Skip to content

v2.4.2

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 19 Aug 05:26
· 11 commits to main since this release
v2.4.2
This tag was signed with the committer’s verified signature.
aseemann Axel Seemann
SSH Key Fingerprint: 8lRA9t55M0XwmLS2h+9QXpnBwCPImNUgmrMRqY/CMb0
Verified
Learn about vigilant mode.
47fb540
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v2.4.2 — three production-impacting fixes

This release folds in three bugfixes that had already surfaced in production on netresearch.de, plus routine CI/security hardening.

Fixed

  • Non-ASCII source paths no longer 500. Images living under a folder with a non-ASCII character (e.g. an umlaut in "Gründung") returned an empty-body HTTP 500 for every /processed/* variant. Root cause: an intervention/image v4 regression — its decoder auto-detection checks BinaryImageDecoder before FilePathImageDecoder, and misclassifies any path string containing a non-ASCII byte as raw binary data instead of a file path. Fixed by wrapping the path in SplFileInfo before decoding, which selects the decoder by input type instead of inspecting content. intervention/image v3 was never affected, so no TYPO3_12 backport was needed. (#156)

  • Zero-dimension responsive variants (w1920h0, w0h100) no longer collapse to 1×1px. SourceSetViewHelper encodes "derive this side from the aspect ratio" as 0 in the variant URL (stage teasers, height-based logos). A dimension-clamping change started flooring that 0 to 1, so those variants rendered as 1920×1 or 1×1 px images — invisible sliders above the last breakpoint, collapsed footer logos in production. 0 is now mapped to "derive from aspect ratio" again, same as an absent dimension. (#144)

  • Animated GIFs are passed through unprocessed instead of being re-encoded frame-by-frame. A multi-frame GIF routed through variant processing could hit the PHP max_execution_time fatal — uncatchable, so every retry burned another 30s — and completed variants came out ~5.5x larger than the source. Animated GIFs are now detected via a bounded byte-scan for the frame-separator sequence and short-circuited straight to the original file before decoding; static (single-frame) GIFs keep the normal resize/WebP/AVIF pipeline. (#143)

CI / security hardening

  • Added gitleaks and zizmor (GitHub Actions security linter) to the CI matrix, migrated to Rector 2.6 and the org's shared Rector config, pinned step-security/harden-runner to v2.21.0, and synced the reusable checks.yml workflow from the org template. (#145, #146, #147, #148, #150, #151, #152, #153, #157, #158)

Installation

composer require netresearch/nr-image-optimize

Publication status

Security

All release artifacts are signed with Sigstore keyless signing.

Verify signatures

cosign verify-blob \
  --bundle nr-image-optimize-2.4.2.zip.sigstore.json \
  --certificate-identity-regexp "https://github.com/netresearch/.*" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  nr-image-optimize-2.4.2.zip

Verify checksums

sha256sum -c checksums.txt

Software Bill of Materials (SBOM)

SBOMs are provided in both SPDX and CycloneDX formats for supply chain transparency.

Assets 12
Loading