immich-server 3.4.1-1
Self-hosted photos and videos backup tool (server and web client)
config.json file.
/v1/packages/immich-server/versions SHAs are authoritative.
Metadata
Relations
Depends
Make dependencies
Optional dependencies
Conflicts
Security
Revision scans
| Revision | Status | Scanned | Findings |
|---|---|---|---|
| c1bbd373566ahead | verified | 2026-11-11 18:41 | 16 |
| 635a66f2dc50 | verified | 2026-11-10 20:04 | 16 |
| e7614b08ae1a | verified | 2026-11-05 16:14 | 16 |
| e26ca928594e | verified | 2026-11-05 16:11 | 16 |
| 329f64501351 | verified | 2026-11-05 16:04 | 16 |
| bd7eb87b99af | verified | 2026-11-05 16:02 | 16 |
| 2fdc0617caaa | verified | 2026-11-05 16:02 | 16 |
Head findings
risky-tool
in
PKGBUILD'pnpm' is invoked - this fetches/executes external code outside alpm's control.
pnpm fetch --ignore-scripts # First, get node_modules folder to patch into
risky-tool
in
PKGBUILD'pnpm' is invoked - this fetches/executes external code outside alpm's control.
pnpm install --filter immich --frozen-lockfile --offline # sometimes pnpm fetch doesn't give us the node_modules folder
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
sharp_dir="$(mktemp -d "${srcdir}/sharp-patch.XXXXXXXX")"risky-tool
in
PKGBUILD'pnpm' is invoked - this fetches/executes external code outside alpm's control.
pnpm patch sharp --edit-dir "$sharp_dir" < <(yes '' 2>/dev/null)
risky-tool
in
PKGBUILD'pnpm' is invoked - this fetches/executes external code outside alpm's control.
pnpm patch-commit "$sharp_dir" # Second, this runs the scripts
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
TIME=$(date --iso-8601=seconds | tr -d "\n") # used to write how updated the geodata is
risky-tool
in
PKGBUILD'pnpm' is invoked - this fetches/executes external code outside alpm's control.
pnpm --filter @immich/sdk --filter @immich/plugin-sdk build
risky-tool
in
PKGBUILD'pnpm' is invoked - this fetches/executes external code outside alpm's control.
pnpm exec nest build --type-check
risky-tool
in
PKGBUILD'pnpm' is invoked - this fetches/executes external code outside alpm's control.
pnpm --filter @immich/sdk --filter @immich/plugin-sdk --filter immich build # SHARP_IGNORE_GLOBAL_LIBVIPS=true
risky-tool
in
PKGBUILD'pnpm' is invoked - this fetches/executes external code outside alpm's control.
pnpm --filter immich --prod --no-optional deploy output/server-pruned
risky-tool
in
PKGBUILD'pnpm' is invoked - this fetches/executes external code outside alpm's control.
pnpm --filter @immich/sdk --filter immich-web install --frozen-lockfile
risky-tool
in
PKGBUILD'pnpm' is invoked - this fetches/executes external code outside alpm's control.
pnpm --filter @immich/sdk --filter immich-web build
risky-tool
in
PKGBUILD'pnpm' is invoked - this fetches/executes external code outside alpm's control.
pnpm --filter @immich/sdk --filter @immich/cli install --frozen-lockfile
risky-tool
in
PKGBUILD'pnpm' is invoked - this fetches/executes external code outside alpm's control.
pnpm --filter @immich/sdk --filter @immich/cli build
risky-tool
in
PKGBUILD'pnpm' is invoked - this fetches/executes external code outside alpm's control.
pnpm --filter @immich/cli deploy --prod --no-optional output/cli-pruned
command-substitution
in
immich-server.installDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
if [ "$(printf '%s\n' "$2" "1.142.0" | sort -V | tail -n1)" = "1.142.0" ]; then
Findings below High severity are retained for review but do not block serving. Verified means no obvious red flags from static analysis - never a guarantee that a package is safe.