The fix is pretty easy -- you should call `block_untrusted` to stop loaders like matlab from running:

https://www.rubydoc.info/gems/ruby-vips/Vips.block_untrusted

You can also set the env var `VIPS_BLOCK_UNTRUSTED`, which might be easier.

You can block or allow specific load operations, so you can limit format support to just the types you need:

https://www.rubydoc.info/gems/ruby-vips/Vips#block-class_met...

That might be even better.

There was a post on libvips.org about this a while ago:

https://www.libvips.org/2022/05/28/What's-new-in-8.13.html

And a note about it in the checklist for devs:

https://www.libvips.org/API/current/developer-checklist.html...

libvips shouldn't be calling imagemagick for heif decode, it has a nice one built in. Unless you were using a very old libvips!

I've found jemalloc works best for long running libvips processes, fwiw.

Hello, looks nice! I had a few thoughts:

- I'd consider adding support for libvips smartcrop, ICC colour management, HDR, image alpha

- can you join pipelines? you could have one making a background, one making a foreground, then composite them, for example

- your benchmarks don't measure peak memory use, it can be a useful thing to test, especially if people are processing large images (eg. the output of every modern smartphone sigh)

- have you benchmarked against nip4, the official libvips GUI? it has a CLI mode you can run with GNU parallel

- I agree, a CLI mode for your tool sounds useful

Hi, thanks for the comments.

- I'd consider adding support for libvips smartcrop, ICC colour management, HDR, image alpha Fair enough - I wanted to first see if there's interest in the tool and then I'd definitely add more functions.

- can you join pipelines? you could have one making a background, one making a foreground, then composite them, for example No, you can't join them currently in this way. Sounds like an interesting advanced feature to add.

- your benchmarks don't measure peak memory use, it can be a useful thing to test, especially if people are processing large images (eg. the output of every modern smartphone sigh) Very good point, I should definitely have measured that too. Will add that soon.

- have you benchmarked against nip4, the official libvips GUI? it has a CLI mode you can run with GNU parallel I haven't and that would indeed by interesting to measure. Will look into it as well.

- I agree, a CLI mode for your tool sounds useful I'll probably add a CLI if the tool gets traction and it's requested.

Some packages with native code components (like sharp) will use these hooks to download the correct precompiled native binary for you.

sharp downloads over https and checks the sha256 (I think?) of the archive.

sharp does this too:

https://sharp.pixelplumbing.com/install/#prebuilt-binaries

it can sometimes need to compile the C++ shim that sits between node and libvips, but that's rare.

sharp does not rebuild libvips, it downloads a pre-compiled libvips for your platform.

https://sharp.pixelplumbing.com/install/#prebuilt-binaries

It can usually also download a precompiled binary for the C++ shim that sits between node and libvips, but if your node / arch / etc. is not supported, it'll compile that (that's what the build.js file you linked does).

Hello, libvips author here, you can get it to do the OKLab averaging for you. For example, using pyvips (ahem, untested):

image = pyvips.Image.new_from_file(filename, access="sequential")

scale = min(200 / image.width, 200 / image.height)

thumbnail = image.colourspace("oklab").resize(scale).extract_bands(0, n=3)

rgbf = thumbnail.write_to_memory()

That'll stream the source image and make a RGBRGBRGB memory buffer of single precision floats. You could perhaps use kernel="linear" and avoid any ringing from lanczos3.

I think I would downsample in a linear light space, like scRGB. Averaging there means averaging photons, which will surely be better than OKLab. Maybe switch to OKLab for clustering. Though of course I've not tested it.

libvips uses imagemagick (via libMagick) for BMP load and save, fwiw

It's just `vips copy src.heic dst.jpg`.

ah right, ffmpeg requires the -i, not vips.