nuxt-og-image 6.4.7 → 6.4.9

package/dist/runtime/app/components/Templates/Community/SimpleBlog.satori.vue

@@ -1,7 +1,7 @@
 <script setup>
-import { useSiteConfig } from "#site-config/app/composables";
 import { parseURL } from "ufo";
 import { computed } from "vue";
+import { useSiteConfig } from "#site-config/app/composables";
 const props = defineProps({
   colorMode: { type: String, required: false, default: "light" },
   title: { type: String, required: false, default: "title" },

package/dist/runtime/app/utils/plugins.js

@@ -1,10 +1,10 @@
-import { useRequestEvent } from "#app";
-import { withSiteUrl } from "#site-config/app/composables";
 import { TemplateParamsPlugin } from "@unhead/vue/plugins";
 import { defu } from "defu";
 import { createRouter as createRadixRouter, toRouteMatcher } from "radix3";
 import { parseURL, withoutBase } from "ufo";
 import { toValue } from "vue";
+import { useRequestEvent } from "#app";
+import { withSiteUrl } from "#site-config/app/composables";
 import { createOgImageMeta, getOgImagePath } from "../../app/utils.js";
 import { isInternalRoute } from "../../shared.js";
 const RE_COMMA = /,/g;
@@ -19,7 +19,7 @@ export function ogImageCanonicalUrls(nuxtApp) {
     ssrContext?.head.use({
       key: "nuxt-og-image:overrides-and-canonical-urls",
       hooks: {
-        "tags:afterResolve": async (ctx2) => {
+        "tags:afterResolve": (ctx2) => {
           let title = "";
           let description = "";
           for (const tag of ctx2.tags) {
@@ -39,7 +39,7 @@ export function ogImageCanonicalUrls(nuxtApp) {
               }
               tag.props.content = tag.props.content.replaceAll("%title", title).replaceAll("%description", description).replaceAll(" ", "+");
               if (!tag.props.content?.startsWith("https")) {
-                await nuxtApp.runWithContext(() => {
+                nuxtApp.runWithContext(() => {
                   tag.props.content = toValue(withSiteUrl(tag.props.content || "", {
                     withBase: true,
                     canonical: !import.meta.dev

package/dist/runtime/app/utils.js

@@ -1,9 +1,9 @@
-import { componentNames } from "#build/nuxt-og-image/components.mjs";
 import { defu } from "defu";
 import { stringify } from "devalue";
 import { useHead, useRuntimeConfig } from "nuxt/app";
 import { joinURL, withQuery } from "ufo";
 import { isRef, toValue } from "vue";
+import { componentNames } from "#build/nuxt-og-image/components.mjs";
 import { buildOgImageUrl, generateMeta, separateProps } from "../shared.js";
 function resolveUnrefHeadInput(input) {
   if (input == null)

package/dist/runtime/server/og-image/bindings/browser/chrome-launcher.js

@@ -4,6 +4,7 @@ const chromePath = Launcher.getFirstInstallation();
 export async function createBrowser(_event) {
   return playwrightCore.chromium.launch({
     headless: true,
-    executablePath: chromePath
+    executablePath: chromePath,
+    timeout: 15e3
   });
 }

package/dist/runtime/server/og-image/bindings/browser/cloudflare.js

@@ -1,3 +1,4 @@
+import { withTimeout } from "../../../util/withTimeout.js";
 import { useOgImageRuntimeConfig } from "../../../utils.js";
 let puppeteer;
 async function getPuppeteer() {
@@ -25,7 +26,8 @@ export async function createBrowser(event) {
       `[Nuxt OG Image] Cloudflare browser binding "${bindingName}" not found. Ensure it's configured in wrangler.toml and the request has cloudflare context.`
     );
   }
-  browserPromise = (async () => {
+  const launchTimeout = useOgImageRuntimeConfig().security?.renderTimeout ?? 15e3;
+  browserPromise = withTimeout((async () => {
     const pptr = await getPuppeteer();
     const sessions = await pptr.sessions(binding);
     const existingSession = sessions.find((s) => !s.connected);
@@ -38,7 +40,7 @@ export async function createBrowser(event) {
       browser = null;
     });
     return browser;
-  })();
+  })(), launchTimeout, "cloudflare browser launch");
   browser = await browserPromise;
   browserPromise = null;
   return browser;

package/dist/runtime/server/og-image/bindings/browser/on-demand.js

@@ -27,6 +27,7 @@ export async function createBrowser(_event) {
     })();
   }
   return await playwrightCore.chromium.launch({
-    headless: true
+    headless: true,
+    timeout: 15e3
   });
 }

package/dist/runtime/server/og-image/bindings/browser/playwright.js

@@ -1,6 +1,7 @@
 import playwright from "playwright";
 export async function createBrowser(_event) {
   return await playwright.chromium.launch({
-    headless: true
+    headless: true,
+    timeout: 15e3
   });
 }

package/dist/runtime/server/og-image/bindings/font-assets/dev-prerender.js

@@ -1,9 +1,9 @@
 import { readFile } from "node:fs/promises";
-import { buildDir, rootDir } from "#og-image-virtual/build-dir.mjs";
 import { getRequestURL } from "h3";
 import { useRuntimeConfig } from "nitropack/runtime";
 import { join } from "pathe";
 import { withBase } from "ufo";
+import { buildDir, rootDir } from "#og-image-virtual/build-dir.mjs";
 import { getFetchTimeout } from "../../../util/fetchTimeout.js";
 import { useOgImageRuntimeConfig } from "../../../utils.js";
 let fontUrlMapping;

package/dist/runtime/server/og-image/bindings/font-assets/node.js

@@ -1,6 +1,6 @@
-import { getNitroOrigin } from "#site-config/server/composables";
 import { useRuntimeConfig } from "nitropack/runtime";
 import { withBase } from "ufo";
+import { getNitroOrigin } from "#site-config/server/composables";
 import { getFetchTimeout } from "../../../util/fetchTimeout.js";
 import { useOgImageRuntimeConfig } from "../../../utils.js";
 export async function resolve(event, font) {

package/dist/runtime/server/og-image/browser/renderer.js

@@ -1,5 +1,5 @@
-import { createBrowser } from "#og-image/bindings/browser";
 import { createError } from "h3";
+import { createBrowser } from "#og-image/bindings/browser";
 import { createScreenshot } from "./screenshot.js";
 const BrowserRenderer = {
   name: "browser",

package/dist/runtime/server/og-image/browser/screenshot.js

@@ -1,6 +1,6 @@
-import { getNitroOrigin } from "#site-config/server/composables";
 import { withQuery } from "ufo";
 import { toValue } from "vue";
+import { getNitroOrigin } from "#site-config/server/composables";
 import { buildOgImageUrl } from "../../../shared.js";
 import { getFetchTimeout } from "../../util/fetchTimeout.js";
 import { logger } from "../../util/logger.js";
@@ -55,7 +55,7 @@ async function takeScreenshot(page, selector, options) {
   return await page.screenshot(puppeteerOptions);
 }
 export async function createScreenshot({ basePath, e, options, extension, timings }, browser) {
-  const runtimeConfig = useOgImageRuntimeConfig();
+  const runtimeConfig = useOgImageRuntimeConfig(e);
   const { colorPreference, defaults, security } = runtimeConfig;
   const path = options.component === "PageScreenshot" ? basePath : buildOgImageUrl(options, "html", false, defaults, security?.secret || void 0).url;
   let page;

package/dist/runtime/server/og-image/cache/buildCache.js

@@ -1,6 +1,6 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { componentNames } from "#og-image-virtual/component-names.mjs";
 import { join } from "pathe";
+import { componentNames } from "#og-image-virtual/component-names.mjs";
 import { hashOgImageOptions } from "../../../shared/urlEncoding.js";
 import { useOgImageRuntimeConfig } from "../../utils.js";
 export function getComponentHash(componentName) {

package/dist/runtime/server/og-image/context.js

@@ -1,18 +1,19 @@
-import { prerenderOptionsCache } from "#og-image-cache";
-import { getSiteConfig } from "#site-config/server/composables/getSiteConfig";
-import { createSitePathResolver } from "#site-config/server/composables/utils";
 import { defu } from "defu";
 import { createError, getQuery } from "h3";
 import { useNitroApp } from "nitropack/runtime";
 import { hash } from "ohash";
 import { parseURL, withoutLeadingSlash, withoutTrailingSlash, withQuery } from "ufo";
 import { normalizeKey } from "unstorage";
+import { prerenderOptionsCache } from "#og-image-cache";
+import { getSiteConfig } from "#site-config/server/composables/getSiteConfig";
+import { createSitePathResolver } from "#site-config/server/composables/utils";
 import { logger } from "../../logger.js";
 import { decodeOgImageParams, extractEncodedSegment, sanitizeProps, separateProps, verifyOgImageSignature } from "../../shared.js";
 import { autoEjectCommunityTemplate } from "../util/auto-eject.js";
 import { createNitroRouteRuleMatcher } from "../util/kit.js";
 import { normaliseOptions } from "../util/options.js";
 import { createTimings, TIMING_CTX_KEY } from "../util/timings.js";
+import { withTimeout } from "../util/withTimeout.js";
 import { useOgImageRuntimeConfig } from "../utils.js";
 import { getBrowserRenderer, getSatoriRenderer, getTakumiRenderer } from "./instances.js";
 const RE_HASH_MODE = /^o_([a-z0-9]+)$/i;
@@ -34,7 +35,7 @@ export function resolvePathCacheKey(e, path, resolvedOptions) {
   ].join(":");
 }
 export async function resolveContext(e) {
-  const runtimeConfig = useOgImageRuntimeConfig();
+  const runtimeConfig = useOgImageRuntimeConfig(e);
   const resolvePathWithBase = createSitePathResolver(e, {
     absolute: false,
     withBase: true
@@ -200,8 +201,14 @@ export async function resolveContext(e) {
     basePath,
     options: normalised.options,
     timings,
+    // @ts-expect-error hookable v6
     _nitro: useNitroApp()
   };
-  await ctx._nitro.hooks.callHook("nuxt-og-image:context", ctx);
+  const hookTimeout = runtimeConfig.security?.renderTimeout ?? 15e3;
+  await withTimeout(
+    ctx._nitro.hooks.callHook("nuxt-og-image:context", ctx),
+    hookTimeout,
+    "nuxt-og-image:context hook"
+  );
   return ctx;
 }

package/dist/runtime/server/og-image/core/plugins/imageSrc.js

@@ -1,63 +1,14 @@
-import { getNitroOrigin } from "#site-config/server/composables/getNitroOrigin";
 import { useStorage } from "nitropack/runtime";
 import { withBase, withoutLeadingSlash } from "ufo";
+import { getNitroOrigin } from "#site-config/server/composables/getNitroOrigin";
 import { toBase64Image } from "../../../../shared.js";
 import { decodeHtml } from "../../../util/encoding.js";
 import { fetchLocalAsset } from "../../../util/fetchLocalAsset.js";
 import { getFetchTimeout } from "../../../util/fetchTimeout.js";
 import { logger } from "../../../util/logger.js";
+import { fetchWithRedirectValidation, isBlockedUrl } from "../../../util/ssrf.js";
 import { getImageDimensions } from "../../utils/image-detector.js";
 import { defineTransformer } from "../plugins.js";
-const RE_IPV6_BRACKETS = /^\[|\]$/g;
-const RE_MAPPED_V4 = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/;
-const RE_DIGIT_ONLY = /^\d+$/;
-const RE_INT_IP = /^(?:0x[\da-f]+|\d+)$/i;
-function isPrivateIPv4(a, b) {
-  if (a === 127)
-    return true;
-  if (a === 10)
-    return true;
-  if (a === 172 && b >= 16 && b <= 31)
-    return true;
-  if (a === 192 && b === 168)
-    return true;
-  if (a === 169 && b === 254)
-    return true;
-  if (a === 0)
-    return true;
-  return false;
-}
-function isBlockedUrl(url) {
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    return true;
-  }
-  if (parsed.protocol !== "http:" && parsed.protocol !== "https:")
-    return true;
-  const hostname = parsed.hostname.toLowerCase();
-  const bare = hostname.replace(RE_IPV6_BRACKETS, "");
-  if (bare === "localhost" || bare.endsWith(".localhost"))
-    return true;
-  const mappedV4 = bare.match(RE_MAPPED_V4);
-  const ip = mappedV4 ? mappedV4[1] : bare;
-  const parts = ip.split(".");
-  if (parts.length === 4 && parts.every((p) => RE_DIGIT_ONLY.test(p))) {
-    const octets = parts.map(Number);
-    if (octets.some((o) => o > 255))
-      return true;
-    return isPrivateIPv4(octets[0], octets[1]);
-  }
-  if (RE_INT_IP.test(ip)) {
-    const num = Number(ip);
-    if (!Number.isNaN(num) && num >= 0 && num <= 4294967295)
-      return isPrivateIPv4(num >> 24 & 255, num >> 16 & 255);
-  }
-  if (bare === "::1" || bare.startsWith("fc") || bare.startsWith("fd") || bare.startsWith("fe80"))
-    return true;
-  return false;
-}
 const RE_URL_LEADING = /^url\(['"]?/;
 const RE_URL_TRAILING = /['"]?\)$/;
 const SUBREQUEST_HEADERS = { "x-nuxt-og-image": "1" };
@@ -120,12 +71,24 @@ async function doResolveSrcToBuffer(src, kind, { e, publicStoragePath, runtimeCo
     return { blocked: true };
   }
   const end = timings.start("image-fetch");
-  const buffer = await $fetch(decodedSrc, {
-    responseType: "arrayBuffer",
-    timeout: fetchTimeout
-  }).catch((err) => {
-    logFailure(decodedSrc, err);
-  }).finally(end);
+  let buffer;
+  if (import.meta.dev) {
+    buffer = await $fetch(decodedSrc, {
+      responseType: "arrayBuffer",
+      timeout: fetchTimeout
+    }).catch((err) => {
+      logFailure(decodedSrc, err);
+    }).finally(end);
+  } else {
+    const ab = await fetchWithRedirectValidation(decodedSrc, {
+      timeout: fetchTimeout
+    }).catch((err) => {
+      logFailure(decodedSrc, err);
+      return null;
+    }).finally(end);
+    if (ab)
+      buffer = new Uint8Array(ab);
+  }
   return buffer ? { buffer } : {};
 }
 function applyImageDimensions(node, buffer) {
@@ -173,8 +136,12 @@ export default defineTransformer([
         applyImageDimensions(node, result.buffer);
         return;
       }
-      if (isRelative)
+      if (isRelative) {
         node.props.src = withBase(src, `${getNitroOrigin(ctx.e)}`);
+        return;
+      }
+      if (!import.meta.dev)
+        delete node.props.src;
     }
   },
   // fix style="background-image: url('')"
@@ -190,8 +157,12 @@ export default defineTransformer([
         delete node.props.style.backgroundImage;
         return;
       }
-      if (result.buffer)
+      if (result.buffer) {
         node.props.style.backgroundImage = `url(${toBufferSourceAsBase64(result.buffer)})`;
+        return;
+      }
+      if (!import.meta.dev && !src.startsWith("/"))
+        delete node.props.style.backgroundImage;
     }
   }
 ]);

package/dist/runtime/server/og-image/core/transforms/emojis/fetch.js

@@ -1,5 +1,5 @@
-import { emojiCache } from "#og-image-cache";
 import { $fetch } from "ofetch";
+import { emojiCache } from "#og-image-cache";
 import { getFetchTimeout } from "../../../../util/fetchTimeout.js";
 import { getEmojiCodePoint, getEmojiIconNames } from "./emoji-utils.js";
 export async function getEmojiSvg(ctx, emojiChar) {

package/dist/runtime/server/og-image/core/vnodes.js

@@ -178,7 +178,8 @@ export async function createVNodes(ctx, options) {
     logger.warn("The `html` option is deprecated and will be removed in the next major version. Use a Vue component instead.");
   }
   if (!html) {
-    const island = await fetchIsland(ctx.e, ctx.options.component, typeof ctx.options.props !== "undefined" ? ctx.options.props : ctx.options);
+    const islandTimeout = ctx.runtimeConfig.security?.renderTimeout ?? 15e3;
+    const island = await ctx.timings.measure("island-fetch", () => fetchIsland(ctx.e, ctx.options.component, typeof ctx.options.props !== "undefined" ? ctx.options.props : ctx.options, islandTimeout));
     island.html = htmlDecodeQuotes(island.html);
     await applyEmojis(ctx, island);
     html = island.html;
@@ -195,6 +196,6 @@ export async function createVNodes(ctx, options) {
     rootChild.props.style = { width: "100%", height: "100%", ...rootChild.props.style };
   }
   warnUnsupportedSvgElements(vnodeTree, ctx.options.component);
-  await Promise.all(walkTree(ctx, vnodeTree, [encoding, styleDirectives, imageSrc]));
+  await ctx.timings.measure("vnode-walk", () => Promise.all(walkTree(ctx, vnodeTree, [encoding, styleDirectives, imageSrc])));
   return vnodeTree;
 }

package/dist/runtime/server/og-image/devtools.js

@@ -1,6 +1,6 @@
-import { htmlPayloadCache } from "#og-image-cache";
 import { parse } from "devalue";
 import { createError } from "h3";
+import { htmlPayloadCache } from "#og-image-cache";
 import { extractSocialPreviewTags } from "../../pure.js";
 import { logger } from "../util/logger.js";
 const PAYLOAD_REGEX = /<script.+id="nuxt-og-image-options"[^>]*>(.+?)<\/script>/;

package/dist/runtime/server/og-image/font-source.d.ts

@@ -0,0 +1,20 @@
+export type FontFormat = 'ttf' | 'otf' | 'woff' | 'woff2';
+export declare function fontFormat(src: string): FontFormat;
+/**
+ * Pick the src to actually load for a parsed font entry.
+ *
+ * - When `preferStatic` is set (takumi), prefers the full static satoriSrc over a subset WOFF2
+ *   primary src. @nuxt/fonts CSS often ships only the latin subset for a family, so using the
+ *   subset would hide non-latin glyphs (devanagari, CJK) the static file covers.
+ * - Otherwise, uses the primary src when the renderer can parse its format, falling back to
+ *   satoriSrc as a static alternative when the primary format is unsupported (satori + WOFF2).
+ *
+ * Returns null when no src on this entry can be parsed by the renderer.
+ */
+export declare function selectFontSource(f: {
+    src: string;
+    satoriSrc?: string;
+}, supportedFormats: Set<FontFormat>, preferStatic: boolean): {
+    src: string;
+    isStaticFallback: boolean;
+} | null;

package/dist/runtime/server/og-image/font-source.js

@@ -0,0 +1,20 @@
+export function fontFormat(src) {
+  if (src.endsWith(".woff2"))
+    return "woff2";
+  if (src.endsWith(".woff"))
+    return "woff";
+  if (src.endsWith(".otf"))
+    return "otf";
+  return "ttf";
+}
+export function selectFontSource(f, supportedFormats, preferStatic) {
+  const primarySupported = supportedFormats.has(fontFormat(f.src));
+  const satoriSupported = !!(f.satoriSrc && supportedFormats.has(fontFormat(f.satoriSrc)));
+  if (preferStatic && satoriSupported && f.satoriSrc !== f.src)
+    return { src: f.satoriSrc, isStaticFallback: true };
+  if (primarySupported)
+    return { src: f.src, isStaticFallback: false };
+  if (satoriSupported)
+    return { src: f.satoriSrc, isStaticFallback: true };
+  return null;
+}

package/dist/runtime/server/og-image/fonts.d.ts

@@ -1,8 +1,8 @@
 import type { H3Event } from 'h3';
 import type { OgImageRenderEventContext, RuntimeFontConfig } from '../../types.js';
+import type { FontFormat } from './font-source.js';
 export { buildSubsetFamilyChain, renameSubsetFonts, resolveSubsetChain } from './font-subsets.js';
 export { codepointsIntersectRanges, extractCodepoints, parseUnicodeRange } from './unicode-range.js';
-type FontFormat = 'ttf' | 'otf' | 'woff' | 'woff2';
 export interface LoadFontsOptions {
     /**
      * Font formats the renderer can parse.
@@ -16,6 +16,13 @@ export interface LoadFontsOptions {
     fontFamilyOverride?: string;
     /** Codepoints present in the template — fonts whose unicodeRange doesn't intersect are skipped */
     codepoints?: Set<number>;
+    /**
+     * Prefer the static satoriSrc (full TTF/WOFF from fontless) over the primary src
+     * (subset WOFF2 from @nuxt/fonts) when both are usable. Takumi uses this so non-Latin
+     * glyphs (devanagari, CJK, etc.) render — @nuxt/fonts CSS often only ships latin
+     * subsets for a family, but the fontless static file contains the full glyph set.
+     */
+    preferStatic?: boolean;
 }
 export declare function loadAllFontsDebug(component?: string): {
     component: string | undefined;

package/dist/runtime/server/og-image/fonts.js

@@ -4,19 +4,11 @@ import resolvedFonts from "#og-image/fonts";
 import availableFonts from "#og-image/fonts-available";
 import { logger } from "../../logger.js";
 import { fontArrayCache, fontCache } from "./cache/lru.js";
+import { fontFormat, selectFontSource } from "./font-source.js";
 import { renameSubsetFonts } from "./font-subsets.js";
 import { codepointsIntersectRanges, parseUnicodeRange } from "./unicode-range.js";
 export { buildSubsetFamilyChain, renameSubsetFonts, resolveSubsetChain } from "./font-subsets.js";
 export { codepointsIntersectRanges, extractCodepoints, parseUnicodeRange } from "./unicode-range.js";
-function fontFormat(src) {
-  if (src.endsWith(".woff2"))
-    return "woff2";
-  if (src.endsWith(".woff"))
-    return "woff";
-  if (src.endsWith(".otf"))
-    return "otf";
-  return "ttf";
-}
 async function loadFont(event, font, src) {
   const cacheKey = `${font.family}-${font.weight}-${font.style}-${src}`;
   const cached = fontCache.get(cacheKey);
@@ -103,39 +95,37 @@ export async function loadAllFonts(event, options) {
       }
     }
   }
-  if (options.codepoints && options.codepoints.size > 0) {
-    for (let i = fonts.length - 1; i >= 0; i--) {
-      const f = fonts[i];
-      if (!f.unicodeRange)
-        continue;
-      const ranges = parseUnicodeRange(f.unicodeRange);
-      if (!ranges)
-        continue;
-      if (!codepointsIntersectRanges(options.codepoints, ranges))
-        fonts.splice(i, 1);
-    }
+  const resolved = [];
+  for (const f of fonts) {
+    const selection = selectFontSource(f, options.supportedFormats, options.preferStatic ?? false);
+    if (selection)
+      resolved.push({ font: f, ...selection });
   }
+  const filtered = options.codepoints && options.codepoints.size > 0 ? resolved.filter(({ font: f, isStaticFallback }) => {
+    if (isStaticFallback || !f.unicodeRange)
+      return true;
+    const ranges = parseUnicodeRange(f.unicodeRange);
+    if (!ranges)
+      return true;
+    return codepointsIntersectRanges(options.codepoints, ranges);
+  }) : resolved;
   const results = await Promise.all(
-    fonts.map(async (f) => {
-      let src = f.src;
-      const srcFormat = fontFormat(f.src);
-      if (!options.supportedFormats.has(srcFormat)) {
-        if (f.satoriSrc && options.supportedFormats.has(fontFormat(f.satoriSrc))) {
-          src = f.satoriSrc;
-        } else {
-          return null;
-        }
-      }
+    filtered.map(async ({ font: f, src: initialSrc, isStaticFallback }) => {
+      let src = initialSrc;
       let data = await loadFont(event, f, src);
-      if (!data && src !== f.src && options.supportedFormats.has(srcFormat)) {
+      if (!data && src !== f.src && options.supportedFormats.has(fontFormat(f.src))) {
         data = await loadFont(event, f, f.src);
-        if (data)
+        if (data) {
           src = f.src;
+          isStaticFallback = false;
+        }
       }
       if (!data)
         return null;
       return {
         ...f,
+        src,
+        ...isStaticFallback ? { unicodeRange: void 0 } : {},
         cacheKey: `${f.family}-${f.weight}-${f.style}-${src}`,
         data
       };

package/dist/runtime/server/og-image/satori/plugins/emojis.js

@@ -1,6 +1,6 @@
-import { getEmojiSvg } from "#og-image/emoji-transform";
 import { parse } from "ultrahtml";
 import { querySelector } from "ultrahtml/selector";
+import { getEmojiSvg } from "#og-image/emoji-transform";
 import { defineTransformer } from "../../core/plugins.js";
 import { RE_MATCH_EMOJIS } from "../../core/transforms/emojis/emoji-utils.js";
 import { elementToVNode } from "../../core/vnodes.js";

package/dist/runtime/server/og-image/satori/renderer.js

@@ -1,6 +1,7 @@
+import { defu } from "defu";
 import { tw4FontVars } from "#og-image-virtual/tw4-theme.mjs";
 import compatibility from "#og-image/compatibility";
-import { defu } from "defu";
+import { withTimeout } from "../../util/withTimeout.js";
 import { useOgImageRuntimeConfig } from "../../utils.js";
 import { buildSubsetFamilyChain, extractCodepoints, getDefaultFontFamily, loadAllFontsDebug, loadFontsForRenderer, resolveSubsetChain } from "../fonts.js";
 import { getResvg, getSatori, getSharp } from "./instances.js";
@@ -27,7 +28,7 @@ export async function createSvg(event) {
   const { satoriOptions: _satoriOptions } = useOgImageRuntimeConfig();
   const { fontFamilyOverride, defaultFont } = getDefaultFontFamily(options);
   const [satori, vnodes] = await Promise.all([
-    getSatori(),
+    timings.measure("satori-init", () => getSatori()),
     createVNodes(event)
   ]);
   const codepoints = extractCodepoints(vnodes);
@@ -39,7 +40,12 @@ export async function createSvg(event) {
     codepoints,
     fontDefs: options.fonts
   }));
-  await event._nitro.hooks.callHook("nuxt-og-image:satori:vnodes", vnodes, event);
+  const hookTimeout = event.runtimeConfig.security?.renderTimeout ?? 15e3;
+  await withTimeout(
+    event._nitro.hooks.callHook("nuxt-og-image:satori:vnodes", vnodes, event),
+    hookTimeout,
+    "nuxt-og-image:satori:vnodes hook"
+  );
   const satoriFonts = !hasCustomFonts && _satoriFontCache.get(fonts) || fonts.map((f) => ({ ...f, name: f.family }));
   if (!hasCustomFonts)
     _satoriFontCache.set(fonts, satoriFonts);

package/dist/runtime/server/og-image/takumi/nodes.js

@@ -10,7 +10,7 @@ const RE_LT = /</g;
 const RE_GT = />/g;
 export async function createTakumiNodes(ctx) {
   const vnodeTree = await createVNodes(ctx);
-  return await vnodeToTakumiNode(vnodeTree, DEFAULT_FONT_SIZE);
+  return await ctx.timings.measure("takumi-nodes", () => vnodeToTakumiNode(vnodeTree, DEFAULT_FONT_SIZE));
 }
 function pickNumericDimension(props, key) {
   const v = props[key];