- Add a vips builder stage that compiles libvips 8.18.6 from source
(pinned tarball + sha256), linked against distro libheif/aom/dav1d
(AVIF/HEIC) and libjxl (JPEG XL).
- Trim delegates to the formats Pixelfed uses: jpeg, png, gif, webp,
avif/heic, jxl; disable tiff, pdf, svg, openexr, magick, etc. to keep
the library small and reduce attack surface on untrusted uploads.
- Drop the ext-vips C extension (incompatible with libvips 8.18 and
unused: Pixelfed uses jcupitt/vips via FFI) and keep ffi enabled.
- Update runtime deps to match the compiled library.
- Add MEDIA_TYPES (webp/avif/jxl) to .env.example and .env.docker.example.
Switch IMAGE_DRIVER default from gd to vips in config/image.php and the
shipped .env examples. libvips is faster, lower-memory, and has strong
WebP/AVIF support; both libvips and the php-vips extension ship in the
official Docker image. ImageDriverManager already maps 'vips' to the
installed Intervention Vips driver, so no code change is needed.
.env.testing stays on gd because the CI test runners install the gd
extension, not php-vips.
- Remove Passport::personalAccessClientId() (removed in Passport v13, auto-discovers now)
- Remove Passport::enableImplicitGrant() (legacy grant, no clients use it)
- Flatten config instance.oauth.pat to pat_enabled (remove dead pat.id key)
- Add OAUTH_PAT_ENABLED=false to .env.example and .env.docker.example
- Show swal alert when PATs disabled instead of hidden API error
- Improve store() error handling to surface 403 messages in the UI
- Remove OAUTH_PAT_ID row from admin diagnostics blade
Shlee
Your Name