safe_image 0.3.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ce9a76b504fa826aef4164c5748c800a95828ef7fda6bda3a00e7e85f0134f38
-  data.tar.gz: 61c5ebac14806e8e3445c3e7aa73bb1ab5191cc414e1af311b752ad0be492bc7
+  metadata.gz: 1f73bfd1e95c6fbb93ad43254cbff0b2d14cf1d667b5af58daf3e7f2311e3240
+  data.tar.gz: 598bc5111672e82b922bfc134c168488ad9348b2b85cf5d6f3ac6d12c959ddfc
 SHA512:
-  metadata.gz: 5d15f34ca4de05f1ca4618695bc3993a000ce38a7de54afde86ac87497c0288ad0ed37493ca31431669341be10991bbcdb5192796ea6bdb3af016943adfac2bc
-  data.tar.gz: e71a59800452d4d396741e4e28134c47403490100233e803644a90a0ca967abd74fb5572a936a7af247411cb2055378982bccad89085085184aa92c66ca94d0d
+  metadata.gz: d3dd059f65b1f5d5ad43290aaf3e654817eca8d5127f90717cbf91739c31b92c9674c5fcc73c5b61a5b2be724c5b8053e298a35f6063cd880959a3ccfb9916c8
+  data.tar.gz: 5eeb7da08494d4e76f6ba5e9aa6479b083c8e1cd8f40fa7779537c00884a0e5cb068714b6fbf6ece00fc82fcdc39919c458c2fadcc4740b1348786a88871fb7a

data/CHANGELOG.md

@@ -5,6 +5,19 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.0 - 2026-06-18]
+
+### Removed (breaking)
+
+- Removed `SafeImage.sanitize_svg!` and the internal SVG/CSS sanitizer
+  implementation. Safe Image still supports bounded SVG metadata probing for
+  local and remote `.svg` files, but applications that need to clean or inline
+  user-supplied SVG content must use a dedicated sanitizer outside this gem.
+- Removed the compatibility/in-place file-writing APIs. `resize`, `crop`,
+  `downsize`, `convert`, `fix_orientation`, `convert_favicon_to_png`, and
+  `optimize` now require explicit, distinct `input:` and `output:` paths;
+  `optimize_image!` and `convert_to_jpeg` are gone.
+
 ## [0.3.0 - 2026-06-12]
 
 ### Changed (breaking)
@@ -81,8 +94,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   allowlist, all TCP denied on ABI ≥ 4, abstract-unix-socket/signal scopes on
   ABI ≥ 6), and — when the installed `landlock` gem exposes
   `seccomp_deny_network!` — the helper's deny-all-network seccomp filter
-  (blocking sockets of every family, closing the UDP gap the in-process
-  Landlock policy alone leaves open), *before* touching untrusted input, and
+  (blocking sockets of every family), *before* touching untrusted input, and
   exits after the operation. Workers are pooled so N threads run N sandboxed
   operations at once (the single zygote would serialise them): the pool grows
   on demand to `SAFE_IMAGE_ZYGOTE_WORKERS` (default 8) and offered concurrency
@@ -284,18 +296,15 @@ between backends.
 - Graceful operation without libvips: the new `SafeImage::VipsUnavailableError`
   (a subclass of `UnsupportedFormatError`) makes `backend: :auto` route through
   ImageMagick on hosts without the library, while explicit `backend: :vips`
-  calls fail closed. `SafeImage::VipsGlue.available?` reports the state.
+  calls fail closed. `SafeImage::Native.available?` reports the state.
 - `docker/run.sh`: containerised validation against Debian bookworm's packaged
-  libvips 8.14 with no toolchain installed.
+  libvips 8.14 and native-helper build/install.
 
 ### Changed
 
-- **The compiled C extension is gone.** libvips is now bound at runtime
-  through a minimal Fiddle binding (`SafeImage::VipsGlue`) that exposes only
-  the operations the gem invokes. Nothing compiles at gem install time; the
-  only gem dependencies are `fiddle` and `rexml`. Minimum libvips is 8.13
-  (Debian bookworm's 8.14 package is tested); `SAFE_IMAGE_LIBVIPS` overrides
-  the library name.
+- **The compiled C helper owns libvips execution.** libvips is initialized in
+  the bundled helper process, which exposes only the operations the gem invokes.
+  Minimum libvips is 8.13 (Debian bookworm's 8.14 package is tested).
 - All transform defaults are now native-first: `resize`, `crop`, `downsize`,
   `convert` and `thumbnail` default to `backend: :auto` (previously
   ImageMagick for the first three and `:vips` fail-closed for `thumbnail`).
@@ -337,8 +346,8 @@ between backends.
   untrusted-operation block: JPEG XL is part of the supported input surface,
   and inputs still pass extension routing, pixel caps and (optionally) the
   Landlock sandbox.
-- The Fiddle binding doubles as an operation allowlist, and a leak-loop test
-  guards GObject reference handling.
+- The native helper doubles as an operation allowlist, and a leak-loop test
+  guards helper request handling.
 
 ## [0.1.0] - 2026-06-09