thx so much for the quick reply. just to ensure:

if i serve a malicious webp through the proxy that was uploaded by someone, the clients will not be affected, even if they use an old chrome that has still an old version of libwebp in it?

Usage of libwebp 1.3.2 protects imgproxy itself. When imgproxy processes an image, it decodes it and then encodes it to the resulting format. So the resulting image won't be malicious anyway. if imgproxy doesn't process an image due to the IMGPROXY_SKIP_PROCESSING_FORMATS config or the raw option, it serves the original image without modifications.