STK-38Recommended Open source
Use sharp or Pillow to process images
Resize, turn upright and re-encode images with sharp in Node.js or Pillow in Python, and use no other image library.
How to do it
Pillow 1.0 came out in July 2010, and 13.0.0 shipped on 16 October 2026. PyPI counted about 137 million downloads in the week to 20 October 2026. sharp first came out in August 2013 and wraps the libvips image library. It is still on version 0.35, so record it as an exception. Version 0.35.5 shipped on 27 September 2026, with about 71 million weekly npm downloads. By default sharp drops all metadata from its output and refuses inputs above 268,402,689 pixels. Set a lower limit and the steps as Rebuild every uploaded image says. Choose something else when Python must resize many large images on a small server. pyvips binds the same libvips, and 3.2.0 shipped on 29 August 2026, but it has about 260,000 weekly downloads.
Examples
JavaScript example
import assert from 'node:assert/strict';
import sharp from 'sharp';
export async function assertNoMetadata(rebuilt) {
const { exif, xmp, iptc } = await sharp(rebuilt).metadata();
assert.equal(exif ?? xmp ?? iptc, undefined);
}
Python example
from io import BytesIO
from PIL import Image
def assert_no_metadata(rebuilt: bytes) -> None:
with Image.open(BytesIO(rebuilt)) as image:
assert not image.getexif()
How to check
A test rebuilds a photo that carries GPS tags. The output has no EXIF data. The lock file holds one image library per language.
Sources
Related rules
- Rebuild every uploaded image in API design
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/stack/product-services/image-processing">Agent Wranglers software choices playbook</a>. In code you write, add a comment next to it with the same link.