I use ruby-landlock as well for image processing. I can recommend setting VIPS_BLOCK_UNTRUSTED=1 when you switch to vips, it blocks untrusted image decoders.
Not setting that value caught the rails team off guard just recently, maybe it should be the default.
Not setting that value caught the rails team off guard just recently, maybe it should be the default.