nuxt-og-image 6.8.0 → 6.9.0

package/dist/chunks/tw4.mjs

@@ -2,7 +2,7 @@ import { readFile } from 'node:fs/promises';
 import { pathToFileURL } from 'node:url';
 import { resolveModulePath } from 'exsolve';
 import { dirname, join } from 'pathe';
-import { e as extractVariantBaseClasses, r as resolveVariantPrefixes, h as resolveExtractedVars, l as resolveVarsDeep, s as simplifyCss, p as postProcessStyles, m as loadLightningCss, a as extractCssVars, c as extractUniversalVars, d as extractPerClassVars, g as extractVarsFromCss, f as extractClassStyles } from '../shared/nuxt-og-image.D936Fp6O.mjs';
+import { e as extractVariantBaseClasses, r as resolveVariantPrefixes, h as resolveExtractedVars, l as resolveVarsDeep, s as simplifyCss, p as postProcessStyles, m as loadLightningCss, a as extractCssVars, c as extractUniversalVars, d as extractPerClassVars, g as extractVarsFromCss, f as extractClassStyles } from '../shared/nuxt-og-image.CTD0ZPNd.mjs';
 import 'node:crypto';
 import 'node:fs';
 import '@nuxt/kit';

package/dist/chunks/uno.mjs

@@ -1,8 +1,8 @@
 import { readFile } from 'node:fs/promises';
 import { defu } from 'defu';
 import { logger } from '../../dist/runtime/logger.js';
-import { e as extractVariantBaseClasses, s as simplifyCss, a as extractCssVars, b as extractPropertyInitialValues, c as extractUniversalVars, d as extractPerClassVars, f as extractClassStyles, p as postProcessStyles, r as resolveVariantPrefixes, i as importOptionalPeer, g as extractVarsFromCss, h as resolveExtractedVars } from '../shared/nuxt-og-image.D936Fp6O.mjs';
-export { j as importResolvedModule, k as resolveOptionalModulePath } from '../shared/nuxt-og-image.D936Fp6O.mjs';
+import { e as extractVariantBaseClasses, s as simplifyCss, a as extractCssVars, b as extractPropertyInitialValues, c as extractUniversalVars, d as extractPerClassVars, f as extractClassStyles, p as postProcessStyles, r as resolveVariantPrefixes, i as importOptionalPeer, g as extractVarsFromCss, h as resolveExtractedVars } from '../shared/nuxt-og-image.CTD0ZPNd.mjs';
+export { j as importResolvedModule, k as resolveOptionalModulePath } from '../shared/nuxt-og-image.CTD0ZPNd.mjs';
 import 'node:crypto';
 import 'node:fs';
 import 'node:url';

package/dist/module.json

@@ -4,7 +4,7 @@
     "nuxt": ">=3.16.0"
   },
   "configKey": "ogImage",
-  "version": "6.8.0",
+  "version": "6.9.0",
   "builder": {
     "@nuxt/module-builder": "1.0.3",
     "unbuild": "3.6.1"

package/dist/module.mjs

@@ -10,7 +10,7 @@ import 'nuxtseo-shared/kit';
 import 'pathe';
 import 'pkg-types';
 import 'std-env';
-export { n as default } from './shared/nuxt-og-image.D936Fp6O.mjs';
+export { n as default } from './shared/nuxt-og-image.CTD0ZPNd.mjs';
 import '../dist/runtime/logger.js';
 import 'magic-string';
 import 'oxc-walker';

package/dist/runtime/server/nitro.d.ts

@@ -0,0 +1,9 @@
+import type { H3Event } from '#nuxtseo/h3';
+import type { OgImageOptionsInternal } from '../types.js';
+type Options = Partial<OgImageOptionsInternal>;
+/**
+ * Build the absolute OG image URL for a page. Without a page path, uses the current request path.
+ */
+export declare function getOgImageUrl(event: H3Event, options?: Options): string;
+export declare function getOgImageUrl(event: H3Event, pagePath: string, options?: Options): string;
+export {};

package/dist/runtime/server/nitro.js

@@ -0,0 +1,10 @@
+import { parseURL, withoutBase } from "ufo";
+import { useRuntimeConfig } from "#nuxtseo/nitro";
+import { withSiteUrl } from "#site-config/server/composables/utils";
+import { getOgImagePath } from "./utils.js";
+export function getOgImageUrl(event, pathOrOptions, maybeOptions) {
+  const pagePath = typeof pathOrOptions === "string" ? pathOrOptions : withoutBase(parseURL(event.path).pathname, useRuntimeConfig(event).app.baseURL) || "/";
+  const options = typeof pathOrOptions === "string" ? maybeOptions : pathOrOptions;
+  const { path } = getOgImagePath(event, pagePath, options);
+  return withSiteUrl(event, path, { canonical: !import.meta.dev });
+}

package/dist/runtime/server/og-image/bindings/fetch/node.d.ts

@@ -0,0 +1,2 @@
+import type { GuardedFetchInit } from './web.js';
+export declare function guardedFetch(url: string, { headers, signal, isBlockedAddress }: GuardedFetchInit): Promise<Response>;

package/dist/runtime/server/og-image/bindings/fetch/node.js

@@ -0,0 +1,42 @@
+import { lookup as dnsLookup } from "node:dns";
+import { request as httpRequest } from "node:http";
+import { request as httpsRequest } from "node:https";
+import { Readable } from "node:stream";
+function guardedLookup(isBlocked) {
+  return (hostname, options, callback) => {
+    dnsLookup(hostname, { ...options, all: true }, (err, addresses) => {
+      if (err)
+        return callback(err, "", 0);
+      const blocked = addresses.find((a) => isBlocked(a.address));
+      if (blocked)
+        return callback(new Error(`[Nuxt OG Image] ${hostname} resolves to blocked address ${blocked.address}.`), "", 0);
+      if (options.all)
+        return callback(null, addresses);
+      callback(null, addresses[0].address, addresses[0].family);
+    });
+  };
+}
+export function guardedFetch(url, { headers, signal, isBlockedAddress }) {
+  const request = url.startsWith("https:") ? httpsRequest : httpRequest;
+  return new Promise((resolve, reject) => {
+    const req = request(url, {
+      // Match the defaults that `fetch` sent before this transport existed.
+      headers: { "accept": "*/*", "user-agent": "node", ...headers },
+      signal,
+      lookup: guardedLookup(isBlockedAddress ?? (() => false)),
+      // A fresh socket per hop: never reuse a connection nobody checked.
+      agent: false
+    }, (res) => {
+      const status = res.statusCode ?? 0;
+      const responseHeaders = new Headers();
+      for (const [name, value] of Object.entries(res.headers)) {
+        for (const v of [value ?? []].flat())
+          responseHeaders.append(name, v);
+      }
+      const body = status === 204 || status === 304 ? null : Readable.toWeb(res);
+      resolve(new Response(body, { status, headers: responseHeaders }));
+    });
+    req.on("error", reject);
+    req.end();
+  });
+}

package/dist/runtime/server/og-image/bindings/fetch/web.d.ts

@@ -0,0 +1,7 @@
+export interface GuardedFetchInit {
+    headers?: Record<string, string>;
+    signal: AbortSignal;
+    /** Rejects the connection when a resolved address matches. Node only. */
+    isBlockedAddress?: (address: string) => boolean;
+}
+export declare function guardedFetch(url: string, { headers, signal }: GuardedFetchInit): Promise<Response>;

package/dist/runtime/server/og-image/bindings/fetch/web.js

@@ -0,0 +1,3 @@
+export function guardedFetch(url, { headers, signal }) {
+  return fetch(url, { redirect: "manual", headers, signal });
+}

package/dist/runtime/server/og-image/bindings/font-assets/external-url.d.ts

@@ -12,17 +12,6 @@ export declare function isDataFontUrl(path: string): boolean;
  * Check `isDataFontUrl` first — `data:` is non-http and would report true here.
  */
 export declare function isExternalFontUrl(path: string): boolean;
-/**
- * Resolve an authority-bearing font URL to the href to fetch, but only when it
- * is same-origin with the configured site URL. Returns null otherwise.
- *
- * Runtime external font URLs are unsupported — `@nuxt/fonts` is the only
- * supported way to load custom fonts, and it serves them same-origin. The single
- * allowed exception is the site's own origin, gated on an explicitly configured
- * site URL. Resolving against that origin also collapses canonicalization
- * bypasses (a crafted " //127.0.0.1" resolves cross-origin → rejected).
- */
-export declare function resolveSameOriginFontUrl(path: string, siteUrl: string | undefined): string | null;
 /**
  * Fetch a `data:` or authority-bearing font URL. `data:` is decoded directly
  * (no network). An external URL is fetched only when same-origin with the site

package/dist/runtime/server/og-image/bindings/font-assets/external-url.js

@@ -1,4 +1,4 @@
-import { fetchWithRedirectValidation } from "../../../util/ssrf.js";
+import { fetchWithRedirectValidation, resolveSameOriginUrl } from "../../../util/ssrf.js";
 const SENTINEL_ORIGIN = "http://font-asset.invalid/";
 const SENTINEL_HOST = "font-asset.invalid";
 export function isDataFontUrl(path) {
@@ -13,23 +13,6 @@ export function isExternalFontUrl(path) {
   }
   return resolved.protocol !== "http:" || resolved.host !== SENTINEL_HOST;
 }
-export function resolveSameOriginFontUrl(path, siteUrl) {
-  if (!siteUrl)
-    return null;
-  let siteOrigin;
-  try {
-    siteOrigin = new URL(siteUrl).origin;
-  } catch {
-    return null;
-  }
-  let target;
-  try {
-    target = new URL(path, siteOrigin);
-  } catch {
-    return null;
-  }
-  return target.origin === siteOrigin ? target.href : null;
-}
 export async function fetchSpecialFontUrl(path, siteUrl, timeout) {
   if (isDataFontUrl(path)) {
     const res = await fetch(path.trimStart(), { signal: AbortSignal.timeout(timeout) }).catch(() => {
@@ -39,7 +22,7 @@ export async function fetchSpecialFontUrl(path, siteUrl, timeout) {
       return Buffer.from(await res.arrayBuffer());
     throw new Error("[Nuxt OG Image] Invalid data: font URL.");
   }
-  const href = resolveSameOriginFontUrl(path, siteUrl);
+  const href = resolveSameOriginUrl(path, siteUrl);
   if (!href)
     throw new Error("[Nuxt OG Image] External font URLs are not supported. Load custom fonts via @nuxt/fonts.");
   const ab = await fetchWithRedirectValidation(href, { timeout });

package/dist/runtime/server/og-image/browser/screenshot.js

@@ -5,6 +5,7 @@ import { getNitroOrigin } from "#site-config/server/composables";
 import { buildOgImageUrl } from "../../../shared.js";
 import { getFetchTimeout } from "../../util/fetchTimeout.js";
 import { logger } from "../../util/logger.js";
+import { resolveSameOriginUrl } from "../../util/ssrf.js";
 import { useOgImageRuntimeConfig } from "../../utils.js";
 function isPlaywrightPage(page) {
   return typeof page.setViewportSize === "function";
@@ -101,7 +102,9 @@ export async function createScreenshot({ basePath, e, options, extension, timing
         await page.setContent(html, { waitUntil: "networkidle0" });
       }
     } else {
-      const url = isPlaywrightPage(page) ? withQuery(path, options.props || {}) : `${getNitroOrigin(e)}${withQuery(path, options.props || {})}`;
+      const url = resolveSameOriginUrl(withQuery(path, options.props || {}), getNitroOrigin(e));
+      if (!url)
+        throw new Error("[Nuxt OG Image] The browser renderer can only navigate to a same-origin path.");
       await gotoWithIdle(page, url, 1e4);
     }
     const screenshotOptions = {

package/dist/runtime/server/og-image/context.js

@@ -13,6 +13,7 @@ import { autoEjectCommunityTemplate } from "../util/auto-eject.js";
 import { createNitroRouteRuleMatcher } from "../util/kit.js";
 import { normaliseOptions } from "../util/options.js";
 import { getEventQuery } from "../util/query.js";
+import { parseSameOriginPath } from "../util/ssrf.js";
 import { createTimings, TIMING_CTX_KEY } from "../util/timings.js";
 import { withTimeout } from "../util/withTimeout.js";
 import { useOgImageRuntimeConfig } from "../utils.js";
@@ -120,7 +121,14 @@ export async function resolveContext(e) {
     delete queryParams.html;
     queryParams = separateProps(queryParams);
   }
-  const basePath = withoutTrailingSlash(urlOptions._path || "/");
+  const rawPath = urlOptions._path ?? "/";
+  const basePath = parseSameOriginPath(typeof rawPath === "string" ? withoutTrailingSlash(rawPath) : rawPath);
+  if (!basePath) {
+    return createError({
+      statusCode: 400,
+      statusMessage: "[Nuxt OG Image] The _path option must be a same-origin path."
+    });
+  }
   const componentHash = urlOptions._componentHash || "";
   delete urlOptions._path;
   delete urlOptions._hash;

package/dist/runtime/server/routes/resolve.js

@@ -4,6 +4,7 @@ import { fetchWithEvent } from "#nuxtseo/nitro";
 import { getSiteConfig } from "#site-config/server/composables/getSiteConfig";
 import { isInternalRoute } from "../../shared.js";
 import { getEventQuery } from "../util/query.js";
+import { parseSameOriginPath } from "../util/ssrf.js";
 import { useOgImageRuntimeConfig } from "../utils.js";
 const RE_META_TAG = /<meta\b[^>]*>/gi;
 const RE_META_KEY = /\b(?:property|name)\s*=\s*(?:"([^"]+)"|'([^']+)')/i;
@@ -11,7 +12,6 @@ const RE_META_CONTENT = /\bcontent\s*=\s*(?:"([^"]*)"|'([^']*)')/i;
 const MAX_RESOLVE_PATH_LENGTH = 2048;
 const RE_STRIP_PREFIX = /^.*?\/_og\/r/;
 const RE_IMAGE_EXT = /\.(?:png|jpe?g|webp|svg)$/i;
-const RE_DOUBLE_LEADING_SLASH = /^\/{2,}/;
 function extractMeta(html, key) {
   for (const tagMatch of html.matchAll(RE_META_TAG)) {
     const tag = tagMatch[0];
@@ -78,7 +78,7 @@ export default defineEventHandler(async (event) => {
       statusMessage: `[Nuxt OG Image] Target path exceeds ${MAX_RESOLVE_PATH_LENGTH} characters.`
     });
   }
-  if (targetPath.includes("://") || RE_DOUBLE_LEADING_SLASH.test(targetPath)) {
+  if (targetPath.includes("://") || !parseSameOriginPath(targetPath)) {
     throw createError({
       statusCode: 400,
       statusMessage: "[Nuxt OG Image] Target path must be a same-origin path."

package/dist/runtime/server/util/cloudflare.js

@@ -7,11 +7,11 @@ export function getCloudflareEnv(event) {
   const runtimeEnv = toRecord(runtimeCloudflare?.env);
   if (runtimeEnv)
     return runtimeEnv;
-  const contextCloudflare = toRecord(event?.context.cloudflare);
+  const contextCloudflare = toRecord(event?.context?.cloudflare);
   const contextEnv = toRecord(contextCloudflare?.env);
   if (contextEnv)
     return contextEnv;
-  const platform = toRecord(event?.context._platform);
+  const platform = toRecord(event?.context?._platform);
   const platformCloudflare = toRecord(platform?.cloudflare);
   return toRecord(platformCloudflare?.env);
 }

package/dist/runtime/server/util/ssrf.d.ts

@@ -10,6 +10,36 @@ export declare function expandIPv6(addr: string): number[] | null;
  * blocked outright.
  */
 export declare function isBlockedUrl(url: string): boolean;
+/** True when a resolved IP address is internal, reserved, or unparseable. */
+export declare function isBlockedAddress(address: string): boolean;
+declare const sameOriginPathBrand: unique symbol;
+/**
+ * A path that stays on the current origin when resolved against any base URL.
+ * Only `parseSameOriginPath` creates one, so a value of this type is safe to
+ * pass to a same-origin fetch or a headless browser navigation.
+ */
+export type SameOriginPath = string & {
+    readonly [sameOriginPathBrand]: true;
+};
+/**
+ * Parse an untrusted path (for example the `_path` URL option) into a
+ * same-origin path. Returns `undefined` for anything that could leave the
+ * origin: absolute URLs, other schemes, protocol-relative `//host`,
+ * backslash variants, control characters, and paths without a leading `/`
+ * (which a string concatenation with the origin turns into `origin@host`).
+ *
+ * GHSA-h5qf-97cw-2h86: an absolute `_path` navigated the browser renderer to
+ * an internal host and reflected the response into the image.
+ */
+export declare function parseSameOriginPath(input: unknown): SameOriginPath | undefined;
+/**
+ * Resolve `path` against `origin` and return the href, but only when the result
+ * stays on that origin. Returns null for a missing or unparseable origin, and for
+ * anything that resolves elsewhere. The WHATWG parser normalizes leading
+ * controls, tabs, and backslashes first, so " //127.0.0.1" resolves cross-origin
+ * and is rejected (GHSA-q8hw-4fvp-9rwv).
+ */
+export declare function resolveSameOriginUrl(path: string, origin: string | undefined): string | null;
 export interface SafeFetchOptions {
     timeout: number;
     headers?: Record<string, string>;
@@ -35,3 +65,4 @@ export interface SafeFetchOptions {
  * usual missing-asset behaviour.
  */
 export declare function fetchWithRedirectValidation(initialUrl: string, opts: SafeFetchOptions): Promise<ArrayBuffer | null>;
+export {};

package/dist/runtime/server/util/ssrf.js

@@ -1,4 +1,6 @@
+import { guardedFetch } from "#og-image/bindings/fetch";
 const RE_IPV6_BRACKETS = /^\[|\]$/g;
+const RE_TRAILING_DOTS = /\.+$/;
 const RE_DIGIT_ONLY = /^\d+$/;
 const RE_INT_IP = /^(?:0x[\da-f]+|\d+)$/i;
 const RE_HEX_GROUP = /^[0-9a-f]{1,4}$/i;
@@ -18,6 +20,12 @@ function isPrivateIPv4(a, b) {
     return true;
   if (a === 0)
     return true;
+  if (a === 100 && b >= 64 && b <= 127)
+    return true;
+  if (a === 198 && (b === 18 || b === 19))
+    return true;
+  if (a >= 224)
+    return true;
   return false;
 }
 export function expandIPv6(addr) {
@@ -88,6 +96,10 @@ function isPrivateIPv6(groups) {
   }
   if (g0 === 100 && g1 === 65435 && g2 === 1)
     return true;
+  if (g0 === 256 && g1 === 0 && g2 === 0 && g3 === 0)
+    return true;
+  if (g0 === 8193 && g1 === 0)
+    return true;
   if ((g0 & 65024) === 64512)
     return true;
   if ((g0 & 65472) === 65152)
@@ -114,7 +126,7 @@ export function isBlockedUrl(url) {
   if (parsed.protocol !== "http:" && parsed.protocol !== "https:")
     return true;
   const hostname = parsed.hostname.toLowerCase();
-  const bare = hostname.replace(RE_IPV6_BRACKETS, "");
+  const bare = hostname.replace(RE_IPV6_BRACKETS, "").replace(RE_TRAILING_DOTS, "");
   if (bare === "localhost" || bare.endsWith(".localhost"))
     return true;
   const dottedParts = bare.split(".");
@@ -137,6 +149,50 @@ export function isBlockedUrl(url) {
   }
   return false;
 }
+export function isBlockedAddress(address) {
+  return isBlockedUrl(`http://${address.includes(":") ? `[${address}]` : address}/`);
+}
+const PROBE_ORIGIN = "http://og-image.invalid";
+function hasUnsafePathChar(input) {
+  for (let i = 0; i < input.length; i++) {
+    const code = input.charCodeAt(i);
+    if (code <= 31 || code === 127 || code === 92)
+      return true;
+  }
+  return false;
+}
+export function parseSameOriginPath(input) {
+  if (typeof input !== "string" || input[0] !== "/" || input[1] === "/")
+    return void 0;
+  if (hasUnsafePathChar(input))
+    return void 0;
+  let resolved;
+  try {
+    resolved = new URL(input, PROBE_ORIGIN);
+  } catch {
+    return void 0;
+  }
+  if (resolved.origin !== PROBE_ORIGIN)
+    return void 0;
+  return input;
+}
+export function resolveSameOriginUrl(path, origin) {
+  if (!origin)
+    return null;
+  let base;
+  try {
+    base = new URL(origin).origin;
+  } catch {
+    return null;
+  }
+  let target;
+  try {
+    target = new URL(path, base);
+  } catch {
+    return null;
+  }
+  return target.origin === base ? target.href : null;
+}
 export async function fetchWithRedirectValidation(initialUrl, opts) {
   const controller = new AbortController();
   const externalAbort = opts.signal;
@@ -161,20 +217,23 @@ export async function fetchWithRedirectValidation(initialUrl, opts) {
       }
       if (!isTrusted && isBlockedUrl(url))
         return null;
-      const res = await fetch(url, {
-        redirect: "manual",
+      const res = await guardedFetch(url, {
         signal: controller.signal,
-        headers: opts.headers
+        headers: opts.headers,
+        isBlockedAddress: isTrusted ? void 0 : isBlockedAddress
       });
       if (res.status >= 300 && res.status < 400) {
+        await res.body?.cancel();
         const loc = res.headers.get("location");
         if (!loc)
           return null;
         url = new URL(loc, url).toString();
         continue;
       }
-      if (!res.ok)
+      if (!res.ok) {
+        await res.body?.cancel();
         return null;
+      }
       return await res.arrayBuffer();
     }
     return null;

package/dist/runtime/server/utils.d.ts

@@ -4,5 +4,5 @@ export interface GetOgImagePathResult {
     path: string;
     hash?: string;
 }
-export declare function getOgImagePath(_pagePath: string, _options?: Partial<OgImageOptionsInternal>): GetOgImagePathResult;
+export declare function getOgImagePath(event: H3Event, _pagePath: string, _options?: Partial<OgImageOptionsInternal>): GetOgImagePathResult;
 export declare function useOgImageRuntimeConfig(e?: H3Event): OgImageRuntimeConfig;

package/dist/runtime/server/utils.js

@@ -3,9 +3,9 @@ import { useRuntimeConfig } from "#nuxtseo/nitro";
 import { componentNames } from "#og-image-virtual/component-names.mjs";
 import { buildOgImageUrl } from "../shared.js";
 import { getCloudflareEnv } from "./util/cloudflare.js";
-export function getOgImagePath(_pagePath, _options) {
-  const baseURL = useRuntimeConfig().app.baseURL;
-  const { defaults, security } = useOgImageRuntimeConfig();
+export function getOgImagePath(event, _pagePath, _options) {
+  const baseURL = useRuntimeConfig(event).app.baseURL;
+  const { defaults, security } = useOgImageRuntimeConfig(event);
   const extension = _options?.extension || defaults.extension;
   const isStatic = import.meta.prerender && !(security?.secret && security?.strict);
   const options = { ..._options, _path: _pagePath };

package/dist/runtime/types.d.ts

@@ -4,12 +4,13 @@ import type { SatoriOptions } from 'satori';
 import type { JpegOptions, SharpOptions } from 'sharp';
 import type { MaybeRefOrGetter, Ref } from 'vue';
 import type { H3Error, H3Event } from '#nuxtseo/h3';
+import type { SameOriginPath } from './server/util/ssrf.js';
 import type { Timings } from './server/util/timings.js';
 export interface OgImageRenderEventContext {
     e: H3Event;
     extension: 'png' | 'jpeg' | 'jpg' | 'webp' | 'svg' | 'html' | 'json';
     key: string;
-    basePath: string;
+    basePath: SameOriginPath;
     renderer: Renderer;
     options: OgImageOptionsInternal;
     isDevToolsContextRequest: boolean;
@@ -241,6 +242,7 @@ export interface RuntimeCompatibilitySchema {
     takumi: 'node' | 'node-dev' | 'wasm' | false;
     sharp: 'node' | false;
     emoji?: 'local' | 'fetch';
+    fetch?: 'node' | 'web';
     wasm?: any;
 }
 export interface RuntimeCompatibilityMeta {

package/dist/shared/{nuxt-og-image.D936Fp6O.mjs → nuxt-og-image.CTD0ZPNd.mjs}

@@ -3,7 +3,7 @@ import * as fs from 'node:fs';
 import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, rmSync } from 'node:fs';
 import { readFile, mkdir, writeFile, readdir } from 'node:fs/promises';
 import { fileURLToPath, pathToFileURL } from 'node:url';
-import { resolvePath, useNuxt, getNuxtVersion, addTemplate, updateTemplates, directoryToURL, tryResolveModule, addTypeTemplate, defineNuxtModule, createResolver, addImports, hasNuxtModule, hasNuxtModuleCompatibility, getNuxtModuleVersion, addVitePlugin, addBuildPlugin, addServerHandler, addPlugin, addComponentsDir, addServerPlugin } from '@nuxt/kit';
+import { resolvePath, useNuxt, getNuxtVersion, addTemplate, updateTemplates, directoryToURL, tryResolveModule, addTypeTemplate, defineNuxtModule, createResolver, addImports, hasNuxtModule, hasNuxtModuleCompatibility, getNuxtModuleVersion, addVitePlugin, addBuildPlugin, addServerHandler, addServerImports, addPlugin, addComponentsDir, addServerPlugin } from '@nuxt/kit';
 import { defu } from 'defu';
 import { fnv1a64Base36 } from 'fnv1a-64';
 import { installNuxtSiteConfig } from 'nuxt-site-config/kit';
@@ -119,6 +119,16 @@ async function hasResolvableDependency(dep) {
     return null;
   }).then((r) => r && r !== dep);
 }
+const MIN_SATORI_VERSION = "0.33.5";
+function isSupportedSatoriVersion(version) {
+  const current = (version || "").split(".").map((part) => Number.parseInt(part, 10) || 0);
+  const minimum = MIN_SATORI_VERSION.split(".").map(Number);
+  for (let i = 0; i < minimum.length; i++) {
+    if ((current[i] ?? 0) !== minimum[i])
+      return (current[i] ?? 0) > minimum[i];
+  }
+  return true;
+}
 const VALID_RENDERER_SUFFIXES = ["satori", "browser", "takumi"];
 const RE_RENDERER_SUFFIX_CI = /\.?(satori|browser|takumi)$/i;
 const RE_RENDERER_SUFFIX = /(Satori|Browser|Takumi)$/;
@@ -192,6 +202,8 @@ const cloudflare = {
   sharp: false,
   emoji: "fetch",
   // edge size limits - use API instead of bundling 24MB icons
+  fetch: "web",
+  // no DNS API
   wasm: {
     esmImport: true
     // Do NOT set lazy here — Nitro's cloudflare preset uses lazy: false because
@@ -214,8 +226,9 @@ const WebContainer = {
   satori: "wasm-fs",
   takumi: "wasm",
   sharp: false,
-  emoji: "fetch"
+  emoji: "fetch",
   // webcontainer has size constraints
+  fetch: "web"
 };
 const RuntimeCompatibility = {
   "nitro-dev": NodeDevRuntime,
@@ -256,6 +269,7 @@ const RuntimeCompatibility = {
     sharp: false,
     emoji: "fetch",
     // edge size limits
+    fetch: "web",
     wasm: {
       rollup: {
         targetEnv: "auto-inline",
@@ -276,6 +290,7 @@ const RuntimeCompatibility = {
     sharp: false,
     emoji: "fetch",
     // edge size limits - bundling 24MB icons not viable
+    fetch: "web",
     wasm: {
       // lowers workers kb size
       esmImport: true,
@@ -351,32 +366,32 @@ async function applyNitroPresetCompatibility(nitroConfig, options) {
   );
   if (resolvedCompatibility.satori) {
     const satoriPackage = await readPackageJSON(`${satoriPkgDir}/package.json`);
-    if (satoriPackage.dependencies?.harfbuzzjs) {
-      const harfbuzzWasmPath = resolveModulePath("harfbuzzjs/hb.wasm", { from: `${satoriPkgDir}/package.json` });
-      if (resolvedCompatibility.satori === "wasm" || target.replace(RE_LEGACY_SUFFIX, "") === "netlify-edge") {
-        const harfbuzzDir = harfbuzzWasmPath.slice(0, -"hb.wasm".length);
-        nitroConfig.virtual["#og-image/harfbuzz-callbacks"] = resolvedCompatibility.satori === "wasm" ? await prepareHarfBuzzCallbacks(`${harfbuzzDir}hbjs.js`, join(useNuxt().options.buildDir, "cache/og-image/harfbuzz")) : "export default undefined";
-        Object.assign(nitroConfig.alias, {
-          "harfbuzzjs": await resolve.resolvePath("./runtime/server/og-image/bindings/satori/harfbuzz"),
-          "#og-image/harfbuzz-factory": `${harfbuzzDir}hb.js`,
-          "#og-image/harfbuzz-adapter": `${harfbuzzDir}hbjs.js`
-        });
-        if (resolvedCompatibility.satori === "wasm") {
-          nitroConfig.alias["#og-image/harfbuzz-wasm"] = `${harfbuzzWasmPath}?module`;
-        } else {
-          const base64 = (await readFile(harfbuzzWasmPath)).toString("base64");
-          nitroConfig.virtual["#og-image/harfbuzz-wasm"] = `export default imports => WebAssembly.instantiate(Uint8Array.from(atob(${JSON.stringify(base64)}), c => c.charCodeAt(0)), imports)`;
-        }
-      } else if (Number.parseInt(getNuxtVersion(useNuxt()), 10) >= 5) {
-        const config = nitroConfig;
-        config.traceDeps = [.../* @__PURE__ */ new Set([...config.traceDeps || [], "harfbuzzjs*"])];
+    if (!isSupportedSatoriVersion(satoriPackage.version))
+      throw new Error(`[Nuxt OG Image] Satori ${satoriPackage.version} is not supported. Satori ${MIN_SATORI_VERSION} or later is required (GHSA-wx4j-mvgx-mqwp). Run: npm install satori@latest`);
+    const harfbuzzWasmPath = resolveModulePath("harfbuzzjs/hb.wasm", { from: `${satoriPkgDir}/package.json` });
+    if (resolvedCompatibility.satori === "wasm" || target.replace(RE_LEGACY_SUFFIX, "") === "netlify-edge") {
+      const harfbuzzDir = harfbuzzWasmPath.slice(0, -"hb.wasm".length);
+      nitroConfig.virtual["#og-image/harfbuzz-callbacks"] = resolvedCompatibility.satori === "wasm" ? await prepareHarfBuzzCallbacks(`${harfbuzzDir}hbjs.js`, join(useNuxt().options.buildDir, "cache/og-image/harfbuzz")) : "export default undefined";
+      Object.assign(nitroConfig.alias, {
+        "harfbuzzjs": await resolve.resolvePath("./runtime/server/og-image/bindings/satori/harfbuzz"),
+        "#og-image/harfbuzz-factory": `${harfbuzzDir}hb.js`,
+        "#og-image/harfbuzz-adapter": `${harfbuzzDir}hbjs.js`
+      });
+      if (resolvedCompatibility.satori === "wasm") {
+        nitroConfig.alias["#og-image/harfbuzz-wasm"] = `${harfbuzzWasmPath}?module`;
       } else {
-        nitroConfig.externals = nitroConfig.externals || {};
-        nitroConfig.externals.traceInclude = [.../* @__PURE__ */ new Set([
-          ...nitroConfig.externals.traceInclude || [],
-          harfbuzzWasmPath
-        ])];
+        const base64 = (await readFile(harfbuzzWasmPath)).toString("base64");
+        nitroConfig.virtual["#og-image/harfbuzz-wasm"] = `export default imports => WebAssembly.instantiate(Uint8Array.from(atob(${JSON.stringify(base64)}), c => c.charCodeAt(0)), imports)`;
       }
+    } else if (Number.parseInt(getNuxtVersion(useNuxt()), 10) >= 5) {
+      const config = nitroConfig;
+      config.traceDeps = [.../* @__PURE__ */ new Set([...config.traceDeps || [], "harfbuzzjs*"])];
+    } else {
+      nitroConfig.externals = nitroConfig.externals || {};
+      nitroConfig.externals.traceInclude = [.../* @__PURE__ */ new Set([
+        ...nitroConfig.externals.traceInclude || [],
+        harfbuzzWasmPath
+      ])];
     }
   }
   if (Object.values(resolvedCompatibility).includes("wasm")) {
@@ -4928,6 +4943,10 @@ declare module '#og-image/renderers/takumi' {
   export default _default
 }
 
+declare module '#og-image/bindings/fetch' {
+  export { guardedFetch } from '${typesPath.replace("/types", "")}/server/og-image/bindings/fetch/web'
+}
+
 declare module '#og-image/emoji-transform' {
   import type { OgImageRenderEventContext } from '${typesPath}'
   export function getEmojiSvg(ctx: OgImageRenderEventContext, emoji: string): Promise<string | null>
@@ -5172,6 +5191,7 @@ Or pin to a specific version in package.json:
     setRuntimeAlias("#og-image-cache", resolve("./runtime/server/og-image/cache/lru"));
     const preset = resolveOgImagePreset(nuxt.options.nitro);
     const targetCompatibility = getPresetNitroPresetCompatibility(preset);
+    setRuntimeAlias("#og-image/bindings/fetch", resolve(`./runtime/server/og-image/bindings/fetch/${targetCompatibility.fetch ?? "node"}`));
     const runtimeCompatibilityMeta = {};
     const normalizedPreset = preset.replace(RE_LEGACY_SUFFIX, "");
     const isCloudflareWorkers = ["cloudflare", "cloudflare-module", "cloudflare-durable"].includes(normalizedPreset);
@@ -5587,6 +5607,9 @@ ${familyInfo}`);
       name: "getOgImagePath",
       from: resolve("./runtime/app/utils")
     });
+    addServerImports([
+      { name: "getOgImageUrl", from: resolve("./runtime/server/nitro") }
+    ]);
     const basePluginPath = `./runtime/app/plugins${config.zeroRuntime ? "/__zero-runtime" : ""}`;
     addPlugin({ mode: "server", src: resolve(`${basePluginPath}/route-rule-og-image.server`) });
     addPlugin({ mode: "server", src: resolve(`${basePluginPath}/og-image-canonical-urls.server`) });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "nuxt-og-image",
   "type": "module",
-  "version": "6.8.0",
+  "version": "6.9.0",
   "description": "Enlightened OG Image generation for Nuxt.",
   "author": {
     "website": "https://harlanzw.com",
@@ -53,13 +53,13 @@
     "@takumi-rs/core": "^1.0.0-beta.3 || ^2.0.0",
     "@takumi-rs/wasm": "^1.0.0-beta.3 || ^2.0.0",
     "@unhead/vue": "^2.0.5 || ^3.0.0",
-    "@unocss/config": "^66.10.2",
-    "@unocss/core": "^66.10.2",
-    "fontless": "^0.2.0 || ^0.4.3",
+    "@unocss/config": "^66.10.5",
+    "@unocss/core": "^66.10.5",
+    "fontless": "^0.2.0 || ^0.4.3 || ^1.0.0",
     "nitropack": "^2.13.4",
     "playwright-core": "^1.50.0",
-    "satori": ">=0.19.2",
-    "sharp": "^0.34.0 || ^0.35.4",
+    "satori": ">=0.33.5",
+    "sharp": "^0.35.4",
     "tailwindcss": "^4.0.0",
     "unifont": "^0.7.0 || ^0.8.3",
     "unstorage": "^1.15.0",
@@ -110,9 +110,9 @@
     }
   },
   "dependencies": {
-    "@clack/prompts": "^1.8.0",
+    "@clack/prompts": "^1.8.1",
     "@nuxt/kit": "^4.5.2",
-    "@vue/compiler-sfc": "^3.5.42",
+    "@vue/compiler-sfc": "^3.5.43",
     "chrome-launcher": "^1.2.1",
     "consola": "^3.4.2",
     "defu": "^6.1.7",
@@ -120,7 +120,7 @@
     "exsolve": "^1.1.1",
     "fnv1a-64": "^0.1.2",
     "lightningcss": "^1.33.0",
-    "magic-string": "^1.3.1",
+    "magic-string": "^1.4.1",
     "magicast": "^0.5.5",
     "mocked-exports": "^0.1.1",
     "nuxt-site-config": "^4.2.3",
@@ -129,7 +129,7 @@
     "object-identity": "^0.2.3",
     "ofetch": "^1.5.1",
     "ohash": "^2.0.12",
-    "oxc-parser": "^0.149.0",
+    "oxc-parser": "^0.151.0",
     "oxc-walker": "^1.1.1",
     "pathe": "^2.0.3",
     "pkg-types": "^2.3.3",
@@ -139,21 +139,21 @@
     "tinyexec": "^1.3.1",
     "ufo": "^1.6.4",
     "ultrahtml": "^1.7.0",
-    "unplugin": "^3.3.0"
+    "unplugin": "^3.4.0"
   },
   "devDependencies": {
     "@antfu/eslint-config": "^9.5.1",
     "@fontsource/noto-sans-sc": "^5.3.0",
     "@iconify-json/carbon": "^1.2.27",
     "@iconify-json/logos": "^1.2.14",
-    "@iconify-json/noto": "^1.2.7",
+    "@iconify-json/noto": "^1.2.8",
     "@iconify-json/ri": "^1.2.10",
-    "@iconify-json/tabler": "^1.2.38",
+    "@iconify-json/tabler": "^1.2.39",
     "@iconify/types": "^2.0.0",
     "@img/sharp-linux-x64": "^0.35.4",
-    "@nuxt/content": "^3.16.0",
-    "@nuxt/devtools": "4.0.0-alpha.18",
-    "@nuxt/devtools-kit": "4.0.0-alpha.18",
+    "@nuxt/content": "^3.16.1",
+    "@nuxt/devtools": "4.0.0-beta.1",
+    "@nuxt/devtools-kit": "4.0.0-beta.1",
     "@nuxt/fonts": "^0.14.0",
     "@nuxt/icon": "^2.5.1",
     "@nuxt/image": "^2.1.0",
@@ -167,30 +167,30 @@
     "@resvg/resvg-js": "^2.6.2",
     "@resvg/resvg-wasm": "^2.6.2",
     "@tailwindcss/vite": "^4.3.3",
-    "@takumi-rs/core": "^2.13.7",
+    "@takumi-rs/core": "^2.14.0",
     "@takumi-rs/core-v1": "npm:@takumi-rs/core@1.8.7",
-    "@takumi-rs/helpers": "^2.13.7",
+    "@takumi-rs/helpers": "^2.14.0",
     "@takumi-rs/helpers-v1": "npm:@takumi-rs/helpers@1.8.7",
-    "@takumi-rs/wasm": "^2.13.7",
+    "@takumi-rs/wasm": "^2.14.0",
     "@takumi-rs/wasm-v1": "npm:@takumi-rs/wasm@1.8.7",
-    "@unocss/config": "^66.10.2",
-    "@unocss/core": "^66.10.2",
-    "@unocss/nuxt": "^66.10.2",
-    "@unocss/preset-icons": "^66.10.2",
-    "@unocss/preset-wind": "^66.10.2",
-    "@unocss/preset-wind4": "^66.10.2",
-    "@vitejs/plugin-vue": "^6.0.8",
-    "@vue/compiler-core": "^3.5.42",
-    "@vueuse/nuxt": "^14.4.0",
+    "@unocss/config": "^66.10.5",
+    "@unocss/core": "^66.10.5",
+    "@unocss/nuxt": "^66.10.5",
+    "@unocss/preset-icons": "^66.10.5",
+    "@unocss/preset-wind": "^66.10.5",
+    "@unocss/preset-wind4": "^66.10.5",
+    "@vitejs/plugin-vue": "^6.0.9",
+    "@vue/compiler-core": "^3.5.43",
+    "@vueuse/nuxt": "^15.0.0",
     "birpc": "^4.2.0",
     "bumpp": "^12.3.0",
-    "eslint": "^10.10.0",
-    "eslint-plugin-harlanzw": "^0.21.1",
-    "fontless": "^0.4.3",
+    "eslint": "^10.11.0",
+    "eslint-plugin-harlanzw": "^0.22.0",
+    "fontless": "^1.0.0",
     "fontless-v0-2": "npm:fontless@0.2.0",
     "globby": "^16.2.4",
     "happy-dom": "^20.14.5",
-    "hookable": "^6.1.1",
+    "hookable": "^6.1.2",
     "jest-image-snapshot": "^6.5.2",
     "lightningcss": "^1.33.0",
     "nitropack": "^2.13.4",
@@ -199,24 +199,21 @@
     "playwright": "^1.63.0",
     "playwright-core": "^1.63.0",
     "sass": "^1.104.1",
-    "satori": "^0.33.4",
-    "satori-v0-19": "npm:satori@0.19.2",
-    "satori-v0-32": "npm:satori@0.32.0",
+    "satori": "^0.33.5",
     "sharp": "^0.35.4",
-    "sharp-v0-34": "npm:sharp@0.34.0",
     "sirv": "^3.0.2",
     "tailwindcss": "^4.3.3",
     "typescript": "6.0.3",
     "unbuild": "^3.6.1",
     "unifont": "^0.8.3",
     "unifont-v0-7": "npm:unifont@0.7.0",
-    "unocss": "^66.10.2",
-    "vitest": "^5.0.0",
-    "vue": "^3.5.42",
+    "unocss": "^66.10.5",
+    "vitest": "^5.0.1",
+    "vue": "^3.5.43",
     "vue-tsc": "^3.3.11",
-    "wrangler": "^4.131.1",
+    "wrangler": "^4.136.1",
     "yoga-wasm-web": "^0.3.3",
-    "zod": "^4.6.4"
+    "zod": "^4.6.5"
   },
   "scripts": {
     "bench:edge-startup": "nuxt build bench/fixtures/edge-startup && node bench/edge-startup.mjs bench/fixtures/edge-startup/.netlify/edge-functions/server/server.js",

package/types/virtual.d.ts

@@ -29,6 +29,14 @@ declare module '#og-image/renderers/browser' {
   export default renderer
 }
 
+declare module '#og-image/bindings/fetch' {
+  export function guardedFetch(url: string, init: {
+    headers?: Record<string, string>
+    signal: AbortSignal
+    isBlockedAddress?: (address: string) => boolean
+  }): Promise<Response>
+}
+
 declare module '#og-image/bindings/satori' {
   const satori: typeof import('satori').satori
   export default satori