didChangeDependencies();
+    _disableAnimations = MediaQuery.disableAnimationsOf(context);
+  }
+
   @override
   dispose() {
     _timer.cancel();
@@ -166,6 +173,11 @@ class _DriftSlideshowPageState extends ConsumerState<DriftSlideshowPage> with Si
   }
 
   void _crossFadeToPage(int page) {
+    if (_disableAnimations) {
+      _pageController.jumpToPage(page);
+      return;
+    }
+
     final previousIndex = _index;
     _pageController.jumpToPage(page);
     setState(() {
@@ -273,19 +285,12 @@ class _DriftSlideshowPageState extends ConsumerState<DriftSlideshowPage> with Si
     }
 
     if (asset.isImage) {
-      final elapsed = _stopwatch.elapsedMilliseconds;
-      final duration = _config.duration * 1000;
-
-      return TweenAnimationBuilder(
+      return _SlideshowProgressBar(
         key: Key(_index.toString()),
-        tween: Tween<double>(begin: elapsed / duration.toDouble(), end: _paused ? elapsed / duration.toDouble() : 1.0),
-        duration: Duration(milliseconds: _paused ? 1 : max(duration - elapsed, 1)),
-        builder: (context, value, _) => LinearProgressIndicator(
-          color: context.colorScheme.primary,
-          borderRadius: const BorderRadius.all(Radius.zero),
-          minHeight: 5,
-          value: value,
-        ),
+        durationMs: _config.duration * 1000,
+        elapsedMs: _stopwatch.elapsedMilliseconds,
+        paused: _paused,
+        color: context.colorScheme.primary,
       );
     } else {
       return LinearProgressIndicator(
@@ -334,6 +339,21 @@ class _DriftSlideshowPageState extends ConsumerState<DriftSlideshowPage> with Si
     final imageProvider = getFullImageProvider(asset, size: context.sizeData);
 
     if (asset.isImage) {
+      PhotoView buildPhotoView(PhotoViewComputedScale initialScale) => PhotoView(
+        imageProvider: imageProvider,
+        index: index,
+        disableScaleGestures: true,
+        gaplessPlayback: true,
+        filterQuality: FilterQuality.high,
+        initialScale: initialScale,
+        controller: PhotoViewController(),
+        onTapUp: (_, _, _) => _onTapUp(),
+      );
+
+      if (_disableAnimations) {
+        return buildPhotoView(scale);
+      }
+
       final zoomOut = _zoomCycle.isOdd;
       final elapsed = _stopwatch.elapsedMilliseconds;
       final duration = _config.duration * 1000;
@@ -349,16 +369,7 @@ class _DriftSlideshowPageState extends ConsumerState<DriftSlideshowPage> with Si
               : 1.0,
         ),
         duration: Duration(milliseconds: _paused ? 1 : max(duration - elapsed, 1)),
-        builder: (context, value, _) => PhotoView(
-          imageProvider: imageProvider,
-          index: index,
-          disableScaleGestures: true,
-          gaplessPlayback: true,
-          filterQuality: FilterQuality.high,
-          initialScale: scale * (1.0 + value * _kenBurnsZoom),
-          controller: PhotoViewController(),
-          onTapUp: (_, _, _) => _onTapUp(),
-        ),
+        builder: (context, value, _) => buildPhotoView(scale * (1.0 + value * _kenBurnsZoom)),
       );
     } else {
       final status = ref.watch(videoPlayerProvider(asset.heroTag).select((s) => s.status));
@@ -463,3 +474,75 @@ class _DriftSlideshowPageState extends ConsumerState<DriftSlideshowPage> with Si
     );
   }
 }
+
+/// Progress bar for image slides, driven by an explicit [AnimationController].
+///
+/// [TweenAnimationBuilder] creates its controller internally with the default
+/// [AnimationBehavior.normal], which makes it run ~20x too fast while the system
+/// "reduce motion" setting is on (flutter/flutter#164287). This owns its
+/// controller so it can use [AnimationBehavior.preserve] and animate at the real
+/// slide duration regardless of that setting.
+class _SlideshowProgressBar extends StatefulWidget {
+  final int durationMs;
+  final int elapsedMs;
+  final bool paused;
+  final Color color;
+
+  const _SlideshowProgressBar({
+    super.key,
+    required this.durationMs,
+    required this.elapsedMs,
+    required this.paused,
+    required this.color,
+  });
+
+  @override
+  State<_SlideshowProgressBar> createState() => _SlideshowProgressBarState();
+}
+
+class _SlideshowProgressBarState extends State<_SlideshowProgressBar> with SingleTickerProviderStateMixin {
+  late final AnimationController _controller;
+
+  @override
+  void initState() {
+    super.initState();
+    _controller = AnimationController(
+      vsync: this,
+      duration: Duration(milliseconds: widget.durationMs),
+      animationBehavior: AnimationBehavior.preserve,
+    )..value = (widget.elapsedMs / widget.durationMs).clamp(0.0, 1.0);
+    if (!widget.paused) {
+      _controller.forward();
+    }
+  }
+
+  @override
+  void didUpdateWidget(_SlideshowProgressBar oldWidget) {
+    super.didUpdateWidget(oldWidget);
+    if (widget.durationMs != oldWidget.durationMs) {
+      _controller.duration = Duration(milliseconds: widget.durationMs);
+    }
+    if (widget.paused != oldWidget.paused) {
+      widget.paused ? _controller.stop() : _controller.forward();
+    }
+  }
+
+  @override
+  void dispose() {
+    _controller.dispose();
+    super.dispose();
+  }
+
+  @override
+  Widget build(BuildContext context) {
+    return AnimatedBuilder(
+      animation: _controller,
+      builder: (context, _) => LinearProgressIndicator(
+        color: widget.color,
+        borderRadius: const BorderRadius.all(Radius.zero),
+        minHeight: 5,
+        value: _controller.value,
+      ),
+    );
+  }
+}

mobile/lib/presentation/widgets/action_buttons/delete_action_button.widget.dart

@@ -2,11 +2,13 @@ import 'package:flutter/material.dart';
 import 'package:fluttertoast/fluttertoast.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:immich_mobile/constants/enums.dart';
+import 'package:immich_mobile/domain/models/asset/base_asset.model.dart';
 import 'package:immich_mobile/domain/models/events.model.dart';
 import 'package:immich_mobile/domain/utils/event_stream.dart';
 import 'package:immich_mobile/extensions/build_context_extensions.dart';
 import 'package:immich_mobile/extensions/translate_extensions.dart';
 import 'package:immich_mobile/presentation/widgets/action_buttons/base_action_button.widget.dart';
+import 'package:immich_mobile/providers/asset_viewer/asset_viewer.provider.dart';
 import 'package:immich_mobile/providers/infrastructure/action.provider.dart';
 import 'package:immich_mobile/providers/timeline/multiselect.provider.dart';
 import 'package:immich_mobile/widgets/common/immich_toast.dart';
@@ -59,13 +61,19 @@ class DeleteActionButton extends ConsumerWidget {
       }
     }
 
-    if (source == ActionSource.viewer) {
-      EventStream.shared.emit(const ViewerReloadAssetEvent());
-    }
+    final currentAsset = ref.read(assetViewerProvider).currentAsset;
+    final stackIndex = ref.read(assetViewerProvider).stackIndex;
 
     final result = await ref.read(actionProvider.notifier).trashRemoteAndDeleteLocal(source);
     ref.read(multiSelectProvider.notifier).reset();
 
+    if (source == ActionSource.viewer && result.success) {
+      final shouldRefreshStack = currentAsset is RemoteAsset && currentAsset.stackId != null;
+      EventStream.shared.emit(
+        shouldRefreshStack ? ViewerStackAssetDeletedEvent(stackIndex: stackIndex) : const ViewerReloadAssetEvent(),
+      );
+    }
+
     final successMessage = 'delete_action_prompt'.t(context: context, args: {'count': result.count.toString()});
 
     if (context.mounted) {

mobile/lib/presentation/widgets/asset_viewer/asset_page.widget.dart

@@ -413,7 +413,8 @@ class _AssetPageState extends ConsumerState<AssetPage> {
     final showAssetStack = ref.watch(timelineServiceProvider.select((s) => s.origin != TimelineOrigin.trash));
     final stackChildren = showAssetStack ? ref.watch(stackChildrenNotifier(asset)).valueOrNull : null;
     if (stackChildren != null && stackChildren.isNotEmpty) {
-      displayAsset = stackChildren.elementAt(stackIndex);
+      final safeStackIndex = stackIndex.clamp(0, stackChildren.length - 1);
+      displayAsset = stackChildren.elementAt(safeStackIndex);
     }
 
     final isCurrent = currentAsset != null && currentAsset.refersToSameAsset(displayAsset);

mobile/lib/presentation/widgets/asset_viewer/asset_stack.provider.dart

@@ -11,6 +11,10 @@ class StackChildrenNotifier extends AutoDisposeFamilyAsyncNotifier<List<RemoteAs
 
     return ref.watch(assetServiceProvider).getStack(asset);
   }
+
+  void setStack(List<RemoteAsset> stack) {
+    state = AsyncData(stack);
+  }
 }
 
 final stackChildrenNotifier = AsyncNotifierProvider.autoDispose

mobile/lib/presentation/widgets/asset_viewer/asset_viewer.page.dart

@@ -1,4 +1,5 @@
 import 'dart:async';
+import 'dart:math' as math;
 
 import 'package:auto_route/auto_route.dart';
 import 'package:easy_localization/easy_localization.dart';
@@ -221,6 +222,8 @@ class _AssetViewerState extends ConsumerState<AssetViewer> {
         _onTimelineReloadEvent();
       case ViewerReloadAssetEvent():
         _onViewerReloadEvent();
+      case ViewerStackAssetDeletedEvent event:
+        _onViewerStackAssetDeletedEvent(event);
       default:
     }
   }
@@ -236,6 +239,33 @@ class _AssetViewerState extends ConsumerState<AssetViewer> {
     _onAssetChanged(target);
   }
 
+  Future<void> _onViewerStackAssetDeletedEvent(ViewerStackAssetDeletedEvent event) async {
+    final timelineAsset = ref.read(timelineServiceProvider).getAssetSafe(_currentPage);
+    if (timelineAsset == null) {
+      _onViewerReloadEvent();
+      return;
+    }
+
+    final stackProvider = stackChildrenNotifier(timelineAsset);
+
+    ref.invalidate(stackProvider);
+    final stack = await ref.read(stackProvider.future);
+
+    if (!mounted) {
+      return;
+    }
+
+    if (stack.isEmpty) {
+      _onViewerReloadEvent();
+      return;
+    }
+
+    final targetIndex = math.min(event.stackIndex, stack.length - 1);
+    ref.read(assetViewerProvider.notifier)
+      ..setAsset(stack[targetIndex])
+      ..setStackIndex(targetIndex);
+  }
+
   void _onTimelineReloadEvent() {
     final timelineService = ref.read(timelineServiceProvider);
     final totalAssets = timelineService.totalAssets;
@@ -252,6 +282,11 @@ class _AssetViewerState extends ConsumerState<AssetViewer> {
     if (index != _currentPage) {
       _pageController.jumpToPage(index);
       _onAssetChanged(index);
+    } else if (currentAsset is RemoteAsset && currentAsset.stackId != null && assetIndex == null) {
+      final timelineAsset = timelineService.getAssetSafe(index);
+      if (timelineAsset is! RemoteAsset || currentAsset.stackId != timelineAsset.stackId) {
+        _onAssetChanged(index);
+      }
     } else if (currentAsset != null && assetIndex == null) {
       _onAssetChanged(index);
     }

mobile/lib/presentation/widgets/asset_viewer/bottom_bar.widget.dart

@@ -101,7 +101,7 @@ class ViewerBottomBar extends ConsumerWidget {
                       child: Column(
                         mainAxisSize: MainAxisSize.min,
                         children: [
-                          OcrToggleButton(asset: asset),
+                          if (asset.isImage) OcrToggleButton(asset: asset),
                           if (asset.isVideo) VideoControls(videoPlayerName: asset.heroTag),
                           if (!isReadonlyModeEnabled)
                             Row(mainAxisAlignment: MainAxisAlignment.spaceEvenly, children: actions),

mobile/lib/presentation/widgets/map/map.widget.dart

@@ -16,7 +16,6 @@ import 'package:immich_mobile/presentation/widgets/bottom_sheet/map_bottom_sheet
 import 'package:immich_mobile/presentation/widgets/map/map.state.dart';
 import 'package:immich_mobile/presentation/widgets/map/map_utils.dart';
 import 'package:immich_mobile/providers/routes.provider.dart';
-import 'package:immich_mobile/routing/router.dart';
 import 'package:immich_mobile/utils/async_mutex.dart';
 import 'package:immich_mobile/utils/debounce.dart';
 import 'package:immich_mobile/widgets/common/immich_toast.dart';
@@ -133,8 +132,7 @@ class _DriftMapState extends ConsumerState<DriftMap> {
     // When the AssetViewer is open, the DriftMap route stays alive in the background.
     // If we continue to update bounds, the map-scoped timeline service gets recreated and the previous one disposed,
     // which can invalidate the TimelineService instance that was passed into AssetViewerRoute (causing "loading forever").
-    final currentRoute = ref.read(currentRouteNameProvider);
-    if (currentRoute == AssetViewerRoute.name) {
+    if (ref.read(isAssetViewerOpenProvider)) {
       return;
     }
 
@@ -183,6 +181,11 @@ class _DriftMapState extends ConsumerState<DriftMap> {
 
   @override
   Widget build(BuildContext context) {
+    ref.listen<bool>(isAssetViewerOpenProvider, (previous, current) {
+      if (previous == true && !current) {
+        _debouncer.run(() => setBounds(forceReload: true));
+      }
+    });
     return Stack(
       children: [
         _Map(initialLocation: widget.initialLocation, onMapCreated: onMapCreated, onMapReady: onMapReady),

mobile/lib/providers/routes.provider.dart

@@ -2,6 +2,7 @@ import 'package:flutter/widgets.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 
 final inLockedViewProvider = StateProvider<bool>((ref) => false);
+final isAssetViewerOpenProvider = StateProvider<bool>((ref) => false);
 final currentRouteNameProvider = StateProvider<String?>((ref) => null);
 final previousRouteNameProvider = StateProvider<String?>((ref) => null);
 final previousRouteDataProvider = StateProvider<RouteSettings?>((ref) => null);

mobile/lib/routing/app_navigation_observer.dart

@@ -24,9 +24,20 @@ class AppNavigationObserver extends AutoRouterObserver {
       ref.read(currentRouteNameProvider.notifier).state = route.settings.name;
       ref.read(previousRouteNameProvider.notifier).state = previousRoute?.settings.name;
       ref.read(previousRouteDataProvider.notifier).state = previousRoute?.settings;
+      if (route.settings.name == AssetViewerRoute.name) {
+        ref.read(isAssetViewerOpenProvider.notifier).state = true;
+      }
     });
   }
 
+  @override
+  void didPop(Route route, Route? previousRoute) {
+    _handleDriftLockedFolderState(previousRoute ?? route, null);
+    if (route.settings.name == AssetViewerRoute.name) {
+      Future(() => ref.read(isAssetViewerOpenProvider.notifier).state = false);
+    }
+  }
+
   _handleDriftLockedFolderState(Route route, Route? previousRoute) {
     final isInLockedView = ref.read(inLockedViewProvider);
     final isFromLockedViewToDetailView =

pnpm-lock.yaml

@@ -7,7 +7,7 @@ settings:
 
 overrides:
   canvas: 3.2.3
-  sharp: ^0.34.5
+  sharp: ^0.35.2
 
 packageExtensionsChecksum: sha256-W6pFzyf+6QXnV91iA6oob0OGVkergPXDN1afLgoF53k=
 
@@ -181,8 +181,8 @@ importers:
         specifier: ^4.0.0
         version: 4.3.0(@typescript/typescript6@6.0.2)(prettier@3.9.5)
       sharp:
-        specifier: ^0.34.5
-        version: 0.34.5
+        specifier: ^0.35.2
+        version: 0.35.2
       socket.io-client:
         specifier: ^4.7.4
         version: 4.8.3
@@ -471,7 +471,7 @@ importers:
         version: 2.1.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@socket.io/redis-adapter':
         specifier: ^8.3.0
-        version: 8.3.0(socket.io-adapter@2.5.7)
+        version: 8.3.0(socket.io-adapter@2.5.8)
       archiver:
         specifier: ^7.0.0
         version: 7.0.1
@@ -611,8 +611,8 @@ importers:
         specifier: ^7.8.1
         version: 7.8.5
       sharp:
-        specifier: ^0.34.5
-        version: 0.34.5
+        specifier: ^0.35.2
+        version: 0.35.2
       sirv:
         specifier: ^3.0.0
         version: 3.0.2
@@ -1800,8 +1800,8 @@ packages:
   '@codemirror/lint@6.9.7':
     resolution: {integrity: sha512-28/+iWLYxKxsvGYhSYL7zaCZqLz5+FFFDq9tVsvGv9kv8RY4fFAchJ5WX9M3YrrRlTIsECjsXPqeNgnSmNP2dg==}
 
-  '@codemirror/search@6.7.0':
-    resolution: {integrity: sha512-ZvGm99wc/s2cITtMT15LFdn8aH/aS+V+DqyGq/N5ZlV5vWtH+nILvC2nw0zX7ByNoHHDZ2IxxdW38O0tc5nVHg==}
+  '@codemirror/search@6.7.1':
+    resolution: {integrity: sha512-uMe5UO6PamJtSHrXhhHOzSX3ReWtiJrva6GnPMwSOrZtiExb5X5eExhr2OUZQVvdxPsKpY3Ro2mFbQadpPWmHA==}
 
   '@codemirror/state@6.6.0':
     resolution: {integrity: sha512-4nbvra5R5EtiCzr9BTHiTLc+MLXK2QGiAVYMyi8PkQd3SR+6ixar/Q/01Fa21TBIDOZXgeWV4WppsQolSreAPQ==}
@@ -2954,152 +2954,161 @@ packages:
     resolution: {integrity: sha512-Td76q7j57o/tLVdgS746cYARfSyxk8iEfRxewL9h4OMzYhbW4TAcppl0mT4eyqXddh6L/jwoM75mo7ixa/pCeQ==}
     engines: {node: '>=18'}
 
-  '@img/sharp-darwin-arm64@0.34.5':
-    resolution: {integrity: sha512-imtQ3WMJXbMY4fxb/Ndp6HBTNVtWCUI0WdobyheGf5+ad6xX8VIDO8u2xE4qc/fr08CKG/7dDseFtn6M6g/r3w==}
-    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+  '@img/sharp-darwin-arm64@0.35.2':
+    resolution: {integrity: sha512-eEieHsMksAW4IiO5NzauESRl2D2qz3J/kwUxUrSfV06A93eEaRfMpHXyUb1mAqrR7i8U9A0GRqE9pjn6u1Jjpg==}
+    engines: {node: '>=20.9.0'}
     cpu: [arm64]
     os: [darwin]
 
-  '@img/sharp-darwin-x64@0.34.5':
-    resolution: {integrity: sha512-YNEFAF/4KQ/PeW0N+r+aVVsoIY0/qxxikF2SWdp+NRkmMB7y9LBZAVqQ4yhGCm/H3H270OSykqmQMKLBhBJDEw==}
-    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+  '@img/sharp-darwin-x64@0.35.2':
+    resolution: {integrity: sha512-BaktuGPCeHJMARpodR8jK4uKiZrPAy9WrfQW0sdI37clracq8Bp01AYS3SZgi5FS/y5twa9t4+LIuuxQjqRrWw==}
+    engines: {node: '>=20.9.0'}
     cpu: [x64]
     os: [darwin]
 
-  '@img/sharp-libvips-darwin-arm64@1.2.4':
-    resolution: {integrity: sha512-zqjjo7RatFfFoP0MkQ51jfuFZBnVE2pRiaydKJ1G/rHZvnsrHAOcQALIi9sA5co5xenQdTugCvtb1cuf78Vf4g==}
+  '@img/sharp-freebsd-wasm32@0.35.2':
+    resolution: {integrity: sha512-YoAxdnd8hPUkvLHd3bWY+YA8nw3xM/RyRopYucNsWHVSan8NLVM3X2volsfoRDcXdUJPg6tXahSd7HXPK7lRnw==}
+    engines: {node: '>=20.9.0'}
+    os: [freebsd]
+
+  '@img/sharp-libvips-darwin-arm64@1.3.1':
+    resolution: {integrity: sha512-4V/M3roRMTYjiwZY9IOVQOE8OyeCxFAkYmyZDrZl51uOKjibm3oeEJ4WAmLxutAfzFbC9jqUiPs2gbnGflH+7g==}
     cpu: [arm64]
     os: [darwin]
 
-  '@img/sharp-libvips-darwin-x64@1.2.4':
-    resolution: {integrity: sha512-1IOd5xfVhlGwX+zXv2N93k0yMONvUlANylbJw1eTah8K/Jtpi15KC+WSiaX/nBmbm2HxRM1gZ0nSdjSsrZbGKg==}
+  '@img/sharp-libvips-darwin-x64@1.3.1':
+    resolution: {integrity: sha512-c0/DxItpJv2+dGhgycJBBgotdqruGYDvA79drdh0MD1dFpy7JzJ/PlXwi1H4rFf0eTy8tgbI91aHDnZIceY3jQ==}
     cpu: [x64]
     os: [darwin]
 
-  '@img/sharp-libvips-linux-arm64@1.2.4':
-    resolution: {integrity: sha512-excjX8DfsIcJ10x1Kzr4RcWe1edC9PquDRRPx3YVCvQv+U5p7Yin2s32ftzikXojb1PIFc/9Mt28/y+iRklkrw==}
+  '@img/sharp-libvips-linux-arm64@1.3.1':
+    resolution: {integrity: sha512-JznefmcK9j1JKPz8AkQDh89kjojubyfOasWBPKfzMIhPwsgDy9evpE/naJTXXXmghS1iFwR8u/kTwh/I2/+GCw==}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@img/sharp-libvips-linux-arm@1.2.4':
-    resolution: {integrity: sha512-bFI7xcKFELdiNCVov8e44Ia4u2byA+l3XtsAj+Q8tfCwO6BQ8iDojYdvoPMqsKDkuoOo+X6HZA0s0q11ANMQ8A==}
+  '@img/sharp-libvips-linux-arm@1.3.1':
+    resolution: {integrity: sha512-aGGy9aWzXgHBG7HNyQPWorZthlp7+x6fDRoPAQbGO3ThcttuTyKIx3NuSHb6zb4gBNq6/yNn9f1cy9nFKS/Vmg==}
     cpu: [arm]
     os: [linux]
     libc: [glibc]
 
-  '@img/sharp-libvips-linux-ppc64@1.2.4':
-    resolution: {integrity: sha512-FMuvGijLDYG6lW+b/UvyilUWu5Ayu+3r2d1S8notiGCIyYU/76eig1UfMmkZ7vwgOrzKzlQbFSuQfgm7GYUPpA==}
+  '@img/sharp-libvips-linux-ppc64@1.3.1':
+    resolution: {integrity: sha512-1EkwGNCZk6iWNCMWqrvdJ+r1j0PT1zIz60CNPhYnJlK/zyeWqlsPZIe+ocBVqPF8k/Ssee/NCk+tE9Ryrko6ng==}
     cpu: [ppc64]
     os: [linux]
     libc: [glibc]
 
-  '@img/sharp-libvips-linux-riscv64@1.2.4':
-    resolution: {integrity: sha512-oVDbcR4zUC0ce82teubSm+x6ETixtKZBh/qbREIOcI3cULzDyb18Sr/Wcyx7NRQeQzOiHTNbZFF1UwPS2scyGA==}
+  '@img/sharp-libvips-linux-riscv64@1.3.1':
+    resolution: {integrity: sha512-Ilays+w2bXdnxzxtQdmXR62u8o8GYa3eL4+Gr+1KiE4xperMZUslRaVPJwwPkzlHEjGfXAfRVAa/7CYCtSqsBw==}
     cpu: [riscv64]
     os: [linux]
     libc: [glibc]
 
-  '@img/sharp-libvips-linux-s390x@1.2.4':
-    resolution: {integrity: sha512-qmp9VrzgPgMoGZyPvrQHqk02uyjA0/QrTO26Tqk6l4ZV0MPWIW6LTkqOIov+J1yEu7MbFQaDpwdwJKhbJvuRxQ==}
+  '@img/sharp-libvips-linux-s390x@1.3.1':
+    resolution: {integrity: sha512-VfBwVHQTbRoj4XlpA/KLZ7ltgMpz+4WSejFzQ+GnoImjo1PtEJ59QB2qR1xQEeRPYIkNrPIm2L4cICMvz4C2ew==}
     cpu: [s390x]
     os: [linux]
     libc: [glibc]
 
-  '@img/sharp-libvips-linux-x64@1.2.4':
-    resolution: {integrity: sha512-tJxiiLsmHc9Ax1bz3oaOYBURTXGIRDODBqhveVHonrHJ9/+k89qbLl0bcJns+e4t4rvaNBxaEZsFtSfAdquPrw==}
+  '@img/sharp-libvips-linux-x64@1.3.1':
+    resolution: {integrity: sha512-+c8ukgwU62DS54nCAjw7keOfHUkmr0B5QHEdcOqRnodF/MNXJbVI8Eopoj4B/0H8Asr65I+A4Amrn7a85/md6A==}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@img/sharp-libvips-linuxmusl-arm64@1.2.4':
-    resolution: {integrity: sha512-FVQHuwx1IIuNow9QAbYUzJ+En8KcVm9Lk5+uGUQJHaZmMECZmOlix9HnH7n1TRkXMS0pGxIJokIVB9SuqZGGXw==}
+  '@img/sharp-libvips-linuxmusl-arm64@1.3.1':
+    resolution: {integrity: sha512-qlKb/pwbkAi1WMsJrYHk7CuDrd12s27U2QnRhFYUoJNrRCmkosMTttuRFat/DDB3IlDm5qE1TJgZ4JDnHX8Ldw==}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@img/sharp-libvips-linuxmusl-x64@1.2.4':
-    resolution: {integrity: sha512-+LpyBk7L44ZIXwz/VYfglaX/okxezESc6UxDSoyo2Ks6Jxc4Y7sGjpgU9s4PMgqgjj1gZCylTieNamqA1MF7Dg==}
+  '@img/sharp-libvips-linuxmusl-x64@1.3.1':
+    resolution: {integrity: sha512-yO21HwoUVLN8Qa+/SBjQLMYwBWAVJjeGPNe+hc0OUeMeifEtJqu5a1c4HayE1nNpDih9y3/KkoltfkDodmKAlg==}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@img/sharp-linux-arm64@0.34.5':
-    resolution: {integrity: sha512-bKQzaJRY/bkPOXyKx5EVup7qkaojECG6NLYswgktOZjaXecSAeCWiZwwiFf3/Y+O1HrauiE3FVsGxFg8c24rZg==}
-    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+  '@img/sharp-linux-arm64@0.35.2':
+    resolution: {integrity: sha512-af12Pnd0ZGu2HfP8NayB0kk6eC/lrfbQE6HlR4jD+34wdJ1Vw9TF6TMn6ZvffT+WgqVsl0hRbmNvz2u/23VmwA==}
+    engines: {node: '>=20.9.0'}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@img/sharp-linux-arm@0.34.5':
-    resolution: {integrity: sha512-9dLqsvwtg1uuXBGZKsxem9595+ujv0sJ6Vi8wcTANSFpwV/GONat5eCkzQo/1O6zRIkh0m/8+5BjrRr7jDUSZw==}
-    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+  '@img/sharp-linux-arm@0.35.2':
+    resolution: {integrity: sha512-SE4kzF2mepn6z+6E7L6lsV8FzuLL6IPQdyX8ZiwROAG/G8td+hP/m7FsFPwidtrF19gvajuC9l6TxAVcsA4S7A==}
+    engines: {node: '>=20.9.0'}
     cpu: [arm]
     os: [linux]
     libc: [glibc]
 
-  '@img/sharp-linux-ppc64@0.34.5':
-    resolution: {integrity: sha512-7zznwNaqW6YtsfrGGDA6BRkISKAAE1Jo0QdpNYXNMHu2+0dTrPflTLNkpc8l7MUP5M16ZJcUvysVWWrMefZquA==}
-    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+  '@img/sharp-linux-ppc64@0.35.2':
+    resolution: {integrity: sha512-hYSBm7zcNtDCozCxQHYZJiu63b/bXsgRZuOxCIBZsStMM9Vap47iFHdbX4kCvQsblPB/k+clhELpdQJHQLSHvg==}
+    engines: {node: '>=20.9.0'}
     cpu: [ppc64]
     os: [linux]
     libc: [glibc]
 
-  '@img/sharp-linux-riscv64@0.34.5':
-    resolution: {integrity: sha512-51gJuLPTKa7piYPaVs8GmByo7/U7/7TZOq+cnXJIHZKavIRHAP77e3N2HEl3dgiqdD/w0yUfiJnII77PuDDFdw==}
-    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+  '@img/sharp-linux-riscv64@0.35.2':
+    resolution: {integrity: sha512-qQt0Kc13+Hoan/Awq/qMSQw3L+RI1NCRPgD5cUJ/1WSSmIoysLOc72jlRM3E0OHN9Yr313jgeQ2T+zW+F03QFA==}
+    engines: {node: '>=20.9.0'}
     cpu: [riscv64]
     os: [linux]
     libc: [glibc]
 
-  '@img/sharp-linux-s390x@0.34.5':
-    resolution: {integrity: sha512-nQtCk0PdKfho3eC5MrbQoigJ2gd1CgddUMkabUj+rBevs8tZ2cULOx46E7oyX+04WGfABgIwmMC0VqieTiR4jg==}
-    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+  '@img/sharp-linux-s390x@0.35.2':
+    resolution: {integrity: sha512-E4fLLfRPzDLlEeDaTzI98OFLcv++WL5ChLLMwPoVd0CIoZQqupBSNbOisPL5am9XsbQ9T84+iiMpUvbFtkunbA==}
+    engines: {node: '>=20.9.0'}
     cpu: [s390x]
     os: [linux]
     libc: [glibc]
 
-  '@img/sharp-linux-x64@0.34.5':
-    resolution: {integrity: sha512-MEzd8HPKxVxVenwAa+JRPwEC7QFjoPWuS5NZnBt6B3pu7EG2Ge0id1oLHZpPJdn3OQK+BQDiw9zStiHBTJQQQQ==}
-    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+  '@img/sharp-linux-x64@0.35.2':
+    resolution: {integrity: sha512-gi0zFJJRLswfCZmHtJdikXPOc5u7qamSOS3NHedLqLd4W8Q0NqjdBr6TTRIgsfFjqfTsHFgdfvJ9LwqSgcHiAA==}
+    engines: {node: '>=20.9.0'}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@img/sharp-linuxmusl-arm64@0.34.5':
-    resolution: {integrity: sha512-fprJR6GtRsMt6Kyfq44IsChVZeGN97gTD331weR1ex1c1rypDEABN6Tm2xa1wE6lYb5DdEnk03NZPqA7Id21yg==}
-    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+  '@img/sharp-linuxmusl-arm64@0.35.2':
+    resolution: {integrity: sha512-siWbOW1u6HFnFLrp0waKyW7VEf7jYvcDWdrXEFa8AkdAQgEvuu5Fz8/Y70w9EeqAdwDtfU012BhEHHaDqvQNzg==}
+    engines: {node: '>=20.9.0'}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@img/sharp-linuxmusl-x64@0.34.5':
-    resolution: {integrity: sha512-Jg8wNT1MUzIvhBFxViqrEhWDGzqymo3sV7z7ZsaWbZNDLXRJZoRGrjulp60YYtV4wfY8VIKcWidjojlLcWrd8Q==}
-    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+  '@img/sharp-linuxmusl-x64@0.35.2':
+    resolution: {integrity: sha512-YBqMMcjDi4QGYiSn4vNOYBhmlC4z5AXqkOUUqI2e0AFA4urNv4ESgOgwNl3K+4etQhha0twXlzeF20bbULm9Yg==}
+    engines: {node: '>=20.9.0'}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@img/sharp-wasm32@0.34.5':
-    resolution: {integrity: sha512-OdWTEiVkY2PHwqkbBI8frFxQQFekHaSSkUIJkwzclWZe64O1X4UlUjqqqLaPbUpMOQk6FBu/HtlGXNblIs0huw==}
-    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+  '@img/sharp-wasm32@0.35.2':
+    resolution: {integrity: sha512-Mrv4JQNYVQ94xH+jzZ9r+gowleN8mv2FTgKT+PI6bx5C0G8TdNYndu161pg2i7uoBwxy2ImPMHrJOM2LZef7Bw==}
+    engines: {node: '>=20.9.0'}
+
+  '@img/sharp-webcontainers-wasm32@0.35.2':
+    resolution: {integrity: sha512-QNV27pxs9wpApEiCfvHM1RDoP1w1+2KrUWWDPEhEwg+latvOrfuhWrHWZKwdSFwU6jh3myjw/yOCRsUIuOft3g==}
+    engines: {node: '>=20.9.0'}
     cpu: [wasm32]
 
-  '@img/sharp-win32-arm64@0.34.5':
-    resolution: {integrity: sha512-WQ3AgWCWYSb2yt+IG8mnC6Jdk9Whs7O0gxphblsLvdhSpSTtmu69ZG1Gkb6NuvxsNACwiPV6cNSZNzt0KPsw7g==}
-    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+  '@img/sharp-win32-arm64@0.35.2':
+    resolution: {integrity: sha512-BiVRYc/t6/Vl3e1hBx0hugG4oN9Pydf4fgMSpxTQJmwGUg/YoXTWHiFeRymHfCZzifxu4F4rpk/I67D0LQ20wQ==}
+    engines: {node: '>=20.9.0'}
     cpu: [arm64]
     os: [win32]
 
-  '@img/sharp-win32-ia32@0.34.5':
-    resolution: {integrity: sha512-FV9m/7NmeCmSHDD5j4+4pNI8Cp3aW+JvLoXcTUo0IqyjSfAZJ8dIUmijx1qaJsIiU+Hosw6xM5KijAWRJCSgNg==}
-    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+  '@img/sharp-win32-ia32@0.35.2':
+    resolution: {integrity: sha512-YYEhx9PImCC7T0tI8JDMi4DB9LwLCXCU5OWNYEXAxh5Q1ShKkyC6byxzoBJ3gEFDnH2lQckWuDe70G7mB2XJog==}
+    engines: {node: ^20.9.0}
     cpu: [ia32]
     os: [win32]
 
-  '@img/sharp-win32-x64@0.34.5':
-    resolution: {integrity: sha512-+29YMsqY2/9eFEiW93eqWnuLcWcufowXewwSNIT6UwZdUUCrM3oFjMWH/Z6/TMmb4hlFenmfAVbpWeup2jryCw==}
-    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+  '@img/sharp-win32-x64@0.35.2':
+    resolution: {integrity: sha512-imoOyBcoM/iiUr4J6VPpCNjPnjvP/Gks95898yB8YqoGGYmHYbOyCuNv9FMhFgtaiHFGbHW8bxKqRV6VjtXThQ==}
+    engines: {node: '>=20.9.0'}
     cpu: [x64]
     os: [win32]
 
@@ -7426,15 +7435,15 @@ packages:
   end-of-stream@1.4.5:
     resolution: {integrity: sha512-ooEGc6HP26xXq/N+GCGOT0JKCLDGrq2bQUZrQ7gyrJiZANJ/8YDTxTpQBXGMn+WbIQXNVpyWymm7KYVICQnyOg==}
 
-  engine.io-client@6.6.5:
-    resolution: {integrity: sha512-QCwxUDULPlXv8F6tqMMKx5dNkTe6OaBYRMPYeXKBlyOoKvAmE0ac6pW7fFhSscJ/5SI7666/U/B+MElbsrJlIg==}
+  engine.io-client@6.6.6:
+    resolution: {integrity: sha512-iY6QdftLQ9pyiPoX082bpf/u1UewnOaJrtJIF9T0++QB34lZrj0uP+Q/bj8AlUsAxqhnkTV2BS8SBZSxOmoV5Q==}
 
   engine.io-parser@5.2.3:
     resolution: {integrity: sha512-HqD3yTBfnBxIrbnM1DoD6Pcq8NECnh8d4As1Qgh0z5Gg3jRRIqijury0CL3ghu/edArpUYiYqQiDUQBIs4np3Q==}
     engines: {node: '>=10.0.0'}
 
-  engine.io@6.6.8:
-    resolution: {integrity: sha512-2agL3ueZhqxoVrfmntO8yuVj+uNSlIOnhykYHk3Cq0ShYPdUjjUiSJrQvXjq01I9jAuI0Zl2YO8Evv5Mqytm5g==}
+  engine.io@6.6.9:
+    resolution: {integrity: sha512-clKkw4C7nJ22mGgoVcCg6V/W/TxdNyIOTr89k2ONZu81qqkddPFDF0LXcbAwhzPD8DjkiRCjzuiO6Y+fkpD4vg==}
     engines: {node: '>=10.2.0'}
 
   enhanced-resolve@5.21.6:
@@ -8458,8 +8467,8 @@ packages:
     resolution: {integrity: sha512-TR3KfrTZTYLPB6jUjfx6MF9WcWrHL9su5TObK4ZkYgBdWKPOFoSoQIdEuTuR82pmtxH2spWG9h6etwfr1pLBqQ==}
     engines: {node: '>=6'}
 
-  import-in-the-middle@3.0.2:
-    resolution: {integrity: sha512-LGLYRl0A2gtyUJb2WDliBHmk6TtlHwdDjxonacZ8QrEs/ZW+YDgNv2QAfjRQWpS8HqvNcq6GGnN6jrOa5FysDQ==}
+  import-in-the-middle@3.1.0:
+    resolution: {integrity: sha512-c0AeAV8VcwZzfYE7euTZY3H+VXUPMVugiovdosq80lqEXJmOekg3zGUAYg6KImHMaMuBoTUfTv7xNpUFdy0hJA==}
     engines: {node: '>=18'}
 
   import-lazy@4.0.0:
@@ -11461,9 +11470,9 @@ packages:
     resolution: {integrity: sha512-rLGSWeK2ufzCVx05wYd+xrWnOOdSV7xNUW5/XFgx3Bc02hBkpMlrd2F1dDII7/jhWzv0MSyBFh5uJIy9hLdfuw==}
     hasBin: true
 
-  sharp@0.34.5:
-    resolution: {integrity: sha512-Ou9I5Ft9WNcCbXrU9cMgPBcCK8LiwLqcbywW3t4oDV37n1pzpuNLsYiAV8eODnjbtQlSDwZ2cUEeQz4E54Hltg==}
-    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+  sharp@0.35.2:
+    resolution: {integrity: sha512-FVtFjtBCMiJS6yb5CX7Sop45WFMpeGw6oRKuJnXYgf/f1ms/D7LE/ZUSNxnW7rZ/dbslQWYkoqFHGPaDBtaK4w==}
+    engines: {node: '>=20.9.0'}
 
   shebang-command@2.0.0:
     resolution: {integrity: sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==}
@@ -11547,8 +11556,8 @@ packages:
   snake-case@3.0.4:
     resolution: {integrity: sha512-LAOh4z89bGQvl9pFfNF8V146i7o7/CqFPbqzYgP+yYzDIDeS9HaNFtXABamRW+AQzEVODcvE79ljJ+8a9YSdMg==}
 
-  socket.io-adapter@2.5.7:
-    resolution: {integrity: sha512-e0LyK91f3cUxTmv95/KzoLg47+zF+s/sbxRGDNsyG4dmIP8ZSX8ax6byOxfJXeNNtS/8AZlfD+uP7gBeR7DLlg==}
+  socket.io-adapter@2.5.8:
+    resolution: {integrity: sha512-6Oy52pbg+kvdCVvjcN+FnY7BvxZ7cIHNScbvztT/It5d0vbwoJoVZmF2gjJmnV0/4WlXRfG15zc45ySk9Ah8bw==}
 
   socket.io-client@4.8.3:
     resolution: {integrity: sha512-uP0bpjWrjQmUt5DTHq9RuoCBdFJF10cdX9X+a368j/Ft0wmaVgxlrjvK3kjvgCODOMMOz9lcaRzxmso0bTWZ/g==}
@@ -12327,8 +12336,8 @@ packages:
   undici-types@7.18.2:
     resolution: {integrity: sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==}
 
-  undici@6.26.0:
-    resolution: {integrity: sha512-4yqz8a3n5HmGTlsbADNtr/dJlhkh/55Rq798G6ibiULcXbDtaLpTl1pvdqcbFfeoj3iSi52lePFM7h9H21cw/A==}
+  undici@6.27.0:
+    resolution: {integrity: sha512-YmfV3YnEDzXRC5lZ2jWtWWHKGUm1zIt8AhesR1tens+HTNv+YZlN/dp6G727LOvMJ8xjP9Be7Y2Sdr96LDm+pg==}
     engines: {node: '>=18.17'}
 
   undici@8.7.0:
@@ -12913,8 +12922,8 @@ packages:
       utf-8-validate:
         optional: true
 
-  ws@8.20.1:
-    resolution: {integrity: sha512-It4dO0K5v//JtTXuPkfEOaI3uUN87iYPnqo/ZzqCoG3g8uhA66QUMs/SrM0YK7/NAu+r4LMh/9dq2A7k+rHs+w==}
+  ws@8.21.0:
+    resolution: {integrity: sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==}
     engines: {node: '>=10.0.0'}
     peerDependencies:
       bufferutil: ^4.0.1
@@ -14010,7 +14019,7 @@ snapshots:
     dependencies:
       '@babel/code-frame': 7.29.7
       '@babel/generator': 7.29.7
-      '@babel/parser': 7.29.7
+      '@babel/parser': 7.27.0
       '@babel/template': 7.29.7
       '@babel/types': 7.29.7
       debug: 4.4.3
@@ -14079,7 +14088,7 @@ snapshots:
       '@codemirror/view': 6.43.1
       crelt: 1.0.6
 
-  '@codemirror/search@6.7.0':
+  '@codemirror/search@6.7.1':
     dependencies:
       '@codemirror/state': 6.6.0
       '@codemirror/view': 6.43.1
@@ -15908,98 +15917,108 @@ snapshots:
 
   '@img/colour@1.1.0': {}
 
-  '@img/sharp-darwin-arm64@0.34.5':
+  '@img/sharp-darwin-arm64@0.35.2':
     optionalDependencies:
-      '@img/sharp-libvips-darwin-arm64': 1.2.4
+      '@img/sharp-libvips-darwin-arm64': 1.3.1
     optional: true
 
-  '@img/sharp-darwin-x64@0.34.5':
+  '@img/sharp-darwin-x64@0.35.2':
     optionalDependencies:
-      '@img/sharp-libvips-darwin-x64': 1.2.4
+      '@img/sharp-libvips-darwin-x64': 1.3.1
     optional: true
 
-  '@img/sharp-libvips-darwin-arm64@1.2.4':
+  '@img/sharp-freebsd-wasm32@0.35.2':
+    dependencies:
+      '@img/sharp-wasm32': 0.35.2
     optional: true
 
-  '@img/sharp-libvips-darwin-x64@1.2.4':
+  '@img/sharp-libvips-darwin-arm64@1.3.1':
     optional: true
 
-  '@img/sharp-libvips-linux-arm64@1.2.4':
+  '@img/sharp-libvips-darwin-x64@1.3.1':
     optional: true
 
-  '@img/sharp-libvips-linux-arm@1.2.4':
+  '@img/sharp-libvips-linux-arm64@1.3.1':
     optional: true
 
-  '@img/sharp-libvips-linux-ppc64@1.2.4':
+  '@img/sharp-libvips-linux-arm@1.3.1':
     optional: true
 
-  '@img/sharp-libvips-linux-riscv64@1.2.4':
+  '@img/sharp-libvips-linux-ppc64@1.3.1':
     optional: true
 
-  '@img/sharp-libvips-linux-s390x@1.2.4':
+  '@img/sharp-libvips-linux-riscv64@1.3.1':
     optional: true
 
-  '@img/sharp-libvips-linux-x64@1.2.4':
+  '@img/sharp-libvips-linux-s390x@1.3.1':
     optional: true
 
-  '@img/sharp-libvips-linuxmusl-arm64@1.2.4':
+  '@img/sharp-libvips-linux-x64@1.3.1':
     optional: true
 
-  '@img/sharp-libvips-linuxmusl-x64@1.2.4':
+  '@img/sharp-libvips-linuxmusl-arm64@1.3.1':
     optional: true
 
-  '@img/sharp-linux-arm64@0.34.5':
+  '@img/sharp-libvips-linuxmusl-x64@1.3.1':
+    optional: true
+
+  '@img/sharp-linux-arm64@0.35.2':
     optionalDependencies:
-      '@img/sharp-libvips-linux-arm64': 1.2.4
+      '@img/sharp-libvips-linux-arm64': 1.3.1
     optional: true
 
-  '@img/sharp-linux-arm@0.34.5':
+  '@img/sharp-linux-arm@0.35.2':
     optionalDependencies:
-      '@img/sharp-libvips-linux-arm': 1.2.4
+      '@img/sharp-libvips-linux-arm': 1.3.1
     optional: true
 
-  '@img/sharp-linux-ppc64@0.34.5':
+  '@img/sharp-linux-ppc64@0.35.2':
     optionalDependencies:
-      '@img/sharp-libvips-linux-ppc64': 1.2.4
+      '@img/sharp-libvips-linux-ppc64': 1.3.1
     optional: true
 
-  '@img/sharp-linux-riscv64@0.34.5':
+  '@img/sharp-linux-riscv64@0.35.2':
     optionalDependencies:
-      '@img/sharp-libvips-linux-riscv64': 1.2.4
+      '@img/sharp-libvips-linux-riscv64': 1.3.1
     optional: true
 
-  '@img/sharp-linux-s390x@0.34.5':
+  '@img/sharp-linux-s390x@0.35.2':
     optionalDependencies:
-      '@img/sharp-libvips-linux-s390x': 1.2.4
+      '@img/sharp-libvips-linux-s390x': 1.3.1
     optional: true
 
-  '@img/sharp-linux-x64@0.34.5':
+  '@img/sharp-linux-x64@0.35.2':
     optionalDependencies:
-      '@img/sharp-libvips-linux-x64': 1.2.4
+      '@img/sharp-libvips-linux-x64': 1.3.1
     optional: true
 
-  '@img/sharp-linuxmusl-arm64@0.34.5':
+  '@img/sharp-linuxmusl-arm64@0.35.2':
     optionalDependencies:
-      '@img/sharp-libvips-linuxmusl-arm64': 1.2.4
+      '@img/sharp-libvips-linuxmusl-arm64': 1.3.1
     optional: true
 
-  '@img/sharp-linuxmusl-x64@0.34.5':
+  '@img/sharp-linuxmusl-x64@0.35.2':
     optionalDependencies:
-      '@img/sharp-libvips-linuxmusl-x64': 1.2.4
+      '@img/sharp-libvips-linuxmusl-x64': 1.3.1
     optional: true
 
-  '@img/sharp-wasm32@0.34.5':
+  '@img/sharp-wasm32@0.35.2':
     dependencies:
       '@emnapi/runtime': 1.11.1
     optional: true
 
-  '@img/sharp-win32-arm64@0.34.5':
+  '@img/sharp-webcontainers-wasm32@0.35.2':
+    dependencies:
+      '@img/sharp-wasm32': 0.35.2
     optional: true
 
-  '@img/sharp-win32-ia32@0.34.5':
+  '@img/sharp-win32-arm64@0.35.2':
     optional: true
 
-  '@img/sharp-win32-x64@0.34.5':
+  '@img/sharp-win32-ia32@0.35.2':
+    optional: true
+
+  '@img/sharp-win32-x64@0.35.2':
     optional: true
 
   '@immich/justified-layout-wasm@0.4.3': {}
@@ -16914,7 +16933,7 @@ snapshots:
     dependencies:
       '@opentelemetry/api': 1.9.1
       '@opentelemetry/api-logs': 0.220.0
-      import-in-the-middle: 3.0.2
+      import-in-the-middle: 3.1.0
       require-in-the-middle: 8.0.1
     transitivePeerDependencies:
       - supports-color
@@ -17583,11 +17602,11 @@ snapshots:
 
   '@socket.io/component-emitter@3.1.2': {}
 
-  '@socket.io/redis-adapter@8.3.0(socket.io-adapter@2.5.7)':
+  '@socket.io/redis-adapter@8.3.0(socket.io-adapter@2.5.8)':
     dependencies:
       debug: 4.3.7
       notepack.io: 3.0.1
-      socket.io-adapter: 2.5.7
+      socket.io-adapter: 2.5.8
       uid2: 1.0.0
     transitivePeerDependencies:
       - supports-color
@@ -17608,7 +17627,7 @@ snapshots:
     dependencies:
       '@sveltejs/vite-plugin-svelte': 7.2.0(svelte@5.56.5(@typescript-eslint/types@8.64.0))(vite@8.1.5(@types/node@24.13.3)(esbuild@0.28.1)(jiti@2.7.0)(sass@1.101.0)(terser@5.49.0)(tsx@4.23.1)(yaml@2.9.0))
       magic-string: 0.30.21
-      sharp: 0.34.5
+      sharp: 0.35.2
       svelte: 5.56.5(@typescript-eslint/types@8.64.0)
       svelte-parse-markup: 0.1.5(svelte@5.56.5(@typescript-eslint/types@8.64.0))
       vite: 8.1.5(@types/node@24.13.3)(esbuild@0.28.1)(jiti@2.7.0)(sass@1.101.0)(terser@5.49.0)(tsx@4.23.1)(yaml@2.9.0)
@@ -18368,7 +18387,7 @@ snapshots:
 
   '@types/pg-pool@2.0.7':
     dependencies:
-      '@types/pg': 8.20.0
+      '@types/pg': 8.15.6
 
   '@types/pg@8.15.6':
     dependencies:
@@ -20501,12 +20520,12 @@ snapshots:
     dependencies:
       once: 1.4.0
 
-  engine.io-client@6.6.5:
+  engine.io-client@6.6.6:
     dependencies:
       '@socket.io/component-emitter': 3.1.2
       debug: 4.4.3
       engine.io-parser: 5.2.3
-      ws: 8.20.1
+      ws: 8.21.0
       xmlhttprequest-ssl: 2.1.2
     transitivePeerDependencies:
       - bufferutil
@@ -20515,7 +20534,7 @@ snapshots:
 
   engine.io-parser@5.2.3: {}
 
-  engine.io@6.6.8:
+  engine.io@6.6.9:
     dependencies:
       '@types/cors': 2.8.19
       '@types/node': 24.13.3
@@ -20526,7 +20545,7 @@ snapshots:
       cors: 2.8.6
       debug: 4.4.3
       engine.io-parser: 5.2.3
-      ws: 8.20.1
+      ws: 8.21.0
     transitivePeerDependencies:
       - bufferutil
       - supports-color
@@ -21901,7 +21920,7 @@ snapshots:
       parent-module: 1.0.1
       resolve-from: 4.0.0
 
-  import-in-the-middle@3.0.2:
+  import-in-the-middle@3.1.0:
     dependencies:
       acorn: 8.17.0
       acorn-import-attributes: 1.9.5(acorn@8.17.0)
@@ -23509,7 +23528,7 @@ snapshots:
       semver: 7.8.5
       tar: 7.5.16
       tinyglobby: 0.2.17
-      undici: 6.26.0
+      undici: 6.27.0
       which: 7.0.0
 
   node-releases@2.0.51: {}
@@ -25319,7 +25338,7 @@ snapshots:
       stream-source: 0.3.5
       text-encoding: 0.6.4
 
-  sharp@0.34.5:
+  sharp@0.35.2:
     dependencies:
       '@img/colour': 1.1.0
       detect-libc: 2.1.2
@@ -25327,30 +25346,31 @@ snapshots:
       node-gyp: 13.0.0
       semver: 7.8.5
     optionalDependencies:
-      '@img/sharp-darwin-arm64': 0.34.5
-      '@img/sharp-darwin-x64': 0.34.5
-      '@img/sharp-libvips-darwin-arm64': 1.2.4
-      '@img/sharp-libvips-darwin-x64': 1.2.4
-      '@img/sharp-libvips-linux-arm': 1.2.4
-      '@img/sharp-libvips-linux-arm64': 1.2.4
-      '@img/sharp-libvips-linux-ppc64': 1.2.4
-      '@img/sharp-libvips-linux-riscv64': 1.2.4
-      '@img/sharp-libvips-linux-s390x': 1.2.4
-      '@img/sharp-libvips-linux-x64': 1.2.4
-      '@img/sharp-libvips-linuxmusl-arm64': 1.2.4
-      '@img/sharp-libvips-linuxmusl-x64': 1.2.4
-      '@img/sharp-linux-arm': 0.34.5
-      '@img/sharp-linux-arm64': 0.34.5
-      '@img/sharp-linux-ppc64': 0.34.5
-      '@img/sharp-linux-riscv64': 0.34.5
-      '@img/sharp-linux-s390x': 0.34.5
-      '@img/sharp-linux-x64': 0.34.5
-      '@img/sharp-linuxmusl-arm64': 0.34.5
-      '@img/sharp-linuxmusl-x64': 0.34.5
-      '@img/sharp-wasm32': 0.34.5
-      '@img/sharp-win32-arm64': 0.34.5
-      '@img/sharp-win32-ia32': 0.34.5
-      '@img/sharp-win32-x64': 0.34.5
+      '@img/sharp-darwin-arm64': 0.35.2
+      '@img/sharp-darwin-x64': 0.35.2
+      '@img/sharp-freebsd-wasm32': 0.35.2
+      '@img/sharp-libvips-darwin-arm64': 1.3.1
+      '@img/sharp-libvips-darwin-x64': 1.3.1
+      '@img/sharp-libvips-linux-arm': 1.3.1
+      '@img/sharp-libvips-linux-arm64': 1.3.1
+      '@img/sharp-libvips-linux-ppc64': 1.3.1
+      '@img/sharp-libvips-linux-riscv64': 1.3.1
+      '@img/sharp-libvips-linux-s390x': 1.3.1
+      '@img/sharp-libvips-linux-x64': 1.3.1
+      '@img/sharp-libvips-linuxmusl-arm64': 1.3.1
+      '@img/sharp-libvips-linuxmusl-x64': 1.3.1
+      '@img/sharp-linux-arm': 0.35.2
+      '@img/sharp-linux-arm64': 0.35.2
+      '@img/sharp-linux-ppc64': 0.35.2
+      '@img/sharp-linux-riscv64': 0.35.2
+      '@img/sharp-linux-s390x': 0.35.2
+      '@img/sharp-linux-x64': 0.35.2
+      '@img/sharp-linuxmusl-arm64': 0.35.2
+      '@img/sharp-linuxmusl-x64': 0.35.2
+      '@img/sharp-webcontainers-wasm32': 0.35.2
+      '@img/sharp-win32-arm64': 0.35.2
+      '@img/sharp-win32-ia32': 0.35.2
+      '@img/sharp-win32-x64': 0.35.2
 
   shebang-command@2.0.0:
     dependencies:
@@ -25442,10 +25462,10 @@ snapshots:
       dot-case: 3.0.4
       tslib: 2.8.1
 
-  socket.io-adapter@2.5.7:
+  socket.io-adapter@2.5.8:
     dependencies:
       debug: 4.4.3
-      ws: 8.20.1
+      ws: 8.21.1
     transitivePeerDependencies:
       - bufferutil
       - supports-color
@@ -25455,7 +25475,7 @@ snapshots:
     dependencies:
       '@socket.io/component-emitter': 3.1.2
       debug: 4.4.3
-      engine.io-client: 6.6.5
+      engine.io-client: 6.6.6
       socket.io-parser: 4.2.6
     transitivePeerDependencies:
       - bufferutil
@@ -25475,8 +25495,8 @@ snapshots:
       base64id: 2.0.0
       cors: 2.8.6
       debug: 4.4.3
-      engine.io: 6.6.8
-      socket.io-adapter: 2.5.7
+      engine.io: 6.6.9
+      socket.io-adapter: 2.5.8
       socket.io-parser: 4.2.6
     transitivePeerDependencies:
       - bufferutil
@@ -25779,7 +25799,7 @@ snapshots:
       '@codemirror/lang-json': 6.0.2
       '@codemirror/language': 6.12.3
       '@codemirror/lint': 6.9.7
-      '@codemirror/search': 6.7.0
+      '@codemirror/search': 6.7.1
       '@codemirror/state': 6.6.0
       '@codemirror/view': 6.43.1
       '@fortawesome/free-regular-svg-icons': 7.2.0
@@ -26339,7 +26359,7 @@ snapshots:
 
   undici-types@7.18.2: {}
 
-  undici@6.26.0: {}
+  undici@6.27.0: {}
 
   undici@8.7.0: {}
 
@@ -26562,7 +26582,7 @@ snapshots:
     dependencies:
       '@rollup/pluginutils': 5.4.0(rollup@4.62.0)
       imagetools-core: 9.1.0
-      sharp: 0.34.5
+      sharp: 0.35.2
     transitivePeerDependencies:
       - rollup
 
@@ -27057,7 +27077,7 @@ snapshots:
 
   ws@7.5.12: {}
 
-  ws@8.20.1: {}
+  ws@8.21.0: {}
 
   ws@8.21.1: {}
 

pnpm-workspace.yaml

@@ -29,7 +29,7 @@ allowBuilds:
   postman-code-generators: false
 overrides:
   canvas: 3.2.3
-  sharp: ^0.34.5
+  sharp: ^0.35.2
 packageExtensions:
   nestjs-kysely:
     dependencies:

server/Dockerfile

@@ -20,8 +20,9 @@ RUN --mount=type=cache,id=pnpm-server,target=/buildcache/pnpm-store \
   --mount=type=bind,source=.pnpmfile.cjs,target=.pnpmfile.cjs \
   --mount=type=bind,source=pnpm-lock.yaml,target=pnpm-lock.yaml \
   --mount=type=bind,source=pnpm-workspace.yaml,target=pnpm-workspace.yaml \
-  SHARP_IGNORE_GLOBAL_LIBVIPS=true pnpm --filter @immich/sdk --filter @immich/plugin-sdk --filter immich build && \
-  SHARP_FORCE_GLOBAL_LIBVIPS=true  pnpm --filter immich --prod --no-optional deploy /output/server-pruned
+  pnpm --filter @immich/sdk --filter @immich/plugin-sdk --filter immich build && \
+  pnpm --filter immich --prod deploy /output/server-pruned && \
+  SHARP_FORCE_GLOBAL_LIBVIPS=true pnpm --dir /output/server-pruned/node_modules/sharp exec npm run build
 
 FROM builder AS web
 
@@ -37,7 +38,7 @@ RUN --mount=type=cache,id=pnpm-web,target=/buildcache/pnpm-store \
   --mount=type=bind,source=.pnpmfile.cjs,target=.pnpmfile.cjs \
   --mount=type=bind,source=pnpm-lock.yaml,target=pnpm-lock.yaml \
   --mount=type=bind,source=pnpm-workspace.yaml,target=pnpm-workspace.yaml \
-  SHARP_IGNORE_GLOBAL_LIBVIPS=true pnpm --filter @immich/sdk --filter immich-web install --frozen-lockfile --force && \
+  pnpm --filter @immich/sdk --filter immich-web install --frozen-lockfile --force && \
   pnpm --filter @immich/sdk --filter immich-web build
 
 FROM builder AS cli

server/package.json

@@ -107,7 +107,7 @@
     "rxjs": "^7.8.1",
     "sanitize-filename": "^1.6.3",
     "semver": "^7.8.1",
-    "sharp": "^0.34.5",
+    "sharp": "^0.35.2",
     "sirv": "^3.0.0",
     "socket.io": "^4.8.1",
     "tailwindcss-preset-email": "^1.4.0",
@@ -169,6 +169,6 @@
     "vitest": "^3.0.0"
   },
   "overrides": {
-    "sharp": "^0.34.5"
+    "sharp": "^0.35.2"
   }
 }

server/src/services/auth.service.spec.ts

@@ -1140,6 +1140,125 @@ describe(AuthService.name, () => {
 
       expect(mocks.user.create).toHaveBeenCalledWith(expect.objectContaining({ isAdmin: true }));
     });
+
+    it('should create an admin user if the role claim is an array containing admin', async () => {
+      mocks.systemMetadata.get.mockResolvedValue(systemConfigStub.oauthWithAutoRegister);
+      mocks.oauth.getProfileAndOAuthSid.mockResolvedValue({
+        profile: OAuthProfileFactory.create({ immich_role: ['user', 'admin'] }),
+      });
+      mocks.user.getByEmail.mockResolvedValue(void 0);
+      mocks.user.getByOAuthId.mockResolvedValue(void 0);
+      mocks.user.create.mockResolvedValue(UserFactory.create({ oauthId: 'oauth-id' }));
+      mocks.session.create.mockResolvedValue(SessionFactory.create());
+
+      await sut.callback(
+        { url: 'http://immich/auth/login?code=abc123', state: 'xyz789', codeVerifier: 'foo' },
+        {},
+        loginDetails,
+      );
+
+      expect(mocks.user.create).toHaveBeenCalledWith(expect.objectContaining({ isAdmin: true }));
+    });
+
+    it('should create a standard user if the role claim is an array containing only user', async () => {
+      mocks.systemMetadata.get.mockResolvedValue(systemConfigStub.oauthWithAutoRegister);
+      mocks.oauth.getProfileAndOAuthSid.mockResolvedValue({
+        profile: OAuthProfileFactory.create({ immich_role: ['user'] }),
+      });
+      mocks.user.getByEmail.mockResolvedValue(void 0);
+      mocks.user.getByOAuthId.mockResolvedValue(void 0);
+      mocks.user.getAdmin.mockResolvedValue(UserFactory.create({ isAdmin: true }));
+      mocks.user.create.mockResolvedValue(UserFactory.create({ oauthId: 'oauth-id' }));
+      mocks.session.create.mockResolvedValue(SessionFactory.create());
+
+      await sut.callback(
+        { url: 'http://immich/auth/login?code=abc123', state: 'xyz789', codeVerifier: 'foo' },
+        {},
+        loginDetails,
+      );
+
+      expect(mocks.user.create).toHaveBeenCalledWith(expect.objectContaining({ isAdmin: false }));
+    });
+
+    it('should promote an existing user to admin if the role claim contains admin on login', async () => {
+      const user = UserFactory.create({ isAdmin: false, oauthId: 'oauth-id' });
+
+      mocks.systemMetadata.get.mockResolvedValue(systemConfigStub.oauthEnabled);
+      mocks.oauth.getProfileAndOAuthSid.mockResolvedValue({
+        profile: OAuthProfileFactory.create({ sub: user.oauthId, immich_role: 'admin' }),
+      });
+      mocks.user.getByOAuthId.mockResolvedValue(user);
+      mocks.user.update.mockResolvedValue({ ...user, isAdmin: true });
+      mocks.session.create.mockResolvedValue(SessionFactory.create());
+
+      await sut.callback(
+        { url: 'http://immich/auth/login?code=abc123', state: 'xyz789', codeVerifier: 'foo' },
+        {},
+        loginDetails,
+      );
+
+      expect(mocks.user.update).toHaveBeenCalledWith(user.id, { isAdmin: true });
+    });
+
+    it('should demote an existing admin if the role claim only contains user on login', async () => {
+      const user = UserFactory.create({ isAdmin: true, oauthId: 'oauth-id' });
+
+      mocks.systemMetadata.get.mockResolvedValue(systemConfigStub.oauthEnabled);
+      mocks.oauth.getProfileAndOAuthSid.mockResolvedValue({
+        profile: OAuthProfileFactory.create({ sub: user.oauthId, immich_role: ['user'] }),
+      });
+      mocks.user.getByOAuthId.mockResolvedValue(user);
+      mocks.user.update.mockResolvedValue({ ...user, isAdmin: false });
+      mocks.session.create.mockResolvedValue(SessionFactory.create());
+
+      await sut.callback(
+        { url: 'http://immich/auth/login?code=abc123', state: 'xyz789', codeVerifier: 'foo' },
+        {},
+        loginDetails,
+      );
+
+      expect(mocks.user.update).toHaveBeenCalledWith(user.id, { isAdmin: false });
+    });
+
+    it('should not change isAdmin for an existing user if the role claim is blank', async () => {
+      const user = UserFactory.create({ isAdmin: true, oauthId: 'oauth-id' });
+
+      mocks.systemMetadata.get.mockResolvedValue(systemConfigStub.oauthEnabled);
+      mocks.oauth.getProfileAndOAuthSid.mockResolvedValue({
+        profile: OAuthProfileFactory.create({ sub: user.oauthId }),
+      });
+      mocks.user.getByOAuthId.mockResolvedValue(user);
+      mocks.session.create.mockResolvedValue(SessionFactory.create());
+
+      await sut.callback(
+        { url: 'http://immich/auth/login?code=abc123', state: 'xyz789', codeVerifier: 'foo' },
+        {},
+        loginDetails,
+      );
+
+      expect(mocks.user.update).not.toHaveBeenCalled();
+    });
+
+    it('should re-evaluate the role claim for a user linked by email', async () => {
+      const user = UserFactory.create({ isAdmin: false });
+      const profile = OAuthProfileFactory.create({ immich_role: 'admin' });
+
+      mocks.systemMetadata.get.mockResolvedValue(systemConfigStub.oauthEnabled);
+      mocks.oauth.getProfileAndOAuthSid.mockResolvedValue({ profile });
+      mocks.user.getByEmail.mockResolvedValue(user);
+      mocks.user.update.mockResolvedValueOnce({ ...user, oauthId: profile.sub });
+      mocks.user.update.mockResolvedValueOnce({ ...user, oauthId: profile.sub, isAdmin: true });
+      mocks.session.create.mockResolvedValue(SessionFactory.create());
+
+      await sut.callback(
+        { url: 'http://immich/auth/login?code=abc123', state: 'xyz789', codeVerifier: 'foobar' },
+        {},
+        loginDetails,
+      );
+
+      expect(mocks.user.update).toHaveBeenCalledWith(user.id, { oauthId: profile.sub });
+      expect(mocks.user.update).toHaveBeenCalledWith(user.id, { isAdmin: true });
+    });
   });
 
   describe('link', () => {

server/src/services/auth.service.ts

@@ -331,6 +331,13 @@ export class AuthService extends BaseService {
       }
     }
 
+    const role = this.getRoleClaim(profile, roleClaim);
+    const isAdmin = role === 'admin';
+
+    if (user && role && isAdmin !== user.isAdmin) {
+      user = await this.userRepository.update(user.id, { isAdmin });
+    }
+
     // register new user
     if (!user) {
       if (!autoRegister) {
@@ -356,11 +363,6 @@ export class AuthService extends BaseService {
         default: defaultStorageQuota,
         isValid: (value: unknown) => Number(value) >= 0,
       });
-      const role = this.getClaim<'admin' | 'user'>(profile, {
-        key: roleClaim,
-        default: 'user',
-        isValid: (value: unknown) => typeof value === 'string' && ['admin', 'user'].includes(value),
-      });
 
       user = await this.createUser({
         name:
@@ -372,7 +374,7 @@ export class AuthService extends BaseService {
         oauthId: profile.sub,
         quotaSizeInBytes: storageQuota === null ? null : storageQuota * HumanReadableSize.GiB,
         storageLabel: storageLabel || null,
-        isAdmin: role === 'admin',
+        isAdmin,
       });
     }
 
@@ -641,6 +643,19 @@ export class AuthService extends BaseService {
     return options.isValid(value) ? (value as T) : options.default;
   }
 
+  private getRoleClaim(profile: OAuthProfile, roleClaim: string): 'admin' | 'user' | undefined {
+    const value = profile[roleClaim as keyof OAuthProfile];
+    const roles = Array.isArray(value) ? value : [value];
+    const isRole = (role: string) => roles.includes(role);
+
+    if (isRole('admin')) {
+      return 'admin';
+    }
+    if (isRole('user')) {
+      return 'user';
+    }
+  }
+
   private resolveRedirectUri(
     { mobileRedirectUri, mobileOverrideEnabled }: { mobileRedirectUri: string; mobileOverrideEnabled: boolean },
     url: string,