> I am unclear on how jpeg and jpeg-turbo, as projecs, deal with > security issues and prompt releases. I think we should look at them > both and understand if we are moving to a worse (or better) situation > before leaping. For jpeg: https://www.cvedetails.com/vendor/17990/IJG.html For libjpeg-turbo: https://www.cvedetails.com/vendor/17075/Libjpeg-turbo.html Seems the current releases aren't affected by unfixed CVEs, but they aren't in a hurry to fix security bugs. However the libjpeg-turbo development is more active and as I see, more popular. -- Regards, kikadf