Repository navigation

fix(deps): update dependency satori to ^0.63.0 [security] - #62

Open

renovate[bot] wants to merge 1 commit into

renovate/npm-satori-vulnerability

Open

fix(deps): update dependency satori to ^0.63.0 [security]#62
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/npm-satori-vulnerability

renovate Bot commented Oct 27, 2026

Contributor

This PR contains the following updates:

Package	Change	Age	Confidence
satori	`^0.29.0` → `^0.63.0`

Satori-generated SVG has improper escaping

CVE-2026-94545 / GHSA-wx4j-mvgx-mqwp

More information

Details

Impact

Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup.

The impact depends on how the generated SVG is consumed.

Workaround

No complete workaround exists besides upgrading. Applications that cannot immediately upgrade should not render attacker-controlled content with Satori.

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

vercel/satori (satori)

`v0.63.2`

Bug Fixes

Report invalid sizes, insets and margins like other invalid values (#950) (074f0b3)

`v0.63.1`

Bug Fixes

Honor emoji and text presentation selectors (#948) (e1aa7be), closes #533 #665 #533

`v0.63.0`

Bug Fixes

Render variable fonts as their default instance (#946) (b9e5af5)

Features

Render selects and their options like Chrome (#947) (c66082d)

`v0.62.0`

Bug Fixes

Don't make lines of white space between blocks (#945) (7e8efab)
Hide closed dialogs, and draw open ones like browsers (#944) (5ae3a69)
Size SVGs without width and height like browsers (#942) (f725edd), closes #940 #939
Support -webkit-flex and -webkit-inline-flex (#941) (b7e86d9)

Features

Render the labels of button inputs (#943) (b46e5ad)

`v0.61.0`

Bug Fixes

Keep the sizes and aspect ratios of inline SVGs (#940) (0a9f09e), closes #939

Features

Support SVG filters of the document in filter (#939) (1a0ea26), closes #id #goo filters.svg#id

`v0.60.3`

Bug Fixes

Accept auto insets (#937) (3d166fe)
Support math functions in border radii (#938) (8aa18e7)

`v0.60.2`

Performance Improvements

Don't draw what's outside of the image, and render web pages in the playground (#932) (7fbec2e)

`v0.60.1`

Bug Fixes

Keep values of var() apart, and support env() (#933) (a79edfe)
Mask with the alpha of images (#936) (a566246)
Parse the font shorthand like browsers (#934) (d1cd694)
Support math functions in the positions of color stops (#935) (05b9efc)

`v0.60.0`

Bug Fixes

Don't inherit registered custom properties without initial values (#930) (18207e7), closes #921

Features

Support container units (#926) (b75a07b)

`v0.59.2`

Bug Fixes

Avoid quadratic backtracking in number patterns (#929) (070eeca), closes #926

`v0.59.1`

Bug Fixes

Don't change the size of text with text-wrap: balance (#925) (e723cdb)
Support math functions in line-height (#928) (0e52a95), closes #927 #927

`v0.59.0`

Features

Render the value or placeholder of text inputs (#923) (7394b9b)

`v0.58.0`

Bug Fixes

Use the width of 0 in the font for the ch unit (#922) (97649cc)

Features

Support @property in stylesheets (#921) (6d78b67)

`v0.57.2`

Bug Fixes

Don't report the internal container prop of hidden elements (#920) (dc42783), closes #908 #914

`v0.57.1`

Bug Fixes

Don't render white space between flex and grid items (#915) (e236985)
Place text in line boxes like Chrome (#917) (fd600ac), closes #915
Support math functions in grid track sizes (#918) (646eec2), closes #915 #917 #915 #915 #917 #919

Performance Improvements

Don't lay out the content of elements that aren't displayed (#908) (df9e2b5)

`v0.57.0`

Bug Fixes

Support more viewport units, lh and max sizes of none (#913) (b0348a2)

Features

Support container queries in stylesheets (#914) (7a5b152)

`v0.56.2`

Bug Fixes

Move to the start of closed SVG subpaths that continue (#912) (59361dd)
Size text with the points scale factor (#910) (bb3d658)

`v0.56.1`

Bug Fixes

Parse important values that end with functions in stylesheets (#907) (8f27849)

`v0.56.0`

Bug Fixes

Balance text with inline elements, and inherit text-wrap (#901) (61d6753)
Hide elements with the hidden attribute and hidden inputs (#902) (2129a1e)
Resolve CSS variables in SVG attributes (#903) (a47c40a)

Features

Support logical properties (#900) (4566fb0), closes #905 #905
Support the mask shorthand, mask-clip and mask-composite (#904) (9871646), closes #fff #fff

`v0.55.5`

Bug Fixes

Let styles override the size attributes of images (#899) (31bd763), closes #900

`v0.55.4`

Bug Fixes

Lay out and like browsers (#898) (a746621), closes #899

`v0.55.3`

Bug Fixes

Accept pseudo-classes of shadow trees in stylesheets (#897) (547aac0), closes #898

`v0.55.2`

Bug Fixes

Resolve CSS variables like browsers (#895) (cb5abac)

`v0.55.1`

Bug Fixes

Read WOFF tables from inflateSync's return value (#825) (902f94d)

`v0.55.0`

Bug Fixes

Decode layout.wasm without Node's Buffer (#890) (1646e8a)

Features

Support WOFF2 fonts (#892) (d54fccb), closes vercel/next.js#63935 vercel/next.js#67700

`v0.54.0`

Features

Drop invalid declarations of stylesheets like browsers (#891) (8202b5e)

`v0.53.0`

Features

Support ::before and ::after (#889) (f3185b6), closes #6366f1

`v0.52.0`

Features

playground: Add a stylesheet example (#888) (2e44170), closes #887 #886

`v0.51.0`

Features

Support <style> elements (#887) (9247343), closes #0f172a #2563eb #886

`v0.50.0`

Features

Hide <style> and render components before layout (#886) (947a4fc)

`v0.49.1`

Bug Fixes

Add letterSpacing after every character like browsers (#884) (348b3ac)

`v0.49.0`

Features

Synthesize bold and italic when the font has none (#885) (96e9105)

`v0.48.1`

Bug Fixes

Reorder right-to-left text in any direction, and indent lines like browsers (#883) (fc65e1b), closes #882 #882

`v0.48.0`

Features

Support direction: rtl (#882) (7588b06)

`v0.47.1`

Bug Fixes

Align text by its baseline (#873) (2bace17)
Clamp the lines of vertical -webkit-box elements like browsers (#875) (680bbe4)
Move tabs to the tab stops of their line (#876) (e441832)
Only keep a character before an ellipsis at the start of a line (#874) (ca93f94)
Show the background through transparent stops of radial gradients (#872) (b480215)

`v0.47.0`

Features

Support backgroundBlendMode (#870) (75d20f5)
Support textTransform: full-width and full-size-kana (#869) (d717b5a)

`v0.46.0`

Features

Support fontKerning and fontVariant (#868) (23b8d1c)

`v0.45.0`

Features

Support overflowWrap and wordWrap (#867) (d29185c)
Support sizing keywords in sizes and flexBasis: content (#866) (368e18c)

`v0.44.3`

Bug Fixes

Report the boxes of inline elements to onNodeDetected (#865) (f1fab0e)

`v0.44.2`

Bug Fixes

Repeat one dash pattern on rounded borders (#864) (0ffd1b9), closes #862

`v0.44.1`

Bug Fixes

Dash rounded borders around their corners like Chrome (#862) (10386b7)
Don't wrap the content of inline blocks around outer floats (#863) (6cd3ca6)

`v0.44.0`

Features

Draw list markers, and support listStyle and counters (#859) (21fabc4)

`v0.43.0`

Features

Support position: sticky, wordSpacing, translate, rotate, scale and the grid shorthands (#858) (573f007)

`v0.42.0`

Features

Convert CSS Color 4 and 5 colors, and interpolate gradients in color spaces (#857) (6843297)

`v0.41.0`

Features

Support all overflow values, overflowX, overflowY and overflowClipMargin (#854) (a7e9338)

`v0.40.0`

Features

Support float and clear (#853) (c711cb7)

`v0.39.0`

Features

Support aspectRatio, order, visibility, outline, place-* and all border styles (#852) (c2545da)

`v0.38.2`

Bug Fixes

Filter groups, conic gradients, math functions and lenient styles (#851) (43c54d4)

`v0.38.1`

Performance Improvements

Speed up rendering about 2x (#848) (55a6b55)

`v0.38.0`

Features

Apply opacity as a group and fix CSS rendering bugs (#846) (3b84a9e)

`v0.37.1`

Bug Fixes

stop the ESM bundle from reading __dirname (#845) (a140ad0)

`v0.37.0`

Features

Support mix-blend-mode, isolation, paint-order and WebKit text properties (#842) (2f6bbdf)

`v0.36.0`

Features

Support position: fixed and z-index (#840) (89079f6)

`v0.35.2`

Bug Fixes

bundle harfbuzzjs so consumers do not resolve the unpatched package (#796) (1c2ac0f), closes #791 #794
report http status and content type when an image fails to load (#797) (e5f2da9), closes #613 #626 #575 #575

`v0.35.1`

Bug Fixes

Update sharp to 0.35.5 (#839) (807f14b)

`v0.35.0`

Features

Support 3D transforms (#830) (3402868)

`v0.34.1`

Bug Fixes

Keep more precision in transform matrices (#829) (553bd11)

`v0.34.0`

Features

Experimental canvas and WebGL (#828) (f15960f)

`v0.33.5`

Bug Fixes

Harden SVG serialization (#814) (26a52af)

`v0.33.4`

Bug Fixes

Use Geist for playground cards (#790) (9668d20)

`v0.33.3`

Bug Fixes

Optimize opacity processing (#789) (6c400d5)

`v0.33.2`

Bug Fixes

Better font caching (#788) (b22c04c)

`v0.33.1`

Bug Fixes

Improve cache and update benchmark (~12% faster) (#787) (ed7d78e)

`v0.33.0`

Features

Add HarfBuzz text shaping (#735) (b2127fe)

`v0.32.0`

Features

backdrop-filter (#786) (de6db71)

`v0.31.0`

Features

shape() in clip-path (#785) (9487cbb)

`v0.30.0`

Features

corner-shape support (#784) (8705f4c)

Configuration

📅 Schedule: (in timezone America/Denver)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.


          fix(deps): update dependency satori to ^0.63.0 [security]

eca032c

renovate Bot added the security label

This branch has not been deployed

No deployments

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels