Henkan – WebP & AVIF Converter

更新日志

2.4.0

Security

• Enhanced image MIME validation: Added strict server-side image type verification using mime_content_type() with exif_imagetype() fallback.
• Fail-closed image processing: Files are rejected when no reliable image type verification method is available.
• Conversion locking: Added atomic per-attachment conversion locks to prevent concurrent conversion of the same image and generated sizes.
• Stale lock recovery: Conversion locks that remain active after an unexpected process termination can be safely recovered.
• Lock ownership validation: Processes can only release locks that they own.
• Integrity check locking: Prevented multiple integrity checks from running concurrently.

Bulk Optimization

• Cursor-based media scanning: Replaced unbounded media-library queries with bounded cursor/keyset pagination.
• Reduced memory usage: Large media libraries are no longer loaded into PHP memory in a single request.
• Improved AJAX bulk processing: Bulk scans now process images in controlled batches and return a continuation cursor.
• Improved “Only missing” detection: Conversion status is now verified against the actual files on disk instead of relying solely on database records.
• Multi-format verification: Missing WebP, AVIF, or JPEG XL files are detected independently when multiple output formats are enabled.

Background Processing

• Real background queue worker: Added a bounded WP-Cron worker for background bulk optimization.
• Queue locking: Prevented multiple background workers from processing the same queue simultaneously.
• Cursor-based queue: The background queue stores a lightweight attachment cursor instead of maintaining a potentially massive list of attachment IDs.
• Bounded worker execution: Each worker run processes a limited number of attachments to reduce PHP execution time and memory pressure.
• Automatic queue continuation: Remaining work is automatically scheduled for subsequent WP-Cron runs.
• Safe queue completion: Queue state is persisted and finalized cleanly after the last batch.
• Automatic cache cleanup: Relevant caches are cleared after successful queue completion when enabled.

WP-CLI

• Keyset pagination: Replaced offset-based pagination with ID-based cursor pagination.
• Improved large-library performance: WP-CLI bulk processing no longer becomes progressively slower as the attachment offset increases.
• Bounded processing: CLI operations now use controlled batch sizes.

Database & Integrity

• Chunked integrity checks: Henkan data is now checked in bounded batches instead of loading the complete wp_henkan_data table into memory.
• Reduced database memory pressure: Large Henkan installations can perform integrity checks without creating oversized PHP result sets.
• Improved missing-file detection: Integrity checks can identify missing converted files more reliably.

Web Server Delivery

• Deterministic format priority: Updated generated Nginx configuration to use the documented format priority:
  WebP > AVIF > JPEG XL.
• Improved multi-format handling: Format availability is evaluated independently rather than treating the presence of one generated format as sufficient.

2.3.3

• Security: Added strict server-side MIME-type verification (using mime_content_type and exif_imagetype) to the image creation process. This prevents malicious file uploads disguised as images from reaching the CLI fallback converters, effectively mitigating the CVE-2026-65640 vulnerability (Imagick/Ghostscript RCE).
• Changed: Bumped the “Requires at least” WordPress version to 7.0.4 to align with core security standards and ensure safe environment execution.

2.3.2

• **Fix Readme

2.3.0

• **New tab: Smart Options. A dedicated “Smart Options” tab has been added to the plugin dashboard. It groups all optional, advanced features behind individual toggles that are disabled by default. Existing setups are completely unaffected unless a feature is explicitly activated.
• **Smart Option: Quality by Image Size. Allows a separate, lower quality value to be applied to WordPress-generated thumbnail crop sizes (e.g. thumbnail, medium, medium_large) while the global quality setting continues to apply to full-size originals. The feature uses wp_get_registered_image_subsizes() to determine whether a given image size is an actual WordPress crop — custom single-resolution setups where WordPress thumbnail generation is not used are not affected even if the toggle is enabled.
• **Smart Option: Integrity Check. Adds a daily WP-Cron job that verifies whether converted files recorded in the wp_henkan_data table still physically exist on disk. Any entry whose files are no longer present is removed from the database, causing the image to be re-queued for conversion on the next bulk scan. The Smart Options tab displays the date of the last run and the number of missing files found. Particularly useful after server migrations or accidental file deletions.
• **Smart Option: Max Output Width. Optionally limits the pixel width of converted output files. If an uploaded image exceeds the configured maximum width, it is scaled down proportionally before conversion. The original file is never modified — only the converted WebP/AVIF/JXL output is resized. Aspect ratio is always preserved. Images already narrower than the configured value are not affected.
• **Conversion Statistics panel. A new read-only statistics panel in the Smart Options tab shows the total number of converted images and the cumulative disk space saved. Also introduces the wp henkan stats WP-CLI command for the same information from the terminal.
• **New WP-CLI command: wp henkan stats. Outputs a summary of total converted images and space saved directly from the terminal.

2.2.0

• Tested up to: WordPress 7.0
• New: Full compatibility with WordPress 7.0 architectural changes.
• New: High-performance database architecture. Migrated conversion data from wp_postmeta to a dedicated custom table (wp_henkan_data). This significantly speeds up backend load times and reduces database queries for large media libraries. The migration runs seamlessly and automatically in the background.
• New: Asynchronous Background Queue for Bulk Optimization. You can now run massive conversion tasks safely in the background via WP-Cron without keeping the browser tab open. This feature can be toggled in the Advanced Settings.
• New: Granular Exclusion Rules. You can now exclude specific files, paths, or naming patterns (e.g., logos, specific folders) from conversion using simple string matching or Regex.
• Tweak: Improved resource management and cleanup routines. The plugin now automatically purges the associated database rows in the custom table when an attachment is permanently deleted.

2.1.1

• Fix: Added native WordPress Media Library support for AVIF and JXL formats.
• Fix: Added an admin grid fallback to display WebP/JPEG thumbnails if the browser does not support JXL natively.

2.1.0

• Feature: Multi-Format Engine! You can now generate WebP, AVIF, and JXL simultaneously for every uploaded image.
• Feature: Added experimental support for JPEG XL (.jxl) via cjxl and ImageMagick.
• UI/UX: Completely redesigned the Admin Dashboard. All settings, Server Rewrites, and WP-CLI commands are now unified into a clean, single-card tabbed interface.
• Engine: Introduced an intelligent Auto-Fallback system. If native OS binaries (avifenc, cwebp) fail or are blocked by your host, Henkan automatically falls back to PHP GD or ImageMagick.
• Engine: Strict format priority (WebP > AVIF > JXL) ensures maximum browser compatibility for the main WordPress media library files.
• Core: Added detailed, transparent error logging directly in the bulk optimization UI to help identify missing server binaries.
• Compliance: Achieved 100% strict compliance with WordPress Coding Standards (WPCS) and security escaping rules.

2.0.4

• Bumped minimum requirements to PHP 7.4 and WordPress 6.0 for better security and native binary performance.
• Improved Readme layout and added FAQ section.

2.0.3

• Initial release on the official WordPress.org Plugin Directory.
• Full i18n Overhaul & WP.org Compliance.
• Strict settings sanitization and security patches applied.