From 66ba9504a29cae40d3abe3180e550610808db979 Mon Sep 17 00:00:00 2001
From: Ralf Haferkamp <r.haferkamp@opencloud.eu>
Date: Wed, 13 May 2026 13:26:47 +0200
Subject: [PATCH 1/2] fix: disallow thumbnails for tiff and jpeg2000 images

---
 services/thumbnails/pkg/thumbnail/mimetypes_vips.go | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/services/thumbnails/pkg/thumbnail/mimetypes_vips.go b/services/thumbnails/pkg/thumbnail/mimetypes_vips.go
index b94fafafaf..597d2e742e 100644
--- a/services/thumbnails/pkg/thumbnail/mimetypes_vips.go
+++ b/services/thumbnails/pkg/thumbnail/mimetypes_vips.go
@@ -2,6 +2,15 @@
 
 package thumbnail
 
+import "github.com/davidbyttow/govips/v2/vips"
+
+func init() {
+	// temporary remove TIFF and JP2K from go-vips' list of supported
+	// imagetypes
+	delete(vips.ImageTypes, vips.ImageTypeTIFF)
+	delete(vips.ImageTypes, vips.ImageTypeJP2K)
+}
+
 var (
 	// SupportedMimeTypes contains an all mimetypes which are supported by the thumbnailer.
 	SupportedMimeTypes = map[string]struct{}{
@@ -11,7 +20,6 @@ var (
 		"image/gif":                         {},
 		"image/bmp":                         {},
 		"image/x-ms-bmp":                    {},
-		"image/tiff":                        {},
 		"text/plain":                        {},
 		"audio/flac":                        {},
 		"audio/mpeg":                        {},

From 08eb7321ee3c6eed2adc9bfa626e6ea590f3d1b9 Mon Sep 17 00:00:00 2001
From: Ralf Haferkamp <r.haferkamp@opencloud.eu>
Date: Wed, 13 May 2026 14:13:27 +0200
Subject: [PATCH 2/2] chore: bump docker base image to alpine 3.23 (#2754)

---
 Dockerfile                            | 2 +-
 opencloud/docker/Dockerfile.multiarch | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 041a7a8a43..780b42b3d5 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -29,7 +29,7 @@ COPY --from=generate /opencloud /opencloud
 WORKDIR /opencloud/opencloud
 RUN make go-generate build ENABLE_VIPS=true
 
-FROM alpine:3.20
+FROM alpine:3.23
 
 RUN apk add --no-cache attr ca-certificates curl mailcap tree vips && \
 	echo 'hosts: files dns' >| /etc/nsswitch.conf
diff --git a/opencloud/docker/Dockerfile.multiarch b/opencloud/docker/Dockerfile.multiarch
index 0d859da151..e0e19a5889 100644
--- a/opencloud/docker/Dockerfile.multiarch
+++ b/opencloud/docker/Dockerfile.multiarch
@@ -1,4 +1,4 @@
-FROM golang:alpine3.22 AS build
+FROM golang:alpine3.23 AS build
 ARG TARGETOS
 ARG TARGETARCH
 ARG VERSION
@@ -14,7 +14,7 @@ RUN --mount=type=bind,target=/build,rw \
     GOOS="${TARGETOS:-linux}" GOARCH="${TARGETARCH:-amd64}" ; \
     make -C opencloud/opencloud release-linux-docker-${TARGETARCH} ENABLE_VIPS=true DIST=/dist
 
-FROM alpine:3.22
+FROM alpine:3.23
 ARG VERSION
 ARG REVISION
 ARG TARGETOS