Netresearch: Image Optimization

2 likes

nr_image_optimize / stable

On-demand image optimization for TYPO3 with processed delivery, WebP and AVIF variants, and responsive srcset ViewHelpers.

This version supports TYPO3

13 LTS 14 LTS

Older versions also support TYPO3

11 LTS 12 LTS 13 LTS 14 LTS

Last upload comment

Changed:

• typo3/cms-extbase and typo3/cms-fluid require ^13.4 || ^14.3, the same TYPO3 versions as typo3/cms-core ([#207]).
• GitHub release archives and Composer downloads contain only what the installed extension uses: Classes/, Configuration/, Documentation/, Resources/, the ext_* files, composer.json, LICENSE and README.rst ([#210]).

Security:

• New variants only for signed URLs. The /processed/ endpoint creates a variant that is not on disk yet only when the URL carries a sig parameter, an HMAC of the variant path keyed with the TYPO3 encryption key. The sourceSet ViewHelper signs every URL it renders; variants already on disk are served without a signature. Pages cached before the update carry unsigned URLs until the page cache is flushed ([#214]).
• Files of non-public storages are refused. The processor refuses source files inside the base path of a non-public Local FAL storage, also when a variant of them is already on disk. The web server delivers files below public/processed/ without asking TYPO3, so remove variants of such files that earlier versions wrote there. When the FAL storages cannot be read, the processor answers HTTP 503 ([#214]).
• Only image files are decoded. Variant URLs accept only the extensions jpg, jpeg, png, gif, webp, avif, bmp, tif and tiff, and a source is decoded only when its content is JPEG, PNG, GIF, WebP, AVIF, BMP or TIFF (otherwise HTTP 400) ([#214]).

[#207]: https://github.com/netresearch/t3x-nr-image-optimize/pull/207 [#210]: https://github.com/netresearch/t3x-nr-image-optimize/pull/210 [#214]: https://github.com/netresearch/t3x-nr-image-optimize/pull/214

For details see https://github.com/netresearch/t3x-nr-image-optimize/releases

Downloads by month

Installation

Install extension via ZIP file

Download ZIP file
Log into your TYPO3 backend
Go to Extension Manager module
Press the upload button on the top bar
Select the ZIP file and upload it. If you want to overwrite an existing extension installation, activate the checkbox.

Install extension via composer command

Go to your folder where the root composer.json file is located
Type: composer require netresearch/nr-image-optimize to get the latest version that runs on your TYPO3 version.

Install extension with T3X file

Download T3X file
Log into your TYPO3 backend
Go to Extension Manager module
Press the upload button on the top bar
Select the T3X file and upload it. If you want to overwrite an existing extension installation, activate the checkbox.

Other extensions by this user (20)

Version history

Filter for TYPO3 versions

2.6.1 stable Latest

October 07, 2026

TYPO3: 13 LTS 14 LTS (>=13.4.0 <=14.99.99)

Download

2.6.0 stable

September 25, 2026

TYPO3: 13 LTS 14 LTS (>=13.4.0 <=14.99.99)

Added:

• generateWebp and generateAvif extension settings — turn generation of the .webp or .avif sidecar off for the whole installation, for example where one sidecar format is enough. Both default to on; a missing or unparsable setting also counts as on. The per-URL skipWebP / skipAvif parameters still apply on top. Sidecars already on disk are served until the processed images are cleared (OPSCHEM-605, [#203]).
• Invalidate processed variants by original path — the maintenance module deletes only the variants derived from a given original file path, a directory prefix (trailing /) or a glob pattern (* / ?), instead of clearing the whole processed/ directory ([#182]).

Fixed:

• AVIF variants are written when qualityAvif is 100. At quality 100 ImageMagick requests lossless AVIF from libheif/aom, the AOM encoder rejects it, and no AVIF variant was written. The processor now hands at most 99 to the AVIF encoder (OPSCHEM-605, [#203]).
• Processed AVIF originals requested with q100 no longer fail with HTTP 500. The primary variant of an AVIF original went through the same encoder path; its URL quality is now capped at 99 as well. The cached file name keeps q100 (OPSCHEM-605, [#206]).
• The maintenance module no longer walks processed/ while rendering the page. Statistics load asynchronously in one request, and the five largest files are tracked during the directory pass instead of collecting every file, which exhausted memory_limit on large processed/ trees ([#181]).
• Documentation describes variant selection as the processor does it. The processor serves the first non-empty file of .avif, .webp and the original, and does not inspect the Accept header; skipWebP / skipAvif only suppress generation ([#203]).

[#181]: https://github.com/netresearch/t3x-nr-image

For details see https://github.com/netresearch/t3x-nr-image-optimize/releases

Download

2.5.0 stable

August 31, 2026

TYPO3: 13 LTS 14 LTS (>=13.4.0 <=14.3.99)

Added:

• image and cropVariant arguments on SourceSetViewHelper — when a FAL FileReference is passed via image, the ViewHelper derives the effective height from that image's crop-variant area (falling back to its original aspect ratio when the variant has no crop data), instead of requiring callers to pre-compute a crop-aware height themselves via a separate, site-specific ViewHelper. height remains authoritative when image is omitted (NEXT-100).

For details see https://github.com/netresearch/t3x-nr-image-optimize/releases

Download

2.4.2 stable

August 19, 2026

TYPO3: 13 LTS 14 LTS (>=13.4.0 <=14.3.99)

Fixed:

• **Source images under a folder with a non-ASCII character (e.g. an umlaut) no longer return an empty-body HTTP 500 for /processed/* requests.** The regression was in intervention/image v4: InputHandler::handle() checks BinaryImageDecoder before FilePathImageDecoder, and BinaryImageDecoder's heuristic treats any string containing a byte outside printable ASCII as binary image data — including a legitimate absolute path whose only non-ASCII content is a UTF-8 umlaut. Wrapping the path in SplFileInfo before handing it to ImageManager::read()/decode() makes decoder selection match on input type rather than content, sidestepping the heuristic. v3 (3.7.2, 3.11.1) was not affected — no TYPO3_12 backport needed ([#156]).

[#156]: https://github.com/netresearch/t3x-nr-image-optimize/pull/156

For details see https://github.com/netresearch/t3x-nr-image-optimize/releases

Download

2.4.1 stable

July 25, 2026

TYPO3: 13 LTS 14 LTS (>=13.4.0 <=14.3.99)

- chore: release v2.4.1 (#140)
- docs(agents): correct the release process and ban retagging
- chore: release v2.4.1
- fix: target the TYPO3 v14 LTS (14.3), not the EOL 14.0 sprint line (#139)
- fix: target the TYPO3 v14 LTS (14.3), not the EOL 14.0 sprint line

For details see https://github.com/netresearch/t3x-nr-image-optimize/releases

Download

2.4.0 stable

July 24, 2026

TYPO3: 13 LTS 14 LTS (>=13.4.0 <=14.4.99)

- chore: release v2.4.0 (#137)
- chore: release v2.4.0
- chore: prepare release v2.4.0 (#136)
- chore: prepare release v2.4.0
- feat: configurable WebP/AVIF output quality (#134)
- docs: record ADR-0001 on format negotiation via query params (#130)
- feat: configurable WebP/AVIF output quality
- docs: record ADR-0001 on format negotiation via query params
- fix(maintenance): keep clear-processed-images working on symlinked deployments (#133)
- fix(maintenance): keep clear-processed-images working on symlinked deployments
- feat: extend allowed roots with var/ and additionalTrustedRoots (#135)
- style: split combined continue condition per rector ChangeOrIfContinueToMultiContinueRector
- feat: add additionalTrustedRoots extension configuration setting
- docs: mention var/ in getAllowedRoots() docblock enumeration
- feat: accept Environment::getVarPath() as an allowed root
- chore: ignore transient superpowers working documents

For details see https://github.com/netresearch/t3x-nr-image-optimize/releases

Download

2.3.1 stable

July 22, 2026

TYPO3: 13 LTS 14 LTS (>=13.4.0 <=14.4.99)

- chore: release v2.3.1 (#128)
- chore: release v2.3.1
- fix: v14 theme-aware backend icons and dark-mode module templates (#127)
- fix: make backend module templates dark-mode aware
- fix: adopt TYPO3 v14 theme-aware backend icons

For details see https://github.com/netresearch/t3x-nr-image-optimize/releases

Download

2.3.0 stable

July 22, 2026

TYPO3: 13 LTS 14 LTS (>=13.4.0 <=14.4.99)

- chore: release v2.3.0 (#125)
- chore: release v2.3.0
- feat(processor): add per-instance opt-in to trust storage-nested symlinks (#123)
- feat(processor): add per-instance opt-in to trust storage-nested symlinks
- fix(processor): resolve public/_assets/<hash> symlinks in allowed roots (#118)
- fix(processor): resolve public/_assets/<hash> symlinks in allowed roots
- [BUGFIX] Apply the configured quality when encoding image variants (#115)
- refactor(tests): simplify the processAndRespond scenario helpers
- style(tests): use instanceof for the optional encoder errors
- refactor(tests): deduplicate the processAndRespond test family
- test: assert the encoding quality in the main processAndRespond test
- ci: run the acceptance suite through the shared workflow
- [TASK] Drop the local acceptance job from the CI workflow
- [BUGFIX] Address review findings on the encoding-quality fix
- [BUGFIX] Apply the configured quality when encoding image variants

For details see https://github.com/netresearch/t3x-nr-image-optimize/releases

Download

2.2.4 stable

July 14, 2026

TYPO3: 13 LTS 14 LTS (>=13.4.0 <=14.4.99)

- chore: release v2.2.4 (#112)
- chore: release v2.2.4
- fix(viewhelper): pass through non-processable URLs unchanged (#110)
- HSM-466: fix(viewhelper): treat data: URIs as passthrough URLs
- HSM-466: chore: ignore generated packages/ and var/ directories
- HSM-466: fix(viewhelper): pass through non-processable URLs unchanged
- ci: adopt canonical typo3-extension template (#109)
- ci: adopt netresearch/.github typo3-extension template
- docs: add implementation conventions distilled from PR review cycles (#107)
- docs: align performance conventions with actual implementation
- docs: add implementation conventions distilled from PR review cycles
- fix(backend): resolve module labels via array format (#105)
- fix(backend): resolve module labels via array format
- docs(phpstan): clarify why Tests/* is included in path-scoped rules (#102)
- docs(phpstan): clarify why Tests/* is included in path-scoped rules
- docs(agents): refresh AGENTS.md tree with scoped per-directory files (#101)
- docs(agents): address Copilot review feedback on PR #101
- docs(agents): drop CLAUDE.md/GEMINI.md symlinks from Documentation/
- docs(agents): refresh AGENTS.md tree with scoped per-directory files
- chore(phpstan): finish ergebnis rules re-evaluation (remaining 4) (#100)
- chore(phpstan): path-scope remaining 4 ergebnis rules with documented rationale
- chore(phpstan): re-evaluate ergebnis rule suppressions (4 of 8) (#99)
- chore(phpstan): replace isset() with array_key_exists() in production
- chore(phpstan): path-scope ergebnis.noErrorSuppression to wrapper files
- chore(phpstan): path-scope ergebnis.noExtends to framework-heritage paths
- chore(phpstan): re-enable ergebnis.noPhpstanIgnore rule
- chore: adopt release-typo3-extension orchestrator (#90)
- chore: adopt release-typo3-extension orchestrator
- ci: actually fix PHPStan errors after dep drift (no baseline) (#98)
- ci: actually f

For details see https://github.com/netresearch/t3x-nr-image-optimize/releases

Download

2.2.3 stable

April 24, 2026

TYPO3: 13 LTS 14 LTS (>=13.4.0 <=14.4.99)

## Changes
- [RELEASE] v2.2.3 (#97)
- chore: release v2.2.3
- test(acceptance): fix SourceSet type-attribute tests to match intent (#95)
- test(acceptance): fix SourceSet type-attribute tests to match intent
- test(functional): restore strict coverage metadata + switch CI to xdebug (#93)
- test(functional): restore strict coverage metadata + switch CI to xdebug
- fix(processor): log 400 responses, harden allowed-roots cache, functional symlink test (#70) (#91)
- test(functional): relax strict coverage metadata
- test(functional): unblock MaintenanceController DI test
- fix(test-runner): install imagick via pecl, not apk
- fix(processor,ci): address PR #91 review feedback
- fix(processor): log 400 responses and harden allowed-roots cache (#70)
- test(functional): add symlinked fileadmin regression test for #70
- chore(deps): update step-security/harden-runner action to v2.19.0 (#89)
- chore(deps): update step-security/harden-runner action to v2.19.0
- fix(processor): accept filesystem root as public path in isWithinAnyRoot() (#87)
- fix(processor): accept filesystem root as public path in isWithinAnyRoot()
- docs(changelog): address review threads on 2.2.2 entry (#79 / #83) (#86)
- docs(changelog): address review threads on 2.2.2 entry
- ci: add workflow_dispatch-only caller for manual TER publish (#84)
- ci: add workflow_dispatch-only caller for manual TER publish
- docs(changelog): honest 2.2.2 entry covering all 196 commits since 2.2.1 (#83)
- docs(changelog): honest 2.2.2 entry covering all 196 commits since 2.2.1

## Installation

```bash
composer require netresearch/nr-image-optimize
```

## Security

All release artifacts are signed with [Sigstore](https://www.sigstore.dev/) keyless signing.

### Verify signatures

```bash
cosign verify-blob \
--bundle nr-image-optimize-2.2.3.zip.bundle \
--certificate-identity-regexp "https://github.com/netresearch/.*" \

For details see https://github.com/netresearch/t3x-nr-image-optimize/releases

Download

2.2.2 stable

April 21, 2026

TYPO3: 13 LTS 14 LTS (>=13.4.0 <=14.4.99)

## Changes
- [RELEASE] v2.2.2 (#79)
- [RELEASE] v2.2.2
- ci: drop broken slsa-provenance job from release workflow (#78)
- ci: drop broken slsa-provenance job from release workflow
- fix: accept variants under symlinked public/processed & public/uploads (#70 follow-up) (#76)
- test: cover dangling-symlink branch in getAllowedRoots()
- refactor: restrict symlinked-children expansion to hardcoded TYPO3 namespaces
- fix: accept variants under symlinked public children (issue #70 follow-up)
- fix: port Processor bug fixes + tooling improvements from TYPO3_12 (#75)
- test(functional): robust body check + UsesClass for middleware risky tests
- chore(build): bump runTests.sh alpine from 3.8 to 3.22
- fix: skip zero-byte variants in buildFileResponse + serveCachedVariant cascade
- fix: key allowed-roots cache by public path
- fix: accept symlinked FAL storage directories in path validation (#70) (#71)
- fix: address second review round findings (5 specialist reviews)
- fix: revert isset() guard — PHPStan rejects it on readonly property
- fix: guard storageRepository access for uninitialized test fixtures
- fix: address review feedback on symlinked FAL storage path validation
- fix: accept symlinked FAL storage directories in path validation
- ci: suppress Opengrep unlink-use findings with justifications (#69)
- fix(test): use SplFileInfo::getPathname() in acceptance teardown
- ci: suppress Opengrep unlink-use findings with justifications
- chore(deps): bump step-security/harden-runner from 2.17.0 to 2.18.0 in the github-actions group (#68)
- chore(deps): bump step-security/harden-runner
- feat(l10n): remove hard-coded strings, add translator context, sync all 15 languages (#67)
- refactor(l10n): apply review feedback on JS handler + translator note
- feat(l10n): remove hard-coded strings, add translator context, sync 15 languages
- docs: review, enhance and sync full docume

For details see https://github.com/netresearch/t3x-nr-image-optimize/releases

Download

2.2.1 stable

November 12, 2025

TYPO3: 13 LTS (>=13.0.0 <=13.4.99)

[RELEASE] v2.2.1 -- for details see https://github.com/netresearch/t3x-nr-image-optimize/releases

Download

2.2.0 stable

October 15, 2025

TYPO3: 13 LTS (>=13.0.0 <=13.4.99)

[RELEASE] v2.2.0 -- for details see https://github.com/netresearch/t3x-nr-image-optimize/releases

Download

2.1.0 stable

September 18, 2025

TYPO3: 13 LTS (>=13.0.0 <=13.4.99)

[RELEASE] v2.1.0 -- for details see https://github.com/netresearch/t3x-nr-image-optimize/releases

Download

2.0.1 stable

September 17, 2025

TYPO3: 13 LTS (>=13.0.0 <=13.4.99)

[RELEASE] v2.0.1 -- for details see https://github.com/netresearch/t3x-nr-image-optimize/releases

Download

1.6.1 stable

October 07, 2026

TYPO3: 12 LTS (>=12.0.0 <=12.99.99)

• chore(release): v1.6.1 (#217)
• fix: create variants only from signed URLs of public, supported images (TYPO3_12) (#215)

For details see https://github.com/netresearch/t3x-nr-image-optimize/releases

Download

1.6.0 stable

September 25, 2026

TYPO3: 12 LTS (>=12.0.0 <=12.99.99)

• chore(release): v1.6.0 (#204)
• OPSCHEM-605: WebP/AVIF generation switches and AVIF quality cap (TYPO3_12) (#202)

For details see https://github.com/netresearch/t3x-nr-image-optimize/releases

Download

1.5.0 stable

September 07, 2026