Imager X

Dominant colors are now calculated differently, and existing images may get a different dominant color after updating. Cached colors from earlier versions are not reused.

Changed

• getDominantColor() now returns the most common color in the image. Previously it returned the first color of the Color Thief palette, which is ranked by how much of the color space a group of colors spans, not just by how many pixels it has. A small, varied detail could beat a large, flat area, so an image that is 90% red with a blue detail would get blue as its dominant color. This also applies to the dominantColor generate flag and the dominantColor return type of the @imagerTransform GraphQL directive.
• getDominantColor() and getColorPalette() no longer ignore white. Color Thief skips pixels where all channels are above 250, so a mostly white image got the color of whatever else was in it as its dominant color, and a white image got null.
• getDominantColor() now returns the actual average color of the matching pixels, so a white image gets #ffffff and a black image gets #000000, instead of #fcfcfc and #040404.
• ksubileau/color-thief-php 2.0 or later is now required.

Fixed

• Fixed getColorPalette() throwing a TypeError instead of returning null when an image couldn't be analyzed.

Fixed

• Fixed transformed images having their file type detected with finfo on every render, also when the transform already existed. For JPEG, PNG, GIF, WebP and AVIF the mime type is now taken from the getimagesize() call that reads the image dimensions (fixes #315).

Fixed

• Fixed native crop transforms not using the asset's focal point when useForNativeTransforms is enabled, so they now match Craft (fixes #314).

Fixed

• Fixed date interval parsing for all durations (fixes #313).

Added

• Added a --runtimeCache option to the imager-x/clean console command for cleaning expired files in the runtime cache (fixes #311).
• Added an --exclude option to the imager-x/clean console command for excluding subpaths from cleaning. When cleaning the runtime cache, temp, pdf-adapter and video-adapter are always excluded.
• Added a --force option to the imager-x/generate console command for forcing transforms to be generated even if they already exist and have not expired (fixes #310).

Fixed

• Fixed a race condition where concurrent first transforms of the same remote volume asset or external URL could publish a partial file to the source cache and reuse it until it expired. Source file downloads are now serialized with a mutex and published atomically with rename() (fixes #309).
• Fixed duplicate transform queue jobs when elements were saved in multi-site installs. Identical jobs are now deduplicated per request, and volume-based auto generation skips propagation saves (fixes #307).

Fixed

• Fixed additional SSRF bypasses in external URL validation: redirects are now followed manually and re-validated on every hop, the connection is pinned to the validated IP to mitigate DNS rebinding, all resolved A/AAAA records are checked (not just the first), and downloads are restricted to the http/https protocols. The skipExternalUrlValidation config setting still disables these checks.
• Fixed a path traversal issue by confining string-based local image sources to the web root / imager system path.
• Fixed safeFileFormats validation to URL sources in the imagerTransform GraphQL query.
• Fixed potential command injection in the image optimizers and custom encoder by escaping file path arguments with escapeshellarg().
• Fixed the cache clear key comparison to be constant-time, and added validation of the --volume handle in the imager-x/clean console command.

This release contains breaking changes. Please review the release notes carefully before upgrading.

Removed

• Removed Imgix support from core. Imgix is now available as a separate plugin, spacecatninja/imager-x-imgix-transformer. A deprecation notice is logged if old Imgix-related config settings are present. Please install the plugin and migrate your Imgix configuration to config/imager-x-imgix-transformer.php, see documentation for details.
• Removed AWS and GCS external storage drivers from core. These are now available as separate plugins, spacecatninja/imager-x-aws-storage-driver and spacecatninja/imager-x-gcs-storage-driver.
• Removed Kraken and Tinify optimizers from core. These are now available as separate plugins, spacecatninja/imager-x-kraken-optimizer and spacecatninja/imager-x-tinify-optimizer.

Changed

• Changed safeFileFormats config setting, added webp to the default.
• Changed optimizer config key from tinypng to tinify.

Added

• Added skipExternalUrlValidation config setting to skip the new external URL validation check.

Fixed

• Fixed SSRF vulnerability by blocking private/reserved IP ranges for external URL downloads.
• Fixed option escaping for shell commands.
• Fixed handling of cache clear key.

Added

• Added support for auto generating images in content blocks, and added support for expanded syntax to fields auto generate config (fixes #305 and #39).
• Added support for specifying offset and limit per field in the format fieldHandle[offset:limit] (fixes #301).

Changed

• Changed from Asset::EVENT_DEFINE_URL to Asset::EVENT_BEFORE_DEFINE_URL when replacing native transforms with Imager X for performance (thanks, @johnnynotsolucky).

Fixed

• Fixed an issue where the width and height of Imgix transforms would be wrong if both width and height were provided, and mode was fit. (fixes #303, thanks @white-ruud).

Fixed

• Fixed asset check in all GQL related code to allow any file kind, to account for adapters (fixes #297, thanks @denisyilmaz).

Added

• Added config setting disableACL to AWS external storage (fixes #296).

Fixed

• Fixed a type issue that could occur when setting opacity for letterbox.

Added

• Added support for dominantColor as a return type for imagerTransform GraphQL directive (fixes #290).

Fixed

• Fixed an issue where Imgix URLs could have double slashes if useCloudSourcePath was null (fixes #289).

Fixed

• Fixed an issue where TransformJob was throwing an error if an asset couldn’t be found, which would result in errors when replacing assets.

Fixed

• Fixed an issue where GD could throw an error because the output format extension wasn’t an allowed one (addresses #184)

Fixed

• Fixed an issue that could occur if an assets volume didn’t have public URLs enabled (fixes #280).

Added

• Added support for credential less authentication for AWS external storage, the storage config now take a useCredentialLessAuth config setting that can be set to true. It should now behave the same as the AWS volume from P&T (closes #254).

Changed

• Changed/repurposed behaviour of hideClearCachesForUserGroups config setting (which was no longer used), to hide clear cache element actions for user groups (closes #278).

Fixed

• Fixed an issue where Imager would try to remove transforms for non-image assets (fixes #273).

Fixed

• Fixed auto generation for fields inside matrix entry types (fixes #270).

Fixed

• Fixed an issue that could occur if slashes were used in config override parameters (fixes #268).

Changed

• Changed event for registrering extensions to be more in line with what Craft recommends.

Added

• Added support for Craft 5
• Added support for creating queue jobs when using the generate console command.
• Added support for limit and offset when using the generate console command.
• Added support for using {transformName} in filenamePattern (resolves #257)

Fixed

• Fixed incorrect closure check for transform params and improved error handling.
• Fixed icon method for utility
• Fixed use of deprecated method ensureTopFolder.

Changed

• Changed behaviour of avif and jxl transforms, they are now processed via Imagine.