clawbot 69dd0143e8 Test that an SVG served as AVIF is refused, and that each source format loads ...

An SVG starting with an XML comment holding "ftypavis" passes the
first-bytes check for AVIF; resized as PNG, it is answered 200 with the
SVG rendered. The new server test asks for it through both image routes,
resized and as orig, and wants 415 for each. The new processor test
checks that an image in each of the six source formats loads and is saved
again in its own format.

Model: opus-5-5

2026-10-13 03:18:22 +00:00

..

allowlist

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

app

Move pixad's startup from cmd/pixad into internal/app (closes #206)

2026-10-05 01:07:47 +02:00

clientip

Resolve real client IP behind trusted proxies (closes #94)

2026-09-22 10:25:41 +02:00

config

Limit each client's requests to the image routes (closes #236)

2026-10-13 01:36:18 +02:00

database

Queue SQLite writes on one connection so none fails as locked (closes #223)

2026-10-08 04:50:31 +02:00

db/migrations

Eviction no longer reads a whole table while requests wait on the database (closes #227)

2026-10-08 07:12:02 +02:00

encurl

Serve JPEG XL when a request names no format (closes #222)

2026-10-08 12:49:56 +02:00

globals

Move pixad's startup from cmd/pixad into internal/app (closes #206)

2026-10-05 01:07:47 +02:00

handlers

Refuse SVG at the fetcher and never save an unknown input as JPEG (closes #68)

2026-10-13 02:19:41 +00:00

healthcheck

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

httpfetcher

Refuse SVG at the fetcher and never save an unknown input as JPEG (closes #68)

2026-10-13 02:19:41 +00:00

imageprocessor

Test that an SVG served as AVIF is refused, and that each source format loads

2026-10-13 03:18:22 +00:00

imgcache

Keep counts not written by the request's deadline in memory (closes #224)

2026-10-13 03:07:23 +02:00

loadtestorigin

Add script/loadtest to measure throughput, latency and memory (closes #81)

2026-10-05 02:58:41 +02:00

logger

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

magic

Serve and accept JPEG XL as an image format (part of #222)

2026-10-08 11:01:12 +02:00

middleware

Limit each client's requests to the image routes (closes #236)

2026-10-13 01:36:18 +02:00

seal

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

server

Test that an SVG served as AVIF is refused, and that each source format loads

2026-10-13 03:18:22 +00:00

session

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

signature

Include quality and fit in the URL signature (closes #60)

2026-09-28 13:02:21 +02:00

static

Remove unsafe-inline from the Content-Security-Policy (closes #125)

2026-10-04 18:58:40 +02:00

templates

Serve JPEG XL when a request names no format (closes #222)

2026-10-08 12:49:56 +02:00