chore: release main

[vaam-apps]

🤖 I have created a release beep boop

0.2.0

0.2.0 (2026-09-19)

Features

• add cache control headers to image download (79a9e60)
• add ETag and further Cache-Control headers to API (b3e13d9)
• add ETag and further Cache-Control headers to API (03c4621)
• add Knative Serverless Helm chart for image-resizer deployment (bc8f57a)
• Add S3 storage support with subpath functionality (2b4477f)
• apply EXIF orientation and forward ICC profiles (#33, #5) (9b1c8b4)
• apply EXIF orientation and forward ICC profiles (#33, #5) (6d9b81a)
• AVIF, animation, gravity, geometry, watermarks and presets (#49, #50, #51, #52) (41aee92)
• AVIF, animation, gravity, geometry, watermarks and presets (#49, #50, #51, #52) (a88084a)
• basic layout (4c8d504)
• benchmark foundation and P0 security wave (epic #9) (4c4f155)
• benchmark: make benchmark configurable using environment variables (befbea2)
• better readme (87540f3)
• caller-controlled EXIF metadata strip/keep (#5) (2c286a7)
• chart folder (9a821ad)
• chart folder (83fb8f1)
• chart folder (75e7dc8)
• chart folder (f9e0822)
• chart folder (18082dd)
• chart folder (68c8413)
• chart folder (4d5840f)
• ci (8c14882)
• ci (0ac1048)
• ci cache (58023fc)
• container + License (d5457d2)
• full ist working (3bb78af)
• image download working (ade1ddc)
• Improve image processing functionality (242a790)
• in-memory storage (f10d744)
• initial commit (4ddceda)
• Introduce new image processing parameters and enhance documentation/deployment (5c7d20a)
• Introduce new image processing parameters and enhance documentation/deployment (4f28aff)
• libwebp decode, dav1d AVIF decode, libavif+AOM AVIF encode (bc8e28c)
• lossy WebP, signed URLs, codegen removal, imgproxy benchmark harness (fc8868e)
• merge performance config with environment variables (277edcc)
• on error => url (72f3bbb)
• progressive JPEG, chroma subsampling and max_bytes (#76) (#80) (ebeb98d)
• quality, per-format quality and lossless WebP (#35, #4) (c6d6872)
• quality, per-format quality and lossless WebP (#35, #4) (#70) (abd7030)
• refactor storage handlers and improve S3 compatibility across multiple components (94be0bb)
• sbom & provenance (fb901d8)
• split into multiple logic files (5f4a246)
• typo (645b944)
• update image resize functionality (d5eaab3)
• update project branding and increment version to 0.1.2 (ff94564)
• upload successful (eb8ccce)
• wave 2 — concurrency, cache lifecycle, hardening, CI and docs (epic #9) (3c441b3)
• WebP decode via libwebp, AVIF decode+encode via libavif (#67/#68) (47ecf50)

Bug Fixes

• add missing trailing newline and stop yamllint re-indenting valid config (b26cf7b)
• atomic fixture writes, and a concurrency test that cannot race (#90) (9584580)
• benches/encode.rs PNG case measured Fast compression, not production's Best (5fece32)
• benchmark fairness — rate limiter, resize semantics, origin healthcheck (013104b)
• bench: measure per-image latency, not per-request (735dd05)
• bench: measure per-image latency, not per-request (2e02d8d)
• close every open issue (#5, #56, #83, #84, #85) (76ce1ca)
• commit the generated gen-server crate so CI and fresh clones build (#45) (2a9c3a2)
• composite alpha and normalise transparent pixels (#34, #60) (#66) (195a9b8)
• deps: bump rustls to 0.23.45 for RUSTSEC-2026-0285 (#114) (1504305)
• deps: two lockstep dependency breaks — main has not compiled since #104/#106/#109 (#116) (82c07b6)
• docker: run as a non-root user (DS-0002) (#112) (f9c0945)
• document wave-2 env vars and give the bench gate an absolute floor (fb1b91f)
• drop legacy TLS stack from aws-sdk-s3 to clear RUSTSEC-2026-0258/0098/0099/0104 (5f28eb7)
• drop the stale 'make init' step from the Docker build workflow (2be8c08)
• eliminate GH #90 concurrency-test flake at its root cause (616543d)
• enable_http2 no-profile fallback now matches Default::default() (#83) (630ff26)
• exclude Helm templates from YAML linting at the super-linter level (b3410c3)
• helm deploy (022b764)
• helm deploy v2 (8463dc5)
• helm deploy v3 (7d77696)
• helm deploy v4 (43c3de3)
• helm: mark METRICS_AUTH_TOKEN optional so non-otel pods can start (76db770)
• honour imgproxy resize types instead of always cropping (#59, #1) (#64) (ffe8846)
• issue with router (9564827)
• let ALLOWED_SOURCES authorise private origins (#57) (#65) (08c874f)
• make super-linter actually read the repo's linter configs (c272bc3)
• pin loose dependency requirements and repair the otel feature (7f7d34e)
• point the benchmark driver at emgr's signed-path API (95c62c4)
• populate the empty .hadolint.yaml and .clippy.toml (6fb038c)
• relax YAML line length and stop the bench gate failing without a baseline (877ccdf)
• require a bearer token on /metrics, fail closed at startup (#77) (#79) (ec9cad8)
• s3 Docker images could not start; add three-way benchmark and S3 tests (81a1dd9)
• strip trailing whitespace from openapi.yaml (64cb0f0)
• unbreak Docker builds and satisfy cargo-deny under all features (8593cb2)
• wire signing/metrics-auth env vars and fix helm/serverless rendering (GH #84, #85) (0d43ebf)

Performance

• DCT-scaled JPEG decode via mozjpeg (#63 stage 2) (3668b56)
• DCT-scaled JPEG decode via mozjpeg (#63 stage 2) (9a6281c)
• optimize image processing with tokio spawn_blocking (66d829f)
• optimize performance configuration and settings (7de96e7)
• route full-size JPEG decode through mozjpeg (#67) (#81) (e65144a)
• SIMD resampling via fast_image_resize (#63 stage 1) (1a8c7cc)
• skip EXIF extraction when strip_metadata discards it (#88) (f6b0739)
• skip EXIF extraction when stripping, and make metadata cost measurable (#88) (eaedaf4)

Refactoring

• extract encode_png, fix stale AVIF doc citations (#99) (18edfb4)

Documentation

• adr: re-measure AVIF against the encoders we actually ship (0005, closes #93) (c9d031b)
• adr: re-measure AVIF against the encoders we actually ship (0005) (83980e8)
• bring README and performance docs in line with current codebase (f66dac2)
• ci: the cargo-deny comment described the opposite of what runs (b0389f6)
• correct the keep-path claim in the previous commit (aa0428c)
• point the AVIF code comments at 0005, and record why quality stays 80 (cc8eeba)
• re-audit against the code after the codec work (#96) (9dd1eee)
• re-point AVIF citations at adr/0005 now that 0004 is superseded (#97) (88ce884)
• record the g:/gravity decision and its compatibility cost (#73) (56f1d2e)
• record the post-#67 baseline for both benchmark layers (#82) (6f9bae3)
• refresh every document against the code (85f5df4)
• refresh every document against the code (7a0bb21)
• rewrite API reference and examples to match the actual URL grammar (af0bca8)
• rewrite architecture docs to match current implementation (b96e2f8)
• rewrite getting-started, deployment, development and about pages (9404de8)
• write the missing ADR 0004 (AVIF measurement) (#78) (72201e3)

Tests

• cache: cover Avif and Gif in the key-uniqueness sweep (603ba9d)
• cache: cover Avif and Gif in the key-uniqueness sweep (2e47158)

Build System

• Docker plumbing for libavif/AOM/dav1d, benches, docs (#67/#68) (6db06a2)

Continuous Integration

• add the helm repo before resolving chart dependencies (f2d41e7)
• adopt org-wide SAST, lint, Trivy and issue governance (#111) (91e4147)
• adopt release-please for automated version bumps and releases (#115) (eeb7582)
• install the native codec build tools on the runners (c31b3dc)
• re-pin org reusable workflows for the MD024 changelog fix (358af37)
• re-pin org reusable workflows for the MD024 changelog fix (1fa34eb)
• re-pin org reusable workflows to current .github main (#113) (b40b6a0)
• run every built image before pushing it (#62 follow-up) (4ea6525)
• run every built image before pushing it (#62 follow-up) (66f1e2c)

Chores

• bump CACHE_KEY_VERSION to 10 for metadata stripping (#5) (ad7c669)
• bump CACHE_KEY_VERSION to 11 for the AVIF encoder cutover (d8139bb)
• chart version upgrade (b3d3009)
• delete the temporary DSSIM harness (#98) (0267ee1)
• deps: bump axum-otel-metrics from 0.11.0 to 0.14.1 (#101) (2371abe)
• deps: bump base64 from 0.22.1 to 0.23.1 (#105) (4d152b5)
• deps: bump criterion from 0.5.1 to 0.8.2 (#110) (09dbf54)
• deps: bump hmac from 0.12.1 to 0.13.0 (#104) (67548bb)
• deps: bump opentelemetry from 0.29.1 to 0.32.0 (#106) (5d44a4b)
• deps: bump opentelemetry_sdk from 0.29.0 to 0.32.1 (#109) (1c3783d)
• deps: bump opentelemetry-prometheus from 0.29.1 to 0.32.0 (#107) (32991ed)
• deps: bump reqwest from 0.12.28 to 0.13.5 (#103) (c818bb1)
• deps: bump super-linter/super-linter in /.github/workflows (#61) (fa1599b)
• enable image avif+gif features and record third-party notices (7a9c875)
• FUNDING.yml (a165476)
• miaou (315c19a)

---

This PR was generated with Release Please. See documentation.

[vaam-apps]

🤖 Created releases:

• v0.2.0

🌻

[github-actions]

Benchmark results

Regression gate: fails at >15% slower than the main baseline (start-loose threshold, GH #20 - tighten once the numbers are stable across a few runs).

Benchmarks faster than 100.00 µs are measured and reported but never fail the build: at that scale they are under 1% of a 10-30ms request even if they double, so a percentage gate there measures noise rather than user-visible performance. Those rows are marked below floor and still show their real change.

Benchmark	This PR	main baseline	Change
cache_key_generate_key	855.98 ns	617.34 ns	🔺 +38.7% (below floor)

1 benchmark(s) moved past the 15% threshold but sit below the 100.00 µs floor, so they do not fail the build:

• cache_key_generate_key: +38.7%