Immich 3.3.5: security update (CA fix, Node.js), clean upgrade

released
lab run
upgraded from
3.3.4
guest
Ubuntu 26.04 VM
tested
yes, in our lab

Summary

Immich 3.3.5 is a small security release. The release notes say it contains a fix related to a certificate authority (CA) compromise, plus Node.js security patches. The maintainers write that they do not believe the CA issue is an immediate danger to Immich instances, but recommend updating soon.

The listed changes are two dependency updates: the Python Docker image digests and the certifi package (to v2026.10.19). There are no feature changes.

Breaking changes and deprecations

None listed in the release notes. We did not hit any in our test.

Tested in our lab

We installed Immich 3.3.4 with the official Docker Compose files, created an admin user, and uploaded one test image. We then ran docker compose down, changed IMMICH_VERSION to v3.3.5, pulled the images and started again.

Results after the upgrade:

  • All four containers started on the v3.3.5 images. The server reported healthy.
  • The API reported version 3.3.5 and the web UI answered with HTTP 200.
  • The uploaded photo was still there (statistics showed 1 photo, 9059 bytes).
  • The log contained a “Detected schema drift” warning about a missing index, idx_geodata_places_alternate_names. We did not capture the 3.3.4 logs before the upgrade, so we can’t say whether it is new in 3.3.5. We saw no other errors or fatal messages.

We did not test the security fixes themselves, or machine learning, video transcoding or the mobile apps. The data check was one small image on a fresh install.

Lab log

$ docker compose up -d
[...]
 Container immich_server  Started
$ curl -s localhost:2283/api/server/version
{"major":3,"minor":3,"patch":4,"prerelease":null}
$ curl -s localhost:2283/api/server/statistics -H "x-immich-user-token: [redacted]"
{"photos":1,"videos":0,"usage":9059,"usagePhotos":9059,"usageVideos":0,"usageByUser":[...]}
$ docker compose down
[...]
 Network immich_default  Removed
$ sed -i "s/^IMMICH_VERSION=.*/IMMICH_VERSION=v3.3.5/" .env
$ docker compose pull
[...]
 immich-server Pulled
$ docker compose up -d
[...]
 Container immich_server  Started
$ curl -s localhost:2283/api/server/version
{"major":3,"minor":3,"patch":5,"prerelease":null}
$ docker compose ps --format "{{.Name}} {{.Image}} {{.Status}}"
immich_machine_learning ghcr.io/immich-app/immich-machine-learning:v3.3.5 Up 43 seconds (h[...]
immich_server ghcr.io/immich-app/immich-server:v3.3.5 Up 43 seconds (healthy)
$ curl -s localhost:2283/api/server/statistics -H "x-immich-user-token: [redacted]"
{"photos":1,"videos":0,"usage":9059,"usagePhotos":9059,"usageVideos":0,"usageByUser":[...]}
$ curl -s -o /dev/null -w "%{http_code}\n" localhost:2283/
200

Reported by others

Nothing beyond the maintainers’ own release notes, which we summarised above. We did not look for user reports.

Verdict

Upgrade soon. The maintainers recommend it for security reasons, and the upgrade from 3.3.4 worked in our lab with data intact. Back up your database and library first, as usual.

sources