safe_image 0.3.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ce9a76b504fa826aef4164c5748c800a95828ef7fda6bda3a00e7e85f0134f38
-  data.tar.gz: 61c5ebac14806e8e3445c3e7aa73bb1ab5191cc414e1af311b752ad0be492bc7
+  metadata.gz: 29ce0a1f4932ad1cf1dd7e47c6ae9b29009a7d2d63d54e350ec62feb1dc09e22
+  data.tar.gz: 2bd28448920dc859ddb8e5a0703d51163aee702807184971b8bcea594fd36fec
 SHA512:
-  metadata.gz: 5d15f34ca4de05f1ca4618695bc3993a000ce38a7de54afde86ac87497c0288ad0ed37493ca31431669341be10991bbcdb5192796ea6bdb3af016943adfac2bc
-  data.tar.gz: e71a59800452d4d396741e4e28134c47403490100233e803644a90a0ca967abd74fb5572a936a7af247411cb2055378982bccad89085085184aa92c66ca94d0d
+  metadata.gz: c756eb00ec11291985e5b9f6f573abf19399c0592e1e7d390e9239e29d359893432f55a86283441d22e22bd6a3b0d0f98b3886735d73737c809937320220b0ca
+  data.tar.gz: 2b7b4e9d309a6184a9881010eb058990eb4b86b293ca717c26f12d89cc9310fa8dc03a8bb9dcbeb6071840529a86f0d68726cda8715602d46ab1bc7bb80f8aae

data/CHANGELOG.md

@@ -5,6 +5,59 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.5.0 - 2026-06-22]
+
+### Changed
+
+- **The `:vips` backend now runs libvips in the bundled native helper process.**
+  Ruby no longer loads libvips into the application process for probing,
+  thumbnailing, converting, orientation, dominant-color, ICO pixel extraction,
+  or letter-avatar generation. The helper exposes only the operations Safe Image
+  calls, blocks unsafe libvips operations/loaders, and fails closed when the
+  helper is unavailable; there is still no fallback from `:vips` to
+  ImageMagick.
+- **Sandboxing now uses the public Landlock API around helper/tool processes.**
+  The previous Ruby zygote/worker sandbox plumbing was removed in favour of
+  simpler process execution with explicit read/write/execute allowlists and the
+  existing rlimits/network-deny posture.
+- **Operation dispatch was simplified.** Transform and metadata operations now
+  dispatch directly to backend operation classes, removing an internal
+  forwarding layer while preserving the public API.
+- **PNG optimization now mirrors Discourse's ordering.** Safe Image runs a
+  lossless PNG optimizer first, then optionally runs `pngquant` for small lossy
+  PNG optimization attempts. `oxipng` remains preferred when installed, with
+  `optipng` accepted as a packaged fallback.
+
+### Added
+
+- Added a shared metadata result builder to keep SVG, ICO, vips, and
+  ImageMagick metadata probe results consistent.
+- Added a `native:build` rake task and made `rake test` build/install the
+  `safe_image_vips_helper` binary before running the test suite.
+
+### Fixed
+
+- Fixed source-tree and CI test runs where `SafeImage.configure!(backend:
+  :vips)` failed because `lib/safe_image/safe_image_vips_helper` had not been
+  built yet.
+- Fixed CI setup order so libvips development headers are installed before
+  bundler/native build steps run.
+- Fixed CI portability by avoiding an apt dependency on unavailable `oxipng`
+  packages; CI now uses packaged `optipng` for PNG lossless optimizer coverage.
+
+## [0.4.0 - 2026-06-18]
+
+### Removed (breaking)
+
+- Removed `SafeImage.sanitize_svg!` and the internal SVG/CSS sanitizer
+  implementation. Safe Image still supports bounded SVG metadata probing for
+  local and remote `.svg` files, but applications that need to clean or inline
+  user-supplied SVG content must use a dedicated sanitizer outside this gem.
+- Removed the compatibility/in-place file-writing APIs. `resize`, `crop`,
+  `downsize`, `convert`, `fix_orientation`, `convert_favicon_to_png`, and
+  `optimize` now require explicit, distinct `input:` and `output:` paths;
+  `optimize_image!` and `convert_to_jpeg` are gone.
+
 ## [0.3.0 - 2026-06-12]
 
 ### Changed (breaking)
@@ -81,8 +134,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   allowlist, all TCP denied on ABI ≥ 4, abstract-unix-socket/signal scopes on
   ABI ≥ 6), and — when the installed `landlock` gem exposes
   `seccomp_deny_network!` — the helper's deny-all-network seccomp filter
-  (blocking sockets of every family, closing the UDP gap the in-process
-  Landlock policy alone leaves open), *before* touching untrusted input, and
+  (blocking sockets of every family), *before* touching untrusted input, and
   exits after the operation. Workers are pooled so N threads run N sandboxed
   operations at once (the single zygote would serialise them): the pool grows
   on demand to `SAFE_IMAGE_ZYGOTE_WORKERS` (default 8) and offered concurrency
@@ -284,18 +336,15 @@ between backends.
 - Graceful operation without libvips: the new `SafeImage::VipsUnavailableError`
   (a subclass of `UnsupportedFormatError`) makes `backend: :auto` route through
   ImageMagick on hosts without the library, while explicit `backend: :vips`
-  calls fail closed. `SafeImage::VipsGlue.available?` reports the state.
+  calls fail closed. `SafeImage::Native.available?` reports the state.
 - `docker/run.sh`: containerised validation against Debian bookworm's packaged
-  libvips 8.14 with no toolchain installed.
+  libvips 8.14 and native-helper build/install.
 
 ### Changed
 
-- **The compiled C extension is gone.** libvips is now bound at runtime
-  through a minimal Fiddle binding (`SafeImage::VipsGlue`) that exposes only
-  the operations the gem invokes. Nothing compiles at gem install time; the
-  only gem dependencies are `fiddle` and `rexml`. Minimum libvips is 8.13
-  (Debian bookworm's 8.14 package is tested); `SAFE_IMAGE_LIBVIPS` overrides
-  the library name.
+- **The compiled C helper owns libvips execution.** libvips is initialized in
+  the bundled helper process, which exposes only the operations the gem invokes.
+  Minimum libvips is 8.13 (Debian bookworm's 8.14 package is tested).
 - All transform defaults are now native-first: `resize`, `crop`, `downsize`,
   `convert` and `thumbnail` default to `backend: :auto` (previously
   ImageMagick for the first three and `:vips` fail-closed for `thumbnail`).
@@ -337,8 +386,8 @@ between backends.
   untrusted-operation block: JPEG XL is part of the supported input surface,
   and inputs still pass extension routing, pixel caps and (optionally) the
   Landlock sandbox.
-- The Fiddle binding doubles as an operation allowlist, and a leak-loop test
-  guards GObject reference handling.
+- The native helper doubles as an operation allowlist, and a leak-loop test
+  guards helper request handling.
 
 ## [0.1.0] - 2026-06-09