@thomas.f/prnext 0.1.13-alpha → 0.1.16-alpha

package/runtime/og-backend.mjs

@@ -0,0 +1,8 @@
+// Older native sharp backends can be supplied by the consuming application.
+// Fall back to the bundled resvg renderer unless librsvg includes its RCE fix.
+export function safeSvgBackend(backend) {
+  const version = backend?.versions?.rsvg;
+  if (typeof version !== 'string' || !/^\d+\.\d+\.\d+$/.test(version)) return false;
+  const [major, minor, patch] = version.split('.').map(Number);
+  return major > 2 || (major === 2 && (minor > 63 || (minor === 63 && patch >= 2)));
+}

package/runtime/og-loader.mjs

@@ -1,17 +1,4 @@
-// Upstream's Node bundle contains HarfBuzz's CommonJS globals and an adjacent
-// hb.wasm reference. Resolve these explicitly for direct prnext/og consumers.
-// Production builds prepare a relocatable module instead and avoid this loader.
-import { createRequire } from 'node:module';
-import { readFile } from 'node:fs/promises';
-import { pathToFileURL } from 'node:url';
-import path from 'node:path';
+// Ship the reviewed renderer instead of resolving upstream's vulnerable pin.
 export async function loadImageRenderer() {
-  const require = createRequire(import.meta.url);
-  const entry = require.resolve('@vercel/og');
-  const fontDirectory = path.dirname(entry);
-  const satori = createRequire(entry).resolve('satori');
-  const harfbuzzDirectory = path.dirname(createRequire(satori).resolve('harfbuzzjs/hb.wasm'));
-  const source = (await readFile(entry, 'utf8')).replaceAll('import.meta.url', JSON.stringify(pathToFileURL(entry).href));
-  const globals = `import {createRequire as __prnextRequire} from 'node:module';const require=__prnextRequire(${JSON.stringify(pathToFileURL(path.join(fontDirectory, 'index.node.js')).href)}),__filename=${JSON.stringify(entry)},__dirname=${JSON.stringify(harfbuzzDirectory)};\n`;
-  return import('data:text/javascript;base64,' + Buffer.from(globals + source).toString('base64'));
+  return import('./og/index.node.mjs');
 }