[AVIF] Upload failed: File type not allowed

[MyWay]

Description

Hi, in past versions I was able to upload avif images, but now I'm getting: Upload failed: File type not allowed. Apparently support was removed here: ffaadc4

Steps to reproduce

1. Go on the admin dashboard
2. Create a post
3. Try to upload a avif image

Environment

• "@emdash-cms/admin": "^0.34.0",
• "emdash": "^0.34.0",

Logs / error output

[ascorbic]

@emdashbot investigate

[emdashbot]

Completed

Investigation complete: AVIF upload blocked by missing image/avif in server allowlist and admin accept string.

• Classify issue and locate upload code
• Reproduce via failing vitest test
• Diagnose root cause
• Verify whether bug or intended behavior
• Report result

Outcome: Reproduced with a failing unit test: `matchesMimeAllowlist('image/avif', GLOBAL_UPLOAD_ALLOWLIST)` returns false. The root cause is that `packages/core/src/api/handlers/media-allowlist.ts` enumerates raster image MIME types for the default upload allowlist but omits `image/avif`. Every server upload path rejects AVIF with `INVALID_TYPE` / "File type not allowed":

• `packages/core/src/astro/routes/api/media.ts:140`
• `packages/core/src/astro/routes/api/media/upload-url.ts:87`
• `packages/core/src/api/handlers/media-upload.ts:164`

The admin file picker also excludes AVIF: `packages/admin/src/components/MediaUploadDialog.tsx` sets `LOCAL_MEDIA_UPLOAD_ACCEPT` to `image/png,image/jpeg,image/gif,image/webp,...`.

This is inconsistent with the rest of the codebase, which already treats AVIF as a first-class image format: the media file serving route lists `image/avif` in `SAFE_INLINE_TYPES`, the image transform code supports `avif`, and the plugin registry artifact proxy explicitly allows `image/avif`.

I ran a temporary failing assertion in `packages/core/tests/unit/media/media-allowlist.test.ts` (`expect(matchesMimeAllowlist('image/avif', GLOBAL_UPLOAD_ALLOWLIST)).toBe(true)`) and reverted the test file afterwards. The failure trace is from `vitest run tests/unit/media/media-allowlist.test.ts` in `packages/core`.

Verdict: bug — the allowlist comment explains that image types are enumerated explicitly only to keep SVG out, not to exclude AVIF, and the docs media-library table is the only other place that omits AVIF. Fix is mechanical: add `image/avif` to `GLOBAL_UPLOAD_ALLOWLIST` and to `LOCAL_MEDIA_UPLOAD_ACCEPT`, and update the allowlist unit test.

Mode: diagnose

View live dashboard · Run: d3987b61-2c65-4083-b1d2-5584dda73c89

[ascorbic]

@emdashbot resume

[ascorbic]

@emdashbot resume