fix(server): bump sharp to 0.34.3 + add unlimited flag
#20327
Conversation
| @@ -141,6 +141,7 @@ export class MediaRepository { | |||
| failOn: options.processInvalidImages ? 'none' : 'error', | |||
| limitInputPixels: false, | |||
| raw: options.raw, | |||
| unlimited: true, | |||
There was a problem hiding this comment.
This should presumably be guarded behind some sort of configuration option (e.g. an environment variable).
Enabling this should be carefully considered in deployments where trust in users is weaker.
There was a problem hiding this comment.
Can you elaborate on the potential issues or security concerns?
There was a problem hiding this comment.
You could presumably create a malicious image which consumes enough memory to crash the server
There was a problem hiding this comment.
Perhaps it'd be better to make limitInputPixels configurable? That sounds like it might also solve this and be a safer approach. Potentially it could be set based on available system memory, which might also prevent people from hitting this as often
There was a problem hiding this comment.
You could presumably create a malicious image which consumes enough memory to crash the server
Thank you, this is what I meant
|
the base-image is merged |
simonhammes
force-pushed
the
sharp-0.34.3
branch
from
e9d4a34 to
a135c22
Compare
simonhammes
force-pushed
the
sharp-0.34.3
branch
from
856a5dd to
50715d6
Compare
|
0.0 |
| @@ -1,5 +1,5 @@ | |||
| # dev build | |||
| FROM ghcr.io/immich-app/base-server-dev:202507291116@sha256:e38543bdd77a02ed156cd9175ed11e9c16dccf48c418d46ecda48ce684de456a AS dev | |||
| FROM ghcr.io/immich-app/base-server-dev:commit-e54882f68fed72fa84c0bb3c422e374a7c082703 AS dev | |||
There was a problem hiding this comment.
libvips 8.17 is already in the current base image, so no need to change the tag.
|
Superseded by #21596 |
Description
This bumps
sharpto0.34.3and adds theunlimitedflag to disable all memory-related restrictions.Fixes #20028
To Do
I applied the changes locally in order to test the changes in this PR.
How Has This Been Tested?
Checklist:
src/services/uses repositories implementations for database calls, filesystem operations, etc.src/repositories/is pretty basic/simple and does not have any immich specific logic (that belongs insrc/services/)