Skip to content

chore(deps): update dependency nuxt-og-image to v7 - #130

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/nuxt-og-image-7.x
Open

chore(deps): update dependency nuxt-og-image to v7#130
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/nuxt-og-image-7.x

Conversation

@renovate

@renovate renovate Bot commented Oct 19, 2026

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
nuxt-og-image (source) ^5.1.1 → ^7.0.0 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

nuxt-modules/og-image (nuxt-og-image)

v7.0.7

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v7.0.6

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v7.0.5

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v7.0.4

Compare Source

   🐞 Bug Fixes

Static fonts that og-image downloads now ship as /_og-static-fonts/*.ttf instead of *.woff.

    View changes on GitHub

v7.0.3

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v7.0.2

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v7.0.1

Compare Source

No significant changes

    View changes on GitHub

v7.0.0

Compare Source

This is the Nuxt OG Image v7 release article, also on nuxtseo.com. It ships in Nuxt SEO v6; to upgrade, follow the v5 to v6 migration guide.

Nuxt OG Image v7 ships in Nuxt SEO v6. See the Nuxt SEO v6 release notes.

V7 requires Nuxt 4.6.1+ or Nuxt 5. It signs image URLs with your Nuxt app secret, uses native Satori layout, and reads fonts from @nuxt/fonts v1.
It can also publish rendered images to object storage.

Follow the v6 to v7 migration guide to upgrade.

Quick migration:

pnpm add nuxt-og-image@^7
npx nuxt-og-image generate-secret

Set the printed NUXT_APP_SECRET value in your production environment.

🚀 Features

Publish Images to Object Storage

The module can upload rendered images to a public bucket through a Nitro storage mount. Prerendered og:image tags then use the bucket URL. (#​730)

export default defineNuxtConfig({
  ogImage: {
    publish: { storage: 'og-image-public', baseURL: 'https://images.example.com' },
  },
  nitro: {
    storage: {
      'og-image-public': { driver: 'cloudflare-r2-binding', binding: 'OG_IMAGES' },
    },
  },
})

A runtime image request redirects to the published copy when it exists. Otherwise, the server returns the image and uploads it in the background.
Prerendered local images now use app.cdnURL when you set it. See the publish option.

One Secret for Signing

URL signing now derives its key from the Nuxt 4.6 app secret. One NUXT_APP_SECRET value covers OG images, sessions, and other Nuxt features. (#​729)

npx nuxt-og-image generate-secret

# NUXT_APP_SECRET=...

See the Security guide.

Native Satori Layout

Satori 0.47.1 supports block, inline, flexbox, and grid layout. Templates now use this native layout. (#​736)

The module now passes translate, rotate, scale, inset, z-index, and backdrop utilities to Satori.

@​nuxt/fonts v1 Integration

The module reads fonts through the fonts:resolved hook of @​nuxt/fonts 1.0. (#​698)

  • OG images can use every resolved family and weight, including families that only your site CSS uses.
  • Bold text works on the webpack and rspack builders.
  • Takumi loads OTF and WOFF files, as well as TTF and WOFF2.
  • Satori converts static WOFF2 files and resolves static alternatives for variable fonts.
Performance
  • SSR client builds no longer include the static URL encoder, the component manifest, or URL hashing. (#​723)
  • On an edge benchmark, cold import CPU fell from 119.8 ms to 114.1 ms, and RSS fell from 50.8 MiB to 47.4 MiB. (#​720)

⚠️ Breaking Changes

Nuxt 4.6.1 and Node 22 Required

V7 drops Nuxt 3 and Nuxt 4 versions before 4.6.1. (#​720, #​739)

Dependency v6 v7
Nuxt >=3.16.0 ^4.6.1 || ^5.0.0
Node.js >=18.0.0 ^22.22.3 || ^24.15.0 || >=26.0.0
@unhead/vue ^2.0.5 || ^3.0.0 ^3.4.2
unstorage ^1.15.0 ^1.17.5
Signing Key From NUXT_APP_SECRET

V6 generated a new secret on each build unless you set one. V7 derives the key from Nuxt runtimeConfig.appSecret. (#​729)

Production needs a root secret with at least 32 characters. If it is missing or invalid, OG image requests fail with a 500 error. (#​742)

// Before: remove this
export default defineNuxtConfig({
  ogImage: { security: { secret: process.env.NUXT_OG_IMAGE_SECRET } },
})
# After
NUXT_APP_SECRET=<output of npx nuxt-og-image generate-secret>
  • V7 still reads NUXT_OG_IMAGE_SECRET when the app secret is empty, and warns once.
  • V7 removes string values of ogImage.security.secret and runtimeConfig.ogImage.secret. security.secret: false still turns off signing.
  • All v6 signed URLs become invalid. Rebuild prerendered pages and purge cached HTML.
Satori 0.47.1 Required

The satori peer is now ^0.47.1. The module no longer adds display: flex and flex-direction: column to a bare <div>. (#​736)

<!-- Before -->
<div class="w-full h-full justify-between p-8">

<!-- After -->
<div class="box-border flex flex-col w-full h-full justify-between p-8">

Text elements no longer get flex wrapping or a 0.2em gap. Templates may also need box-border, border-solid, explicit heading margins, or shrink-0 on SVGs.
The migration guide lists each layout change.

@​nuxt/fonts 1.0 Required for Custom Fonts

With @nuxt/fonts before 1.0, OG images use the bundled Inter font and the build warns. (#​698)

pnpm add @nuxt/fonts@^1

The fontless peer is now ^1.3.2, and the unifont peer is now ^1.0.3. If OG text uses a script outside the default subsets, set subsets on each family.

Optional Peers Updated and Takumi v1 Removed

V7 requires these optional peer ranges. (#​739)

Package v7 range
@takumi-rs/core, @takumi-rs/wasm ^2.15.0
@resvg/resvg-js, @resvg/resvg-wasm ^2.6.2
sharp ^0.35.5
playwright-core ^1.64.0
chrome-launcher ^1.2.2
tailwindcss ^4.3.3
@unocss/core, @unocss/config ^66.10.5
zod ^4.6.6

The Takumi fetchedResources and persistentImages options merge into images. Each entry keeps its src and data fields.

// Before
defineOgImage('Card', props, { takumi: { fetchedResources: [{ src, data }], persistentImages: [{ src, data }] } })

// After
defineOgImage('Card', props, { takumi: { images: [{ src, data }] } })
chrome-launcher Is an Optional Peer

The module no longer installs chrome-launcher. Satori and Takumi apps do not need it. (#​749)

If you use the browser renderer with a local Chrome, install it as a dev dependency:

pnpm add -D chrome-launcher

Without it, development and local builds download Chromium through Playwright on the first render.
The browser renderer still needs playwright-core. Without it, the build fails and prints the install command.
This applies when you set ogImage.browser or a page uses a .browser.vue template.

Server Helpers Use Nuxt's RequestEvent

getOgImageUrl(event, ...) now takes Nuxt's portable RequestEvent. In a handler that calls it, import defineEventHandler from nuxt/server. (#​720)

// Before: the h3 defineEventHandler auto-import

// After
import { defineEventHandler } from 'nuxt/server'
import { getOgImageUrl } from '#og-image/server'

export default defineEventHandler(event => ({
  url: getOgImageUrl(event, '/blog/hello', { component: 'OgImagePost', props: { title: 'My post' } }),
}))

For explicit app imports, use #og-image/app.

DevTools Panel Needs nuxtseo-devtools-host

The OG Image DevTools panel moved to an optional host package. (#​720)

pnpm add -D nuxtseo-devtools-host@^1

You do not need to add it to modules. Production rendering does not need it.

Bounded Runtime Cache

With the default runtimeCacheStorage: true and no Nitro cache mount, the image cache is now a 64 MiB LRU cache. (#​726, #​727)

  • runtimeCacheStorage: false now bypasses storage completely.
  • Storage drivers receive a TTL of cacheMaxAgeSeconds, with a minimum of 60 seconds. (#​725)

See the Runtime Cache guide.

🐛 Bug Fixes

  • Escape commas and plus signs in dynamic image URLs, so a client cannot cut off the signature (#​733)
  • Use the render timeout for storage lookups when publishing (#​731)
  • Respect app.baseURL in DevTools font previews (#​738)
  • Pass the cache TTL to the storage driver, by @​0xgdr (#​725)
  • Declare Site Config as a native module dependency (#​734)

👉 Changelog

   🚨 Breaking Changes
   🚀 Features
   🐞 Bug Fixes
   🏎 Performance
    View changes on GitHub
🧠 Agent Skill

If you use an AI agent, install the nuxt-og-image Skill on skilld.dev with this command:

npx skilld install nuxt-modules/og-image/nuxt-og-image

v6.10.4

Compare Source

No significant changes

    View changes on GitHub

v6.10.3

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v6.10.2

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v6.10.1

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v6.10.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v6.9.1

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v6.9.0

Compare Source

compare changes

🩹 Fixes
  • Hash static og paths holding reserved characters (#​695)
  • Require explicit opt-in for page screenshots (#​697)
🏡 Chore
✅ Tests
  • Enable screenshots in the hash-mode fixture (#​701)
❤️ Contributors

v6.8.0

Compare Source

compare changes

🚀 Enhancements
  • nitro: Expose getOgImageUrl for server handlers (#​691)
🩹 Fixes
  • satori: Require satori 0.33.5 or later (#​692)
  • sharp: Require sharp 0.35.4 or later (#​694)
🏡 Chore
❤️ Contributors

v6.7.8

Compare Source

compare changes

🚀 Enhancements
  • Option to disable automatic twitter tags (#​681)
🔥 Performance
  • Let the bundler filter the build plugins (#​676)
🩹 Fixes
  • devtools: Replace __dirname with import.meta.url in layer config (#​674)
  • fonts: Keep subset family names stable across renders (#​682)
  • Do not set headers on a finished response (#​685)
🏡 Chore
  • lint: Adopt shared eslint base config (#​675)
  • Bump (e5e7a7a1)
  • ci: Report edge startup benchmarks on pull requests (#​686)
  • ci: Benchmark the merged pull request checkout (#​687)
  • ci: Match benchmark comments to package size reports (#​689)
❤️ Contributors

v6.7.7

Compare Source

compare changes

🩹 Fixes
  • Encode asterisks in OG image URLs (#​672)
❤️ Contributors

v6.7.6

Compare Source

compare changes

🚀 Enhancements
  • ci: Add package size reporting (#​655)
🩹 Fixes
  • Use Nitro 3 internal fetch bridge (#​656)
  • types: Require Nitro runtime config secret (#​668)
  • Reuse Nuxt Fonts assets for Satori and Takumi (#​664)
  • devtools: Send refresh broadcasts as events (#​671)
🏡 Chore
❤️ Contributors

v6.7.5

Compare Source

compare changes

🩹 Fixes
  • docs: Remove redirected compatibility route (67a6ece7)
  • Isolate worker render failures under concurrent prerendering (#​652)
  • Support Nitro 3 runtime imports (#​653)
  • fonts: Suppress Takumi fallback warning (#​654)
🏡 Chore
❤️ Contributors

v6.7.4

Compare Source

compare changes

🩹 Fixes
  • Warn when secure signing is disabled (3db1f129)
  • Clamp Lightning CSS integer infinity (#​644)
  • Remove obsolete extreme value clamp (#​647)
  • Wrap plugin entrypoints (#​650)
🏡 Chore
❤️ Contributors

v6.7.3

Compare Source

compare changes

🩹 Fixes
  • Parse queries from event paths (#​642)
🏡 Chore
❤️ Contributors

v6.7.2

Compare Source

compare changes

🩹 Fixes
📖 Documentation
  • Content audit sweep (grammar, links, structure) (#​640)
🏡 Chore
❤️ Contributors

v6.7.1

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v6.7.0

Compare Source

compare changes

🩹 Fixes
🏡 Chore
❤️ Contributors

v6.6.0

Compare Source

compare changes

🚀 Enhancements
  • Support Takumi v2 compatibility (#​635)
  • Sign og image urls by default (#​638)
🩹 Fixes
  • Point Takumi installs at v2 beta (#​636)
  • Prevent unauthenticated SSRF via font URL parameter (#​637)
🏡 Chore
❤️ Contributors

v6.5.3

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v6.5.2

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v6.5.1

Compare Source

compare changes

🩹 Fixes
  • Block embedded-IPv4 IPv6 bypasses (#​624)
  • content: Declare zod as optional peer dependency (#​622, #​625)
  • Resolve #og-image alias when no subpath is given (#​615, #​617)
  • Skip renderer prompt in non-interactive environments (#​623)
  • Degrade gracefully when cache backend is unreachable (#​613, #​619)
  • Skip runtime buffer cache during prerender (#​613, #​626)
🏡 Chore
✅ Tests
  • Bump setupTimeout for public-sans-repro fixture (#​616)
  • Refresh takumi emoji snapshot after takumi-rs 1.5.x bump (#​620)
❤️ Contributors

v6.5.0

Compare Source

compare changes

🩹 Fixes
  • Nuxt 4.4.6 island validation (7a28d322)
🏡 Chore
❤️ Contributors

v6.4.11

Compare Source

compare changes

🚀 Enhancements
  • nuxt-ui: Color mode aware token resolution via data-theme (#​598)
🩹 Fixes
  • fonts: Skip fontaine fallbacks (aa33012c)
  • takumi: Treat single-entry variable fonts as axis-driven (defensive) (#​599)
  • takumi: Keep variable WOFF2 over per-weight static fallback (#​600)
🏡 Chore
❤️ Contributors

v6.4.10

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v6.4.9

Compare Source

compare changes

🩹 Fixes
  • More helpful font warnings (78ca997b)
  • Resolve Cloudflare runtime og image secret (#​596)
🏡 Chore
❤️ Contributors

v6.4.8

Compare Source

compare changes

🩹 Fixes
  • Runtime secret override via NUXT_OG_IMAGE_SECRET (#​593)
  • security: Harden SSRF guard with redirect validation and IPv6 coverage (#​594)
  • Harden takumi WASM lock and expand Server-Timing instrumentation (#​592)
🏡 Chore
✅ Tests
  • Bump e2e hook timeout to 240s (#​590)
❤️ Contributors

v6.4.7

Compare Source

compare changes

🩹 Fixes
  • takumi: Restore non-latin glyph support regressed in v6.2.0 (#​587)
🏡 Chore
❤️ Contributors

v6.4.6

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v6.4.5

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v6.4.4

Compare Source

compare changes

🩹 Fixes
  • takumi: Serialize WASM calls (#​583)
🏡 Chore
❤️ Contributors

v6.4.3

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v6.4.2

Compare Source

compare changes

🩹 Fixes
  • Dispose prior og:image head entry on client navigation (d709ecf1)
  • Add image fetch timeouts and Server-Timing instrumentation (#​581)
🏡 Chore
❤️ Contributors

v6.4.1

Compare Source

compare changes

🚀 Enhancements
  • nuxt-ui: Color mode aware token resolution via data-theme (#​598)
🩹 Fixes
  • fonts: Skip fontaine fallbacks (aa33012c)
  • takumi: Treat single-entry variable fonts as axis-driven (defensive) (#​599)
  • takumi: Keep variable WOFF2 over per-weight static fallback (#​600)
🏡 Chore
❤️ Contributors

v6.4.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v6.3.10

Compare Source

compare changes

🚀 Enhancements
  • Add /_og/r/<path> resolver endpoint (#​572)
🩹 Fixes
🏡 Chore
❤️ Contributors

v6.3.9

Compare Source

compare changes

🏡 Chore
❤️ Contributors

v6.3.8

Compare Source

compare changes

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "on Monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@coldtea-pr-lens

coldtea-pr-lens Bot commented Oct 19, 2026

Copy link
Copy Markdown

Note

renovate[bot] opened this pull request, so PR Lens left it undrawn. Comment @pr-lens draw to draw it

github.comment.notice: false in .github/pr-lens.yml turns this note off

@socket-security

socket-security Bot commented Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatednuxt-og-image@​5.1.4 ⏵ 7.0.795 -2100 +498 +396 +4100

View full report

@coderabbitai

coderabbitai Bot commented Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Ignore keyword(s) in the title.

⛔ Ignored keywords: 1
  • chore(deps)

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: c2ce68f7-d7d9-4f0f-a8d6-44ccc3b4e835

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@renovate
renovate Bot force-pushed the renovate/nuxt-og-image-7.x branch from fb245b9 to bc82249 Compare October 19, 2026 10:11
@renovate
renovate Bot force-pushed the renovate/nuxt-og-image-7.x branch from bc82249 to b6d7902 Compare October 20, 2026 15:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

chore dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants