fix(image): allow any quality 1-100 when images.qualities is unset

[james-elicx]

Problem

The image optimization endpoint returns 400 Bad Request for any quality other than 75. For example, the app-router-playground product card uses <Image quality={90}>, and the deployed endpoint fails:

GET /_next/image?url=%2Fshop%2Ftablet.png&w=750&q=90  ->  400 Bad Request
GET /_next/image?url=%2Fshop%2Ftablet.png&w=640&q=75  ->  200 OK

Only q=75 worked; q=50, q=90, q=100 all 400'd regardless of width.

Root cause

parseImageParams defaulted the allowed-quality list to DEFAULT_IMAGE_QUALITIES = [75] whenever images.qualities was not configured, and the build/runtime plumbing baked [75] into the deploy worker (__VINEXT_IMAGE_QUALITIES ?? "[75]").

Next.js only enforces a quality allowlist when images.qualities is explicitly set. When unset, it permits any integer quality from 1–100 — the allowlist block is skipped entirely:

// next/src/server/image-optimizer.ts — validateParams
const quality = parseInt(q, 10)
if (isNaN(quality) || quality < 1 || quality > 100) { /* reject */ }
if (qualities) {                       // only when configured
  if (isDev) qualities.push(BLUR_QUALITY)
  if (!qualities.includes(quality)) { /* reject */ }
}

Fix

• parseImageParams / resolveDevImageRedirect take an optional allowedQualities and only enforce the allowlist when one is provided (still range-checks 1–100 and preserves the dev BLUR_QUALITY exception).
• Removed the [75] default and the ?? DEFAULT_IMAGE_QUALITIES / ?? "[75]" fallbacks; the build now emits null when qualities is unset so the "allow all" semantics survive into the deploy worker.
• Covers all call paths (app-router, pages-router, dev server, deploy worker) since they all route through the shared parseImageParams.

Tests

• Regression test: any quality 1–100 passes when qualities is unset.
• Allowlist is still enforced when qualities is configured.
• Updated the prior test that asserted the buggy [75]-only behaviour.

Follow-up

A stacked PR will address the remaining validateParams parity gaps (recursive /_next/image guard, localPatterns, remotePatterns, minimumCacheTTL).

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@vinext/cloudflare@2023

npm i https://pkg.pr.new/vinext@2023

commit: 2fb2e3a