Fixed

• Fixed possible BMP loader heap buffer overflow.
• (pro) Fixed SVG minifier failure on empty comments.
• SVG sanitizator now strips dangerous href values in all the elements.
• Fixed truncation of source image downloads when origins returned gzip-compressed responses.
• The Content-Length header was previously ignored for S3, Google Cloud Storage, Azure Blob Storage, and Swift responses.
• SVG sanitizer now strips unsafe href/xlink:href attribute values (such as javascript:) from all elements, not just <use>, preventing script execution via crafted SVGs.
• SSRF boundary bypass in private source address guard. The guard now correctly rejects RFC 6598 CGNAT addresses (100.64.0.0/10) and detects IPv6 addresses that carry embedded IPv4 payloads (IPv4-compatible, 6to4, NAT64 well-known, NAT64 local-use, Teredo, ISATAP), per RFC 3056, RFC 4291, RFC 4380, RFC 5214, RFC 6052, RFC 8215.

Fixed

• (pro) Non-essential cache errors are no longer reported.

Fixed

• (pro) Non-essential cache errors are no longer reported.

Added

• requests_total, status_codes_total, errors_total, request_duration_seconds, request_span_duration_seconds metrics to OpenTelemetry.
• (pro) cache_hits_total, cache_misses_total metrics.

Changed

• devcontainers are now using volumes for caching.

• (docker) Fix loading HEIC/AVIF images with large number of items (for real this time).

Fixed

• (docker) Fix loading HEIC/AVIF images with large number of items.

Changed

• Remove form tags from SVGs during sanitization.
• Use more strict Content-Security-Policy header: default-src 'none'; style-src 'unsafe-inline'; img-src data:; sandbox.

Fixed

• Don't write the Cache-Control header for error responses.
• Allow zero IMGPROXY_MAX_REDIRECTS config value.

Fixed

• Fix handling of wide-gamut ICC profiles.

Fixed

• Fix AWS credentials lifetime when IMGPROXY_S3_ASSUME_ROLE_ARN config is used.
• (pro) Fix a rare deadlock during ML model inference.

Fixed

• Fix AWS credentials lifetime when IMGPROXY_S3_ASSUME_ROLE_ARN config is used.
• (pro) Fix a rare deadlock during ML model inference.