fix(mobile): save raw photo downloads that fail on android

2026-07-18 21:32:58 +03:00 · 2026-07-10 02:02:15 +06:00
134 changed files with 835 additions and 1234 deletions
--- a/.github/workflows/build-mobile.yml
+++ b/.github/workflows/build-mobile.yml
@@ -51,11 +51,10 @@ jobs:
      should_run: ${{ steps.check.outputs.should_run }}
    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-contents: read

      - name: Check what should run
        id: check
@@ -80,12 +79,10 @@ jobs:

    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-contents: read
-          permission-pull-requests: write

      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
@@ -106,7 +103,7 @@ jobs:
        working-directory: ./mobile
        run: printf "%s" $KEY_JKS | base64 -d > android/key.jks

-      - uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0
+      - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
        with:
          distribution: 'zulu'
          java-version: '17'
@@ -205,11 +202,10 @@ jobs:

    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-contents: read

      - name: Select Xcode 26
        run: sudo xcode-select -s /Applications/Xcode_26.2.app/Contents/Developer
@@ -241,7 +237,7 @@ jobs:
        run: flutter build ios --config-only --no-codesign

      - name: Setup Ruby
-        uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # v1.316.0
+        uses: ruby/setup-ruby@0dafeac902942906541bc140009cdbf32665b601 # v1.315.0
        with:
          ruby-version: '3.3'
          bundler-cache: true
--- a/.github/workflows/cache-cleanup.yml
+++ b/.github/workflows/cache-cleanup.yml
@@ -19,12 +19,10 @@ jobs:
      actions: write
    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-contents: read
-          permission-actions: write

      - name: Check out code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
--- a/.github/workflows/check-openapi.yml
+++ b/.github/workflows/check-openapi.yml
@@ -25,7 +25,7 @@ jobs:
          persist-credentials: false

      - name: Check for breaking API changes
-        uses: oasdiff/oasdiff-action/breaking@291b6594ce617f22f49af5898ee038ed0b46e8fe # v0.1.5
+        uses: oasdiff/oasdiff-action/breaking@ae5ef6402ebe218ac6e872c59d0fa4557694e75c # v0.1.4
        with:
          base: https://raw.githubusercontent.com/${{ github.repository }}/main/open-api/immich-openapi-specs.json
          revision: open-api/immich-openapi-specs.json
--- a/.github/workflows/cli.yml
+++ b/.github/workflows/cli.yml
@@ -31,11 +31,10 @@ jobs:
        working-directory: ./packages/cli
    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-contents: read

      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@@ -64,11 +63,10 @@ jobs:

    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-contents: read

      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@@ -83,7 +81,7 @@ jobs:
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Login to GitHub Container Registry
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        uses: docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4 # v4.3.0
        if: ${{ !github.event.pull_request.head.repo.fork }}
        with:
          registry: ghcr.io
--- a/.github/workflows/close-duplicates.yml
+++ b/.github/workflows/close-duplicates.yml
@@ -39,7 +39,7 @@ jobs:
    needs: [get_body, should_run]
    if: ${{ needs.should_run.outputs.should_run == 'true' }}
    container:
-      image: ghcr.io/immich-app/mdq:main@sha256:e3fe456f346b02c2f479462100763aee3ba8245768dfeac3c4262acb068e5c62
+      image: ghcr.io/immich-app/mdq:main@sha256:2a64c7f045cb7b580fbdf3614d7d1805f5775fec453e3d1023764180efa8c70b
    outputs:
      checked: ${{ steps.get_checkbox.outputs.checked }}
    steps:
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -44,11 +44,10 @@ jobs:

    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-contents: read

      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@@ -58,7 +57,7 @@ jobs:

      # Initializes the CodeQL tools for scanning.
      - name: Initialize CodeQL
-        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
        with:
          languages: ${{ matrix.language }}
          # If you wish to specify custom queries, you can do so here or in a config file.
@@ -71,7 +70,7 @@ jobs:
      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
      # If this step fails, then you should remove it and run the build manually (see below)
      - name: Autobuild
-        uses: github/codeql-action/autobuild@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/autobuild@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3

      # ℹ️ Command-line programs to run using the OS shell.
      # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -84,6 +83,6 @@ jobs:
      #   ./location_of_script_within_repo/buildscript.sh

      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
        with:
          category: '/language:${{matrix.language}}'
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -23,11 +23,10 @@ jobs:
      should_run: ${{ steps.check.outputs.should_run }}
    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-contents: read

      - name: Check what should run
        id: check
@@ -61,7 +60,7 @@ jobs:
        suffix: ['', '-cuda', '-rocm', '-openvino', '-armnn', '-rknn']
    steps:
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        uses: docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4 # v4.3.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
@@ -91,7 +90,7 @@ jobs:
        suffix: ['']
    steps:
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        uses: docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4 # v4.3.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
--- a/.github/workflows/docs-build.yml
+++ b/.github/workflows/docs-build.yml
@@ -21,11 +21,10 @@ jobs:
      should_run: ${{ steps.check.outputs.should_run }}
    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-contents: read

      - name: Check what should run
        id: check
@@ -55,11 +54,10 @@ jobs:

    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-contents: read

      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
--- a/.github/workflows/docs-deploy.yml
+++ b/.github/workflows/docs-deploy.yml
@@ -20,12 +20,10 @@ jobs:
      artifact: ${{ steps.get-artifact.outputs.result }}
    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-actions: read
-          permission-pull-requests: read

      - if: ${{ github.event.workflow_run.conclusion != 'success' }}
        run: echo 'The triggering workflow did not succeed' && exit 1
@@ -128,13 +126,10 @@ jobs:
    if: ${{ fromJson(needs.checks.outputs.artifact).found && fromJson(needs.checks.outputs.parameters).shouldDeploy }}
    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-contents: read
-          permission-actions: read
-          permission-pull-requests: write

      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
--- a/.github/workflows/docs-destroy.yml
+++ b/.github/workflows/docs-destroy.yml
@@ -17,12 +17,10 @@ jobs:
      pull-requests: write
    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-contents: read
-          permission-pull-requests: write

      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
--- a/.github/workflows/fdroid.yml
+++ b/.github/workflows/fdroid.yml
@@ -1,56 +0,0 @@
-name: Update F-Droid Repo
-
-on:
-  release:
-    types: [published]
-
-permissions: {}
-
-jobs:
-  update-index:
-    runs-on: ubuntu-latest
-    if: ${{ !github.event.release.prerelease }}
-    permissions:
-      contents: read
-    steps:
-      - name: Checkout pubspec for versionCode
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          ref: ${{ github.event.release.tag_name }}
-          persist-credentials: false
-          sparse-checkout: mobile/pubspec.yaml
-          sparse-checkout-cone-mode: false
-
-      - name: Update F-Droid repo
-        env:
-          GITLAB_TOKEN: ${{ secrets.FDROID_REPO_TOKEN }}
-          RELEASE: ${{ toJSON(github.event.release) }}
-          TAG: ${{ github.event.release.tag_name }}
-        run: |
-          VERSION_CODE=$(yq '.version' mobile/pubspec.yaml | cut -d+ -f2)
-          export VERSION_CODE
-
-          NEW_ENTRY=$(yq -P '
-            [.assets[] | select(.name == "app-release.apk")] as $matches |
-            with(select($matches | length == 0); error("app-release.apk not found in release assets")) |
-            {
-              "url": $matches[0].browser_download_url,
-              "sha256sum": ($matches[0].digest | sub("^sha256:", "")),
-              "date": (.published_at | split("T") | .[0]),
-              "version-code": env(VERSION_CODE)
-            } | .date tag= "!!timestamp"
-          ' <<< "$RELEASE")
-          export NEW_ENTRY
-
-          git clone --depth 1 "https://oauth2:${GITLAB_TOKEN}@gitlab.futo.org/fdroid/repo-v2.git" fdroid-repo
-          cd fdroid-repo
-
-          yq -i '
-            with(select([.apks[] | select(."version-code" == env(VERSION_CODE))] | length > 0); error("version-code already in index")) |
-            .apks = [env(NEW_ENTRY)] + .apks
-          ' apps/Immich/index.yml
-
-          git config user.name "Immich Release Bot"
-          git config user.email "bot@immich.app"
-          git commit -am "Immich: add version-code ${VERSION_CODE} (${TAG})"
-          git push
--- a/.github/workflows/fix-format.yml
+++ b/.github/workflows/fix-format.yml
@@ -15,12 +15,10 @@ jobs:
      pull-requests: write
    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-contents: write
-          permission-pull-requests: write

      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
--- a/.github/workflows/merge-translations.yml
+++ b/.github/workflows/merge-translations.yml
@@ -35,8 +35,6 @@ jobs:
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-contents: write
-          permission-pull-requests: write

      - name: Find translation PR
        id: find_pr
--- a/.github/workflows/pr-label-validation.yml
+++ b/.github/workflows/pr-label-validation.yml
@@ -14,14 +14,13 @@ jobs:
      pull-requests: write
    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-pull-requests: write

      - name: Require PR to have a changelog label
-        uses: mheap/github-action-required-labels@23e10fde7e062233401931a0eece796cd9bf3177 # v5.6.0
+        uses: mheap/github-action-required-labels@0ac283b4e65c1fb28ce6079dea5546ceca98ccbe # v5.5.2
        with:
          token: ${{ steps.token.outputs.token }}
          mode: exactly
--- a/.github/workflows/pr-labeler.yml
+++ b/.github/workflows/pr-labeler.yml
@@ -12,13 +12,11 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-contents: read
-          permission-pull-requests: write

-      - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
+      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
        with:
          repo-token: ${{ steps.token.outputs.token }}
--- a/.github/workflows/prepare-release.yml
+++ b/.github/workflows/prepare-release.yml
@@ -54,11 +54,10 @@ jobs:
    permissions: {} # No job-level permissions are needed because it uses the app-token
    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-contents: write

      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@@ -74,7 +73,7 @@ jobs:

      # TODO move to mise
      - name: Install uv
-        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0

      - name: Bump version
        env:
@@ -136,8 +135,6 @@ jobs:
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-contents: write
-          permission-actions: read

      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
--- a/.github/workflows/preview-label.yaml
+++ b/.github/workflows/preview-label.yaml
@@ -14,11 +14,10 @@ jobs:
      pull-requests: write
    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-pull-requests: write

      - uses: immich-app/devtools/actions/sticky-comment@0135acd12ad9f3369b94a2aa3c0ae8c835a4e926 # sticky-comment-action-v1.0.0
        with:
@@ -33,11 +32,10 @@ jobs:
      pull-requests: write
    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-pull-requests: write

      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
--- a/.github/workflows/sdk.yml
+++ b/.github/workflows/sdk.yml
@@ -16,11 +16,10 @@ jobs:
      packages: write
    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-contents: read

      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
--- a/.github/workflows/static_analysis.yml
+++ b/.github/workflows/static_analysis.yml
@@ -20,11 +20,10 @@ jobs:
      should_run: ${{ steps.check.outputs.should_run }}
    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-contents: read

      - name: Check what should run
        id: check
@@ -34,7 +33,6 @@ jobs:
          filters: |
            mobile:
              - 'mobile/**'
-              - 'i18n/en.json'
          force-filters: |
            - '.github/workflows/static_analysis.yml'
          force-events: 'workflow_dispatch,release'
@@ -51,11 +49,10 @@ jobs:
        working-directory: ./mobile
    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-contents: read

      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -17,11 +17,10 @@ jobs:
      should_run: ${{ steps.check.outputs.should_run }}
    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-contents: read

      - name: Check what should run
        id: check
@@ -78,11 +77,10 @@ jobs:
      contents: read
    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-contents: read

      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@@ -107,11 +105,10 @@ jobs:
      contents: read
    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-contents: read

      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@@ -139,11 +136,10 @@ jobs:
        working-directory: ./packages/cli
    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-contents: read

      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@@ -171,11 +167,10 @@ jobs:
        working-directory: ./packages/cli
    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-contents: read

      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@@ -216,11 +211,10 @@ jobs:
        working-directory: ./web
    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-contents: read

      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@@ -255,11 +249,10 @@ jobs:
        working-directory: ./web
    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-contents: read

      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@@ -284,11 +277,10 @@ jobs:
      contents: read
    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-contents: read

      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@@ -335,11 +327,10 @@ jobs:
        working-directory: ./e2e
    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-contents: read

      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@@ -368,11 +359,10 @@ jobs:
        working-directory: ./server
    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-contents: read

      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@@ -405,11 +395,10 @@ jobs:
        runner: [ubuntu-latest, ubuntu-24.04-arm]
    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-contents: read

      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@@ -483,11 +472,10 @@ jobs:
        runner: [ubuntu-latest, ubuntu-24.04-arm]
    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-contents: read

      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@@ -592,11 +580,10 @@ jobs:
      contents: read
    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-contents: read

      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
@@ -631,11 +618,10 @@ jobs:
        working-directory: ./machine-learning
    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-contents: read

      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
@@ -662,11 +648,10 @@ jobs:
        working-directory: ./.github
    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-contents: read

      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@@ -693,11 +678,10 @@ jobs:
      contents: read
    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-contents: read

      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
@@ -715,11 +699,10 @@ jobs:
      contents: read
    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-contents: read

      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@@ -774,11 +757,10 @@ jobs:
          - 5432:5432
    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-contents: read

      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
--- a/.github/workflows/weblate-lock.yml
+++ b/.github/workflows/weblate-lock.yml
@@ -24,11 +24,10 @@ jobs:
      should_run: ${{ steps.check.outputs.should_run }}
    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-contents: read

      - name: Check what should run
        id: check
@@ -48,11 +47,10 @@ jobs:
    if: ${{ fromJSON(needs.pre-job.outputs.should_run).i18n == true }}
    steps:
      - id: token
-        uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
+        uses: immich-app/devtools/actions/create-workflow-token@9db058b2e6eec20e07760b0e17a0505c78ec3191 # create-workflow-token-action-v2.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-          permission-pull-requests: read

      - name: Bot review status
        env:
--- a/2
+++ b/2
@@ -4,4 +4,4 @@
 /web/ @danieldietzler
 /machine-learning/ @mertalev
 /e2e/ @danieldietzler
-/mobile/ @shenlong-tanwen @santoshakil @agg23
+/mobile/ @shenlong-tanwen @santoshakil
--- a/docker/docker-compose.prod.yml
+++ b/docker/docker-compose.prod.yml
@@ -85,7 +85,7 @@ services:
    container_name: immich_prometheus
    ports:
      - 9090:9090
-    image: prom/prometheus@sha256:3c42b892cf723fa54d2f262c37a0e1f80aa8c8ddb1da7b9b0df9455a35a7f893
+    image: prom/prometheus@sha256:a75c5a35bc21d7afe69551eefa3cb1e1fb1775fe759408007a66b54ec3de1f29
    volumes:
      - ./prometheus.yml:/etc/prometheus/prometheus.yml
      - prometheus-data:/prometheus
--- a/docs/docs/administration/system-integrity.md
+++ b/docs/docs/administration/system-integrity.md
@@ -1,30 +1,5 @@
 # System Integrity

-## Integrity report
-
-At a [customizable interval](https://my.immich.app/admin/system-settings?isOpen=integrity-checks), Immich runs integrity checks to ensure that your library is still intact and there are no corrupt files.
-There are three kind of issues Immich checks for:
-
- Untracked files: the path was found in Immich's directories but it is not referenced in Immich's database
- Missing files: the path is found in the Immich internal database, but does not actually exist on disk
- Checksum mismatches: the checksum of the file stored in Immich's database does not match the actual file's checksum anymore
-
-All three run nightly at 3am by default. For the "Checksum files" check, there are additional time and progress limits, as those are the most taxing checks. With these additional limits, Immich can slowly check checksums of your files over the course of a couple of days.
-
-You can see the results of these checks on the [maintenance](https://my.immich.app/admin/maintenance) page. Here, you can also trigger a full scan (a _check_) for specific jobs, or all of them. In addition, you can also _refresh_ checks. This will only look at items that have currently been reported on, and check if those have been fixed.
-
-### Common causes
-
-Most common are untracked files. In many cases those are corrupted thumbnails or encoded videos that have been partially generated at some point and never got cleaned up properly. These are usually fine to delete, as both can always be regenerated at a later point. Other files will need to be investigated on a case-by-case basis by checking they already exist in Immich and thinking about how they might have gotten untracked.
-
-:::info
-You might want to run the _missing_ jobs for thumbnails and encoded videos (https://my.immich.app/admin/queues) to make sure all your assets have proper thumbnails and encoded videos. Watch the server logs while running the jobs, in case there are any issues with some assets.
-:::
-
-Missing files are files where Immich references them internally, but they don't actually exist on disk in that location. It could be that you deleted a file on disk from the internal library (don't do that, Immich doesn't support it). It could also be that there are issues with your file storage. Please carefully investigate missing files, and never hesitate to reach out on [our Discord](https://discord.immich.app) if you have any questions!
-
-Checksum mismatches are often indicative of file system corruption. It could also be that you previously edited a file from the internal library on the disk, which is also not supported and will cause a checksum mismatch. Again, the recommended action is to look at any reported item individually, check it out, try to remember if you changed it or some metadata on it at some point. If you edited the file, the supported resolution is to delete the mismatched asset from Immich and reupload it as a new asset.
-
 ## Folder checks

 :::info
@@ -65,7 +40,7 @@ The above error messages show that the server has previously (successfully) writ

 ### Ignoring the checks

-:::danger
+:::warning
 The checks are designed to catch common problems that we have seen users have in the past, and often indicate there's something wrong that you should solve. If you know what you're doing and you want to disable them you can set the following environment variable:
 :::

--- a/docs/docs/developer/setup.md
+++ b/docs/docs/developer/setup.md
@@ -99,21 +99,6 @@ To see local changes to `@immich/ui` in Immich, do the following:
 2. Run `mise //mobile:translation` to generate the translation file.
 3. Change to the `mobile/` directory and run `flutter run` to start the app.

-##### iOS Code Signing
-
-The Immich Apple Team ID and bundle IDs are specified in `mobile/ios/Signing.xcconfig`. For local development, we provide an override mechanism.
-
-Create `mobile/ios/Signing.local.xcconfig` and populate it with the necessary values needed to build and sign Immich yourself. This local override file is gitignored.
-
-```
-IMMICH_TEAM_ID = ABCDE12345
-IMMICH_BUNDLE_ID_PROD = com.customuniqueid.immich
-IMMICH_BUNDLE_ID_DEV = com.customuniqueid.immichdev
-IMMICH_GROUP_ID = group.com.customuniqueid.immich
-```
-
-The environment values are used across Immich's targets and schemes to prevent redundant edits by contributors.
-
 #### Translation

 To add a new translation text, enter the key-value pair in the `i18n/en.json` in the root of the immich project. Then run:
--- a/docs/docs/features/command-line-interface.md
+++ b/docs/docs/features/command-line-interface.md
@@ -99,7 +99,6 @@ Options:
  -H, --include-hidden        Include hidden folders (default: false, env: IMMICH_INCLUDE_HIDDEN)
  -a, --album                 Automatically create albums based on folder name (default: false, env: IMMICH_AUTO_CREATE_ALBUM)
  -A, --album-name <name>     Add all assets to specified album (env: IMMICH_ALBUM_NAME)
-  --visibility <visibility>   Set the visibility of uploaded assets (choices: "archive", "timeline", "hidden", "locked", env: IMMICH_VISIBILITY)
  -n, --dry-run               Don't perform any actions, just show what will be done (default: false, env: IMMICH_DRY_RUN)
  -c, --concurrency <number>  Number of assets to upload at the same time (default: 4, env: IMMICH_UPLOAD_CONCURRENCY)
  -j, --json-output           Output detailed information in json format (default: false, env: IMMICH_JSON_OUTPUT)
@@ -177,12 +176,6 @@ By default, hidden files are skipped. If you want to include hidden files, use t
 immich upload --include-hidden --recursive directory/
 ```

-You can set the visibility of uploaded assets to `archive`, `timeline`, `hidden`, or `locked` with the `--visibility` option:
-
-```bash
-immich upload --visibility archive --recursive directory/
-```
-
 You can use the `--json-output` option to get a json printed which includes
 three keys: `newFiles`, `duplicates` and `newAssets`. Due to some logging
 output you will need to strip the first three lines of output to get the json.
--- a/docs/docs/partials/_mobile-app-download.md
+++ b/docs/docs/partials/_mobile-app-download.md
@@ -1,7 +1,7 @@
 The mobile app can be downloaded from the following places:

- [Apple App Store](https://apps.apple.com/us/app/immich/id1613945652)
- [Google Play Store](https://play.google.com/store/apps/details?id=app.alextran.immich)
- [GitHub Releases (APK)](https://github.com/immich-app/immich/releases)
 - Obtainium: You can get your Obtainium config link from the [Utilities page of your Immich server](https://my.immich.app/utilities).
- [F-Droid](https://app.futo.org/fdroid/repo/)
+- [Google Play Store](https://play.google.com/store/apps/details?id=app.alextran.immich)
+- [Apple App Store](https://apps.apple.com/us/app/immich/id1613945652)
+- [F-Droid](https://f-droid.org/packages/app.alextran.immich)
+- [GitHub Releases (apk)](https://github.com/immich-app/immich/releases)
--- a/docs/static/archived-versions.json
+++ b/docs/static/archived-versions.json
@@ -1,7 +1,7 @@
 [
  {
-    "label": "v3.0.3",
-    "url": "https://docs.v3.0.3.archive.immich.app"
+    "label": "v3.0.2",
+    "url": "https://docs.v3.0.2.archive.immich.app"
  },
  {
    "label": "v2.7.5",
--- a/e2e/package.json
+++ b/e2e/package.json
@@ -1,6 +1,6 @@
 {
  "name": "immich-e2e",
-  "version": "3.0.3",
+  "version": "3.0.2",
  "description": "",
  "main": "index.js",
  "type": "module",
--- a/e2e/src/specs/server/api/album.e2e-spec.ts
+++ b/e2e/src/specs/server/api/album.e2e-spec.ts
@@ -796,22 +796,5 @@ describe('/albums', () => {
      expect(status).toBe(400);
      expect(body).toEqual(errorDto.badRequest('Not found or no album.share access'));
    });
-
-    it('should not allow an editor to change the role of an owner', async () => {
-      const album = await utils.createAlbum(user1.accessToken, {
-        albumName: 'testAlbum',
-        albumUsers: [{ userId: user2.userId, role: AlbumUserRole.Editor }],
-      });
-
-      expect(album.albumUsers[1].role).toEqual(AlbumUserRole.Editor);
-
-      const { status, body } = await request(app)
-        .put(`/albums/${album.id}/user/${user1.userId}`)
-        .set('Authorization', `Bearer ${user2.accessToken}`)
-        .send({ role: AlbumUserRole.Editor });
-
-      expect(status).toBe(400);
-      expect(body).toEqual(errorDto.badRequest('User is owner'));
-    });
  });
 });
--- a/i18n/en.json
+++ b/i18n/en.json
@@ -814,6 +814,7 @@
  "custom_date": "Custom date",
  "custom_locale": "Custom locale",
  "custom_locale_description": "Format dates, times, and numbers based on the selected language and region",
+  "custom_url": "Custom URL",
  "cutoff_date_description": "Keep photos from the last…",
  "cutoff_day": "{count, plural, one {day} other {days}}",
  "cutoff_year": "{count, plural, one {year} other {years}}",
@@ -1620,7 +1621,7 @@
  "person": "Person",
  "person_age_months": "{months, plural, one {# month} other {# months}} old",
  "person_age_year_months": "1 year, {months, plural, one {# month} other {# months}} old",
-  "person_age_years": "{years, plural, one {# year} other {# years}} old",
+  "person_age_years": "{years, plural, other {# years}} old",
  "person_birthdate": "Born on {date}",
  "person_hidden": "{name}{hidden, select, true { (hidden)} other {}}",
  "person_recognized": "Person recognized",
@@ -1947,9 +1948,7 @@
  "shared_link_app_bar_title": "Shared Links",
  "shared_link_clipboard_copied_massage": "Copied to clipboard",
  "shared_link_create_error": "Error while creating shared link",
-  "shared_link_custom_url_description": "Access this shared link with a custom URL name",
-  "shared_link_custom_url_title": "Custom URL",
-  "shared_link_custom_url_warning": "Warning: a custom URL name with a forward slash may not behave as you expect.",
+  "shared_link_custom_url_description": "Access this shared link with a custom URL",
  "shared_link_edit_description_hint": "Enter the share description",
  "shared_link_edit_expire_after_option_day": "1 day",
  "shared_link_edit_expire_after_option_days": "{count} days",
--- a/i18n/fr.json
+++ b/i18n/fr.json
@@ -431,8 +431,8 @@
    "transcoding_realtime_description": "Permet au transcodage d'être réalisé en temps réel durant la diffusion du flux de la vidéo. Active la bascule automatique entre résolutions, mais peut entraîner une latence importante de lecture et des microcoupures en fonction des capacités du serveur.",
    "transcoding_realtime_enabled": "Activer la transcodification en temps réel",
    "transcoding_realtime_enabled_description": "Si désactivé, le serveur refusera de démarrer de nouvelles sessions de transcodifications en temps réel.",
-    "transcoding_realtime_resolutions": "Résolutions",
-    "transcoding_realtime_resolutions_description": "Les résolutions proposées pour le transcodage en temps réel. Des résolutions supérieures peuvent causer des soucis pendant la lecture si le serveur ne peut pas les transcoder suffisamment rapidement.",
+    "transcoding_realtime_resolutions": "Définitions",
+    "transcoding_realtime_resolutions_description": "Les définitions proposées pour le transcodage en temps réel. Des définitions supérieures peuvent causer des soucis pendant la lecture si le serveur ne peut pas les transcoder suffisamment rapidement.",
    "transcoding_realtime_video_codecs": "Codecs vidéo",
    "transcoding_realtime_video_codecs_description": "Les codecs vidéo proposés pour le transcodage en temps réel. Les clients choisissent la meilleure option qu'ils supportent durant la lecture. AV1 est plus efficace que HEVC, qui est plus efficace que H.264. En utilisant l'accélération matérielle, sélectionnez seulement les codecs que l'accélérateur peut encoder. En utilisant le transcodage logiciel, notez que H.264 est plus rapide que AV1, qui est plus rapide que HEVC.",
    "transcoding_reference_frames": "Trames de référence",
--- a/machine-learning/pyproject.toml
+++ b/machine-learning/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "immich-ml"
-version = "3.0.3"
+version = "3.0.2"
 description = ""
 authors = [{ name = "Hau Tran", email = "alex.tran1502@gmail.com" }]
 requires-python = ">=3.11,<4.0"
--- a/machine-learning/uv.lock
+++ b/machine-learning/uv.lock
@@ -974,7 +974,7 @@ wheels = [

 [[package]]
 name = "immich-ml"
-version = "3.0.3"
+version = "3.0.2"
 source = { editable = "." }
 dependencies = [
    { name = "aiocache" },
--- a/mise.lock
+++ b/mise.lock
@@ -184,6 +184,33 @@ checksum = "sha256:b5e1d2a1ad3c03229ddc89823848f4a1c11f9c6402a51fa26f0aaa5f1d7a2
 url = "https://github.com/WebAssembly/binaryen/releases/download/version_124/binaryen-version_124-x86_64-windows.tar.gz"
 url_api = "https://api.github.com/repos/WebAssembly/binaryen/releases/assets/288925833"

+[[tools.java]]
+version = "21.0.2"
+backend = "core:java"
+
+[tools.java.options]
+shorthand_vendor = "openjdk"
+
+[tools.java."platforms.linux-arm64"]
+checksum = "sha256:08db1392a48d4eb5ea5315cf8f18b89dbaf36cda663ba882cf03c704c9257ec2"
+url = "https://download.java.net/java/GA/jdk21.0.2/f2283984656d49d69e91c558476027ac/13/GPL/openjdk-21.0.2_linux-aarch64_bin.tar.gz"
+
+[tools.java."platforms.linux-x64"]
+checksum = "sha256:a2def047a73941e01a73739f92755f86b895811afb1f91243db214cff5bdac3f"
+url = "https://download.java.net/java/GA/jdk21.0.2/f2283984656d49d69e91c558476027ac/13/GPL/openjdk-21.0.2_linux-x64_bin.tar.gz"
+
+[tools.java."platforms.macos-arm64"]
+checksum = "sha256:b3d588e16ec1e0ef9805d8a696591bd518a5cea62567da8f53b5ce32d11d22e4"
+url = "https://download.java.net/java/GA/jdk21.0.2/f2283984656d49d69e91c558476027ac/13/GPL/openjdk-21.0.2_macos-aarch64_bin.tar.gz"
+
+[tools.java."platforms.macos-x64"]
+checksum = "sha256:8fd09e15dc406387a0aba70bf5d99692874e999bf9cd9208b452b5d76ac922d3"
+url = "https://download.java.net/java/GA/jdk21.0.2/f2283984656d49d69e91c558476027ac/13/GPL/openjdk-21.0.2_macos-x64_bin.tar.gz"
+
+[tools.java."platforms.windows-x64"]
+checksum = "sha256:b6c17e747ae78cdd6de4d7532b3164b277daee97c007d3eaa2b39cca99882664"
+url = "https://download.java.net/java/GA/jdk21.0.2/f2283984656d49d69e91c558476027ac/13/GPL/openjdk-21.0.2_windows-x64_bin.zip"
+
 [[tools.node]]
 version = "24.15.0"
 backend = "core:node"
--- a/mise.toml
+++ b/mise.toml
@@ -23,7 +23,7 @@ opentofu = "1.11.6"
 "github:extism/cli" = "1.6.3"
 "github:webassembly/binaryen" = "version_124"
 "github:extism/js-pdk" = "1.6.0"
-java = "25.0.3+9.0.LTS"
+java = "21.0.2"

 [tools."github:jellyfin/jellyfin-ffmpeg"]
 version = "7.1.3-6"
--- a/mobile/android/app/src/main/kotlin/app/alextran/immich/MainActivity.kt
+++ b/mobile/android/app/src/main/kotlin/app/alextran/immich/MainActivity.kt
@@ -18,6 +18,7 @@ import app.alextran.immich.images.LocalImageApi
 import app.alextran.immich.images.LocalImagesImpl
 import app.alextran.immich.images.RemoteImageApi
 import app.alextran.immich.images.RemoteImagesImpl
+import app.alextran.immich.mediasave.MediaSavePlugin
 import app.alextran.immich.permission.PermissionApi
 import app.alextran.immich.permission.PermissionApiImpl
 import app.alextran.immich.sync.NativeSyncApi
@@ -63,6 +64,7 @@ class MainActivity : FlutterFragmentActivity() {
      ConnectivityApi.setUp(messenger, ConnectivityApiImpl(ctx))

      flutterEngine.plugins.add(ViewIntentPlugin())
+      flutterEngine.plugins.add(MediaSavePlugin())
      flutterEngine.plugins.add(backgroundEngineLockImpl)
      flutterEngine.plugins.add(nativeSyncApiImpl)
      flutterEngine.plugins.add(permissionApiImpl)
--- a/mobile/android/app/src/main/kotlin/app/alextran/immich/images/LocalImagesImpl.kt
+++ b/mobile/android/app/src/main/kotlin/app/alextran/immich/images/LocalImagesImpl.kt
@@ -64,7 +64,13 @@ fun Bitmap.toNativeBuffer(): Map<String, Long>  {
    // native convert declined (OOM/lock) -> fall through to the Skia copy path below.
  }
  // Other non-8888 configs (e.g. HDR F16) still need Skia's convert; 8-bit is copied as-is.
-  val bitmap = toArgb8888()
+  val bitmap = if (config != Bitmap.Config.ARGB_8888) {
+    val converted = copy(Bitmap.Config.ARGB_8888, false)
+    recycle()
+    converted ?: throw IOException("could not convert bitmap to ARGB_8888")
+  } else {
+    this
+  }
  val size = bitmap.width * bitmap.height * 4
  val pointer = NativeBuffer.allocate(size)
  try {
@@ -211,7 +217,7 @@ class LocalImagesImpl(context: Context) : LocalImageApi {
        if (orientation == ExifInterface.ORIENTATION_NORMAL || orientation == ExifInterface.ORIENTATION_UNDEFINED) {
          bitmap.toNativeBuffer()
        } else {
-          rotateToNativeBuffer(bitmap, orientation)
+          rotateToNativeBuffer(bitmap, orientation, signal)
        }
      }
      // Don't re-check cancellation here: res owns a malloc'd buffer, and bailing to CANCELLED would
@@ -251,7 +257,39 @@ class LocalImagesImpl(context: Context) : LocalImageApi {
  }

  private fun rawOrientation(uri: Uri): Int {
-    return resolver.openInputStream(uri)?.use { readOrientation(it) } ?: ExifInterface.ORIENTATION_NORMAL
+    return resolver.openInputStream(uri)?.use {
+      ExifInterface(it).getAttributeInt(ExifInterface.TAG_ORIENTATION, ExifInterface.ORIENTATION_NORMAL)
+    } ?: ExifInterface.ORIENTATION_NORMAL
+  }
+
+  // ImageDecoder / loadThumbnail skip EXIF orientation for raw (e.g. DNG) on Q+, so the decoded
+  // bitmap comes back unrotated. Rotate it into the output buffer in native code (one pass, no
+  // intermediate rotated bitmap).
+  private fun rotateToNativeBuffer(bitmap: Bitmap, orientation: Int, signal: CancellationSignal): Map<String, Long> {
+    signal.throwIfCanceled()
+    // Force ARGB_8888: the native rotate needs a lockable 8888 buffer, and toNativeBuffer() below
+    // allocates width*height*4 (an F16/HDR decode would otherwise under-allocate). No-op for the
+    // common already-8888 case.
+    val src = if (bitmap.config != Bitmap.Config.ARGB_8888) {
+      val converted = bitmap.copy(Bitmap.Config.ARGB_8888, false)
+      bitmap.recycle()
+      converted ?: throw IOException("could not convert bitmap to ARGB_8888")
+    } else {
+      bitmap
+    }
+    try {
+      val info = IntArray(3)
+      val pointer = NativeImage.rotate(src, orientation, info)
+      if (pointer == 0L) throw IOException("native rotate failed for orientation $orientation")
+      return mapOf(
+        "pointer" to pointer,
+        "width" to info[0].toLong(),
+        "height" to info[1].toLong(),
+        "rowBytes" to info[2].toLong()
+      )
+    } finally {
+      if (!src.isRecycled) src.recycle()
+    }
  }

  private fun decodeVideoThumbnail(id: Long, target: Size, signal: CancellationSignal): Bitmap {
--- a/mobile/android/app/src/main/kotlin/app/alextran/immich/images/RawOrientation.kt
+++ b/mobile/android/app/src/main/kotlin/app/alextran/immich/images/RawOrientation.kt
@@ -1,68 +0,0 @@
-package app.alextran.immich.images
-
-import android.graphics.Bitmap
-import androidx.exifinterface.media.ExifInterface
-import app.alextran.immich.NativeImage
-import java.io.IOException
-import java.io.InputStream
-import java.nio.ByteBuffer
-import java.nio.ByteOrder
-
-fun readOrientation(input: InputStream): Int =
-  ExifInterface(input).getAttributeInt(ExifInterface.TAG_ORIENTATION, ExifInterface.ORIENTATION_NORMAL)
-
-// Reads the EXIF orientation (TIFF tag 0x0112) from a raw file's IFD0.
-fun readRawOrientation(buffer: ByteBuffer, len: Int): Int {
-  try {
-    if (len < 8) return ExifInterface.ORIENTATION_NORMAL
-    buffer.order(
-      when (buffer.get(0).toInt() and 0xFF) {
-        0x49 -> ByteOrder.LITTLE_ENDIAN
-        0x4D -> ByteOrder.BIG_ENDIAN
-        else -> return ExifInterface.ORIENTATION_NORMAL
-      }
-    )
-    val ifd0 = buffer.getInt(4).toLong() and 0xFFFFFFFFL
-    if (ifd0 < 8 || ifd0 + 2 > len) return ExifInterface.ORIENTATION_NORMAL
-    val start = ifd0.toInt()
-    val entries = buffer.getShort(start).toInt() and 0xFFFF
-    if (entries <= 0 || entries > 512) return ExifInterface.ORIENTATION_NORMAL
-    // Each IFD entry is 12 bytes: tag(2) type(2) count(4) value(4); orientation is a SHORT in value.
-    for (i in 0 until entries) {
-      val p = start + 2 + i * 12
-      if (p + 12 > len) return ExifInterface.ORIENTATION_NORMAL
-      if ((buffer.getShort(p).toInt() and 0xFFFF) == 0x0112) {
-        val value = buffer.getShort(p + 8).toInt() and 0xFFFF
-        return if (value in 1..8) value else ExifInterface.ORIENTATION_NORMAL
-      }
-    }
-    return ExifInterface.ORIENTATION_NORMAL
-  } catch (_: Exception) {
-    return ExifInterface.ORIENTATION_NORMAL
-  }
-}
-
-fun Bitmap.toArgb8888(): Bitmap {
-  if (config == Bitmap.Config.ARGB_8888) return this
-  val converted = copy(Bitmap.Config.ARGB_8888, false)
-  recycle()
-  return converted ?: throw IOException("could not convert bitmap to ARGB_8888")
-}
-
-// Force ARGB_8888 first: the native rotate needs a lockable 8888 buffer and allocates w*h*4.
-fun rotateToNativeBuffer(bitmap: Bitmap, orientation: Int): Map<String, Long> {
-  val src = bitmap.toArgb8888()
-  try {
-    val info = IntArray(3)
-    val pointer = NativeImage.rotate(src, orientation, info)
-    if (pointer == 0L) throw IOException("native rotate failed for orientation $orientation")
-    return mapOf(
-      "pointer" to pointer,
-      "width" to info[0].toLong(),
-      "height" to info[1].toLong(),
-      "rowBytes" to info[2].toLong()
-    )
-  } finally {
-    if (!src.isRecycled) src.recycle()
-  }
-}
--- a/mobile/android/app/src/main/kotlin/app/alextran/immich/images/RemoteImagesImpl.kt
+++ b/mobile/android/app/src/main/kotlin/app/alextran/immich/images/RemoteImagesImpl.kt
@@ -5,7 +5,6 @@ import android.graphics.ImageDecoder
 import android.os.Build
 import android.os.CancellationSignal
 import android.os.OperationCanceledException
-import androidx.exifinterface.media.ExifInterface
 import app.alextran.immich.INITIAL_BUFFER_SIZE
 import app.alextran.immich.NativeBuffer
 import app.alextran.immich.NativeByteBuffer
@@ -31,35 +30,6 @@ private const val MAX_PREALLOC_BYTES = 128 * 1024 * 1024

 private class RemoteRequest(val cancellationSignal: CancellationSignal)

-// The full mimeTypes.raw set the server can serve (short + vendor forms).
-private val RAW_MIME_TYPES = setOf(
-  "image/3fr", "image/ari", "image/arw",
-  "image/cap", "image/cin", "image/cr2",
-  "image/cr3", "image/crw", "image/dcr",
-  "image/dng", "image/erf", "image/fff",
-  "image/iiq", "image/k25", "image/kdc",
-  "image/mrw", "image/nef", "image/nrw",
-  "image/orf", "image/ori", "image/pef",
-  "image/psd", "image/raf", "image/raw",
-  "image/rw2", "image/rwl", "image/sr2",
-  "image/srf", "image/srw", "image/vnd.adobe.photoshop",
-  "image/x-adobe-dng", "image/x-arriflex-ari", "image/x-canon-cr2",
-  "image/x-canon-cr3", "image/x-canon-crw", "image/x-epson-erf",
-  "image/x-fuji-raf", "image/x-hasselblad-3fr", "image/x-hasselblad-fff",
-  "image/x-kodak-dcr", "image/x-kodak-k25", "image/x-kodak-kdc",
-  "image/x-leica-rwl", "image/x-minolta-mrw", "image/x-nikon-nef",
-  "image/x-nikon-nrw", "image/x-olympus-orf", "image/x-olympus-ori",
-  "image/x-panasonic-raw", "image/x-panasonic-rw2", "image/x-pentax-pef",
-  "image/x-phantom-cin", "image/x-phaseone-cap", "image/x-phaseone-iiq",
-  "image/x-samsung-srw", "image/x-sigma-x3f", "image/x-sony-arw",
-  "image/x-sony-sr2", "image/x-sony-srf", "image/x3f",
-)
-
-private fun isRawMime(contentType: String?): Boolean {
-  val mime = contentType?.substringBefore(';')?.trim()?.lowercase() ?: return false
-  return mime in RAW_MIME_TYPES
-}
-
 class RemoteImagesImpl(context: Context) : RemoteImageApi {
  private val requestMap = ConcurrentHashMap<Long, RemoteRequest>()

@@ -87,7 +57,7 @@ class RemoteImagesImpl(context: Context) : RemoteImageApi {
    ImageFetcherManager.fetch(
      url,
      signal,
-      onSuccess = { buffer, contentType ->
+      onSuccess = { buffer ->
        if (signal.isCanceled) {
          requestMap.remove(requestId)
          buffer.free()
@@ -102,18 +72,8 @@ class RemoteImagesImpl(context: Context) : RemoteImageApi {
        if (!preferEncoded && Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
          decodeExecutor.execute {
            val res = if (signal.isCanceled) null else try {
-              val bitmap = ImageDecoder.createSource(NativeBuffer.wrap(buffer.pointer, buffer.offset)).decodeBitmap()
-              // The embedded preview a raw decodes to has no orientation, so read the container's.
-              val orientation = if (isRawMime(contentType)) {
-                readRawOrientation(NativeBuffer.wrap(buffer.pointer, buffer.offset), buffer.offset)
-              } else {
-                ExifInterface.ORIENTATION_NORMAL
-              }
-              if (orientation == ExifInterface.ORIENTATION_NORMAL || orientation == ExifInterface.ORIENTATION_UNDEFINED) {
-                bitmap.toNativeBuffer()
-              } else {
-                rotateToNativeBuffer(bitmap, orientation)
-              }
+              val source = ImageDecoder.createSource(NativeBuffer.wrap(buffer.pointer, buffer.offset))
+              source.decodeBitmap().toNativeBuffer()
            } catch (_: Throwable) {
              null
            }
@@ -194,7 +154,7 @@ private object ImageFetcherManager {
  fun fetch(
    url: String,
    signal: CancellationSignal,
-    onSuccess: (NativeByteBuffer, String?) -> Unit,
+    onSuccess: (NativeByteBuffer) -> Unit,
    onFailure: (Exception) -> Unit,
  ) {
    fetcher.fetch(url, signal, onSuccess, onFailure)
@@ -225,7 +185,7 @@ private sealed interface ImageFetcher {
  fun fetch(
    url: String,
    signal: CancellationSignal,
-    onSuccess: (NativeByteBuffer, String?) -> Unit,
+    onSuccess: (NativeByteBuffer) -> Unit,
    onFailure: (Exception) -> Unit,
  )

@@ -243,7 +203,7 @@ private class CronetImageFetcher : ImageFetcher {
  override fun fetch(
    url: String,
    signal: CancellationSignal,
-    onSuccess: (NativeByteBuffer, String?) -> Unit,
+    onSuccess: (NativeByteBuffer) -> Unit,
    onFailure: (Exception) -> Unit,
  ) {
    synchronized(stateLock) {
@@ -311,7 +271,7 @@ private class CronetImageFetcher : ImageFetcher {
  }

  private class FetchCallback(
-    private val onSuccess: (NativeByteBuffer, String?) -> Unit,
+    private val onSuccess: (NativeByteBuffer) -> Unit,
    private val onFailure: (Exception) -> Unit,
    private val onComplete: () -> Unit,
  ) : UrlRequest.Callback() {
@@ -368,9 +328,7 @@ private class CronetImageFetcher : ImageFetcher {
    }

    override fun onSucceeded(request: UrlRequest, info: UrlResponseInfo) {
-      val contentType = info.allHeaders.entries
-        .firstOrNull { it.key.equals("content-type", ignoreCase = true) }?.value?.firstOrNull()
-      onSuccess(buffer!!, contentType)
+      onSuccess(buffer!!)
      onComplete()
    }

@@ -421,7 +379,7 @@ private class OkHttpImageFetcher private constructor(
  override fun fetch(
    url: String,
    signal: CancellationSignal,
-    onSuccess: (NativeByteBuffer, String?) -> Unit,
+    onSuccess: (NativeByteBuffer) -> Unit,
    onFailure: (Exception) -> Unit,
  ) {
    synchronized(stateLock) {
@@ -475,7 +433,7 @@ private class OkHttpImageFetcher private constructor(
                  buffer.ensureHeadroom()
                }
              }
-              onSuccess(buffer, response.header("Content-Type"))
+              onSuccess(buffer)
            } catch (e: Exception) {
              buffer.free()
              onFailure(e)
--- a/mobile/android/app/src/main/kotlin/app/alextran/immich/mediasave/MediaSave.g.kt
+++ b/mobile/android/app/src/main/kotlin/app/alextran/immich/mediasave/MediaSave.g.kt
@@ -0,0 +1,97 @@
+// Autogenerated from Pigeon (v26.3.4), do not edit directly.
+// See also: https://pub.dev/packages/pigeon
+@file:Suppress("UNCHECKED_CAST", "ArrayInDataClass")
+
+package app.alextran.immich.mediasave
+
+import android.util.Log
+import io.flutter.plugin.common.BasicMessageChannel
+import io.flutter.plugin.common.BinaryMessenger
+import io.flutter.plugin.common.EventChannel
+import io.flutter.plugin.common.MessageCodec
+import io.flutter.plugin.common.StandardMethodCodec
+import io.flutter.plugin.common.StandardMessageCodec
+import java.io.ByteArrayOutputStream
+import java.nio.ByteBuffer
+private object MediaSavePigeonUtils {
+
+  fun wrapResult(result: Any?): List<Any?> {
+    return listOf(result)
+  }
+
+  fun wrapError(exception: Throwable): List<Any?> {
+    return if (exception is FlutterError) {
+      listOf(
+        exception.code,
+        exception.message,
+        exception.details
+      )
+    } else {
+      listOf(
+        exception.javaClass.simpleName,
+        exception.toString(),
+        "Cause: " + exception.cause + ", Stacktrace: " + Log.getStackTraceString(exception)
+      )
+    }
+  }
+}
+
+/**
+ * Error class for passing custom error details to Flutter via a thrown PlatformException.
+ * @property code The error code.
+ * @property message The error message.
+ * @property details The error details. Must be a datatype supported by the api codec.
+ */
+class FlutterError (
+  val code: String,
+  override val message: String? = null,
+  val details: Any? = null
+) : RuntimeException()
+private open class MediaSavePigeonCodec : StandardMessageCodec() {
+  override fun readValueOfType(type: Byte, buffer: ByteBuffer): Any? {
+    return     super.readValueOfType(type, buffer)
+  }
+  override fun writeValue(stream: ByteArrayOutputStream, value: Any?)   {
+    super.writeValue(stream, value)
+  }
+}
+
+
+/** Generated interface from Pigeon that represents a handler of messages from Flutter. */
+interface MediaSaveApi {
+  fun saveToDownloads(filePath: String, title: String, relativePath: String?, callback: (Result<String?>) -> Unit)
+
+  companion object {
+    /** The codec used by MediaSaveApi. */
+    val codec: MessageCodec<Any?> by lazy {
+      MediaSavePigeonCodec()
+    }
+    /** Sets up an instance of `MediaSaveApi` to handle messages through the `binaryMessenger`. */
+    @JvmOverloads
+    fun setUp(binaryMessenger: BinaryMessenger, api: MediaSaveApi?, messageChannelSuffix: String = "") {
+      val separatedMessageChannelSuffix = if (messageChannelSuffix.isNotEmpty()) ".$messageChannelSuffix" else ""
+      run {
+        val channel = BasicMessageChannel<Any?>(binaryMessenger, "dev.flutter.pigeon.immich_mobile.MediaSaveApi.saveToDownloads$separatedMessageChannelSuffix", codec)
+        if (api != null) {
+          channel.setMessageHandler { message, reply ->
+            val args = message as List<Any?>
+            val filePathArg = args[0] as String
+            val titleArg = args[1] as String
+            val relativePathArg = args[2] as String?
+            api.saveToDownloads(filePathArg, titleArg, relativePathArg) { result: Result<String?> ->
+              val error = result.exceptionOrNull()
+              if (error != null) {
+                reply.reply(MediaSavePigeonUtils.wrapError(error))
+              } else {
+                val data = result.getOrNull()
+                reply.reply(MediaSavePigeonUtils.wrapResult(data))
+              }
+            }
+          }
+        } else {
+          channel.setMessageHandler(null)
+        }
+      }
+    }
+  }
+}
--- a/mobile/android/app/src/main/kotlin/app/alextran/immich/mediasave/MediaSavePlugin.kt
+++ b/mobile/android/app/src/main/kotlin/app/alextran/immich/mediasave/MediaSavePlugin.kt
@@ -0,0 +1,102 @@
+package app.alextran.immich.mediasave
+
+import android.content.ContentValues
+import android.content.Context
+import android.os.Build
+import android.os.Environment
+import android.provider.MediaStore
+import io.flutter.embedding.engine.plugins.FlutterPlugin
+import java.io.File
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.cancel
+import kotlinx.coroutines.launch
+
+class MediaSavePlugin : FlutterPlugin, MediaSaveApi {
+  private var context: Context? = null
+  private val ioScope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
+
+  override fun onAttachedToEngine(binding: FlutterPlugin.FlutterPluginBinding) {
+    context = binding.applicationContext
+    MediaSaveApi.setUp(binding.binaryMessenger, this)
+  }
+
+  override fun onDetachedFromEngine(binding: FlutterPlugin.FlutterPluginBinding) {
+    MediaSaveApi.setUp(binding.binaryMessenger, null)
+    ioScope.cancel()
+    context = null
+  }
+
+  override fun saveToDownloads(
+    filePath: String,
+    title: String,
+    relativePath: String?,
+    callback: (Result<String?>) -> Unit,
+  ) {
+    val context = context ?: run {
+      callback(Result.success(null))
+      return
+    }
+
+    ioScope.launch {
+      try {
+        callback(Result.success(insertIntoFiles(context, filePath, title, relativePath)))
+      } catch (e: Exception) {
+        callback(Result.failure(e))
+      }
+    }
+  }
+
+  // Uses the Files collection, not Images: Images only accepts MIME types the
+  // platform knows and rejects raw formats like CR3, while Files accepts any
+  // type. The file lands under [relativePath] (Download/Immich), not the gallery.
+  private fun insertIntoFiles(
+    context: Context,
+    filePath: String,
+    title: String,
+    relativePath: String?,
+  ): String? {
+    val resolver = context.contentResolver
+    val collection = MediaStore.Files.getContentUri("external")
+    val source = File(filePath)
+    // Anything reaching this fallback is a format the platform can't type, so
+    // store it as a generic binary. The file saves and stays openable.
+    val mimeType = "application/octet-stream"
+
+    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
+      val values = ContentValues().apply {
+        put(MediaStore.MediaColumns.DISPLAY_NAME, title)
+        put(MediaStore.MediaColumns.MIME_TYPE, mimeType)
+        relativePath?.let { put(MediaStore.MediaColumns.RELATIVE_PATH, it) }
+        put(MediaStore.MediaColumns.IS_PENDING, 1)
+      }
+      val uri = resolver.insert(collection, values) ?: return null
+
+      try {
+        val out = resolver.openOutputStream(uri)
+        if (out == null) {
+          resolver.delete(uri, null, null)
+          return null
+        }
+        out.use { source.inputStream().use { input -> input.copyTo(it) } }
+        resolver.update(uri, ContentValues().apply { put(MediaStore.MediaColumns.IS_PENDING, 0) }, null, null)
+        return uri.lastPathSegment
+      } catch (e: Exception) {
+        resolver.delete(uri, null, null)
+        throw e
+      }
+    }
+
+    val dir = File(Environment.getExternalStorageDirectory(), relativePath ?: Environment.DIRECTORY_DCIM).apply { mkdirs() }
+    val target = File(dir, title)
+    source.inputStream().use { input -> target.outputStream().use { input.copyTo(it) } }
+    val values = ContentValues().apply {
+      put(MediaStore.MediaColumns.DISPLAY_NAME, title)
+      put(MediaStore.MediaColumns.MIME_TYPE, mimeType)
+      @Suppress("DEPRECATION")
+      put(MediaStore.MediaColumns.DATA, target.absolutePath)
+    }
+    return resolver.insert(collection, values)?.lastPathSegment
+  }
+}
--- a/mobile/android/fastlane/Fastfile
+++ b/mobile/android/fastlane/Fastfile
@@ -22,8 +22,8 @@ platform :android do
      task: 'bundle', 
      build_type: 'Release',
      properties: {
-        "android.injected.version.code" => 3056,
-        "android.injected.version.name" => "3.0.3",
+        "android.injected.version.code" => 3055,
+        "android.injected.version.name" => "3.0.2",
      }
    )
    upload_to_play_store(skip_upload_apk: true, skip_upload_images: true, skip_upload_screenshots: true, aab: '../build/app/outputs/bundle/release/app-release.aab', track: 'beta')
@@ -35,8 +35,8 @@ platform :android do
      task: 'bundle', 
      build_type: 'Release',
      properties: {
-        "android.injected.version.code" => 3056,
-        "android.injected.version.name" => "3.0.3",
+        "android.injected.version.code" => 3055,
+        "android.injected.version.name" => "3.0.2",
      }
    )
    upload_to_play_store(skip_upload_apk: true, skip_upload_images: true, skip_upload_screenshots: true, aab: '../build/app/outputs/bundle/release/app-release.aab')
--- a/mobile/ios/.gitignore
+++ b/mobile/ios/.gitignore
@@ -26,9 +26,6 @@ Flutter/flutter_export_environment.sh
 ServiceDefinitions.json
 Runner/GeneratedPluginRegistrant.*

-# Local signing overrides.
-Signing.local.xcconfig
-
 # Exceptions to above rules.
 !default.mode1v3
 !default.mode2v3
--- a/mobile/ios/Podfile
+++ b/mobile/ios/Podfile
@@ -1,5 +1,5 @@
 # Uncomment this line to define a global platform for your project
-platform :ios, '15.0'
+platform :ios, '14.0'

 # CocoaPods analytics sends network stats synchronously affecting flutter build latency.
 ENV['COCOAPODS_DISABLE_STATS'] = 'true'
@@ -45,7 +45,7 @@ post_install do |installer|
  installer.generated_projects.each do |project|
    project.targets.each do |target|
        target.build_configurations.each do |config|
-            config.build_settings['IPHONEOS_DEPLOYMENT_TARGET'] = '15.0'
+            config.build_settings['IPHONEOS_DEPLOYMENT_TARGET'] = '14.0'
        end
    end
  end
--- a/mobile/ios/Runner.xcodeproj/project.pbxproj
+++ b/mobile/ios/Runner.xcodeproj/project.pbxproj
@@ -96,7 +96,6 @@
 		74858FAE1ED2DC5600515810 /* AppDelegate.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = AppDelegate.swift; sourceTree = "<group>"; };
 		78E0A7A72DC9AD7400C4905E /* FlutterGeneratedPluginSwiftPackage */ = {isa = PBXFileReference; lastKnownFileType = wrapper; name = FlutterGeneratedPluginSwiftPackage; path = Flutter/ephemeral/Packages/FlutterGeneratedPluginSwiftPackage; sourceTree = "<group>"; };
 		7AFA3C8E1D35360C0083082E /* Release.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; name = Release.xcconfig; path = Flutter/Release.xcconfig; sourceTree = "<group>"; };
-		51516E0F2A0000000000C0F1 /* Signing.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; path = Signing.xcconfig; sourceTree = "<group>"; };
 		8AB817AA297EDEC88B23F3F6 /* Pods_ShareExtension.framework */ = {isa = PBXFileReference; explicitFileType = wrapper.framework; includeInIndex = 0; path = Pods_ShareExtension.framework; sourceTree = BUILT_PRODUCTS_DIR; };
 		937632897A02DE9C249F20A6 /* Pods-ShareExtension.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-ShareExtension.debug.xcconfig"; path = "Target Support Files/Pods-ShareExtension/Pods-ShareExtension.debug.xcconfig"; sourceTree = "<group>"; };
 		9740EEB21CF90195004384FC /* Debug.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; name = Debug.xcconfig; path = Flutter/Debug.xcconfig; sourceTree = "<group>"; };
@@ -257,7 +256,6 @@
 		97C146E51CF9000F007C117D = {
 			isa = PBXGroup;
 			children = (
-				51516E0F2A0000000000C0F1 /* Signing.xcconfig */,
 				9740EEB11CF90186004384FC /* Flutter */,
 				97C146F01CF9000F007C117D /* Runner */,
 				FAC6F8B62D287F120078CB2F /* ShareExtension */,
@@ -716,7 +714,6 @@
 /* Begin XCBuildConfiguration section */
 		249021D3217E4FDB00AE95B9 /* Profile */ = {
 			isa = XCBuildConfiguration;
-			baseConfigurationReference = 51516E0F2A0000000000C0F1 /* Signing.xcconfig */;
 			buildSettings = {
 				ALWAYS_SEARCH_USER_PATHS = NO;
 				ASSETCATALOG_COMPILER_GENERATE_SWIFT_ASSET_SYMBOL_EXTENSIONS = YES;
@@ -747,7 +744,7 @@
 				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
 				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "iPhone Developer";
 				COPY_PHASE_STRIP = NO;
-				CUSTOM_GROUP_ID = "$(IMMICH_GROUP_ID).profile";
+				CUSTOM_GROUP_ID = group.app.immich.share.profile;
 				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
 				ENABLE_NS_ASSERTIONS = NO;
 				ENABLE_STRICT_OBJC_MSGSEND = YES;
@@ -760,7 +757,7 @@
 				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
 				GCC_WARN_UNUSED_FUNCTION = YES;
 				GCC_WARN_UNUSED_VARIABLE = YES;
-				IPHONEOS_DEPLOYMENT_TARGET = 15.0;
+				IPHONEOS_DEPLOYMENT_TARGET = 14.0;
 				MTL_ENABLE_DEBUG_INFO = NO;
 				NEW_SETTING = "";
 				SDKROOT = iphoneos;
@@ -780,16 +777,16 @@
 				CODE_SIGN_IDENTITY = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
 				CURRENT_PROJECT_VERSION = 4;
-				DEVELOPMENT_TEAM = "$(IMMICH_TEAM_ID)";
+				DEVELOPMENT_TEAM = 2W7AC6T8T5;
 				ENABLE_BITCODE = NO;
 				INFOPLIST_FILE = Runner/Info.plist;
-				IPHONEOS_DEPLOYMENT_TARGET = 15.0;
+				IPHONEOS_DEPLOYMENT_TARGET = 14.0;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
 				MARKETING_VERSION = 3.0.0;
-				PRODUCT_BUNDLE_IDENTIFIER = "$(IMMICH_BUNDLE_ID_DEV).profile";
+				PRODUCT_BUNDLE_IDENTIFIER = app.futo.immich.profile;
 				PRODUCT_NAME = "Immich-Profile";
 				PROVISIONING_PROFILE_SPECIFIER = "";
 				SWIFT_OBJC_BRIDGING_HEADER = "Runner/Runner-Bridging-Header.h";
@@ -800,7 +797,6 @@
 		};
 		97C147031CF9000F007C117D /* Debug */ = {
 			isa = XCBuildConfiguration;
-			baseConfigurationReference = 51516E0F2A0000000000C0F1 /* Signing.xcconfig */;
 			buildSettings = {
 				ALWAYS_SEARCH_USER_PATHS = NO;
 				ASSETCATALOG_COMPILER_GENERATE_SWIFT_ASSET_SYMBOL_EXTENSIONS = AppIcon;
@@ -831,7 +827,7 @@
 				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
 				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "iPhone Developer";
 				COPY_PHASE_STRIP = NO;
-				CUSTOM_GROUP_ID = "$(IMMICH_GROUP_ID).debug";
+				CUSTOM_GROUP_ID = group.app.immich.share.debug;
 				DEBUG_INFORMATION_FORMAT = dwarf;
 				ENABLE_STRICT_OBJC_MSGSEND = YES;
 				ENABLE_TESTABILITY = YES;
@@ -850,7 +846,7 @@
 				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
 				GCC_WARN_UNUSED_FUNCTION = YES;
 				GCC_WARN_UNUSED_VARIABLE = YES;
-				IPHONEOS_DEPLOYMENT_TARGET = 15.0;
+				IPHONEOS_DEPLOYMENT_TARGET = 14.0;
 				MTL_ENABLE_DEBUG_INFO = YES;
 				NEW_SETTING = "";
 				ONLY_ACTIVE_ARCH = YES;
@@ -861,7 +857,6 @@
 		};
 		97C147041CF9000F007C117D /* Release */ = {
 			isa = XCBuildConfiguration;
-			baseConfigurationReference = 51516E0F2A0000000000C0F1 /* Signing.xcconfig */;
 			buildSettings = {
 				ALWAYS_SEARCH_USER_PATHS = NO;
 				ASSETCATALOG_COMPILER_GENERATE_SWIFT_ASSET_SYMBOL_EXTENSIONS = AppIcon;
@@ -892,7 +887,7 @@
 				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
 				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "iPhone Developer";
 				COPY_PHASE_STRIP = NO;
-				CUSTOM_GROUP_ID = "$(IMMICH_GROUP_ID)";
+				CUSTOM_GROUP_ID = group.app.immich.share;
 				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
 				ENABLE_NS_ASSERTIONS = NO;
 				ENABLE_STRICT_OBJC_MSGSEND = YES;
@@ -905,7 +900,7 @@
 				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
 				GCC_WARN_UNUSED_FUNCTION = YES;
 				GCC_WARN_UNUSED_VARIABLE = YES;
-				IPHONEOS_DEPLOYMENT_TARGET = 15.0;
+				IPHONEOS_DEPLOYMENT_TARGET = 14.0;
 				MTL_ENABLE_DEBUG_INFO = NO;
 				NEW_SETTING = "";
 				SDKROOT = iphoneos;
@@ -927,16 +922,16 @@
 				CODE_SIGN_IDENTITY = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
 				CURRENT_PROJECT_VERSION = 4;
-				DEVELOPMENT_TEAM = "$(IMMICH_TEAM_ID)";
+				DEVELOPMENT_TEAM = 2W7AC6T8T5;
 				ENABLE_BITCODE = NO;
 				INFOPLIST_FILE = Runner/Info.plist;
-				IPHONEOS_DEPLOYMENT_TARGET = 15.0;
+				IPHONEOS_DEPLOYMENT_TARGET = 14.0;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
 				MARKETING_VERSION = 3.0.0;
-				PRODUCT_BUNDLE_IDENTIFIER = "$(IMMICH_BUNDLE_ID_DEV).debug";
+				PRODUCT_BUNDLE_IDENTIFIER = app.futo.immich.debug;
 				PRODUCT_NAME = "Immich-Debug";
 				PROVISIONING_PROFILE_SPECIFIER = "";
 				SWIFT_OBJC_BRIDGING_HEADER = "Runner/Runner-Bridging-Header.h";
@@ -956,16 +951,16 @@
 				CODE_SIGN_IDENTITY = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
 				CURRENT_PROJECT_VERSION = 4;
-				DEVELOPMENT_TEAM = "$(IMMICH_TEAM_ID)";
+				DEVELOPMENT_TEAM = 2W7AC6T8T5;
 				ENABLE_BITCODE = NO;
 				INFOPLIST_FILE = Runner/Info.plist;
-				IPHONEOS_DEPLOYMENT_TARGET = 15.0;
+				IPHONEOS_DEPLOYMENT_TARGET = 14.0;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
 				MARKETING_VERSION = 3.0.0;
-				PRODUCT_BUNDLE_IDENTIFIER = "$(IMMICH_BUNDLE_ID_PROD)";
+				PRODUCT_BUNDLE_IDENTIFIER = app.alextran.immich;
 				PRODUCT_NAME = Immich;
 				PROVISIONING_PROFILE_SPECIFIER = "";
 				SWIFT_OBJC_BRIDGING_HEADER = "Runner/Runner-Bridging-Header.h";
@@ -989,7 +984,7 @@
 				CODE_SIGN_IDENTITY = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
 				CURRENT_PROJECT_VERSION = 240;
-				DEVELOPMENT_TEAM = "$(IMMICH_TEAM_ID)";
+				DEVELOPMENT_TEAM = 2W7AC6T8T5;
 				ENABLE_USER_SCRIPT_SANDBOXING = YES;
 				GCC_C_LANGUAGE_STANDARD = gnu17;
 				GENERATE_INFOPLIST_FILE = YES;
@@ -1006,7 +1001,7 @@
 				MARKETING_VERSION = 1.0;
 				MTL_ENABLE_DEBUG_INFO = INCLUDE_SOURCE;
 				MTL_FAST_MATH = YES;
-				PRODUCT_BUNDLE_IDENTIFIER = "$(IMMICH_BUNDLE_ID_DEV).debug.Widget";
+				PRODUCT_BUNDLE_IDENTIFIER = app.futo.immich.debug.Widget;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				SKIP_INSTALL = YES;
 				SWIFT_ACTIVE_COMPILATION_CONDITIONS = "DEBUG $(inherited)";
@@ -1032,7 +1027,7 @@
 				CODE_SIGN_IDENTITY = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
 				CURRENT_PROJECT_VERSION = 240;
-				DEVELOPMENT_TEAM = "$(IMMICH_TEAM_ID)";
+				DEVELOPMENT_TEAM = 2W7AC6T8T5;
 				ENABLE_USER_SCRIPT_SANDBOXING = YES;
 				GCC_C_LANGUAGE_STANDARD = gnu17;
 				GENERATE_INFOPLIST_FILE = YES;
@@ -1048,7 +1043,7 @@
 				LOCALIZATION_PREFERS_STRING_CATALOGS = YES;
 				MARKETING_VERSION = 1.0;
 				MTL_FAST_MATH = YES;
-				PRODUCT_BUNDLE_IDENTIFIER = "$(IMMICH_BUNDLE_ID_PROD).Widget";
+				PRODUCT_BUNDLE_IDENTIFIER = app.alextran.immich.Widget;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				SKIP_INSTALL = YES;
 				SWIFT_EMIT_LOC_STRINGS = YES;
@@ -1072,7 +1067,7 @@
 				CODE_SIGN_IDENTITY = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
 				CURRENT_PROJECT_VERSION = 240;
-				DEVELOPMENT_TEAM = "$(IMMICH_TEAM_ID)";
+				DEVELOPMENT_TEAM = 2W7AC6T8T5;
 				ENABLE_USER_SCRIPT_SANDBOXING = YES;
 				GCC_C_LANGUAGE_STANDARD = gnu17;
 				GENERATE_INFOPLIST_FILE = YES;
@@ -1088,7 +1083,7 @@
 				LOCALIZATION_PREFERS_STRING_CATALOGS = YES;
 				MARKETING_VERSION = 1.0;
 				MTL_FAST_MATH = YES;
-				PRODUCT_BUNDLE_IDENTIFIER = "$(IMMICH_BUNDLE_ID_DEV).profile.Widget";
+				PRODUCT_BUNDLE_IDENTIFIER = app.futo.immich.profile.Widget;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				SKIP_INSTALL = YES;
 				SWIFT_EMIT_LOC_STRINGS = YES;
@@ -1111,7 +1106,7 @@
 				CODE_SIGN_IDENTITY = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
 				CURRENT_PROJECT_VERSION = 240;
-				DEVELOPMENT_TEAM = "$(IMMICH_TEAM_ID)";
+				DEVELOPMENT_TEAM = 2W7AC6T8T5;
 				ENABLE_USER_SCRIPT_SANDBOXING = YES;
 				GCC_C_LANGUAGE_STANDARD = gnu17;
 				GENERATE_INFOPLIST_FILE = YES;
@@ -1128,7 +1123,7 @@
 				MARKETING_VERSION = 1.0;
 				MTL_ENABLE_DEBUG_INFO = INCLUDE_SOURCE;
 				MTL_FAST_MATH = YES;
-				PRODUCT_BUNDLE_IDENTIFIER = "$(IMMICH_BUNDLE_ID_DEV).debug.ShareExtension";
+				PRODUCT_BUNDLE_IDENTIFIER = app.futo.immich.debug.ShareExtension;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				PROVISIONING_PROFILE_SPECIFIER = "";
 				SKIP_INSTALL = YES;
@@ -1154,7 +1149,7 @@
 				CODE_SIGN_IDENTITY = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
 				CURRENT_PROJECT_VERSION = 240;
-				DEVELOPMENT_TEAM = "$(IMMICH_TEAM_ID)";
+				DEVELOPMENT_TEAM = 2W7AC6T8T5;
 				ENABLE_USER_SCRIPT_SANDBOXING = YES;
 				GCC_C_LANGUAGE_STANDARD = gnu17;
 				GENERATE_INFOPLIST_FILE = YES;
@@ -1170,7 +1165,7 @@
 				LOCALIZATION_PREFERS_STRING_CATALOGS = YES;
 				MARKETING_VERSION = 1.0;
 				MTL_FAST_MATH = YES;
-				PRODUCT_BUNDLE_IDENTIFIER = "$(IMMICH_BUNDLE_ID_PROD).ShareExtension";
+				PRODUCT_BUNDLE_IDENTIFIER = app.alextran.immich.ShareExtension;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				PROVISIONING_PROFILE_SPECIFIER = "";
 				SKIP_INSTALL = YES;
@@ -1194,7 +1189,7 @@
 				CODE_SIGN_IDENTITY = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
 				CURRENT_PROJECT_VERSION = 240;
-				DEVELOPMENT_TEAM = "$(IMMICH_TEAM_ID)";
+				DEVELOPMENT_TEAM = 2W7AC6T8T5;
 				ENABLE_USER_SCRIPT_SANDBOXING = YES;
 				GCC_C_LANGUAGE_STANDARD = gnu17;
 				GENERATE_INFOPLIST_FILE = YES;
@@ -1210,7 +1205,7 @@
 				LOCALIZATION_PREFERS_STRING_CATALOGS = YES;
 				MARKETING_VERSION = 1.0;
 				MTL_FAST_MATH = YES;
-				PRODUCT_BUNDLE_IDENTIFIER = "$(IMMICH_BUNDLE_ID_DEV).profile.ShareExtension";
+				PRODUCT_BUNDLE_IDENTIFIER = app.futo.immich.profile.ShareExtension;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				PROVISIONING_PROFILE_SPECIFIER = "";
 				SKIP_INSTALL = YES;
--- a/mobile/ios/Runner.xcworkspace/xcshareddata/swiftpm/Package.resolved
+++ b/mobile/ios/Runner.xcworkspace/xcshareddata/swiftpm/Package.resolved
@@ -122,8 +122,8 @@
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/pointfreeco/swift-sharing",
      "state" : {
-        "revision" : "8244fe63bf43e58188ab13851ad693eecf6a9e90",
-        "version" : "2.9.1"
+        "revision" : "3bfc408cc2d0bee2287c174da6b1c76768377818",
+        "version" : "2.7.4"
      }
    },
    {
--- a/mobile/ios/Runner/Info.plist
+++ b/mobile/ios/Runner/Info.plist
@@ -78,7 +78,7 @@
    <key>CFBundlePackageType</key>
    <string>APPL</string>
    <key>CFBundleShortVersionString</key>
-    <string>3.0.3</string>
+    <string>3.0.2</string>
    <key>CFBundleSignature</key>
    <string>????</string>
    <key>CFBundleURLTypes</key>
--- a/mobile/ios/Signing.xcconfig
+++ b/mobile/ios/Signing.xcconfig
@@ -1,29 +0,0 @@
-// Xcode Signing Constants
-//
-// These are integrated into the Xcode project at build time to allow for dynamic signing configs
-// across our many targets.
-//
-// Create `Signing.local.xcconfig` overriding each variable to provide your own personal signing
-// overrides during local development:
-//     IMMICH_TEAM_ID = ABCDE12345
-//     IMMICH_BUNDLE_ID_PROD = com.customuniqueid.immich
-//     IMMICH_BUNDLE_ID_DEV = com.customuniqueid.immichdev
-//     IMMICH_GROUP_ID = group.com.customuniqueid.immich
-
-// Apple Developer Team ID used for automatically provisioning signing credentials
-IMMICH_TEAM_ID = 2W7AC6T8T5
-
-// Root bundle identifier for the Release configuration.
-// Extension suffixes (`.ShareExtension`/`.Widget`) will be appended
-IMMICH_BUNDLE_ID_PROD = app.alextran.immich
-
-// Root bundle identifier for the Debug and Profile configurations.
-// Build scheme suffixes (`.debug`/`.profile`) will be appended
-IMMICH_BUNDLE_ID_DEV = app.futo.immich
-
-// Root App Group identifier.
-// Build scheme suffixes (`.debug`/`.profile`) will be appended
-IMMICH_GROUP_ID = group.app.immich.share
-
-// Optional per-developer configuration override
-#include? "Signing.local.xcconfig"
--- a/mobile/lib/constants/constants.dart
+++ b/mobile/lib/constants/constants.dart
@@ -26,6 +26,7 @@ const String kDownloadGroupLivePhoto = 'group_livephoto';
 const String kShareDownloadGroup = 'group_share';

 // Timeline constants
+const int kTimelineNoneSegmentSize = 120;
 const int kTimelineAssetLoadBatchSize = 1024;
 const int kTimelineAssetLoadOppositeSize = 64;

--- a/mobile/lib/infrastructure/repositories/timeline.repository.dart
+++ b/mobile/lib/infrastructure/repositories/timeline.repository.dart
@@ -2,6 +2,7 @@ import 'dart:async';

 import 'package:drift/drift.dart';
 import 'package:easy_localization/easy_localization.dart';
+import 'package:immich_mobile/constants/constants.dart';
 import 'package:immich_mobile/domain/models/album/album.model.dart';
 import 'package:immich_mobile/domain/models/asset/base_asset.model.dart';
 import 'package:immich_mobile/domain/models/timeline.model.dart';
@@ -684,7 +685,16 @@ class DriftTimelineRepository extends DriftDatabaseRepository {
  }
 }

-List<Bucket> _generateBuckets(int count) => count == 0 ? const [] : [Bucket(assetCount: count)];
+List<Bucket> _generateBuckets(int count) {
+  final buckets = List.filled(
+    (count / kTimelineNoneSegmentSize).ceil(),
+    const Bucket(assetCount: kTimelineNoneSegmentSize),
+  );
+  if (count % kTimelineNoneSegmentSize != 0) {
+    buckets[buckets.length - 1] = Bucket(assetCount: count % kTimelineNoneSegmentSize);
+  }
+  return buckets;
+}

 extension on Expression<DateTime> {
  Expression<String> dateFmt(GroupAssetsBy groupBy, {bool toLocal = false}) {
--- a/mobile/lib/pages/library/shared_link/shared_link_edit.page.dart
+++ b/mobile/lib/pages/library/shared_link/shared_link_edit.page.dart
@@ -132,10 +132,10 @@ class SharedLinkEditPage extends HookConsumerWidget {
        textInputAction: TextInputAction.done,
        autofocus: false,
        decoration: InputDecoration(
-          labelText: slugController.text.isNotEmpty ? context.t.shared_link_custom_url_title : null,
+          labelText: slugController.text.isNotEmpty ? context.t.custom_url : null,
          labelStyle: const TextStyle(fontWeight: FontWeight.bold),
          border: const OutlineInputBorder(),
-          hintText: context.t.shared_link_custom_url_title,
+          hintText: context.t.custom_url,
          prefixText: slugController.text.isNotEmpty ? '/s/' : null,
          prefixStyle: const TextStyle(fontWeight: FontWeight.bold, fontSize: 14),
        ),
--- a/mobile/lib/platform/media_save_api.g.dart
+++ b/mobile/lib/platform/media_save_api.g.dart
@@ -0,0 +1,81 @@
+// Autogenerated from Pigeon (v26.3.4), do not edit directly.
+// See also: https://pub.dev/packages/pigeon
+// ignore_for_file: unused_import, unused_shown_name
+// ignore_for_file: type=lint
+
+import 'dart:async';
+import 'dart:typed_data' show Float64List, Int32List, Int64List;
+
+import 'package:flutter/services.dart';
+import 'package:meta/meta.dart' show immutable, protected, visibleForTesting;
+
+Object? _extractReplyValueOrThrow(List<Object?>? replyList, String channelName, {required bool isNullValid}) {
+  if (replyList == null) {
+    throw PlatformException(
+      code: 'channel-error',
+      message: 'Unable to establish connection on channel: "$channelName".',
+    );
+  } else if (replyList.length > 1) {
+    throw PlatformException(code: replyList[0]! as String, message: replyList[1] as String?, details: replyList[2]);
+  } else if (!isNullValid && (replyList.isNotEmpty && replyList[0] == null)) {
+    throw PlatformException(
+      code: 'null-error',
+      message: 'Host platform returned null value for non-null return value.',
+    );
+  }
+  return replyList.firstOrNull;
+}
+
+class _PigeonCodec extends StandardMessageCodec {
+  const _PigeonCodec();
+  @override
+  void writeValue(WriteBuffer buffer, Object? value) {
+    if (value is int) {
+      buffer.putUint8(4);
+      buffer.putInt64(value);
+    } else {
+      super.writeValue(buffer, value);
+    }
+  }
+
+  @override
+  Object? readValueOfType(int type, ReadBuffer buffer) {
+    switch (type) {
+      default:
+        return super.readValueOfType(type, buffer);
+    }
+  }
+}
+
+class MediaSaveApi {
+  /// Constructor for [MediaSaveApi].  The [binaryMessenger] named argument is
+  /// available for dependency injection.  If it is left null, the default
+  /// BinaryMessenger will be used which routes to the host platform.
+  MediaSaveApi({BinaryMessenger? binaryMessenger, String messageChannelSuffix = ''})
+    : pigeonVar_binaryMessenger = binaryMessenger,
+      pigeonVar_messageChannelSuffix = messageChannelSuffix.isNotEmpty ? '.$messageChannelSuffix' : '';
+  final BinaryMessenger? pigeonVar_binaryMessenger;
+
+  static const MessageCodec<Object?> pigeonChannelCodec = _PigeonCodec();
+
+  final String pigeonVar_messageChannelSuffix;
+
+  Future<String?> saveToDownloads(String filePath, String title, String? relativePath) async {
+    final pigeonVar_channelName =
+        'dev.flutter.pigeon.immich_mobile.MediaSaveApi.saveToDownloads$pigeonVar_messageChannelSuffix';
+    final pigeonVar_channel = BasicMessageChannel<Object?>(
+      pigeonVar_channelName,
+      pigeonChannelCodec,
+      binaryMessenger: pigeonVar_binaryMessenger,
+    );
+    final Future<Object?> pigeonVar_sendFuture = pigeonVar_channel.send(<Object?>[filePath, title, relativePath]);
+    final pigeonVar_replyList = await pigeonVar_sendFuture as List<Object?>?;
+
+    final Object? pigeonVar_replyValue = _extractReplyValueOrThrow(
+      pigeonVar_replyList,
+      pigeonVar_channelName,
+      isNullValid: true,
+    );
+    return pigeonVar_replyValue as String?;
+  }
+}
--- a/mobile/lib/presentation/widgets/asset_viewer/asset_page.widget.dart
+++ b/mobile/lib/presentation/widgets/asset_viewer/asset_page.widget.dart
@@ -99,8 +99,6 @@ class _AssetPageState extends ConsumerState<AssetPage> {
      case TimelineReloadEvent():
        final asset = ref.read(timelineServiceProvider).getAssetSafe(widget.index);
        if (asset != _asset) {
-          _isZoomed = false;
-          _viewer.setZoomed(false);
          setState(() => _asset = asset);
        }
      default:
--- a/mobile/lib/presentation/widgets/asset_viewer/asset_viewer.page.dart
+++ b/mobile/lib/presentation/widgets/asset_viewer/asset_viewer.page.dart
@@ -81,12 +81,6 @@ class AssetViewer extends ConsumerStatefulWidget {
 }

 class _AssetViewerState extends ConsumerState<AssetViewer> {
-  static const _viewerOverlayStyle = SystemUiOverlayStyle(
-    statusBarIconBrightness: Brightness.light,
-    statusBarBrightness: Brightness.dark,
-    systemNavigationBarIconBrightness: Brightness.light,
-  );
-
  late final _heroOffset = widget.heroOffset ?? TabsRouterScope.of(context)?.controller.activeIndex ?? 0;
  late final _pageController = PageController(initialPage: widget.initialIndex);
  late final _preloader = AssetPreloader(timelineService: ref.read(timelineServiceProvider), mounted: () => mounted);
@@ -286,52 +280,49 @@ class _AssetViewerState extends ConsumerState<AssetViewer> {
      _setSystemUIMode(controls, details);
    });

-    return AnnotatedRegion(
-      value: _viewerOverlayStyle,
-      child: Scaffold(
-        backgroundColor: backgroundColor,
-        resizeToAvoidBottomInset: false,
-        appBar: const ViewerTopAppBar(),
-        extendBody: true,
-        extendBodyBehindAppBar: true,
-        floatingActionButton: IgnorePointer(
-          ignoring: !showingControls,
-          child: AnimatedOpacity(
-            opacity: showingControls ? 1.0 : 0.0,
-            duration: Durations.short2,
-            child: const DownloadStatusFloatingButton(),
-          ),
+    return Scaffold(
+      backgroundColor: backgroundColor,
+      resizeToAvoidBottomInset: false,
+      appBar: const ViewerTopAppBar(),
+      extendBody: true,
+      extendBodyBehindAppBar: true,
+      floatingActionButton: IgnorePointer(
+        ignoring: !showingControls,
+        child: AnimatedOpacity(
+          opacity: showingControls ? 1.0 : 0.0,
+          duration: Durations.short2,
+          child: const DownloadStatusFloatingButton(),
        ),
-        bottomNavigationBar: const ViewerBottomAppBar(),
-        body: Stack(
-          children: [
-            NotificationListener<ScrollEndNotification>(
-              onNotification: _onScrollEnd,
-              child: PhotoViewGestureDetectorScope(
-                axis: Axis.horizontal,
-                child: PageView.builder(
-                  controller: _pageController,
-                  physics: isZoomed
-                      ? const NeverScrollableScrollPhysics()
-                      : CurrentPlatform.isIOS
-                      ? const FastScrollPhysics()
-                      : const FastClampingScrollPhysics(),
-                  itemCount: _totalAssets,
-                  itemBuilder: (context, index) =>
-                      AssetPage(index: index, heroOffset: _heroOffset, onTapNavigate: _onTapNavigate),
-                ),
+      ),
+      bottomNavigationBar: const ViewerBottomAppBar(),
+      body: Stack(
+        children: [
+          NotificationListener<ScrollEndNotification>(
+            onNotification: _onScrollEnd,
+            child: PhotoViewGestureDetectorScope(
+              axis: Axis.horizontal,
+              child: PageView.builder(
+                controller: _pageController,
+                physics: isZoomed
+                    ? const NeverScrollableScrollPhysics()
+                    : CurrentPlatform.isIOS
+                    ? const FastScrollPhysics()
+                    : const FastClampingScrollPhysics(),
+                itemCount: _totalAssets,
+                itemBuilder: (context, index) =>
+                    AssetPage(index: index, heroOffset: _heroOffset, onTapNavigate: _onTapNavigate),
              ),
            ),
-            if (!CurrentPlatform.isIOS)
-              IgnorePointer(
-                child: AnimatedContainer(
-                  duration: Durations.short2,
-                  color: Colors.black.withValues(alpha: showingDetails ? 0.6 : 0.0),
-                  height: context.padding.top,
-                ),
+          ),
+          if (!CurrentPlatform.isIOS)
+            IgnorePointer(
+              child: AnimatedContainer(
+                duration: Durations.short2,
+                color: Colors.black.withValues(alpha: showingDetails ? 0.6 : 0.0),
+                height: context.padding.top,
              ),
-          ],
-        ),
+            ),
+        ],
      ),
    );
  }
--- a/mobile/lib/repositories/file_media.repository.dart
+++ b/mobile/lib/repositories/file_media.repository.dart
@@ -1,10 +1,16 @@
 import 'dart:io';

-import 'package:flutter/foundation.dart';
+import 'package:flutter/services.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:immich_mobile/domain/models/asset/base_asset.model.dart';
+import 'package:immich_mobile/extensions/platform_extensions.dart';
+import 'package:immich_mobile/platform/media_save_api.g.dart';
+import 'package:immich_mobile/utils/mime.utils.dart';
+import 'package:path/path.dart' as p;
 import 'package:photo_manager/photo_manager.dart' hide AssetType;

+final _mediaSaveApi = MediaSaveApi();
+
 final fileMediaRepositoryProvider = Provider((ref) => const FileMediaRepository());

 class FileMediaRepository {
@@ -25,8 +31,19 @@ class FileMediaRepository {
  }

  Future<AssetEntity?> saveImageWithFile(String filePath, {String? title, String? relativePath}) async {
-    final entity = await PhotoManager.editor.saveImageWithPath(filePath, title: title, relativePath: relativePath);
-    return entity;
+    try {
+      return await PhotoManager.editor.saveImageWithPath(filePath, title: title, relativePath: relativePath);
+    } on PlatformException catch (e) {
+      // Some formats (e.g. raw like CR3) have no MIME the platform recognises, so
+      // photo_manager falls back to `image/*` and MediaStore rejects the save.
+      // Save those to Downloads ourselves, where the Files collection takes any
+      // type. Anything else isn't ours to handle.
+      if (!CurrentPlatform.isAndroid || !isUnsupportedMimeError(e)) {
+        rethrow;
+      }
+      final id = await _mediaSaveApi.saveToDownloads(filePath, title ?? p.basename(filePath), 'Download/Immich');
+      return id == null ? null : AssetEntity(id: id, typeInt: 1, width: 0, height: 0);
+    }
  }

  Future<AssetEntity?> saveLivePhoto({required File image, required File video, required String title}) async {
--- a/mobile/lib/services/background_upload.service.dart
+++ b/mobile/lib/services/background_upload.service.dart
@@ -317,8 +317,6 @@ class BackgroundUploadService {
      priority: priority,
      isFavorite: asset.isFavorite,
      requiresWiFi: requiresWiFi,
-      // Visibility hidden on upload to prevent the server from running regular jobs on the live photo asset
-      fields: entity.isLivePhoto ? {'visibility': api.AssetVisibility.hidden.value} : null,
      cloudId: entity.isLivePhoto ? null : asset.cloudId,
      adjustmentTime: entity.isLivePhoto ? null : asset.adjustmentTime?.toIso8601String(),
      latitude: entity.isLivePhoto ? null : asset.latitude?.toString(),
@@ -338,7 +336,8 @@ class BackgroundUploadService {
      return null;
    }

-    final fields = {'livePhotoVideoId': livePhotoVideoId};
+    // Visibility hidden on upload to prevent the server from running regular jobs on the live photo asset
+    final fields = {'livePhotoVideoId': livePhotoVideoId, 'visibility': api.AssetVisibility.hidden.value};

    final requiresWiFi = _shouldRequireWiFi(asset);
    final originalFileName = await _assetMediaRepository.getOriginalFilename(asset.id) ?? asset.name;
--- a/mobile/lib/services/foreground_upload.service.dart
+++ b/mobile/lib/services/foreground_upload.service.dart
@@ -2,7 +2,6 @@ import 'dart:async';
 import 'dart:convert';
 import 'dart:io';

-import 'package:flutter/foundation.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:immich_mobile/domain/models/asset/asset_metadata.model.dart';
 import 'package:immich_mobile/domain/models/asset/base_asset.model.dart' hide AssetVisibility;
@@ -101,7 +100,7 @@ class ForegroundUploadService {
          final requireWifi = _shouldRequireWiFi(asset);
          return requireWifi && !hasWifi;
        },
-        processItem: (asset) => uploadSingleAsset(asset, cancelToken, callbacks: callbacks),
+        processItem: (asset) => _uploadSingleAsset(asset, cancelToken, callbacks: callbacks),
      );
    }
  }
@@ -127,7 +126,7 @@ class ForegroundUploadService {
        continue;
      }

-      await uploadSingleAsset(asset, cancelToken, callbacks: callbacks);
+      await _uploadSingleAsset(asset, cancelToken, callbacks: callbacks);
    }
  }

@@ -144,7 +143,7 @@ class ForegroundUploadService {
    await _executeWithWorkerPool<LocalAsset>(
      items: localAssets,
      cancelToken: cancelToken,
-      processItem: (asset) => uploadSingleAsset(asset, cancelToken, callbacks: callbacks),
+      processItem: (asset) => _uploadSingleAsset(asset, cancelToken, callbacks: callbacks),
    );
  }

@@ -234,8 +233,7 @@ class ForegroundUploadService {
    await Future.wait(workerFutures);
  }

-  @visibleForTesting
-  Future<void> uploadSingleAsset(
+  Future<void> _uploadSingleAsset(
    LocalAsset asset,
    Completer<void>? cancelToken, {
    required UploadCallbacks callbacks,
--- a/mobile/lib/utils/mime.utils.dart
+++ b/mobile/lib/utils/mime.utils.dart
@@ -0,0 +1,12 @@
+import 'package:flutter/services.dart';
+
+// True when a gallery save failed because MediaStore rejected the file's MIME.
+// Android raises `Unsupported MIME type` for formats it can't type (e.g. raw
+// like CR3), where photo_manager falls back to `image/*`. Matched on the detail
+// string (case-insensitive) because photo_manager surfaces no distinct error
+// code for it. Keeps `mime type` in the match so it doesn't catch unrelated
+// `Unsupported*` errors (e.g. UnsupportedOperationException).
+bool isUnsupportedMimeError(PlatformException e) {
+  final details = e.details;
+  return details is String && details.toLowerCase().contains('unsupported mime type');
+}
--- a/mobile/lib/widgets/common/mesmerizing_sliver_app_bar.dart
+++ b/mobile/lib/widgets/common/mesmerizing_sliver_app_bar.dart
@@ -393,8 +393,10 @@ class _RandomAssetBackgroundState extends State<_RandomAssetBackground> with Tic
      builder: (context, child) {
        return Transform.scale(
          scale: _zoomAnimation.value,
+          filterQuality: Platform.isAndroid ? FilterQuality.low : null,
          child: Transform.translate(
            offset: _panAnimation.value,
+            filterQuality: Platform.isAndroid ? FilterQuality.low : null,
            child: Stack(
              fit: StackFit.expand,
              children: [
--- a/mobile/lib/widgets/common/person_sliver_app_bar.dart
+++ b/mobile/lib/widgets/common/person_sliver_app_bar.dart
@@ -496,8 +496,10 @@ class _RandomAssetBackgroundState extends State<_RandomAssetBackground> with Tic
      builder: (context, child) {
        return Transform.scale(
          scale: _zoomAnimation.value,
+          filterQuality: Platform.isAndroid ? FilterQuality.low : null,
          child: Transform.translate(
            offset: _panAnimation.value,
+            filterQuality: Platform.isAndroid ? FilterQuality.low : null,
            child: Stack(
              fit: StackFit.expand,
              children: [
--- a/mobile/lib/widgets/common/remote_album_sliver_app_bar.dart
+++ b/mobile/lib/widgets/common/remote_album_sliver_app_bar.dart
@@ -472,8 +472,10 @@ class _RandomAssetBackgroundState extends State<_RandomAssetBackground> with Tic
      builder: (context, child) {
        return Transform.scale(
          scale: _zoomAnimation.value,
+          filterQuality: Platform.isAndroid ? FilterQuality.low : null,
          child: Transform.translate(
            offset: _panAnimation.value,
+            filterQuality: Platform.isAndroid ? FilterQuality.low : null,
            child: Stack(
              fit: StackFit.expand,
              children: [
--- a/mobile/mise.lock
+++ b/mobile/mise.lock
@@ -1,29 +1,29 @@
 # @generated - this file is auto-generated by `mise lock` https://mise.en.dev/dev-tools/mise-lock.html

 [[tools."aqua:flutter/flutter"]]
-version = "3.44.6"
+version = "3.44.1"
 backend = "aqua:flutter/flutter"

 [tools."aqua:flutter/flutter"."platforms.linux-arm64"]
-url = "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_3.44.6-stable.tar.xz"
+url = "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_3.44.1-stable.tar.xz"

 [tools."aqua:flutter/flutter"."platforms.linux-arm64-musl"]
-url = "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_3.44.6-stable.tar.xz"
+url = "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_3.44.1-stable.tar.xz"

 [tools."aqua:flutter/flutter"."platforms.linux-x64"]
-url = "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_3.44.6-stable.tar.xz"
+url = "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_3.44.1-stable.tar.xz"

 [tools."aqua:flutter/flutter"."platforms.linux-x64-musl"]
-url = "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_3.44.6-stable.tar.xz"
+url = "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_3.44.1-stable.tar.xz"

 [tools."aqua:flutter/flutter"."platforms.macos-arm64"]
-url = "https://storage.googleapis.com/flutter_infra_release/releases/stable/macos/flutter_macos_arm64_3.44.6-stable.zip"
+url = "https://storage.googleapis.com/flutter_infra_release/releases/stable/macos/flutter_macos_arm64_3.44.1-stable.zip"

 [tools."aqua:flutter/flutter"."platforms.macos-x64"]
-url = "https://storage.googleapis.com/flutter_infra_release/releases/stable/macos/flutter_macos_3.44.6-stable.zip"
+url = "https://storage.googleapis.com/flutter_infra_release/releases/stable/macos/flutter_macos_3.44.1-stable.zip"

 [tools."aqua:flutter/flutter"."platforms.windows-x64"]
-url = "https://storage.googleapis.com/flutter_infra_release/releases/stable/windows/flutter_windows_3.44.6-stable.zip"
+url = "https://storage.googleapis.com/flutter_infra_release/releases/stable/windows/flutter_windows_3.44.1-stable.zip"

 [[tools."github:CQLabs/homebrew-dcm"]]
 version = "1.37.0"
@@ -133,3 +133,54 @@ asset_pattern = "dcm-macos-arm-release.zip"
 checksum = "sha256:30bede64367d09067093cc57af6ec9496d7717898138ded5cb98a16ac8dd9d93"
 url = "https://github.com/CQLabs/homebrew-dcm/releases/download/1.37.0/dcm-macos-arm-release.zip"
 url_api = "https://api.github.com/repos/CQLabs/homebrew-dcm/releases/assets/404543757"
+
+[[tools.java]]
+version = "21.0.2"
+backend = "core:java"
+
+[tools.java."platforms.linux-arm64"]
+checksum = "sha256:08db1392a48d4eb5ea5315cf8f18b89dbaf36cda663ba882cf03c704c9257ec2"
+url = "https://download.java.net/java/GA/jdk21.0.2/f2283984656d49d69e91c558476027ac/13/GPL/openjdk-21.0.2_linux-aarch64_bin.tar.gz"
+
+[tools.java."platforms.linux-x64"]
+checksum = "sha256:a2def047a73941e01a73739f92755f86b895811afb1f91243db214cff5bdac3f"
+url = "https://download.java.net/java/GA/jdk21.0.2/f2283984656d49d69e91c558476027ac/13/GPL/openjdk-21.0.2_linux-x64_bin.tar.gz"
+
+[tools.java."platforms.macos-arm64"]
+checksum = "sha256:b3d588e16ec1e0ef9805d8a696591bd518a5cea62567da8f53b5ce32d11d22e4"
+url = "https://download.java.net/java/GA/jdk21.0.2/f2283984656d49d69e91c558476027ac/13/GPL/openjdk-21.0.2_macos-aarch64_bin.tar.gz"
+
+[tools.java."platforms.macos-x64"]
+checksum = "sha256:8fd09e15dc406387a0aba70bf5d99692874e999bf9cd9208b452b5d76ac922d3"
+url = "https://download.java.net/java/GA/jdk21.0.2/f2283984656d49d69e91c558476027ac/13/GPL/openjdk-21.0.2_macos-x64_bin.tar.gz"
+
+[tools.java."platforms.windows-x64"]
+checksum = "sha256:b6c17e747ae78cdd6de4d7532b3164b277daee97c007d3eaa2b39cca99882664"
+url = "https://download.java.net/java/GA/jdk21.0.2/f2283984656d49d69e91c558476027ac/13/GPL/openjdk-21.0.2_windows-x64_bin.zip"
+
+[[tools.java]]
+version = "21.0.2"
+backend = "core:java"
+
+[tools.java.options]
+shorthand_vendor = "openjdk"
+
+[tools.java."platforms.linux-arm64"]
+checksum = "sha256:08db1392a48d4eb5ea5315cf8f18b89dbaf36cda663ba882cf03c704c9257ec2"
+url = "https://download.java.net/java/GA/jdk21.0.2/f2283984656d49d69e91c558476027ac/13/GPL/openjdk-21.0.2_linux-aarch64_bin.tar.gz"
+
+[tools.java."platforms.linux-x64"]
+checksum = "sha256:a2def047a73941e01a73739f92755f86b895811afb1f91243db214cff5bdac3f"
+url = "https://download.java.net/java/GA/jdk21.0.2/f2283984656d49d69e91c558476027ac/13/GPL/openjdk-21.0.2_linux-x64_bin.tar.gz"
+
+[tools.java."platforms.macos-arm64"]
+checksum = "sha256:b3d588e16ec1e0ef9805d8a696591bd518a5cea62567da8f53b5ce32d11d22e4"
+url = "https://download.java.net/java/GA/jdk21.0.2/f2283984656d49d69e91c558476027ac/13/GPL/openjdk-21.0.2_macos-aarch64_bin.tar.gz"
+
+[tools.java."platforms.macos-x64"]
+checksum = "sha256:8fd09e15dc406387a0aba70bf5d99692874e999bf9cd9208b452b5d76ac922d3"
+url = "https://download.java.net/java/GA/jdk21.0.2/f2283984656d49d69e91c558476027ac/13/GPL/openjdk-21.0.2_macos-x64_bin.tar.gz"
+
+[tools.java."platforms.windows-x64"]
+checksum = "sha256:b6c17e747ae78cdd6de4d7532b3164b277daee97c007d3eaa2b39cca99882664"
+url = "https://download.java.net/java/GA/jdk21.0.2/f2283984656d49d69e91c558476027ac/13/GPL/openjdk-21.0.2_windows-x64_bin.zip"
--- a/mobile/mise.toml
+++ b/mobile/mise.toml
@@ -1,6 +1,6 @@
 [tools]
-"aqua:flutter/flutter" = "3.44.6"
-java = "25.0.3+9.0.LTS"
+"aqua:flutter/flutter" = "3.44.1"
+java = "21.0.2"

 [tools."github:CQLabs/homebrew-dcm"]
 version = "1.37.0"
--- a/mobile/openapi/README.md
+++ b/mobile/openapi/README.md
@@ -3,7 +3,7 @@ Immich API

 This Dart package is automatically generated by the [OpenAPI Generator](https://openapi-generator.tech) project:

- API version: 3.0.3
+- API version: 3.0.2
 - Generator version: 7.22.0
 - Build package: org.openapitools.codegen.languages.DartClientCodegen

--- a/mobile/openapi/lib/api/albums_api.dart
+++ b/mobile/openapi/lib/api/albums_api.dart
@@ -681,10 +681,8 @@ class AlbumsApi {
  /// Parameters:
  ///
  /// * [String] id (required):
-  ///   Album ID
  ///
  /// * [String] userId (required):
-  ///   Album user ID, or \"me\" to reference the current user.
  Future<Response> removeUserFromAlbumWithHttpInfo(String id, String userId, { Future<void>? abortTrigger, }) async {
    // ignore: prefer_const_declarations
    final apiPath = r'/albums/{id}/user/{userId}'
@@ -720,10 +718,8 @@ class AlbumsApi {
  /// Parameters:
  ///
  /// * [String] id (required):
-  ///   Album ID
  ///
  /// * [String] userId (required):
-  ///   Album user ID, or \"me\" to reference the current user.
  Future<void> removeUserFromAlbum(String id, String userId, { Future<void>? abortTrigger, }) async {
    final response = await removeUserFromAlbumWithHttpInfo(id, userId, abortTrigger: abortTrigger,);
    if (response.statusCode >= HttpStatus.badRequest) {
@@ -802,10 +798,8 @@ class AlbumsApi {
  /// Parameters:
  ///
  /// * [String] id (required):
-  ///   Album ID
  ///
  /// * [String] userId (required):
-  ///   Album user ID, or \"me\" to reference the current user.
  ///
  /// * [UpdateAlbumUserDto] updateAlbumUserDto (required):
  Future<Response> updateAlbumUserWithHttpInfo(String id, String userId, UpdateAlbumUserDto updateAlbumUserDto, { Future<void>? abortTrigger, }) async {
@@ -843,10 +837,8 @@ class AlbumsApi {
  /// Parameters:
  ///
  /// * [String] id (required):
-  ///   Album ID
  ///
  /// * [String] userId (required):
-  ///   Album user ID, or \"me\" to reference the current user.
  ///
  /// * [UpdateAlbumUserDto] updateAlbumUserDto (required):
  Future<void> updateAlbumUser(String id, String userId, UpdateAlbumUserDto updateAlbumUserDto, { Future<void>? abortTrigger, }) async {
--- a/mobile/pigeon/media_save_api.dart
+++ b/mobile/pigeon/media_save_api.dart
@@ -0,0 +1,21 @@
+import 'package:pigeon/pigeon.dart';
+
+@ConfigurePigeon(
+  PigeonOptions(
+    dartOut: 'lib/platform/media_save_api.g.dart',
+    kotlinOut: 'android/app/src/main/kotlin/app/alextran/immich/mediasave/MediaSave.g.kt',
+    kotlinOptions: KotlinOptions(package: 'app.alextran.immich.mediasave'),
+    dartOptions: DartOptions(),
+    dartPackageName: 'immich_mobile',
+  ),
+)
+@HostApi()
+abstract class MediaSaveApi {
+  // Saves a file to a MediaStore Files-collection entry under [relativePath]
+  // (e.g. Download/Immich). Fallback for when photo_manager can't save a file
+  // because the platform has no MIME for it (e.g. raw like CR3) and MediaStore
+  // rejects the `image/*` it falls back to; the Files collection accepts any
+  // type. Returns the new media id, or null on failure.
+  @async
+  String? saveToDownloads(String filePath, String title, String? relativePath);
+}
--- a/mobile/pubspec.lock
+++ b/mobile/pubspec.lock
@@ -1056,26 +1056,26 @@ packages:
    dependency: "direct main"
    description:
      name: maplibre_gl
-      sha256: b676f124a2fcf88c4dafedc7b462155e6396d61ce7af46354b4de11b45c9812f
+      sha256: "5c7b1008396b2a321bada7d986ed60f9423406fbc7bd16f7ce91b385dfa054cd"
      url: "https://pub.dev"
    source: hosted
-    version: "0.26.2"
+    version: "0.22.0"
  maplibre_gl_platform_interface:
    dependency: transitive
    description:
      name: maplibre_gl_platform_interface
-      sha256: "1f0ca8a99f03fa9434618ee21f4e42dd615830a7dd973e632b11c73ffec993a8"
+      sha256: "08ee0a2d0853ea945a0ab619d52c0c714f43144145cd67478fc6880b52f37509"
      url: "https://pub.dev"
    source: hosted
-    version: "0.26.2"
+    version: "0.22.0"
  maplibre_gl_web:
    dependency: transitive
    description:
      name: maplibre_gl_web
-      sha256: bbf022f29ceef26d73f63e584819fbd02fbaf4eb1facf5234206c78936cf8f1c
+      sha256: "2b13d4b1955a9a54e38a718f2324e56e4983c080fc6de316f6f4b5458baacb58"
      url: "https://pub.dev"
    source: hosted
-    version: "0.26.2"
+    version: "0.22.0"
  matcher:
    dependency: transitive
    description:
@@ -2014,4 +2014,4 @@ packages:
    version: "3.1.3"
 sdks:
  dart: ">=3.12.0 <4.0.0"
-  flutter: "3.44.6"
+  flutter: "3.44.1"
--- a/mobile/pubspec.yaml
+++ b/mobile/pubspec.yaml
@@ -2,11 +2,11 @@ name: immich_mobile
 description: Immich - selfhosted backup media file on mobile phone

 publish_to: 'none'
-version: 3.0.3+3056
+version: 3.0.2+3055

 environment:
  sdk: '>=3.12.0 <4.0.0'
-  flutter: 3.44.6
+  flutter: 3.44.1

 dependencies:
  async: ^2.13.1
@@ -44,7 +44,7 @@ dependencies:
  intl: ^0.20.2
  local_auth: ^2.3.0
  logging: ^1.3.0
-  maplibre_gl: ^0.26.0
+  maplibre_gl: ^0.22.0
  native_video_player:
    git:
      url: https://github.com/immich-app/native_video_player
--- a/mobile/test/api.mocks.dart
+++ b/mobile/test/api.mocks.dart
@@ -1,4 +1,3 @@
-import 'package:immich_mobile/platform/connectivity_api.g.dart';
 import 'package:immich_mobile/repositories/partner_api.repository.dart';
 import 'package:mocktail/mocktail.dart';
 import 'package:openapi/api.dart';
@@ -8,5 +7,3 @@ class MockSyncApi extends Mock implements SyncApi {}
 class MockServerApi extends Mock implements ServerApi {}

 class MockPartnerApiRepository extends Mock implements PartnerApiRepository {}
-
-class MockConnectivityApi extends Mock implements ConnectivityApi {}
--- a/mobile/test/presentation/widgets/asset_viewer/asset_page_zoom_reset_test.dart
+++ b/mobile/test/presentation/widgets/asset_viewer/asset_page_zoom_reset_test.dart
@@ -1,91 +0,0 @@
-import 'package:easy_localization/easy_localization.dart';
-import 'package:flutter/material.dart';
-import 'package:flutter_test/flutter_test.dart';
-import 'package:hooks_riverpod/hooks_riverpod.dart';
-import 'package:immich_mobile/constants/locales.dart';
-import 'package:immich_mobile/domain/models/asset/base_asset.model.dart';
-import 'package:immich_mobile/domain/models/events.model.dart';
-import 'package:immich_mobile/domain/models/timeline.model.dart';
-import 'package:immich_mobile/domain/services/timeline.service.dart';
-import 'package:immich_mobile/domain/utils/event_stream.dart';
-import 'package:immich_mobile/generated/codegen_loader.g.dart';
-import 'package:immich_mobile/presentation/widgets/asset_viewer/asset_page.widget.dart';
-import 'package:immich_mobile/providers/asset_viewer/asset_viewer.provider.dart';
-import 'package:immich_mobile/providers/infrastructure/timeline.provider.dart';
-
-import '../../../fixtures/asset.stub.dart';
-
-/// Timeline displaying a single asset that we can swap
-class _SwappableTimelineService extends TimelineService {
-  BaseAsset asset;
-  _SwappableTimelineService(this.asset)
-    : super((
-        assetSource: (_, __) async => [],
-        bucketSource: () => Stream.value(const [Bucket(assetCount: 1)]),
-        origin: TimelineOrigin.main,
-      ));
-
-  @override
-  int get totalAssets => 1;
-  @override
-  BaseAsset? getAssetSafe(int index) => index == 0 ? asset : null;
-}
-
-class _ZoomedNotifier extends AssetViewerStateNotifier {
-  @override
-  AssetViewerState build() {
-    super.build();
-    return AssetViewerState(currentAsset: LocalAssetStub.image1, isZoomed: true);
-  }
-}
-
-void main() {
-  testWidgets('resets zoom when the displayed asset is replaced on reload', (tester) async {
-    final timeline = _SwappableTimelineService(LocalAssetStub.image1);
-    final container = ProviderContainer(
-      overrides: [
-        timelineServiceProvider.overrideWithValue(timeline),
-        assetViewerProvider.overrideWith(_ZoomedNotifier.new),
-      ],
-    );
-    addTearDown(container.dispose);
-
-    await tester.pumpWidget(
-      UncontrolledProviderScope(
-        container: container,
-        child: EasyLocalization(
-          supportedLocales: locales.values.toList(),
-          path: translationsPath,
-          startLocale: locales.values.first,
-          fallbackLocale: locales.values.first,
-          saveLocale: false,
-          useFallbackTranslations: true,
-          assetLoader: const CodegenLoader(),
-          child: Builder(
-            builder: (context) => MaterialApp(
-              localizationsDelegates: context.localizationDelegates,
-              supportedLocales: context.supportedLocales,
-              locale: context.locale,
-              home: const Material(child: AssetPage(index: 0, heroOffset: 0)),
-            ),
-          ),
-        ),
-      ),
-    );
-    await tester.pump(const Duration(milliseconds: 600));
-    // Ignore any image load errors
-    tester.takeException();
-
-    expect(container.read(assetViewerProvider).isZoomed, isTrue);
-
-    // Swap the asset, simulating a delete
-    timeline.asset = LocalAssetStub.image2;
-    EventStream.shared.emit(const TimelineReloadEvent());
-
-    await tester.idle();
-    await tester.pump();
-    tester.takeException();
-
-    expect(container.read(assetViewerProvider).isZoomed, isFalse);
-  });
-}
--- a/mobile/test/presentation/widgets/asset_viewer/asset_viewer_system_ui_test.dart
+++ b/mobile/test/presentation/widgets/asset_viewer/asset_viewer_system_ui_test.dart
@@ -1,85 +0,0 @@
-import 'dart:async';
-
-import 'package:easy_localization/easy_localization.dart';
-import 'package:flutter/material.dart';
-import 'package:flutter/services.dart';
-import 'package:flutter_test/flutter_test.dart';
-import 'package:hooks_riverpod/hooks_riverpod.dart';
-import 'package:immich_mobile/constants/locales.dart';
-import 'package:immich_mobile/domain/models/timeline.model.dart';
-import 'package:immich_mobile/domain/services/timeline.service.dart';
-import 'package:immich_mobile/generated/codegen_loader.g.dart';
-import 'package:immich_mobile/presentation/widgets/asset_viewer/asset_viewer.page.dart';
-import 'package:immich_mobile/providers/asset_viewer/asset_viewer.provider.dart';
-import 'package:immich_mobile/providers/infrastructure/timeline.provider.dart';
-
-import '../../../fixtures/asset.stub.dart';
-
-class _SeededAssetViewerNotifier extends AssetViewerStateNotifier {
-  @override
-  AssetViewerState build() {
-    super.build();
-    return AssetViewerState(currentAsset: LocalAssetStub.image1);
-  }
-}
-
-TimelineService _stubTimelineService() {
-  return TimelineService((
-    assetSource: (index, count) async => [LocalAssetStub.image1],
-    bucketSource: () => Stream.value(const [Bucket(assetCount: 1)]),
-    origin: TimelineOrigin.main,
-  ));
-}
-
-void main() {
-  testWidgets('status bar icons are light while the asset viewer is open in light mode', (tester) async {
-    // Emulate arriving from a light-themed page whose AppBar set dark status
-    // bar icons (the state the viewer is opened from in light mode).
-    SystemChrome.setSystemUIOverlayStyle(SystemUiOverlayStyle.dark);
-
-    await tester.pumpWidget(
-      EasyLocalization(
-        supportedLocales: locales.values.toList(),
-        path: translationsPath,
-        startLocale: locales.values.first,
-        fallbackLocale: locales.values.first,
-        saveLocale: false,
-        useFallbackTranslations: true,
-        assetLoader: const CodegenLoader(),
-        child: ProviderScope(
-          overrides: [
-            timelineServiceProvider.overrideWithValue(_stubTimelineService()),
-            assetViewerProvider.overrideWith(_SeededAssetViewerNotifier.new),
-          ],
-          child: Builder(
-            builder: (context) => MaterialApp(
-              debugShowCheckedModeBanner: false,
-              localizationsDelegates: context.localizationDelegates,
-              supportedLocales: context.supportedLocales,
-              locale: context.locale,
-              home: const Material(child: AssetViewer(initialIndex: 0)),
-            ),
-          ),
-        ),
-      ),
-    );
-
-    // Let post-frame callbacks and the initial frames run without waiting for
-    // infinite animations (loading spinners) to settle.
-    await tester.pump();
-    await tester.pump(const Duration(milliseconds: 600));
-
-    // Asset thumbnails cannot load in the test environment (no platform
-    // channels / real HTTP). Those image errors are irrelevant to the system
-    // chrome behaviour under test, so drain them.
-    tester.takeException();
-
-    expect(
-      SystemChrome.latestStyle?.statusBarIconBrightness,
-      Brightness.light,
-      reason:
-          'The asset viewer draws over a black background, so status bar '
-          'icons must be light regardless of the app theme',
-    );
-  });
-}
--- a/mobile/test/services/background_upload.service_test.dart
+++ b/mobile/test/services/background_upload.service_test.dart
@@ -118,24 +118,8 @@ void main() {
      expect(task, isNotNull);
      // For live photos, extension should be changed to match the video file
      expect(task!.fields['filename'], equals('OriginalLivePhoto.mov'));
-      expect(task.fields['visibility'], equals('hidden'));
      verify(() => mockAssetMediaRepository.getOriginalFilename(asset.id)).called(1);
    });
-
-    test('should not set visibility for a regular photo', () async {
-      final asset = LocalAssetStub.image1;
-      final mockEntity = MockAssetEntity();
-      final mockFile = File('/path/to/file.jpg');
-
-      when(() => mockEntity.isLivePhoto).thenReturn(false);
-      when(() => mockStorageRepository.getAssetEntityForAsset(asset)).thenAnswer((_) async => mockEntity);
-      when(() => mockStorageRepository.getFileForAsset(asset.id)).thenAnswer((_) async => mockFile);
-      when(() => mockAssetMediaRepository.getOriginalFilename(asset.id)).thenAnswer((_) async => 'Regular.jpg');
-
-      final task = await sut.getUploadTask(asset);
-      expect(task, isNotNull);
-      expect(task!.fields.containsKey('visibility'), isFalse);
-    });
  });

  group('getLivePhotoUploadTask', () {
@@ -156,7 +140,7 @@ void main() {
      expect(task, isNotNull);
      expect(task!.fields['filename'], equals('OriginalLivePhoto.HEIC'));
      expect(task.fields['livePhotoVideoId'], equals('video-id-123'));
-      expect(task.fields.containsKey('visibility'), isFalse);
+      expect(task.fields['visibility'], equals('hidden'));
      verify(() => mockAssetMediaRepository.getOriginalFilename(asset.id)).called(1);
    });

@@ -350,7 +334,7 @@ void main() {
      expect(task, isNotNull);
      expect(task!.fields.containsKey('metadata'), isTrue);
      expect(task.fields['livePhotoVideoId'], equals('video-123'));
-      expect(task.fields.containsKey('visibility'), isFalse);
+      expect(task.fields['visibility'], equals('hidden'));

      final metadata = jsonDecode(task.fields['metadata']!) as List;
      expect(metadata, hasLength(1));
--- a/mobile/test/services/foreground_upload.service_test.dart
+++ b/mobile/test/services/foreground_upload.service_test.dart
@@ -1,128 +0,0 @@
-import 'dart:io';
-
-import 'package:drift/drift.dart' hide isNull, isNotNull;
-import 'package:drift/native.dart';
-import 'package:flutter/services.dart';
-import 'package:flutter_test/flutter_test.dart';
-import 'package:immich_mobile/domain/models/store.model.dart';
-import 'package:immich_mobile/domain/services/store.service.dart';
-import 'package:immich_mobile/entities/store.entity.dart';
-import 'package:immich_mobile/infrastructure/repositories/db.repository.dart';
-import 'package:immich_mobile/infrastructure/repositories/settings.repository.dart';
-import 'package:immich_mobile/infrastructure/repositories/store.repository.dart';
-import 'package:immich_mobile/repositories/upload.repository.dart';
-import 'package:immich_mobile/services/foreground_upload.service.dart';
-import 'package:mocktail/mocktail.dart';
-
-import '../api.mocks.dart';
-import '../fixtures/asset.stub.dart';
-import '../infrastructure/repository.mock.dart';
-import '../mocks/asset_entity.mock.dart';
-import '../repository.mocks.dart';
-
-void main() {
-  late ForegroundUploadService sut;
-  late MockUploadRepository mockUploadRepository;
-  late MockStorageRepository mockStorageRepository;
-  late MockDriftBackupRepository mockBackupRepository;
-  late MockConnectivityApi mockConnectivityApi;
-  late MockAssetMediaRepository mockAssetMediaRepository;
-  late Drift db;
-
-  setUpAll(() async {
-    TestWidgetsFlutterBinding.ensureInitialized();
-    TestDefaultBinaryMessengerBinding.instance.defaultBinaryMessenger.setMockMethodCallHandler(
-      const MethodChannel('plugins.flutter.io/path_provider'),
-      (MethodCall methodCall) async => 'test',
-    );
-    db = Drift(DatabaseConnection(NativeDatabase.memory(), closeStreamsSynchronously: true));
-    await StoreService.init(storeRepository: DriftStoreRepository(db));
-    await SettingsRepository.ensureInitialized(db);
-
-    await Store.put(StoreKey.serverEndpoint, 'http://demo.immich.app');
-    await Store.put(StoreKey.deviceId, 'device-id');
-
-    registerFallbackValue(File('file'));
-    registerFallbackValue(<String, String>{});
-  });
-
-  setUp(() {
-    mockUploadRepository = MockUploadRepository();
-    mockStorageRepository = MockStorageRepository();
-    mockBackupRepository = MockDriftBackupRepository();
-    mockConnectivityApi = MockConnectivityApi();
-    mockAssetMediaRepository = MockAssetMediaRepository();
-
-    sut = ForegroundUploadService(
-      mockUploadRepository,
-      mockStorageRepository,
-      mockBackupRepository,
-      mockConnectivityApi,
-      mockAssetMediaRepository,
-    );
-  });
-
-  List<Map<String, String>> captureFields() {
-    final captured = <Map<String, String>>[];
-    when(
-      () => mockUploadRepository.uploadFile(
-        file: any(named: 'file'),
-        originalFileName: any(named: 'originalFileName'),
-        fields: any(named: 'fields'),
-        cancelToken: any(named: 'cancelToken'),
-        onProgress: any(named: 'onProgress'),
-        logContext: any(named: 'logContext'),
-      ),
-    ).thenAnswer((invocation) async {
-      final fields = invocation.namedArguments[#fields] as Map<String, String>;
-      captured.add(Map.of(fields));
-      return UploadResult.success(remoteAssetId: 'remote-${captured.length}');
-    });
-    return captured;
-  }
-
-  group('uploadSingleAsset', () {
-    test('should upload the motion part hidden and keep the still image visible', () async {
-      final asset = LocalAssetStub.image1;
-      final mockEntity = MockAssetEntity();
-      final stillFile = File('/path/to/still.heic');
-      final videoFile = File('/path/to/motion.mov');
-
-      when(() => mockEntity.isLivePhoto).thenReturn(true);
-      when(() => mockStorageRepository.getAssetEntityForAsset(asset)).thenAnswer((_) async => mockEntity);
-      when(() => mockStorageRepository.isAssetAvailableLocally(asset.id)).thenAnswer((_) async => true);
-      when(() => mockStorageRepository.getFileForAsset(asset.id)).thenAnswer((_) async => stillFile);
-      when(() => mockStorageRepository.getMotionFileForAsset(asset)).thenAnswer((_) async => videoFile);
-      when(() => mockAssetMediaRepository.getOriginalFilename(asset.id)).thenAnswer((_) async => 'live.heic');
-
-      final captured = captureFields();
-
-      await sut.uploadSingleAsset(asset, null, callbacks: const UploadCallbacks());
-
-      expect(captured, hasLength(2));
-      expect(captured[0]['visibility'], equals('hidden'));
-      expect(captured[0].containsKey('livePhotoVideoId'), isFalse);
-      expect(captured[1].containsKey('visibility'), isFalse);
-      expect(captured[1]['livePhotoVideoId'], equals('remote-1'));
-    });
-
-    test('should not set visibility for a regular photo', () async {
-      final asset = LocalAssetStub.image1;
-      final mockEntity = MockAssetEntity();
-      final stillFile = File('/path/to/photo.jpg');
-
-      when(() => mockEntity.isLivePhoto).thenReturn(false);
-      when(() => mockStorageRepository.getAssetEntityForAsset(asset)).thenAnswer((_) async => mockEntity);
-      when(() => mockStorageRepository.isAssetAvailableLocally(asset.id)).thenAnswer((_) async => true);
-      when(() => mockStorageRepository.getFileForAsset(asset.id)).thenAnswer((_) async => stillFile);
-      when(() => mockAssetMediaRepository.getOriginalFilename(asset.id)).thenAnswer((_) async => 'photo.jpg');
-
-      final captured = captureFields();
-
-      await sut.uploadSingleAsset(asset, null, callbacks: const UploadCallbacks());
-
-      expect(captured, hasLength(1));
-      expect(captured[0].containsKey('visibility'), isFalse);
-    });
-  });
-}
--- a/mobile/test/utils/mime_utils_test.dart
+++ b/mobile/test/utils/mime_utils_test.dart
@@ -0,0 +1,27 @@
+import 'package:flutter/services.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:immich_mobile/utils/mime.utils.dart';
+
+void main() {
+  group('isUnsupportedMimeError', () {
+    PlatformException err(Object? details) => PlatformException(code: 'saveImageWithPath', details: details);
+
+    test('detects the MediaStore unsupported-mime failure', () {
+      expect(isUnsupportedMimeError(err('java.lang.IllegalArgumentException: Unsupported MIME type image/*')), isTrue);
+    });
+
+    test('is case-insensitive', () {
+      expect(isUnsupportedMimeError(err('unsupported mime type foo')), isTrue);
+    });
+
+    test('ignores other Unsupported* errors', () {
+      expect(isUnsupportedMimeError(err('java.lang.UnsupportedOperationException')), isFalse);
+    });
+
+    test('ignores unrelated failures and non-string details', () {
+      expect(isUnsupportedMimeError(err('Permission denied')), isFalse);
+      expect(isUnsupportedMimeError(err(null)), isFalse);
+      expect(isUnsupportedMimeError(err(42)), isFalse);
+    });
+  });
+}
--- a/open-api/immich-openapi-specs.json
+++ b/open-api/immich-openapi-specs.json
@@ -2702,7 +2702,6 @@
            "name": "id",
            "required": true,
            "in": "path",
-            "description": "Album ID",
            "schema": {
              "format": "uuid",
              "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$",
@@ -2713,14 +2712,6 @@
            "name": "userId",
            "required": true,
            "in": "path",
-            "description": "Album user ID, or \"me\" to reference the current user.",
-            "x-immich-history": [
-              {
-                "version": "v3",
-                "state": "Updated",
-                "description": "\"me\" as a value is deprecated"
-              }
-            ],
            "schema": {
              "type": "string"
            }
@@ -2771,7 +2762,6 @@
            "name": "id",
            "required": true,
            "in": "path",
-            "description": "Album ID",
            "schema": {
              "format": "uuid",
              "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$",
@@ -2782,14 +2772,6 @@
            "name": "userId",
            "required": true,
            "in": "path",
-            "description": "Album user ID, or \"me\" to reference the current user.",
-            "x-immich-history": [
-              {
-                "version": "v3",
-                "state": "Updated",
-                "description": "\"me\" as a value is deprecated"
-              }
-            ],
            "schema": {
              "type": "string"
            }
@@ -7157,9 +7139,9 @@
            "in": "query",
            "description": "Filter by date",
            "schema": {
-              "format": "date",
-              "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))$",
-              "example": "2024-01-01",
+              "format": "date-time",
+              "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$",
+              "example": "2024-01-01T00:00:00.000Z",
              "type": "string"
            }
          },
@@ -7326,9 +7308,9 @@
            "in": "query",
            "description": "Filter by date",
            "schema": {
-              "format": "date",
-              "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))$",
-              "example": "2024-01-01",
+              "format": "date-time",
+              "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$",
+              "example": "2024-01-01T00:00:00.000Z",
              "type": "string"
            }
          },
@@ -16241,7 +16223,7 @@
  "info": {
    "title": "Immich",
    "description": "Immich API",
-    "version": "3.0.3",
+    "version": "3.0.2",
    "contact": {}
  },
  "tags": [
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
  "name": "immich-monorepo",
-  "version": "3.0.3",
+  "version": "3.0.2",
  "description": "Monorepo for Immich",
  "type": "module",
  "private": true,
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -1,6 +1,6 @@
 {
  "name": "@immich/cli",
-  "version": "3.0.3",
+  "version": "3.0.2",
  "description": "Command Line Interface (CLI) for Immich",
  "repository": {
    "type": "git",
--- a/packages/cli/src/commands/asset.spec.ts
+++ b/packages/cli/src/commands/asset.spec.ts
@@ -4,14 +4,7 @@ import path from 'node:path';
 import { setTimeout as sleep } from 'node:timers/promises';
 import { describe, expect, it, MockedFunction, vi } from 'vitest';

-import {
-  AssetRejectReason,
-  AssetUploadAction,
-  AssetVisibility,
-  checkBulkUpload,
-  defaults,
-  getSupportedMediaTypes,
-} from '@immich/sdk';
+import { AssetRejectReason, AssetUploadAction, checkBulkUpload, defaults, getSupportedMediaTypes } from '@immich/sdk';
 import createFetchMock from 'vitest-fetch-mock';

 import {
@@ -109,20 +102,6 @@ describe('uploadFiles', () => {

    await expect(uploadFiles([testFilePath], { concurrency: 1 })).resolves.toEqual([]);
  });
-
-  it('uploads assets with the specified visibility', async () => {
-    fetchMocker.doMockIf(new RegExp(`${baseUrl}/assets$`), function () {
-      return {
-        status: 200,
-        body: JSON.stringify({ id: 'fc5621b1-86f6-44a1-9905-403e607df9f5', status: 'created' }),
-      };
-    });
-
-    await uploadFiles([testFilePath], { concurrency: 1, visibility: AssetVisibility.Hidden });
-
-    const formData = fetchMocker.mock.calls[0]?.[1]?.body as FormData;
-    expect(formData.get('visibility')).toBe('hidden');
-  });
 });

 describe('checkForDuplicates', () => {
--- a/packages/cli/src/commands/asset.ts
+++ b/packages/cli/src/commands/asset.ts
@@ -4,7 +4,6 @@ import {
  AssetMediaResponseDto,
  AssetMediaStatus,
  AssetUploadAction,
-  AssetVisibility,
  Permission,
  addAssetsToAlbum,
  checkBulkUpload,
@@ -40,7 +39,6 @@ export interface UploadOptionsDto {
  deleteDuplicates?: boolean;
  album?: boolean;
  albumName?: string;
-  visibility?: AssetVisibility;
  includeHidden?: boolean;
  concurrency: number;
  progress?: boolean;
@@ -308,8 +306,10 @@ export const checkForDuplicates = async (files: string[], { concurrency, skipHas
  return { newFiles, duplicates };
 };

-export const uploadFiles = async (files: string[], options: UploadOptionsDto): Promise<Asset[]> => {
-  const { dryRun, concurrency, progress } = options;
+export const uploadFiles = async (
+  files: string[],
+  { dryRun, concurrency, progress }: UploadOptionsDto,
+): Promise<Asset[]> => {
  if (files.length === 0) {
    console.log('All assets were already uploaded, nothing to do.');
    return [];
@@ -358,7 +358,7 @@ export const uploadFiles = async (files: string[], options: UploadOptionsDto): P
        throw new Error(`Stats not found for ${filepath}`);
      }

-      const response = await uploadFile(filepath, stats, options);
+      const response = await uploadFile(filepath, stats);
      newAssets.push({ id: response.id, filepath });
      if (response.status === AssetMediaStatus.Duplicate) {
        duplicateCount++;
@@ -400,11 +400,7 @@ export const uploadFiles = async (files: string[], options: UploadOptionsDto): P
  return newAssets;
 };

-const uploadFile = async (
-  input: string,
-  stats: Stats,
-  { visibility }: UploadOptionsDto,
-): Promise<AssetMediaResponseDto> => {
+const uploadFile = async (input: string, stats: Stats): Promise<AssetMediaResponseDto> => {
  const { baseUrl, headers } = defaults;

  const formData = new FormData();
@@ -413,9 +409,6 @@ const uploadFile = async (
  formData.append('fileSize', String(stats.size));
  formData.append('isFavorite', 'false');
  formData.append('assetData', new UploadFile(input, stats.size));
-  if (visibility) {
-    formData.append('visibility', visibility);
-  }

  const sidecarPath = findSidecar(input);
  if (sidecarPath) {
--- a/packages/cli/src/index.ts
+++ b/packages/cli/src/index.ts
@@ -1,5 +1,4 @@
 #! /usr/bin/env node
-import { AssetVisibility } from '@immich/sdk';
 import { Command, Option } from 'commander';
 import os from 'node:os';
 import path from 'node:path';
@@ -59,11 +58,6 @@ program
      .env('IMMICH_ALBUM_NAME')
      .conflicts('album'),
  )
-  .addOption(
-    new Option('--visibility <visibility>', 'Set the visibility of uploaded assets')
-      .choices(Object.values(AssetVisibility))
-      .env('IMMICH_VISIBILITY'),
-  )
  .addOption(
    new Option('-n, --dry-run', "Don't perform any actions, just show what will be done")
      .env('IMMICH_DRY_RUN')
--- a/packages/plugin-core/src/index.ts
+++ b/packages/plugin-core/src/index.ts
@@ -127,7 +127,7 @@ const methods = wrapper<Manifest>({
  assetDateFilter: ({ config, data }) => {
    const assetDate = new Date(data.asset.localDateTime);
    let startDate = new Date(config.startDate.year, config.startDate.month - 1, config.startDate.day);
-    let endDate = new Date(config.endDate.year, config.endDate.month - 1, config.endDate.day + 1);
+    let endDate = new Date(config.endDate.year, config.endDate.month - 1, config.endDate.day);

    if (config.recurring) {
      startDate.setFullYear(assetDate.getFullYear());
@@ -142,7 +142,7 @@ const methods = wrapper<Manifest>({
      }
    }

-    return { workflow: { continue: assetDate >= startDate && assetDate < endDate } };
+    return { workflow: { continue: assetDate >= startDate && assetDate <= endDate } };
  },

  assetLock: ({ config, data }) => {
--- a/packages/sdk/package.json
+++ b/packages/sdk/package.json
@@ -1,6 +1,6 @@
 {
  "name": "@immich/sdk",
-  "version": "3.0.3",
+  "version": "3.0.2",
  "description": "Auto-generated TypeScript SDK for the Immich API",
  "repository": {
    "type": "git",
--- a/packages/sdk/src/fetch-client.ts
+++ b/packages/sdk/src/fetch-client.ts
@@ -1,6 +1,6 @@
 /**
 * Immich
- * 3.0.3
+ * 3.0.2
 * DO NOT MODIFY - This file has been generated using oazapfts.
 * See https://www.npmjs.com/package/oazapfts
 */
--- a/server/Dockerfile
+++ b/server/Dockerfile
@@ -1,4 +1,4 @@
-FROM ghcr.io/immich-app/base-server-dev:202607132058@sha256:968709a3668167f11ef8ece5962e72ea8a4231e841f98bd5e0f35da4cc295cc7 AS builder
+FROM ghcr.io/immich-app/base-server-dev:202607061334@sha256:c83ef9c6d7f5e7f6a276fe96647484d46b7bf6cacc1e35b823dd1d7a1aeda3b8 AS builder
 ENV COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \
  CI=1 \
  COREPACK_HOME=/tmp \
@@ -56,7 +56,7 @@ FROM builder AS plugins

 ARG TARGETPLATFORM

-COPY --from=ghcr.io/jdx/mise:2026.7.7@sha256:ead960a5f0d2834a78e4640b8e1579d0fcf08cc52a16810dba33b06abf13282e /usr/local/bin/mise /usr/local/bin/mise
+COPY --from=ghcr.io/jdx/mise:2026.7.2@sha256:51d92371cc08e3c4f0e52f58bb3ec1975a6dc966b7430a4da37dcfc6ae772f30 /usr/local/bin/mise /usr/local/bin/mise

 WORKDIR /app
 COPY ./mise.toml ./mise.toml
@@ -80,7 +80,7 @@ RUN --mount=type=cache,id=pnpm-packages,target=/buildcache/pnpm-store \
  --mount=type=cache,id=mise-tools-${TARGETPLATFORM},target=/buildcache/mise \
  mise //:plugins

-FROM ghcr.io/immich-app/base-server-prod:202607132058@sha256:85cca651310842265015f26a6710bb7420a54a8fd1ec22d519b7b620f5f93bb1
+FROM ghcr.io/immich-app/base-server-prod:202607061334@sha256:c07ef6510ff2ccb6ead28434ade7c7a0c08aef33d7d3466b14beccdd431e86f7

 WORKDIR /usr/src/app
 ENV NODE_ENV=production \
--- a/server/Dockerfile.dev
+++ b/server/Dockerfile.dev
@@ -1,8 +1,8 @@
 # dev build
-FROM ghcr.io/immich-app/base-server-dev:202607132058@sha256:968709a3668167f11ef8ece5962e72ea8a4231e841f98bd5e0f35da4cc295cc7 AS dev
+FROM ghcr.io/immich-app/base-server-dev:202607061334@sha256:c83ef9c6d7f5e7f6a276fe96647484d46b7bf6cacc1e35b823dd1d7a1aeda3b8 AS dev


-COPY --from=ghcr.io/jdx/mise:2026.7.7@sha256:ead960a5f0d2834a78e4640b8e1579d0fcf08cc52a16810dba33b06abf13282e /usr/local/bin/mise /usr/local/bin/mise
+COPY --from=ghcr.io/jdx/mise:2026.7.2@sha256:51d92371cc08e3c4f0e52f58bb3ec1975a6dc966b7430a4da37dcfc6ae772f30 /usr/local/bin/mise /usr/local/bin/mise

 RUN echo "devdir=/buildcache/node-gyp" >> /usr/local/etc/npmrc && \
  echo "store-dir=/buildcache/pnpm-store" >> /usr/local/etc/npmrc && \
--- a/server/helmet.json
+++ b/server/helmet.json
@@ -5,7 +5,6 @@
      "script-src": ["'self'", "'wasm-unsafe-eval'", "'unsafe-inline'", "https://www.gstatic.com"],
      "style-src": ["'self'", "'unsafe-inline'"],
      "img-src": ["'self'", "data:", "blob:"],
-      "media-src": ["'self'", "data:", "blob:"],
      "connect-src": [
        "'self'",
        "blob:",
--- a/server/package.json
+++ b/server/package.json
@@ -1,6 +1,6 @@
 {
  "name": "immich",
-  "version": "3.0.3",
+  "version": "3.0.2",
  "description": "",
  "author": "",
  "private": true,
--- a/server/src/controllers/album.controller.ts
+++ b/server/src/controllers/album.controller.ts
@@ -7,7 +7,6 @@ import {
  AlbumsAddAssetsDto,
  AlbumsAddAssetsResponseDto,
  AlbumStatisticsResponseDto,
-  AlbumUserParamDto,
  CreateAlbumDto,
  GetAlbumsDto,
  UpdateAlbumDto,
@@ -19,7 +18,7 @@ import { MapMarkerResponseDto } from 'src/dtos/map.dto';
 import { ApiTag, Permission } from 'src/enum';
 import { Auth, Authenticated } from 'src/middleware/auth.guard';
 import { AlbumService } from 'src/services/album.service';
-import { UUIDParamDto } from 'src/validation';
+import { ParseMeUUIDPipe, UUIDParamDto } from 'src/validation';

@ApiTags(ApiTag.Albums)
@Controller('albums')
@@ -176,7 +175,8 @@ export class AlbumController {
  })
  updateAlbumUser(
    @Auth() auth: AuthDto,
-    @Param() { id, userId }: AlbumUserParamDto,
+    @Param() { id }: UUIDParamDto,
+    @Param('userId', new ParseMeUUIDPipe({ version: '4' })) userId: string,
    @Body() dto: UpdateAlbumUserDto,
  ): Promise<void> {
    return this.service.updateUser(auth, id, userId, dto);
@@ -190,7 +190,11 @@ export class AlbumController {
    description: 'Remove a user from an album. Use an ID of "me" to leave a shared album.',
    history: new HistoryBuilder().added('v1').beta('v1').stable('v2'),
  })
-  removeUserFromAlbum(@Auth() auth: AuthDto, @Param() { id, userId }: AlbumUserParamDto): Promise<void> {
+  removeUserFromAlbum(
+    @Auth() auth: AuthDto,
+    @Param() { id }: UUIDParamDto,
+    @Param('userId', new ParseMeUUIDPipe({ version: '4' })) userId: string,
+  ): Promise<void> {
    return this.service.removeUser(auth, id, userId);
  }
 }
--- a/server/src/dtos/album.dto.ts
+++ b/server/src/dtos/album.dto.ts
@@ -1,7 +1,6 @@
 import { ShallowDehydrateObject } from 'kysely';
 import { createZodDto } from 'nestjs-zod';
 import { AlbumUser, AuthSharedLink } from 'src/database';
-import { HistoryBuilder } from 'src/decorators';
 import { BulkIdErrorReasonSchema } from 'src/dtos/asset-ids.response.dto';
 import { MapAsset } from 'src/dtos/asset-response.dto';
 import { UserResponseSchema, mapUser } from 'src/dtos/user.dto';
@@ -141,19 +140,6 @@ export const AlbumResponseSchema = z
  })
  .meta({ id: 'AlbumResponseDto' });

-const AlbumUserParamSchema = z.object({
-  id: z.uuidv4().describe('Album ID'),
-  // TODO: disallow 'me' as a shortcut in v4 and type userId as uuidv4
-  userId: z
-    .string()
-    .refine((value) => value === 'me' || z.uuidv4().safeParse(value).success, {
-      error: 'Must be a UUID v4 or "me"',
-    })
-    .describe('Album user ID, or "me" to reference the current user.')
-    .meta(new HistoryBuilder().updated('v3', '"me" as a value is deprecated').getExtensions()),
-});
-
-export class AlbumUserParamDto extends createZodDto(AlbumUserParamSchema) {}
 export class AddUsersDto extends createZodDto(AddUsersSchema) {}
 export class AlbumUserCreateDto extends createZodDto(AlbumUserCreateSchema) {}
 export class CreateAlbumDto extends createZodDto(CreateAlbumSchema) {}
--- a/server/src/dtos/memory.dto.ts
+++ b/server/src/dtos/memory.dto.ts
@@ -4,13 +4,13 @@ import { HistoryBuilder } from 'src/decorators';
 import { AssetResponseSchema, mapAsset } from 'src/dtos/asset-response.dto';
 import { AuthDto } from 'src/dtos/auth.dto';
 import { AssetOrderWithRandomSchema, MemoryType, MemoryTypeSchema } from 'src/enum';
-import { isoDatetimeToDate, isoDateToDate, nonEmptyPartial, stringToBool } from 'src/validation';
+import { isoDatetimeToDate, nonEmptyPartial, stringToBool } from 'src/validation';
 import z from 'zod';

 const MemorySearchSchema = z
  .object({
    type: MemoryTypeSchema.optional(),
-    for: isoDateToDate.optional().describe('Filter by date'),
+    for: isoDatetimeToDate.optional().describe('Filter by date'),
    isTrashed: stringToBool.optional().describe('Include trashed memories'),
    isSaved: stringToBool.optional().describe('Filter by saved status'),
    size: z.coerce.number().int().min(1).optional().describe('Number of memories to return'),
--- a/server/src/middleware/file-upload.interceptor.ts
+++ b/server/src/middleware/file-upload.interceptor.ts
@@ -1,4 +1,4 @@
-import { BadRequestException, CallHandler, ExecutionContext, Injectable, NestInterceptor } from '@nestjs/common';
+import { CallHandler, ExecutionContext, Injectable, NestInterceptor } from '@nestjs/common';
 import { PATH_METADATA } from '@nestjs/common/constants';
 import { Reflector } from '@nestjs/core';
 import { transformException } from '@nestjs/platform-express/multer/multer/multer.utils';
@@ -129,9 +129,6 @@ export class FileUploadInterceptor implements NestInterceptor {
          hash?.destroy();
          return callback(error);
        }
-        if (size === 0) {
-          return callback(new BadRequestException('File is empty'));
-        }
        callback(null, {
          path,
          size,
--- a/server/src/repositories/event.repository.ts
+++ b/server/src/repositories/event.repository.ts
@@ -42,7 +42,7 @@ type EventMap = {
  AlbumInvite: [{ id: string; userId: string; senderName: string }];

  // asset events
-  AssetCreate: [{ asset: Pick<Asset, 'id' | 'ownerId'>; file?: UploadFile }];
+  AssetCreate: [{ asset: Asset; file: UploadFile }];
  AssetTag: [{ assetId: string }];
  AssetUntag: [{ assetId: string }];
  AssetHide: [{ assetId: string; userId: string }];
--- a/server/src/repositories/media.repository.ts
+++ b/server/src/repositories/media.repository.ts
@@ -411,7 +411,7 @@ export class MediaRepository {
  }

  async getImageMetadata(input: string | Buffer): Promise<ImageDimensions & { isTransparent: boolean }> {
-    const { width = 0, height = 0, hasAlpha = false } = await sharp(input, { unlimited: true }).metadata();
+    const { width = 0, height = 0, hasAlpha = false } = await sharp(input).metadata();
    return { width, height, isTransparent: hasAlpha };
  }

--- a/server/src/schema/migrations/1782500000000-RestoreLivePhotoStillVisibility.ts
+++ b/server/src/schema/migrations/1782500000000-RestoreLivePhotoStillVisibility.ts
@@ -1,16 +0,0 @@
-import { Kysely, sql } from 'kysely';
-
-export async function up(db: Kysely<any>): Promise<void> {
-  // (#29836) Reset the visibility of any still images that are hidden and have a motion part
-  await sql`
-    UPDATE "asset"
-    SET "visibility" = 'timeline'
-    WHERE "type" = 'IMAGE'
-      AND "visibility" = 'hidden'
-      AND "livePhotoVideoId" IS NOT NULL
-  `.execute(db);
-}
-
-export async function down(): Promise<void> {
-  // Not implemented: the previous 'hidden' value was itself the bug.
-}
--- a/server/src/services/album.service.spec.ts
+++ b/server/src/services/album.service.spec.ts
@@ -663,7 +663,6 @@ describe(AlbumService.name, () => {
      const album = AlbumFactory.from().albumUser({ userId: user.id }).build();
      const { user: owner } = album.albumUsers.find(({ role }) => role === AlbumUserRole.Owner)!;
      mocks.access.album.checkOwnerAccess.mockResolvedValue(new Set([album.id]));
-      mocks.album.getById.mockResolvedValue(getForAlbum(album));
      mocks.albumUser.update.mockResolvedValue();

      await sut.updateUser(AuthFactory.create(owner), album.id, user.id, { role: AlbumUserRole.Viewer });
--- a/server/src/services/album.service.ts
+++ b/server/src/services/album.service.ts
@@ -335,14 +335,6 @@ export class AlbumService extends BaseService {

  async updateUser(auth: AuthDto, id: string, userId: string, dto: UpdateAlbumUserDto): Promise<void> {
    await this.requireAccess({ auth, permission: Permission.AlbumShare, ids: [id] });
-
-    const album = await this.findOrFail(id, userId, { withAssets: false });
-    const owner = album.albumUsers[0];
-
-    if (owner.user.id === userId) {
-      throw new BadRequestException('User is owner');
-    }
-
    await this.albumUserRepository.update({ albumId: id, userId }, { role: dto.role });
  }

--- a/server/src/services/api.service.ts
+++ b/server/src/services/api.service.ts
@@ -20,7 +20,14 @@ export const render = (index: string, meta: OpenGraphTags) => {
    <meta property="og:type" content="website" />
    <meta property="og:title" content="${title}" />
    <meta property="og:description" content="${description}" />
-    ${imageUrl ? `<meta property="og:image" content="${imageUrl}" />` : ''}`;
+    ${imageUrl ? `<meta property="og:image" content="${imageUrl}" />` : ''}
+
+    <!-- Twitter Meta Tags -->
+    <meta name="twitter:card" content="summary_large_image" />
+    <meta name="twitter:title" content="${title}" />
+    <meta name="twitter:description" content="${description}" />
+
+    ${imageUrl ? `<meta name="twitter:image" content="${imageUrl}" />` : ''}`;

  return index.replace('<!-- metadata:tags -->', tags);
 };
--- a/server/src/services/library.service.spec.ts
+++ b/server/src/services/library.service.spec.ts
@@ -576,10 +576,6 @@ describe(LibraryService.name, () => {
        }),
      ]);

-      expect(mocks.event.emit).toHaveBeenCalledWith('AssetCreate', {
-        asset: { id: asset.id, ownerId: library.ownerId },
-      });
-
      expect(mocks.job.queueAll).toHaveBeenCalledWith([
        {
          name: JobName.SidecarCheck,
--- a/server/src/services/library.service.ts
+++ b/server/src/services/library.service.ts
@@ -275,12 +275,6 @@ export class LibraryService extends BaseService {

    this.logger.log(`Imported ${assetIds.length} ${progressMessage} file(s) into library ${job.libraryId}`);

-    await Promise.all(
-      assetIds.map((assetId) =>
-        this.eventRepository.emit('AssetCreate', { asset: { id: assetId, ownerId: library.ownerId } }),
-      ),
-    );
-
    await this.queuePostSyncJobs(assetIds);

    return JobStatus.Success;
--- a/Show More
+++ b/Show More