imgproxy

v4.0.6 Breaking

This release includes 2 breaking changes for platform teams planning a safe upgrade.

Published 1mo Media Servers

✓ No known CVEs patched

✓ No known CVEs patched in this version

Topics

avif crop-image docker go image image-processing

+9 more

image-server jpeg jpeg-xl jxl libvips microservice png resize-images webp

Affected surfaces

auth rce_ssrf

Summary

AI summary

Removed form tags from SVGs and hardened Content‑Security‑Policy headers.

Full changelog

Remove form tags from SVGs during sanitization.
Use more strict Content-Security-Policy header: default-src 'none'; style-src 'unsafe-inline'; img-src data:; sandbox.

Removed `form` tags from sanitized SVGs.
Content‑Security‑Policy header now defaults to `default-src 'none'; style-src 'unsafe-inline'; img-src data:; sandbox`, breaking prior configurations.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track imgproxy

Get notified when new releases ship.

About imgproxy

Fast and secure standalone server for resizing and converting remote images.

v4.0.0 Removed deprecated OpenTelemetry configuration options (endpoint, protocol, GRPC_INSECURE, propagators, connection timeout); use corresponding OTEL_* variables
v4.0.0 Docker images now built on Ubuntu 22.04; minimum libc version required is 2.35
v4.0.0 Minimum libc version requirement changed to 2.35
v4.0.0 Custom New Relic metrics renamed from imgproxy.X to Custom/imgproxy/X
v4.0.0 Log format and naming changed to match documentation