I wanted to say I really, really appreciate your comment here John. libvips is a very useful tool set and maintaining it is certainly a bigger public challenge than I ever took on. I just wish the Ruby on Rails community had hardened their use of it sooner. Again, thank you.
https://www.rubydoc.info/gems/ruby-vips/Vips.block_untrusted
You can also set the env var `VIPS_BLOCK_UNTRUSTED`, which might be easier.
You can block or allow specific load operations, so you can limit format support to just the types you need:
https://www.rubydoc.info/gems/ruby-vips/Vips#block-class_met...
That might be even better.
There was a post on libvips.org about this a while ago:
https://www.libvips.org/2022/05/28/What's-new-in-8.13.html
And a note about it in the checklist for devs:
https://www.libvips.org/API/current/developer-checklist.html...