chore(deps): update dependency nuxt-og-image to v6

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
nuxt-og-image (source)	^5.1.1 → ^6.0.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

nuxt-modules/og-image (nuxt-og-image)

v6.5.1

Compare Source

   🐞 Bug Fixes

• Nuxt 4.4.6 island validation  -  by @​harlan-zw (7a28d)

    View changes on GitHub

v6.5.0

Compare Source

   🚀 Features

• nuxt-ui: Color mode aware token resolution via data-theme  -  by @​harlan-zw in #​598 (82cec)

   🐞 Bug Fixes

• fonts:
  • Skip fontaine fallbacks  -  by @​harlan-zw (aa330)
• takumi:
  • Treat single-entry variable fonts as axis-driven (defensive)  -  by @​harlan-zw in #​599 (c053a)
  • Keep variable WOFF2 over per-weight static fallback  -  by @​harlan-zw in #​600 (31f3b)

    View changes on GitHub

v6.4.11

Compare Source

   🐞 Bug Fixes

• Resolve configured local fonts for OG images  -  by @​harlan-zw in #​597 (9d1cb)

    View changes on GitHub

v6.4.10

Compare Source

   🐞 Bug Fixes

• More helpful font warnings  -  by @​harlan-zw (78ca9)
• Resolve Cloudflare runtime og image secret  -  by @​harlan-zw in #​596 (0a6f4)

    View changes on GitHub

v6.4.9

Compare Source

compare changes

🩹 Fixes

• More helpful font warnings (78ca997b)
• Resolve Cloudflare runtime og image secret (#​596)

🏡 Chore

• Bump (2185ff08)

❤️ Contributors

• Harlan Wilton (@​harlan-zw)

v6.4.8

Compare Source

   🐞 Bug Fixes

• takumi: Restore non-latin glyph support regressed in v6.2.0  -  by @​harlan-zw in #​587 (0b5e6)

    View changes on GitHub

v6.4.7

Compare Source

compare changes

🩹 Fixes

• takumi: Restore non-latin glyph support regressed in v6.2.0 (#​587)

🏡 Chore

• Bump deps (e7e115b4)

❤️ Contributors

• Harlan Wilton (@​harlan-zw)

v6.4.6

Compare Source

   🐞 Bug Fixes

• IMessage Preview displaying multiple images  -  by @​captnCC and johanneskees in #​584 (55336)

    View changes on GitHub

v6.4.5

Compare Source

   🐞 Bug Fixes

• takumi: Serialize WASM calls  -  by @​harlan-zw in #​583 (7e935)

    View changes on GitHub

v6.4.4

Compare Source

compare changes

🩹 Fixes

• takumi: Serialize WASM calls (#​583)

🏡 Chore

• Bump deps (0509eb75)

❤️ Contributors

• Harlan Wilton (@​harlan-zw)

v6.4.3

Compare Source

   🐞 Bug Fixes

• Dispose prior og:image head entry on client navigation  -  by @​harlan-zw (d709e)
• Add image fetch timeouts and Server-Timing instrumentation  -  by @​harlan-zw in #​581 (6ae9a)

    View changes on GitHub

v6.4.2

Compare Source

compare changes

🩹 Fixes

• Dispose prior og:image head entry on client navigation (d709ecf1)
• Add image fetch timeouts and Server-Timing instrumentation (#​581)

🏡 Chore

• Bump deps (62671921)
• Sync tests (53364387)

❤️ Contributors

• Harlan Wilton (@​harlan-zw)

v6.4.1

Compare Source

   🐞 Bug Fixes

• Update og:image on client-side navigation  -  by @​harlan-zw in #​575 (f8cdc)

    View changes on GitHub

v6.4.0

Compare Source

   🚀 Features

• Add /_og/r/<path> resolver endpoint  -  by @​harlan-zw in #​572 (3aa76)

   🐞 Bug Fixes

• Avoid leaking useHead title into og:image URL  -  by @​harlan-zw in #​573 and #​574 (1902f)

    View changes on GitHub

v6.3.10

Compare Source

compare changes

🚀 Enhancements

• Add /_og/r/<path> resolver endpoint (#​572)

🩹 Fixes

• Avoid leaking useHead title into og:image URL (#​573, #​574)

🏡 Chore

• Bump deps (39a558d7)

❤️ Contributors

• Harlan Wilton (@​harlan-zw)

v6.3.9

Compare Source

compare changes

🏡 Chore

• Bump deps (72f3540d)

❤️ Contributors

• Harlan Wilton (@​harlan-zw)

v6.3.8

Compare Source

compare changes

🩹 Fixes

• Fallback to internal handler when font origin is unreachable (#​566)

❤️ Contributors

• Harlan Wilton (@​harlan-zw)

v6.3.7

Compare Source

compare changes

🩹 Fixes

• Resolve :style object literal bindings to inline CSS (#​562)
• Misc cache improvements (#​564)

🏡 Chore

• Takumi v1 (cdf161b3)
• test: Update takumi wasm import for new package structure (#​565)

❤️ Contributors

• Harlan Wilton (@​harlan-zw)

v6.3.6

Compare Source

compare changes

🩹 Fixes

• prerender: Compat issue with html validator (51aa00d3)

🏡 Chore

• Wrong copy (70eab6f5)

❤️ Contributors

• Harlan Wilton (@​harlan-zw)

v6.3.5

Compare Source

compare changes

🩹 Fixes

• prerender: Edge cases in option caching (93ab1c67)

❤️ Contributors

• Harlan Wilton (@​harlan-zw)

v6.3.4

Compare Source

compare changes

🩹 Fixes

• prerender: Sign dynamic URLs in strict mode and handle orphan hashes (#​560)

🏡 Chore

• Sync (4529b9e7)
• Broken i18n fixture (c96607be)

❤️ Contributors

• Harlan Wilton (@​harlan-zw)

v6.3.3

Compare Source

compare changes

🩹 Fixes

• Add missing nitro presets to compatibility map (#​559)

🏡 Chore

• Sync (e2dcc301)
• Sync (bd3b422f)

❤️ Contributors

• Harlan Wilton (@​harlan-zw)

v6.3.2

Compare Source

No significant changes

    View changes on GitHub

v6.3.1

Compare Source

   🐞 Bug Fixes

• Prefer runtime config for secret  -  by @​harlan-zw (65196)

    View changes on GitHub

v6.3.0

Compare Source

   🚀 Features

• security: Add URL signing to prevent parameter tampering  -  by @​harlan-zw in #​546 (87a25)

   🐞 Bug Fixes

• security: Strict mode, deprecate html  -  by @​harlan-zw in #​545 (25c05)

    View changes on GitHub

v6.2.6

Compare Source

compare changes

🚀 Enhancements

• security: Add URL signing to prevent parameter tampering (#​546)

🩹 Fixes

• security: Strict mode, deprecate html (#​545)

❤️ Contributors

• Harlan Wilton (@​harlan-zw)

v6.2.5

Compare Source

   🐞 Bug Fixes

• Hydration-issue warning due to SSR generated DateTime value  -  by @​khatastroffik in #​535 (92d9d)
• Sanitize component props  -  by @​harlan-zw in #​543 (3dcf8)
• Harden security defaults  -  by @​harlan-zw in #​540 (9902a)
• Whitelist component props to prevent cache key DoS  -  by @​harlan-zw in #​544 (bd05a)

    View changes on GitHub

v6.2.4

Compare Source

compare changes

🩹 Fixes

• Hydration-issue warning due to SSR generated DateTime value (#​535)
• Sanitize component props (#​543)
• Harden security defaults (#​540)
• Whitelist component props to prevent cache key DoS (#​544)

🏡 Chore

• Bump deps (a8a65b66)
• Bump deps (bcad7915)
• Artifact (284540a7)
• Sync (e7deb1f7)

❤️ Contributors

• Harlan Wilton (@​harlan-zw)
• Loïs Bégué (@​khatastroffik)

v6.2.3

Compare Source

   🐞 Bug Fixes

• cloudflare: Detect legacy assets mode  -  by @​harlan-zw (7f60a)

   🏎 Performance

• devtools: Drop json-editor-vue  -  by @​harlan-zw (14a58)

    View changes on GitHub

v6.2.2

Compare Source

compare changes

🔥 Performance

• devtools: Drop json-editor-vue (14a585b7)

🩹 Fixes

• cloudflare: Detect legacy assets mode (7f60a480)

🏡 Chore

• Bump deps (362cee2a)

❤️ Contributors

• Harlan Wilton (@​harlan-zw)

v6.2.1

Compare Source

compare changes

🏡 Chore

• Bump deps (caf70605)

❤️ Contributors

• Harlan Wilton (@​harlan-zw)

v6.2.0

Compare Source

compare changes

🩹 Fixes

• Missing compatibility config (4541033c)
• devtools: Broken resolution (57ac2647)

🏡 Chore

• Label devtools layout (ed041041)
• Bump deps (41fa2371)

❤️ Contributors

• Harlan Wilton (@​harlan-zw)

v6.1.2

Compare Source

compare changes

🚀 Enhancements

• content: Add defineOgImageSchema() composable (#​520)

🩹 Fixes

• Update pnpm-lock.yaml (0784c378)
• Broken slash decoding in some cases (6f8ac765)
• client: Resolve layer-devtools path via import.meta.resolve (dd4e0578)
• cloudflare: Resolve fonts via localFetch when ASSETS binding unavailable (#​527)
• B64 encode props with URL-sensitive characters (#​530)
• Resolve CI issues (f3e3045b)
• Use explicit imports mapping for #nuxtseo-shared (08594505)
• Use direct nuxtseo-shared/runtime imports, bump to ^0.3.0 (31b1a991)
• Resolve CI failures in lint, build, typecheck, and tests (47e85d35)
• Use dot-notation for ambiguous CalcTest component in type test (3ba63fef)

💅 Refactors

• Migrate to nuxtseo-shared for shared utilities (f909f014)
• client: Migrate devtools to nuxtseo-shared layer (48c15483)
• Use published nuxtseo-layer-devtools package (74393aa3)
• Remove dead defensive prerender initialization (3b0dae14)
• Use nuxtseo-shared subpath exports, bump to ^0.5.0 (bd50740f)
• Migrate to nuxtseo-shared (#​521)

🏡 Chore

• Sync (1f7cb2c4)
• Sync (ca0fb5b0)
• Update lockfile (162799b7)
• Bump nuxtseo-shared to ^0.2.0 (ecf3d6b0)
• Bump nuxtseo-shared to ^0.4.0, revert runtime to #alias (b368142f)
• Sync (f173a2a7)
• Sync (eb106f60)
• Sync (0f4b0f27)
• Sync (50f5e65e)
• Sync (787a087e)
• Remove unrelated files from PR (5f8ed2f2)
• Examples (73c36536)
• Sync (837a3e66)
• Sync (2d63ada7)

✅ Tests

• Update cloudflare-takumi snapshots after template redesign (66c2a80a)

❤️ Contributors

• Harlan Wilton (@​harlan-zw)

v6.1.1

Compare Source

compare changes

🩹 Fixes

• Auto-detect NuxtHub KV for cache storage (#​517)
• tw4: Use safe module resolution to prevent throws for unresolvable plugins (#​519)

🏡 Chore

• Sync (7019fa01)
• Sync (46d07288)

❤️ Contributors

• Harlan Wilton (@​harlan-zw)

v6.1.0

Compare Source

compare changes

🩹 Fixes

• Add missing option keys to URL encoding and prop separation (#​516)
• Defer x-nitro-prerender header to prevent stale hash URLs during prerender (#​514)
• Base64-encode non-ASCII values in URL path params (#​515)

🏡 Chore

• Lint (26863d01)

❤️ Contributors

• Harlan Wilton (@​harlan-zw)

v6.0.7

Compare Source

compare changes

🚀 Enhancements

• devtools: Add production preview toggle (#​509)
• cli: Add create and switch commands with DX improvements (#​508)
• devtools: Add component creation from empty state (#​510)

🩹 Fixes

• encoding: Avoid pre decoded params to be truncated (#​504)
• fonts: Detect font families from script setup computed properties (#​507)
• devtools: Use actual content width for preview scaling (#​506)
• Recover from v5 defineOgImage syntax (1e882060)

🏡 Chore

• Bump (f9725ffd)
• Lint (9bcb8358)

❤️ Contributors

• Harlan Wilton (@​harlan-zw)
• Baptiste Leproux (@​larbish)

v6.0.6

Compare Source

compare changes

🩹 Fixes

• Broken windows path resolutions (dd1ae90b)

🏡 Chore

• Bump (923c9f83)

❤️ Contributors

• Harlan Wilton (@​harlan-zw)

v6.0.5

Compare Source

compare changes

🩹 Fixes

• Prevent crash when defineOgImage runs client-side during layout transitions (#​502)
• takumi: Use real font family names for correct font-weight matching (#​503)

🏡 Chore

• Bump deps (06f54419)

❤️ Contributors

• Harlan Wilton (@​harlan-zw)

v6.0.4

Compare Source

compare changes

🏡 Chore

• Broken mock still (1f93bf7f)

❤️ Contributors

• Harlan Wilton (@​harlan-zw)

v6.0.3

Compare Source

compare changes

🩹 Fixes

• Don't mock null bindings (c46560be)

🏡 Chore

• Bump (47f57f51)

❤️ Contributors

• Harlan Wilton harlan@harlanzw.com

v6.0.2

Compare Source

   🐞 Bug Fixes

• migration:
  • Broken warning  -  by @​harlan-zw (d87d8)
• satori:
  • Better css var matching  -  by @​harlan-zw (251f1)
  • Infer SVG dimensions from parent  -  by @​harlan-zw (94ef0)
• takumi:
  • Broken font weight matching  -  by @​harlan-zw (3f0c5)
  • Html -> nodes attr ordering  -  by @​harlan-zw (35ea6)

    View changes on GitHub

v6.0.1

Compare Source

compare changes

🩹 Fixes

• takumi: Broken font weight matching (3f0c5eaa)
• migration: Broken warning (d87d88a1)
• takumi: Html -> nodes attr ordering (35ea6145)
• satori: Better css var matching (251f1ee4)
• satori: Infer SVG dimensions from parent (94ef0abc)

💅 Refactors

• Drop sanitizeTakumiStyles (#​498)
• Runtime font loading unify (4c87a57c)

🏡 Chore

• Re-do test infastructure (704a6d4d)
• Sync (9d98db9c)
• Test (1d4f49ce)
• Sync (5762d157)
• Sync (8ba3de55)
• Sync (fb35f0f9)
• CI (127df981)
• CI (04b106b6)

❤️ Contributors

• Harlan Wilton harlan@harlanzw.com
• Kane Wang kane@yeecord.com

v6.0.0

Compare Source

compare changes

🚀 Enhancements

• Add defineOgImageUrl composable for pre-prepared images (acff3941)

🩹 Fixes

• Support node cluster (e5c2571c)
• Add defineOgImageUrl to tree-shake plugin, fix mock type and doc anchor (c1a85a56)
• Lint error in defineOgImageUrl docs (da9dc452)
• Use element loc instead of child loc in ultrahtml SFC parser (d5cd4f95)
• migration: defineOgImage({ url }) -> useSeoMeta (#​496)

💅 Refactors

• Drop defineOgImageUrl, use useSeoMeta for pre-prepared images (ccbaa48f)
• Replace HTML template regex with ultrahtml AST in CLI migration (32a49eeb)
• Use ultrahtml for SFC block extraction, remove last regex parsers (15b7b998)

🏡 Chore

• Remove beta flag (c6d8e981)
• Bump deps (350bc579)
• Bump deps (499500e3)

❤️ Contributors

• Harlan Wilton (@​harlan-zw)

v5.1.13

Compare Source

   🐞 Bug Fixes

• Updated wasm satori API  -  by @​harlan-zw (c330a)
• Handle _query in og-image without breaking render path  -  by @​JackTYM (2e5bd)
• content: Prefer users zod version  -  by @​harlan-zw (e9550)

    View changes on GitHub

v5.1.12

Compare Source

   🐞 Bug Fixes

• Broken google font mirror  -  by @​harlan-zw (7c6f9)

    View changes on GitHub

v5.1.11

Compare Source

   🐞 Bug Fixes

• Broken dist publishing  -  by @​harlan-zw (24a29)

    View changes on GitHub

v5.1.10

Compare Source

   🐞 Bug Fixes

• Broken getOgImagePath usage  -  by @​harlan-zw (8904f)
• NPM trusted publishing  -  by @​harlan-zw (81e90)

    View changes on GitHub

v5.1.9

Compare Source

   🐞 Bug Fixes

• Maybe resolve nitro path resolution bug  -  by @​harlan-zw (118dd)

    View changes on GitHub

v5.1.8

Compare Source

   🐞 Bug Fixes

• Remove #imports  -  by @​harlan-zw (f2788)
• content: Type broken when augmenting  -  by @​harlan-zw (76b7c)

    View changes on GitHub

v5.1.7

Compare Source

   🐞 Bug Fixes

• Prefer nitro.static over _generate  -  by @​danielroe in #​372 (7a570)

    View changes on GitHub

v5.1.6

Compare Source

   🐞 Bug Fixes

• Explicit sharp dependency usage  -  by @​harlan-zw (9e522)

    View changes on GitHub

v5.1.5

Compare Source

   🐞 Bug Fixes

• Handle undefined link/style in server component response  -  by @​danielroe in #​368 (f8ae4)
• Reworked sharp compatibility checks for JPEG rendering  -  by @​harlan-zw in #​370 (f7bb7)

   🏎 Performance

• Persist font cache between og image versions  -  by @​harlan-zw (3967b)
• Pass SVG data directly to sharp for JPEG's  -  by @​harlan-zw (efcc4)

    View changes on GitHub

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cloudflare-workers-and-pages]

Deploying dev-mode with    Cloudflare Pages

Latest commit:	0607082
Status:	🚫  Build failed.

View logs

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	nuxt-og-image@​6.5.1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm culori is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/nuxt-og-image@6.5.1 → npm/culori@4.0.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/culori@4.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report