I wonder if we should use this chance to actually switch to the imagick PHP extension and depracate the use of exec entirely. This would introduce a new dependency on the imagick extension, but also solve some additional problems and potential future security risks.

Started with a first attempt, just a few failing tests still: https://github.com/getkirby/kirby/tree/v5/refactor/imagick

Is there much of a difference between webspace having the CLI available vs. those having the class from the extension ready? Would we cut off users that have been using IM now, if they don't control their webspace?

I don't have any stats on this. My personal "feeling" is that shared hosting with IM support has the extension installed by default. At least from what I've seen so far. But it could be an issue on self managed VPSes. I'm pretty sure we would meet people who have used im before but don't have the extension.

We could maybe also think about keeping the old code, deprecate it and add the imagick version as a new default driver.

Related issue: convert command deprecated #6534