[hsusul]

Why

Local image transformations fail for accepted filenames such as avatar@2x.png. Imgproxy treats the unescaped @ as an output-format separator. Encode local sources at the same renderer boundary used for remote sources.

Fixes #1641.

What changed

• Remove the local:// exception from source URL encoding.
• Cover ordinary filenames, one @, and multiple @ characters through a real HTTP server and native fetch.
• Update existing retry and render route assertions for the encoded local URL.

Scope

This fixes local source URLs in image transformations. It does not address imgproxy's separate handling of ? in local filenames.

Blast Radius

Local imgproxy requests now use the existing encoding applied to remote requests. Backend URL contracts and S3 source encoding remain unchanged.

Verification

• Regression tests committed before the fix fail on unescaped paths. Node 26.13.0 runs pass all 3,424 unit tests and all 27 render route integration tests.
• Real FileBackend upload plus ImageRenderer and bundled imgproxy v3.26.0 produces a PNG of width 1 for versioned cat@2x.jpg. The same reproduction fails when the fix is removed and passes when restored.
• npm run build, npm run lint, and git diff --check pass. Full integration suite was not run.

AI-assisted discovery, implementation, and review. Runtime results verified locally.

[coveralls]

Coverage Report for CI Build 41277796285

Coverage decreased (-0.001%) to 86.947%

Details

• Coverage decreased (-0.001%) from the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	15592
Covered Lines:	13995
Line Coverage:	89.76%
Relevant Branches:	9950
Covered Branches:	8213
Branch Coverage:	82.54%
Branches in Coverage %:	Yes
Coverage Strength:	1224.76 hits per line

---

💛 - Coveralls