[dependabot]

Updates the requirements on sorl-thumbnail to permit the latest version.

Release notes

Sourced from sorl-thumbnail's releases.

13.4.0

sorl-thumbnail 13.4.0 adds a libvips engine, reads each source image once per request, and fixes rounded corners, borders and blur on transparent images. Each change is explained in full in the changelog.

Highlights

• A new libvips engine. Set THUMBNAIL_ENGINE = "sorl.thumbnail.engines.vips_engine.Engine" and install it with pip install sorl-thumbnail[vips]. It supports every thumbnail option and keeps ICC profiles and animated GIFs. Use the convert engine for PDF and SVG sources. #833
• Each source is read once per request. Several sizes of one image, or is_portrait before the tag, no longer read the original again each time. On S3 every read was a full download. This works with every engine. #471
• A project homepage with example galleries for each engine: https://mariocesar.github.io/sorl-thumbnail/

Fixes

• Rounded corners work with JPEG in the PIL engine. Before, they crashed with OSError: cannot write mode RGBA as JPEG. The corners are filled with white, or with the padding color. #849
• remove_border cuts the border exactly, and now trims the empty margins of transparent images, like a PNG logo. PIL and vips engines. #845
• blur no longer leaves a dark outline around transparent images in the PIL engine.
• orientation=False applies only to the thumbnail it is given to. Before, it turned off EXIF orientation for later thumbnails until the server restarted. All engines. #843
• sorl-thumbnail's ImageField rejects a truncated upload with "Upload a valid image" in the PIL engine, instead of failing later on the thumbnail. #427
• Cached thumbnails keep the OPTIONS of their STORAGES alias when BACKEND is written the way Django's docs write it. All engines. #834

Removed

• The DynamoDB key-value store. It was built on boto 2, which can't be imported on any supported Python. #838
• The vipsthumbnail engine and its THUMBNAIL_VIPSTHUMBNAIL and THUMBNAIL_VIPSHEADER settings. It had failed on every thumbnail since 12.6.3. #833
• The THUMBNAIL_LAZY_FILL_EMPTY setting. Nothing read it.

Docs

• New pages: a quickstart, an Amazon S3 guide, troubleshooting, and choosing a thumbnail library. Every option, filter and setting is documented, and the examples run as written.

Before you upgrade

1. ASGI on Django 5.2 or 6.0: add sorl.thumbnail.middleware.SourceCacheMiddleware to MIDDLEWARE. WSGI and Django 6.1 need nothing.
2. Management commands and jobs: wrap the work in with source_cache():, imported from sorl.thumbnail.
3. If a STORAGES alias sets OPTIONS, like base_url or location: run python manage.py thumbnail clear once. It empties the key-value store without deleting any file.
4. If you use remove_border, blur on transparent images, or orientation=False: run python manage.py thumbnail clear_delete_all, so those thumbnails are made again. It also does what step 3 does.
5. If THUMBNAIL_KVSTORE names the DynamoDB store: remove the setting and point THUMBNAIL_CACHE at any Django cache alias.
6. If THUMBNAIL_ENGINE names the vipsthumbnail engine: switch to sorl.thumbnail.engines.vips_engine.Engine.

Links

• Documentation: https://sorl-thumbnail.readthedocs.io/
• Quickstart: https://sorl-thumbnail.readthedocs.io/en/latest/quickstart.html
• Troubleshooting: https://sorl-thumbnail.readthedocs.io/en/latest/troubleshooting.html
• Examples: https://mariocesar.github.io/sorl-thumbnail/
• Changelog: https://github.com/mariocesar/sorl-thumbnail/blob/main/CHANGES.rst#1340
• PyPI: https://pypi.org/project/sorl-thumbnail/13.4.0/
• Report a bug: https://github.com/mariocesar/sorl-thumbnail/issues/new/choose

Full Changelog: mariocesar/sorl-thumbnail@13.3.0...13.4.0

Changelog

Sourced from sorl-thumbnail's changelog.

13.4.0

• A project homepage with example galleries for each image engine, built from demo/ and published to https://mariocesar.github.io/sorl-thumbnail/
• A source is downloaded once per request, with every engine. is_portrait before the tag, or several sizes of one image, read the original once instead of once per use. Before, every filter and tag opened the source again, on S3 a full download each time. sorl-thumbnail now keeps the bytes of the last source it read, the source cache, until the request ends; a FieldFile you have open is not touched. Nothing to do on WSGI or on Django 6.1. On ASGI with Django 5.2 or 6.0 add sorl.thumbnail.middleware.SourceCacheMiddleware to MIDDLEWARE. In a management command or a job wrap the work in with source_cache(): ([#471](https://github.com/mariocesar/sorl-thumbnail/issues/471) <https://github.com/mariocesar/sorl-thumbnail/issues/471>__)
• Rounded corners work with JPEG in the PIL engine. Asking for rounded=10 crashed with OSError: cannot write mode RGBA as JPEG whenever the thumbnail was saved as JPEG, which is the default format. JPEG can't store transparency, so the corners are now filled with white, or with the padding color when the thumbnail is padded. That is the same background THUMBNAIL_FLATTEN uses, and it applies whether the setting is on or not. For transparent corners, ask for format='PNG' or format='WEBP' ([#849](https://github.com/mariocesar/sorl-thumbnail/issues/849) <https://github.com/mariocesar/sorl-thumbnail/issues/849>__)
• remove_border=True now trims the empty margins of transparent images, like a logo saved as PNG with space around it. It works by walking in from each edge and cutting strips that are a single flat color. The transparency channel made every strip look detailed, so nothing was ever cut. A strip now counts as flat when it looks flat on both a black and a white background, so the color a file happens to store under its transparent pixels makes no difference. The PIL and vips engines support remove_border
• remove_border=True now cuts the border exactly. Borders thinner than 10 px were kept, thicker ones were cut short, and wide or tall images lost too much. Delete old thumbnails with manage.py thumbnail clear_delete_all to regenerate them ([#845](https://github.com/mariocesar/sorl-thumbnail/issues/845) <https://github.com/mariocesar/sorl-thumbnail/issues/845>__)
• Blurring a transparent image no longer leaves a dark outline. blur mixed in the color stored under the transparent pixels, usually black, so a white shape on a transparent background came out with grey edges. The PIL engine now blurs with premultiplied alpha, which weighs each pixel by how visible it is. Thumbnails made before the upgrade keep the outline until you delete them, for example with manage.py thumbnail clear_delete_all
• orientation=False now applies only to the thumbnail it is given to. One such call used to turn off EXIF orientation for the size of every later thumbnail in the same process, so a photo taken in portrait could come out squashed or with the wrong is_portrait, until the server restarted. This affected every engine. If you use orientation=False, delete thumbnails made before the upgrade with manage.py thumbnail clear_delete_all ([#843](https://github.com/mariocesar/sorl-thumbnail/issues/843) <https://github.com/mariocesar/sorl-thumbnail/issues/843>__)
• sorl-thumbnail's ImageField rejects a truncated upload, such as a JPEG cut off by a dropped connection, with "Upload a valid image". The PIL engine

... (truncated)

Commits

• 8fca40e docs: Rewrite the README as a project front page with a quick start, features...
• d96a359 Link the quickstart, S3 and troubleshooting docs pages from the homepage
• e5e6dcc ci: Build the docs with warnings as errors in the qa job
• 5d93ad6 docs: Fix the README feature list, the fork step and two small notes
• 5c0737f chore: Describe the package on PyPI in one line
• 36ec72a chore: Remove THUMBNAIL_LAZY_FILL_EMPTY, nothing reads it
• 32ef0bc docs: Document every option, filter and setting, add an intro, a troubleshoot...
• 636f642 docs: Fix the examples that do not run and the install notes from 2010
• 87ded11 chore: Exclude secrets
• acd82a1 Add a project homepage and per-engine example galleries for GitHub Pages (#836)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)