Yes I think the major story here is Google removing and then re-adding it back. Big companies have big egos, so this is quite a miracle.
I have a feeling now JXL is here to stay, finally.
I have a feeling now JXL is here to stay, finally.
I have to think this is a substantial reason for the backflip here as adding a new huge C library to browsers is a huge concern.
libjxl's vulnerability rate is low, but it still reflects the growing pains of a modern high-quality C/C++ parsing library.
With Rust things can be safer: For jxl-oxide there is one CVE. libjxl-rs does not yet have filed CVEs.
More likely the Google eng. director who tried to get rid of it because of not-invented-here syndrome (it was built in a different org) got a new job or changed company.