Enable AUTO_WEBP by default, add AUTO_AVIF as opt-in

Configurable via THUMBOR_AUTO_WEBP and THUMBOR_AUTO_AVIF env vars.

Author: jensens

CHANGES.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.3.2 (unreleased)
+
+- Enable AUTO_WEBP by default for automatic WebP conversion when browser
+  supports it. AUTO_AVIF available as opt-in. Both configurable via
+  `THUMBOR_AUTO_WEBP` and `THUMBOR_AUTO_AVIF` environment variables.
+
 ## 0.3.1 (2026-03-09)
 
 - Fix ruff lint/format errors that blocked CI.

README.md

@@ -97,6 +97,8 @@ The image is automatically rebuilt weekly when a new Thumbor version appears on
 | `PGTHUMBOR_S3_BUCKET` | `""` | S3 bucket for blob fallback (empty = disabled) |
 | `PGTHUMBOR_S3_REGION` | `us-east-1` | S3 region |
 | `PGTHUMBOR_S3_ENDPOINT` | `""` | S3 endpoint for MinIO/Ceph (empty = AWS) |
+| `THUMBOR_AUTO_WEBP` | `"true"` | Auto-convert to WebP when browser supports it |
+| `THUMBOR_AUTO_AVIF` | `"false"` | Auto-convert to AVIF when browser supports it |
 | `PGTHUMBOR_PLONE_AUTH_URL` | `""` | Plone internal URL for auth (empty = disabled) |
 | `PGTHUMBOR_AUTH_CACHE_TTL` | `60` | Auth cache TTL in seconds |
 | `PGTHUMBOR_CACHE_CONTROL_AUTHENTICATED` | `private, max-age=86400` | Cache-Control for authenticated images (browser-only, no proxy caching) |

thumbor.conf

@@ -12,6 +12,10 @@ if os.environ.get("PGTHUMBOR_PLONE_AUTH_URL"):
 SECURITY_KEY = os.environ.get("THUMBOR_SECURITY_KEY", "CHANGE-ME")
 ALLOW_UNSAFE_URL = os.environ.get("ALLOW_UNSAFE_URL", "False").lower() == "true"
 
+# Auto-convert to modern formats when browser supports them (enabled by default)
+AUTO_WEBP = os.environ.get("THUMBOR_AUTO_WEBP", "true").lower() in ("true", "1", "yes")
+AUTO_AVIF = os.environ.get("THUMBOR_AUTO_AVIF", "false").lower() in ("true", "1", "yes")
+
 # Storage (Thumbor result cache — file-based for simplicity)
 RESULT_STORAGE = "thumbor.result_storages.file_storage"
 RESULT_STORAGE_FILE_STORAGE_ROOT_PATH = os.environ.get(