Hello Teddy,

the extension creates Webp thumbnails IF the original image is of Webp mime type.

I can see how it would be interesting to specify which type the thumbnail should be of. Right now, thumbnails are created with the same mime type as the original image.

I'll see how I can improve on that for an upcoming release.

AVIF was out of the question until now, it was not supported by the PHP GD library before PHP 8.1 (GD is the library used to create the thumbnails).
I will add support soon for the systems running PHP 8.1 and over.

allow_url_fopen is required to 'read' and process images that are not local.

As stated in the doc and as you mentioned, it is a security risk If you have no control over the images and files that you are getting from outside your server. However, when you manage both servers/sites (both ends), this is not an issue as much. You are not going to inject malicious code into your own images or into your own files or urls.

The extension only allows the retrieval of images if allow_url_fopen is ON, meaning: only if you decide it's ok to take the risk.
Using Curl won't shield you from malicious files.

I'll see if I should 'ease' the restrictions... Now that there is an option to specify if you want to allow remote files or not.

Thanks Teddy, I really appreciate.

I will be working on that soon, now that moving to Joomla 4 is out of the way (mostly). I can finally go back to improving things up and adding needed features

Note that even when using WebP or Avif, I do provide fallbacks. So, when you'll be able to choose the format of the thumbnails and if you choose WebP or Avif, the fallback (for un-supporting browsers), will be a thumbnail created from the original image's mime type. And if the original image is of WebP or Avif mime type, the fallback image will be png (mostly to ensure images that have transparency remain transparent).