fix(deps): pin satori to 0.32.0 so sponsor and support-matrix images render

[Brooooooklyn]

Problem

Since 2026-10-07 03:55 UTC, napi.rs returns 500 for every generated image:

• /sponsors.svg, /sponsors.png
• /support-matrix.svg, /support-matrix.png

The worker logs TypeError: Cannot read properties of undefined (reading 'href').

satori 0.33 and later load HarfBuzz wasm when the module is imported. In Cloudflare Workers, its startup code thinks it runs in a web worker and reads self.location.href. self.location is undefined in workerd, so the import fails, and every render awaits that failed import.

2026-09-14  #521  satori ^0.32 -> ^0.33     deploys were failing for other reasons,
                                            so production kept the old build
2026-10-06  #536  deploys work again        satori 0.35 reaches production
2026-10-07  03:55 UTC                       first 500s on the image routes
2026-10-08  #537  satori ^0.36              still 500
2026-10-08  #538  Renovate offers ^0.37     same HarfBuzz code path

CI stayed green the whole time. Tests run in Node, where HarfBuzz takes its Node start-up path and works.

What this PR changes

                 before (satori 0.33 .. 0.36)          after (satori 0.32.0)

GET /sponsors.png
      │
      ▼
 import satori ─────► HarfBuzz init                    no HarfBuzz
                      self.location.href                    │
                      ✗ TypeError                           ▼
                            │                      yoga + opentype.js render
                            ▼                               │
                          500                               ▼
                                                     200 image/png

Renovate:  satori  allowedVersions "<0.33.0"   →  no more 0.33+ bump PRs

The support-matrix snapshots go back to the file from before #521. That is the exact output of satori 0.32.

Decisions

Question	Choice	Why
Shim or pin?	Pin 0.32.0	A start-up shim (defining __filename, like lib/satori-env.ts does for __dirname) gets past the first error. Then workerd blocks the next step: Wasm code generation disallowed by embedder. HarfBuzz builds wasm at runtime, and Workers do not allow that. No shim can fix it.
Exact or range?	Exact 0.32.0	The rendered PNG and SVG are byte-identical to the last good build (88fd131).
Why a Renovate rule?	allowedVersions: "<0.33.0"	Without it, Renovate opens the bump again (#538 is open now). CI cannot catch this break, because tests run in Node.
lib/satori-env.ts	Kept	It defines __dirname for satori 0.36. satori 0.32 never reads it, so it is now unused but harmless. Removing it can be a small follow-up.

Known limits

• The sponsor images are served from a KV/R2 cache. While renders failed, nothing new was written. After deploy, the first cold request renders and warms the cache in the background. The daily cron (0 5 * * *) also refreshes it.
• To unpin, satori (or the bundled harfbuzzjs) must start in workerd: no self.location read and no runtime wasm compilation. Until then, keep the Renovate rule.
• chore(deps): update dependency satori to ^0.37.0 - autoclosed #538 (satori ^0.37) should be closed. Renovate should close it on its next run once this rule is on main.

Testing

Check	Result
vp test run (CI mode)	43 files, 909 tests pass. Without the snapshot restore, the 6 support-matrix snapshot tests fail.
vp fmt --check	pass
vp lint	pass (warnings only, none in changed files)
tsc --noEmit	39 errors, the same set as the CI run on #537 (missing vitest types, vite.config.ts). Not from this change.
renovate-config-validator	Config validated successfully
vite build	pass. No harfbuzz or self.location in dist/ssr
vite preview (workerd)	/sponsors.svg 200 image/svg+xml · /sponsors.png 200 image/png (PNG magic) · /support-matrix.svg?tested=full 200 image/svg+xml 215 KB · /support-matrix.png?tested=full 200 image/png 1800×1404. All four bodies are byte-identical to the last good build.
Same preview with satori 0.33.4, 0.35.0, 0.36.0	all four routes 500

Local preview has no sponsor data, so the sponsor image is an empty white card (same as the last good build). Real sponsor avatars are not tested locally.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-08T06:35:37.288487Z	5a436cb	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.