This week, Discourse made libvips the default image processing library to enhance security for user uploads. tgxworld noted that while the operations aren’t a direct port from ImageMagick, no visible changes to image appearance are expected. The plan is to remove the ImageMagick dependency from Docker images in the coming weeks.
In response to questions about installation guides, NateDhaliwal pointed out a potential oversight in the Ubuntu/Debian development installation instructions. tgxworld clarified that the guide had been updated to link to libvips installation steps, although NateDhaliwal suggested removing the old ImageMagick link.
When asked about the rationale for the change by merefield, Falco explained that while libvips has long been known for better speed and lower memory usage, the shift to prioritize it was largely driven by security concerns. With Large Language Models (LLMs) increasingly uncovering bugs across the software stack, image processing remains a major attack surface. Because libvips is more widely used by web applications, it benefits from a larger community “umbrella,” offering better security and stability compared to ImageMagick in this context.
This week, we made libvips the default image processing library in Discourse as part of our ongoing work to make processing user uploads more secure.
Although this isn’t a direct port of the ImageMagick operations, we do not expect any noticeable changes in how images appear to end users. In the coming weeks, we plan to remove the ImageMagick dependency from the Discourse Docker images.
Questions? Comments? Spotted something weird with images? Let me know!
Does the dev install steps need to change?
Which guide are you referring to? We did update the guides but might have missed one or two.
I was referring to Install Discourse on Ubuntu or Debian for Development. I don’t think that was updated.
It was updated which links to the installation instructions for libvips .
out of interest, what was the rationale for this change?
Right. Missed the link. Should the ImageMagick link be removed then?
This first was considered many years ago simply because libvips was faster and used less memory for the operations we do with images. But since it was a lot of work for no visible benefit we let it on the backlog.
Nowadays, the LLM are finding bugs on every part of the stack, and image processing is the major surface area for that. This mean that libvips being more popular among WebApps handling images gives us a larger umbrella for this new challenge.