Commit activity
Last 12 weeks · 114 commits
Community health
3 of 6 standards met
Recent PRs & issues
Fixes #951. Update the runtime pin from to , which backports the fix for CVE-2026-45820 / GHSA-px8p-9vwx-vf98. This preserves the existing 0.7 API, including the contract. Refresh the compatible 0.7 transitive resolutions in the lockfile as well. The existing 0.8.3 development dependency stays unchanged. Validated with pnpm 10.33.0's frozen lockfile-only install, a bounded malformed-ZIP64 regression check, valid ZIP/ZIP64 extraction, and compression/output-buffer compatibility checks. The full Satori test suite was not run.
Published and the latest pin to exactly . CVE-2026-45820 / GHSA-px8p-9vwx-vf98 marks as affected by an infinite loop when reading malformed ZIP64 metadata. Could the pin be updated to ? This is the upstream 0.7.x security backport. It retains the API and the existing CJS/ESM/browser entry points, so it avoids the 0.8 API migration discussed in #825. This is a dependency-remediation request; I have not demonstrated exploitation through Satori's font parsing. The expected result is a published Satori release resolving a patched fflate version.
Recent fixes
Invalid values of sizes, insets and margins were only printed with , e.g. for the of the buttons of vercel.com: With , they're now reported to it like other invalid values, instead of being printed. So stylesheets drop these declarations like browsers, and an earlier valid one applies: with , an element with both classes is 30px wide, as in Chrome. Before, the invalid one replaced it. Margins now name their property in the message too. and , the initial minimums, are valid and leave the minimum unset, and of sizes and margins is accepted in any case, like other keywords. Both were warnings before, and would otherwise have been dropped from stylesheets. Without , they're still warnings rather than errors, so renders that worked keep working. The new tests check the reported errors of , , , and , that nothing is printed, the stylesheet case with the width Chrome gives, and that minimums of a stylesheet override earlier ones with the size Chrome gives, with snapshots. They fail without the fix.
Bug report Description / Observed Behavior I tried to render a white heart, but couldn't. Expected Behavior Should obey my choice of the heart color. Reproduction https://og-playground.vercel.app/?share=XZDNToQwEMdfhYwxeyERP2JMs3pZPXjWxAsXoAN0LS2hRUTCK7jnPXgw0XfweXgBX8EpC0Y3aSYzv_9M56ODRHMEBksunkLleca2Ei-7zvmel6PIcsu8xXEQHC78HWwEt_ke48KUMmqJphKfZ-r8a1FhYoVWpCVa1oWa1UiKTN1aLIyTUFmsZmldGyvSdqUJKtf_vxxHyWNW6VrxlZa6Iv0gTdPfrlR1J16Qeacnf9DDtMt5EEyUxhmLY1njwqG-D9WVc4bt-7D9pPf99TrazfD2Qc-Fzm5CtTyii1Ey-KBLt58B1sF4G2AX1AN2xwN25gKOcZ0BSyNp0Acs9Frct6W7vG3GiP5xU94UMfIpr_fBRjGl5CilbnQlOfQ_ Additional Context I tried every normal heart character from this list: https://en.wikipedia.org/wiki/Hearts_in_Unicode#Encoding The list is basically this: Some of then ordinary unicode characters, two of them are emojis. I don't expect emojis to be rendered in the color that I want, it's just included in there for debugging.
Repository: vercel/satori. Description: Enlightened library to convert HTML and CSS to SVG Stars: 14113, Forks: 392. Primary language: TypeScript. Languages: TypeScript (96.3%), Rust (2.6%), CSS (0.6%), JavaScript (0.5%), Shell (0%). License: MPL-2.0. Homepage: https://og-playground.vercel.app Topics: css, image, image-generation, image-generator, jsx, opengraph-images, satori, svg, vercel. Latest release: 0.63.2 (11h ago). Open PRs: 51, open issues: 101. Last activity: 11h ago. Community health: 75%. Top contributors: shuding, Jackie1210, LuciNyan, styfle, jeetiss, chibicode, dnukumamras, NiteshSingh17, sahithyandev, iteratetograceness and others.