Ridu v0.23.0

Ridu 0.23.0

Ridu gzips its JSON and HTML responses, can see each visitor's address behind proxies it can't
list, such as Railway's, and adds Fit: "inside" for image sizes that show a whole photo. WebP
uploads now work.

Fixes

• WebP uploads were refused. Ridu recognised WebP files but had no decoder for them, so a
  collection that allowed image/webp failed every WebP upload with "decode image metadata: image:
  unknown format". Ridu now decodes WebP and keeps the original as uploaded. Go can't write WebP, so
  image sizes made from a lossy WebP without transparency are JPEG, and those made from a lossless
  or transparent WebP are PNG. "contain" sizes stay PNG for their transparent padding.
• A trusted proxy's Forwarded header without a proto parameter made Ridu treat the request as
  plain HTTP, ignoring X-Forwarded-Proto. Some proxies, reportedly including Railway's, pass a
  visitor's own Forwarded header on, so a visitor who sent one couldn't sign in once those proxies
  were trusted. Ridu now falls back to X-Forwarded-Proto.
• The Go comment on UploadConfig.Private suggested files without it were public. Every download is
  already checked against the collection's read access and sent as private, no-store; Private
  also requires a signed-in caller. The comment and the uploads guide now say so. See
  Uploads.

Changes

• Ridu gzips GET responses of 1 KiB or more that are JSON, HTML, CSS, JavaScript, SVG or other
  text, for clients that accept gzip, and sends Vary: Accept-Encoding. Compressed responses get a
  weak ETag and no Content-Length or Accept-Ranges. Responses under /api/auth/ and responses
  to other methods stay uncompressed, because they can carry session or preview tokens, which
  compression could reveal through the response's length (BREACH). Custom and plugin endpoints
  follow the same rules, so return secrets from POST endpoints. On a Railway deployment,
  /api/schema went from 60 KB to about 9 KB. See
  Production.
• HandlerOptions.TrustedProxyHops, read from RIDU_TRUSTED_PROXY_HOPS in generated projects,
  counts the proxies a request passes through when only the one that connects to Ridu can be listed
  in TrustedProxyCIDRs. Ridu then takes the client address from before them in
  X-Forwarded-For, so sign-in rate limits apply to each visitor instead of the whole proxy. The
  Railway guide now sets
  RIDU_TRUSTED_PROXY_CIDRS=100.64.0.0/10 and RIDU_TRUSTED_PROXY_HOPS=2. Account lockout
  (MaxLoginAttempts) still limits guesses at one account from any number of addresses.
• Fit: "inside" fits an image size within its Width × Height at the picture's own shape,
  without padding, and never enlarges it. The size's stored width and height are the picture's,
  so they can be smaller than the box. "contain" still pads to the full box, as sharp and Payload
  do, and its padding is now documented. See Uploads.
• RequestObservation.ResponseBytes documents that it counts the bytes the handler wrote, before
  compression.

Upgrade

Update the Go module and all Ridu npm packages to 0.23.0 together, and rebuild the admin and
application binary.

cmd/server/main.go belongs to your project, so the new setting isn't added for you. To use it,
add TrustedProxyHops: envInt("RIDU_TRUSTED_PROXY_HOPS"), after TrustedProxyCIDRs in
HandlerOptions, and copy the envInt helper from a project made with ridu new. On Railway, set
the two variables from the Railway guide.

Changing an image size's Fit affects new uploads; files uploaded earlier keep the sizes they were
made with.

Ridu requires Go 1.26.9 or newer. Go 1.27.0 and 1.27.1 meet that minimum but still have the
standard-library vulnerabilities described in the 0.20.0 notes, so build and deploy with Go 1.26.9
or a later 1.26 release, or with Go 1.27.2 or later.