imgproxy
Media ServersFast and secure standalone server for resizing and converting remote images.
Features
- On‑the‑fly image resizing, cropping, rotation, watermarking and format conversion (JPEG, PNG, GIF, WebP, AVIF, JPEG XL)
- Security‑focused design – imgproxy fetches source images and serves processed results without exposing your application’s internals
- Drop‑in replacement for in‑app image‑processing code; generate URLs with processing options instead of calling libraries or CLI tools
Recent releases
View all 8 releases →
v3.31.1
Bugfix
Fixed memory leak when saving HEIC/AVIF images with an alpha channel.
Changelog
Fixed
- Fix memory leak when saving HEIC/AVIF images with alpha channel.
v3.31.0
Breaking risk
⚠ Upgrade required
- -keypath → IMGPROXY_KEY, -saltpath → IMGPROXY_SALT (use environment variables)
- -presets → IMGPROXY_PRESETS_PATH (environment variable)
- (pro) -info-presets → IMGPROXY_INFO_PRESETS_PATH (environment variable)
Breaking changes
- IMGPROXY_FAIL_ON_DEPRECATION when true causes imgproxy to exit with a fatal error on any deprecated config option usage
- -keypath, -saltpath, and -presets CLI arguments are deprecated (use environment variables instead)
- (pro) DarkNet object detection model support is deprecated; use ONNX format
Notable features
- flip processing option
- IMGPROXY_PRESETS_PATH config
- (pro) avif_options processing option
Full changelog
Added
- Add IMGPROXY_FAIL_ON_DEPRECATION config. When set to
true, imgproxy will exit with a fatal error if a deprecated config option is used. - Add flip processing option.
- Add IMGPROXY_PRESETS_PATH config.
- (pro) Add IMGPROXY_INFO_PRESETS_PATH config.
- (pro) Add IMGPROXY_AVIF_SUBSAMPLE config.
- (pro) Add avif_options processing option.
- (pro) Add blur_areas processing option.
- (pro) Add
canonical_namesargument to the exif info option. - (pro) Return
orientationfield in the/infoendpoint response when the dimensions info option is enabled.
Changed
- For security reasons, imgproxy now accepts only service account keys for Google Cloud Storage integration and Google Cloud Secret Manager integration.
- When image source responds with a 4xx status code, imgproxy now responds with the same status code instead of always responding with
404 Not Found. - When image source responds with a 5xx status code, imgproxy now responds with
502 Bad Gatewayinstead of500 Internal Server Error. - Remove
iframeelements from SVGs during sanitization.
Fixed
- Fix crop coordinates calculation when the image has an EXIF orientation different from
1and therotateprocessing option is used. - Fix responding with 404 when a GCS bucket or object is missing.
- Fix handling
:encoded as%3Ain processing/info options. - (pro) Fix memory leak in ML features.
- (pro) Fix generating video thumbnails when the server doesn't include the
Accept-Rangesheader in the response but includes theContent-Range: bytes ...header. - (pro) Fix watermark_size processing option behavior when one of the dimensions is zero.
Deprecated
- Deprecate
-keypathand-saltpathCLI arguments. UseIMGPROXY_KEYandIMGPROXY_SALTenvironment variables instead. - Deprecate
-presetsCLI argument. UseIMGPROXY_PRESETS_PATHenvironment variable instead. - (pro) Deprecate
-info-presetsCLI argument. UseIMGPROXY_INFO_PRESETS_PATHenvironment variable instead. - (pro) Deprecate support for object detection models in DarkNet format. Use ONNX format instead.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
