+1, Thanks for the update
Gaetan On 8/30/26 16:27, Mridul Pathak wrote:
Hi all, commons-imaging has been pinned to 1.0-alpha3 in OFBiz because its API changed in 1.0.0-alpha4, a version we never migrated past; the library itself has stayed alpha-only since 2019 and is currently at 1.0.0-alpha6 with no GA in sight. I audited actual usage and found it's concentrated in one file, SecuredUpload.java, for magic-byte format validation and a TIFF decode/encode fallback -- the JDK's built-in ImageIO already handles PNG/GIF/JPEG natively. Both needs can be covered by dependencies we either already have or that are a clean, narrow addition: metadata-extractor (already a project dependency) for format sniffing via its FileTypeDetector, and com.twelvemonkeys.imageio:imageio-tiff (pure-Java, BSD-3, actively maintained SPI plugin) to give ImageIO native TIFF support, letting us delete the manual Commons Imaging fallback code entirely. I've filed OFBIZ-13507 and put up patches for both trunk and release24.09: - trunk: https://github.com/apache/ofbiz-framework/pull/1819 - release24.09 (backport): https://github.com/apache/ofbiz-framework/pull/1821 It's a net reduction in both dependencies and code (one dependency removed, one narrow one added, about 70 fewer lines on trunk), and also drops the now-unreachable commons-imaging Dependabot ignore rule added in #1810. Feedback welcome before I look at merging. Thanks, Mridul Pathak
