clawbot 6241c6a425 Refuse, before decoding, input libvips would not load as a source format ...

govips picks the libvips loader for the input with DetermineImageType.
The image processor now names the format from that type before decoding,
and refuses with ErrUnsupportedInputFormat, answered 415, any input it
cannot name as one of the six source formats. An SVG whose first bytes
pass the first-bytes check for AVIF therefore never reaches librsvg.
orig is the format named there. README.md and TODO.md say so.

Model: opus-5-5

2026-10-13 03:20:52 +00:00

..

allowlist

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

app

Move pixad's startup from cmd/pixad into internal/app (closes #206)

2026-10-05 01:07:47 +02:00

clientip

Resolve real client IP behind trusted proxies (closes #94)

2026-09-22 10:25:41 +02:00

config

Limit each client's requests to the image routes (closes #236)

2026-10-13 01:36:18 +02:00

database

Queue SQLite writes on one connection so none fails as locked (closes #223)

2026-10-08 04:50:31 +02:00

db/migrations

Eviction no longer reads a whole table while requests wait on the database (closes #227)

2026-10-08 07:12:02 +02:00

encurl

Serve JPEG XL when a request names no format (closes #222)

2026-10-08 12:49:56 +02:00

globals

Move pixad's startup from cmd/pixad into internal/app (closes #206)

2026-10-05 01:07:47 +02:00

handlers

Refuse SVG at the fetcher and never save an unknown input as JPEG (closes #68)

2026-10-13 02:19:41 +00:00

healthcheck

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

httpfetcher

Refuse SVG at the fetcher and never save an unknown input as JPEG (closes #68)

2026-10-13 02:19:41 +00:00

imageprocessor

Refuse, before decoding, input libvips would not load as a source format

2026-10-13 03:20:52 +00:00

imgcache

Keep counts not written by the request's deadline in memory (closes #224)

2026-10-13 03:07:23 +02:00

loadtestorigin

Add script/loadtest to measure throughput, latency and memory (closes #81)

2026-10-05 02:58:41 +02:00

logger

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

magic

Serve and accept JPEG XL as an image format (part of #222)

2026-10-08 11:01:12 +02:00

middleware

Limit each client's requests to the image routes (closes #236)

2026-10-13 01:36:18 +02:00

seal

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

server

Test that an SVG served as AVIF is refused, and that each source format loads

2026-10-13 03:20:48 +00:00

session

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

signature

Include quality and fit in the URL signature (closes #60)

2026-09-28 13:02:21 +02:00

static

Remove unsafe-inline from the Content-Security-Policy (closes #125)

2026-10-04 18:58:40 +02:00

templates

Serve JPEG XL when a request names no format (closes #222)

2026-10-08 12:49:56 +02:00