sharp 0.29.3 → 0.30.2

package/README.md

@@ -1,10 +1,10 @@
 # sharp
 
-<img src="https://cdn.jsdelivr.net/gh/lovell/sharp@master/docs/image/sharp-logo.svg" width="160" height="160" alt="sharp logo" align="right">
+<img src="https://cdn.jsdelivr.net/gh/lovell/sharp@main/docs/image/sharp-logo.svg" width="160" height="160" alt="sharp logo" align="right">
 
 The typical use case for this high speed Node.js module
 is to convert large images in common formats to
-smaller, web-friendly JPEG, PNG, WebP and AVIF images of varying dimensions.
+smaller, web-friendly JPEG, PNG, WebP, GIF and AVIF images of varying dimensions.
 
 Resizing an image is typically 4x-5x faster than using the
 quickest ImageMagick and GraphicsMagick settings
@@ -95,15 +95,15 @@ readableStream
 
 ## Contributing
 
-A [guide for contributors](https://github.com/lovell/sharp/blob/master/.github/CONTRIBUTING.md)
+A [guide for contributors](https://github.com/lovell/sharp/blob/main/.github/CONTRIBUTING.md)
 covers reporting bugs, requesting features and submitting code changes.
 
-[![Test Coverage](https://coveralls.io/repos/lovell/sharp/badge.svg?branch=master)](https://coveralls.io/r/lovell/sharp?branch=master)
+[![Test Coverage](https://coveralls.io/repos/lovell/sharp/badge.svg?branch=main)](https://coveralls.io/r/lovell/sharp?branch=main)
 [![Node-API v5](https://img.shields.io/badge/Node--API-v5-green.svg)](https://nodejs.org/dist/latest/docs/api/n-api.html#n_api_n_api_version_matrix)
 
 ## Licensing
 
-Copyright 2013, 2014, 2015, 2016, 2017, 2018, 2019, 2020, 2021 Lovell Fuller and contributors.
+Copyright 2013, 2014, 2015, 2016, 2017, 2018, 2019, 2020, 2021, 2022 Lovell Fuller and contributors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

package/install/libvips.js

@@ -5,6 +5,7 @@ const os = require('os');
 const path = require('path');
 const stream = require('stream');
 const zlib = require('zlib');
+const { createHash } = require('crypto');
 
 const detectLibc = require('detect-libc');
 const semverLessThan = require('semver/functions/lt');
@@ -18,7 +19,7 @@ const platform = require('../lib/platform');
 
 const minimumGlibcVersionByArch = {
   arm: '2.28',
-  arm64: '2.29',
+  arm64: '2.17',
   x64: '2.17'
 };
 
@@ -55,6 +56,33 @@ const handleError = function (err) {
   }
 };
 
+const verifyIntegrity = function (platformAndArch) {
+  const expected = libvips.integrity(platformAndArch);
+  if (installationForced || !expected) {
+    libvips.log(`Integrity check skipped for ${platformAndArch}`);
+    return new stream.PassThrough();
+  }
+  const hash = createHash('sha512');
+  return new stream.Transform({
+    transform: function (chunk, _encoding, done) {
+      hash.update(chunk);
+      done(null, chunk);
+    },
+    flush: function (done) {
+      const digest = `sha512-${hash.digest('base64')}`;
+      if (expected !== digest) {
+        libvips.removeVendoredLibvips();
+        libvips.log(`Integrity expected: ${expected}`);
+        libvips.log(`Integrity received: ${digest}`);
+        done(new Error(`Integrity check failed for ${platformAndArch}`));
+      } else {
+        libvips.log(`Integrity check passed for ${platformAndArch}`);
+        done();
+      }
+    }
+  });
+};
+
 const extractTarball = function (tarPath, platformAndArch) {
   const versionedVendorPath = path.join(__dirname, '..', 'vendor', minimumLibvipsVersion, platformAndArch);
   libvips.mkdirSync(versionedVendorPath);
@@ -66,6 +94,7 @@ const extractTarball = function (tarPath, platformAndArch) {
 
   stream.pipeline(
     fs.createReadStream(tarPath),
+    verifyIntegrity(platformAndArch),
     new zlib.BrotliDecompress(),
     tarFs.extract(versionedVendorPath, { ignore }),
     function (err) {
@@ -103,14 +132,16 @@ try {
       throw new Error(`BSD/SunOS systems require manual installation of libvips >= ${minimumLibvipsVersion}`);
     }
     // Linux libc version check
-    if (detectLibc.family === detectLibc.GLIBC && detectLibc.version && minimumGlibcVersionByArch[arch]) {
-      if (semverLessThan(`${detectLibc.version}.0`, `${minimumGlibcVersionByArch[arch]}.0`)) {
-        handleError(new Error(`Use with glibc ${detectLibc.version} requires manual installation of libvips >= ${minimumLibvipsVersion}`));
+    const libcFamily = detectLibc.familySync();
+    const libcVersion = detectLibc.versionSync();
+    if (libcFamily === detectLibc.GLIBC && libcVersion && minimumGlibcVersionByArch[arch]) {
+      if (semverLessThan(`${libcVersion}.0`, `${minimumGlibcVersionByArch[arch]}.0`)) {
+        handleError(new Error(`Use with glibc ${libcVersion} requires manual installation of libvips >= ${minimumLibvipsVersion}`));
       }
     }
-    if (detectLibc.family === detectLibc.MUSL && detectLibc.version) {
-      if (semverLessThan(detectLibc.version, '1.1.24')) {
-        handleError(new Error(`Use with musl ${detectLibc.version} requires manual installation of libvips >= ${minimumLibvipsVersion}`));
+    if (libcFamily === detectLibc.MUSL && libcVersion) {
+      if (semverLessThan(libcVersion, '1.1.24')) {
+        handleError(new Error(`Use with musl ${libcVersion} requires manual installation of libvips >= ${minimumLibvipsVersion}`));
       }
     }
     // Node.js minimum version check
@@ -120,7 +151,7 @@ try {
     }
 
     // Download to per-process temporary file
-    const tarFilename = ['libvips', minimumLibvipsVersion, platformAndArch].join('-') + '.tar.br';
+    const tarFilename = ['libvips', minimumLibvipsVersionLabelled, platformAndArch].join('-') + '.tar.br';
     const tarPathCache = path.join(libvips.cachePath(), tarFilename);
     if (fs.existsSync(tarPathCache)) {
       libvips.log(`Using cached ${tarPathCache}`);

package/lib/composite.js

@@ -162,7 +162,6 @@ function composite (images) {
         throw is.invalidParameterError('premultiplied', 'boolean', image.premultiplied);
       }
     }
-
     return composite;
   });
   return this;

package/lib/constructor.js

@@ -13,7 +13,7 @@ const debuglog = util.debuglog('sharp');
 /**
  * Constructor factory to create an instance of `sharp`, to which further methods are chained.
  *
- * JPEG, PNG, WebP, AVIF or TIFF format image data can be streamed out from this object.
+ * JPEG, PNG, WebP, GIF, AVIF or TIFF format image data can be streamed out from this object.
  * When using Stream based output, derived attributes are available from the `info` event.
  *
  * Non-critical problems encountered during processing are emitted as `warning` events.
@@ -103,6 +103,7 @@ const debuglog = util.debuglog('sharp');
  * @param {number|boolean} [options.limitInputPixels=268402689] - Do not process input images where the number of pixels
  *  (width x height) exceeds this limit. Assumes image dimensions contained in the input metadata can be trusted.
  *  An integral Number of pixels, zero or false to remove limit, true to use default limit of 268402689 (0x3FFF x 0x3FFF).
+ * @param {boolean} [options.unlimited=false] - Set this to `true` to remove safety features that help prevent memory exhaustion (SVG, PNG).
  * @param {boolean} [options.sequentialRead=false] - Set this to `true` to use sequential rather than random access where possible.
  *  This can reduce memory usage and might improve performance on some systems.
  * @param {number} [options.density=72] - number representing the DPI for vector images in the range 1 to 100000.
@@ -165,6 +166,7 @@ const Sharp = function (input, options) {
     extendRight: 0,
     extendBackground: [0, 0, 0, 255],
     withoutEnlargement: false,
+    withoutReduction: false,
     affineMatrix: [],
     affineBackground: [0, 0, 0, 255],
     affineIdx: 0,
@@ -233,6 +235,7 @@ const Sharp = function (input, options) {
     pngAdaptiveFiltering: false,
     pngPalette: false,
     pngQuality: 100,
+    pngEffort: 7,
     pngBitdepth: 8,
     pngDither: 1,
     jp2Quality: 80,
@@ -245,7 +248,10 @@ const Sharp = function (input, options) {
     webpLossless: false,
     webpNearLossless: false,
     webpSmartSubsample: false,
-    webpReductionEffort: 4,
+    webpEffort: 4,
+    gifBitdepth: 8,
+    gifEffort: 7,
+    gifDither: 1,
     tiffQuality: 80,
     tiffCompression: 'jpeg',
     tiffPredictor: 'horizontal',
@@ -256,10 +262,11 @@ const Sharp = function (input, options) {
     tiffTileWidth: 256,
     tiffXres: 1.0,
     tiffYres: 1.0,
+    tiffResolutionUnit: 'inch',
     heifQuality: 50,
     heifLossless: false,
     heifCompression: 'av1',
-    heifSpeed: 5,
+    heifEffort: 4,
     heifChromaSubsampling: '4:4:4',
     rawDepth: 'uchar',
     tileSize: 256,

package/lib/input.js

@@ -9,9 +9,9 @@ const sharp = require('./sharp');
  * @private
  */
 function _inputOptionsFromObject (obj) {
-  const { raw, density, limitInputPixels, sequentialRead, failOnError, animated, page, pages, subifd } = obj;
-  return [raw, density, limitInputPixels, sequentialRead, failOnError, animated, page, pages, subifd].some(is.defined)
-    ? { raw, density, limitInputPixels, sequentialRead, failOnError, animated, page, pages, subifd }
+  const { raw, density, limitInputPixels, unlimited, sequentialRead, failOnError, animated, page, pages, subifd } = obj;
+  return [raw, density, limitInputPixels, unlimited, sequentialRead, failOnError, animated, page, pages, subifd].some(is.defined)
+    ? { raw, density, limitInputPixels, unlimited, sequentialRead, failOnError, animated, page, pages, subifd }
     : undefined;
 }
 
@@ -23,6 +23,7 @@ function _createInputDescriptor (input, inputOptions, containerOptions) {
   const inputDescriptor = {
     failOnError: true,
     limitInputPixels: Math.pow(0x3FFF, 2),
+    unlimited: false,
     sequentialRead: false
   };
   if (is.string(input)) {
@@ -83,6 +84,14 @@ function _createInputDescriptor (input, inputOptions, containerOptions) {
         throw is.invalidParameterError('limitInputPixels', 'integer >= 0', inputOptions.limitInputPixels);
       }
     }
+    // unlimited
+    if (is.defined(inputOptions.unlimited)) {
+      if (is.bool(inputOptions.unlimited)) {
+        inputDescriptor.unlimited = inputOptions.unlimited;
+      } else {
+        throw is.invalidParameterError('unlimited', 'boolean', inputOptions.unlimited);
+      }
+    }
     // sequentialRead
     if (is.defined(inputOptions.sequentialRead)) {
       if (is.bool(inputOptions.sequentialRead)) {
@@ -281,7 +290,11 @@ function _isStreamInput () {
 }
 
 /**
- * Fast access to (uncached) image metadata without decoding any compressed image data.
+ * Fast access to (uncached) image metadata without decoding any compressed pixel data.
+ *
+ * This is taken from the header of the input image.
+ * It does not include operations, such as resize, to be applied to the output image.
+ *
  * A `Promise` is returned when `callback` is not provided.
  *
  * - `format`: Name of decoder used to decompress image data e.g. `jpeg`, `png`, `webp`, `gif`, `svg`
@@ -303,6 +316,7 @@ function _isStreamInput () {
  * - `subifds`: Number of Sub Image File Directories in an OME-TIFF image
  * - `background`: Default background colour, if present, for PNG (bKGD) and GIF images, either an RGB Object or a single greyscale value
  * - `compression`: The encoder used to compress an HEIF file, `av1` (AVIF) or `hevc` (HEIC)
+ * - `resolutionUnit`: The unit of resolution (density), either `inch` or `cm`, if present
  * - `hasProfile`: Boolean indicating the presence of an embedded ICC profile
  * - `hasAlpha`: Boolean indicating the presence of an alpha transparency channel
  * - `orientation`: Number value of the EXIF Orientation header, if present
@@ -313,6 +327,9 @@ function _isStreamInput () {
  * - `tifftagPhotoshop`: Buffer containing raw TIFFTAG_PHOTOSHOP data, if present
  *
  * @example
+ * const metadata = await sharp(input).metadata();
+ *
+ * @example
  * const image = sharp(inputJpg);
  * image
  *   .metadata()

package/lib/libvips.js

@@ -8,10 +8,11 @@ const semverCoerce = require('semver/functions/coerce');
 const semverGreaterThanOrEqualTo = require('semver/functions/gte');
 
 const platform = require('./platform');
+const { config } = require('../package.json');
 
 const env = process.env;
 const minimumLibvipsVersionLabelled = env.npm_package_config_libvips || /* istanbul ignore next */
-  require('../package.json').config.libvips;
+  config.libvips;
 const minimumLibvipsVersion = semverCoerce(minimumLibvipsVersionLabelled).version;
 
 const spawnSyncOptions = {
@@ -19,6 +20,8 @@ const spawnSyncOptions = {
   shell: true
 };
 
+const vendorPath = path.join(__dirname, '..', 'vendor', minimumLibvipsVersion, platform());
+
 const mkdirSync = function (dirPath) {
   try {
     fs.mkdirSync(dirPath, { recursive: true });
@@ -39,6 +42,10 @@ const cachePath = function () {
   return libvipsCachePath;
 };
 
+const integrity = function (platformAndArch) {
+  return env[`npm_package_config_integrity_${platformAndArch.replace('-', '_')}`] || config.integrity[platformAndArch];
+};
+
 const log = function (item) {
   if (item instanceof Error) {
     console.error(`sharp: Installation error: ${item.message}`);
@@ -67,16 +74,26 @@ const globalLibvipsVersion = function () {
 };
 
 const hasVendoredLibvips = function () {
-  const vendorPath = path.join(__dirname, '..', 'vendor', minimumLibvipsVersion, platform());
   return fs.existsSync(vendorPath);
 };
 
+/* istanbul ignore next */
+const removeVendoredLibvips = function () {
+  const rm = fs.rmSync ? fs.rmSync : fs.rmdirSync;
+  rm(vendorPath, { recursive: true, maxRetries: 3, force: true });
+};
+
 const pkgConfigPath = function () {
   if (process.platform !== 'win32') {
     const brewPkgConfigPath = spawnSync('which brew >/dev/null 2>&1 && eval $(brew --env) && echo $PKG_CONFIG_LIBDIR', spawnSyncOptions).stdout || '';
-    return [brewPkgConfigPath.trim(), env.PKG_CONFIG_PATH, '/usr/local/lib/pkgconfig', '/usr/lib/pkgconfig']
-      .filter(function (p) { return !!p; })
-      .join(':');
+    return [
+      brewPkgConfigPath.trim(),
+      env.PKG_CONFIG_PATH,
+      '/usr/local/lib/pkgconfig',
+      '/usr/lib/pkgconfig',
+      '/usr/local/libdata/pkgconfig',
+      '/usr/libdata/pkgconfig'
+    ].filter(Boolean).join(':');
   } else {
     return '';
   }
@@ -99,9 +116,11 @@ module.exports = {
   minimumLibvipsVersion,
   minimumLibvipsVersionLabelled,
   cachePath,
+  integrity,
   log,
   globalLibvipsVersion,
   hasVendoredLibvips,
+  removeVendoredLibvips,
   pkgConfigPath,
   useGlobalLibvips,
   mkdirSync

package/lib/operation.js

@@ -245,8 +245,21 @@ function median (size) {
 
 /**
  * Blur the image.
- * When used without parameters, performs a fast, mild blur of the output image.
+ *
+ * When used without parameters, performs a fast 3x3 box blur (equivalent to a box linear filter).
+ *
  * When a `sigma` is provided, performs a slower, more accurate Gaussian blur.
+ *
+ * @example
+ * const boxBlurred = await sharp(input)
+ *   .blur()
+ *   .toBuffer();
+ *
+ * @example
+ * const gaussianBlurred = await sharp(input)
+ *   .blur(5)
+ *   .toBuffer();
+ *
  * @param {number} [sigma] a value between 0.3 and 1000 representing the sigma of the Gaussian mask, where `sigma = 1 + radius / 2`.
  * @returns {Sharp}
  * @throws {Error} Invalid parameters