OpenEXR
A second IDManifest flaw lands two weeks after OpenEXR's forty-CVE sweep
A side-by-side editorial comparison of libvips and Lucide — release velocity, themes, recent moves, and the top alternatives to consider.
libvips 8.18 opened up UltraHDR and Oklab, then spent months closing memory bugs.
The feed tracks release candidates only. The 8.18 line added UltraHDR load and save, Oklab and Oklch colourspaces, raw camera loading through libraw, and gainmap plumbing through thumbnail and dzsave. The most recent tag, 8.18.3-rc1, is a different kind of release: roughly two dozen fixes for out-of-bounds reads, heap overflows and null dereferences across the jp2k, HEIF, Radiance, Magick and PPM loaders.
Lucide folds its icon incubator into the main repo and tightens CI supply-chain posture.
Lucide ships a roughly weekly minor release, and the contents are consistently icon additions, icon geometry refinements, and framework-package fixes across Angular, Vue, and React Native. The community pipeline is the engine — most releases carry several contributors making their first commit. In late July the project folded @lucide/lab, its experimental icon incubator, into the main monorepo.
The feed tracks release candidates only. The 8.18 line added UltraHDR load and save, Oklab and Oklch colourspaces, raw camera loading through libraw, and gainmap plumbing through thumbnail and dzsave. The most recent tag, 8.18.3-rc1, is a different kind of release: roughly two dozen fixes for out-of-bounds reads, heap overflows and null dereferences across the jp2k, HEIF, Radiance, Magick and PPM loaders.
The arc runs from capability expansion to hardening. Having taken on more untrusted input formats, libvips is now paying the cost of that surface in memory-safety fixes, several credited to external fuzzing and security researchers. Format reach and attack surface are growing together.
With 8.18.3-rc1 dominated by loader bounds checks, the next tags are likely to continue as patch-level hardening on the 8.18 line rather than open a new format frontier.
Lucide ships a roughly weekly minor release, and the contents are consistently icon additions, icon geometry refinements, and framework-package fixes across Angular, Vue, and React Native. The community pipeline is the engine — most releases carry several contributors making their first commit. In late July the project folded @lucide/lab, its experimental icon incubator, into the main monorepo.
The consolidation is the through-line: one repository, and a formal path from experimental icon to core set. Alongside it, a sustained CI investment — SHA-pinned actions, explicit workflow permissions, grouped dependabot config — indicates supply-chain posture is now an active concern for a package with this install base. Icon work itself is drifting from raw additions toward metadata quality and optical refinement of icons that already exist.
Expect the weekly minors to continue, dominated by community icon additions, with more graduations out of @lucide/lab into the core set now that both live in one repository.
Other Design products tracked by Sparkpulse, ranked by recent ship velocity. Each card links to a full editorial trajectory and lets you pivot into a head-to-head comparison with either libvips or Lucide.
A second IDManifest flaw lands two weeks after OpenEXR's forty-CVE sweep
Mediamodifier's feed is a template catalog: one mockup per entry, several a day.
Spectra Blocks spends its first six weeks patching what 1.0 shipped.
Storybook is turning its component workshop into a tool surface agents can call.
Picsart bolts on every new video model within days — WAN 3.0 pushes single takes to 30 seconds.
Visme extended past documents into no-code microsites, then hardened the layout and brand layer.
See all libvips alternatives → · See all Lucide alternatives →
Latest ship moves from both products, interleaved chronologically. ⚡ = editorial spark.
They serve adjacent needs but don't currently overlap on shipped themes. Lucide is currently shipping more aggressively (velocity 6.3 vs 0.0), with 1 editorial sparks in the last 30 days against 0. See the at-a-glance table above for a side-by-side breakdown of velocity, recent sparks, and editorial themes.
Sparkpulse doesn't pick a winner — we score release velocity, not feature parity. Lucide is currently shipping more aggressively (velocity 6.3 vs 0.0), with 1 editorial sparks in the last 30 days against 0. For your specific use case, the alternatives sections above list other Design products to evaluate alongside.
Top libvips alternatives in Design are ranked by recent ship velocity. Browse the "libvips alternatives" section above for the current picks, or visit /alternatives/libvips for the full list with editorial commentary on each.
Top Lucide alternatives in Design are ranked by recent ship velocity. Browse the "Lucide alternatives" section above for the current picks, or visit /alternatives/lucide for the full list with editorial commentary on each.