🐛 Fixed font rendering when converting SVGs with text elements to PNG format

[cmraible]

closes https://linear.app/ghost/issue/ONC-1560/re-unable-to-access-my-admin-site

Summary

• Bumps @tryghost/image-transform from 1.4.6 to 1.4.13, which upgrades Sharp from 0.34.2 to 0.34.5
• Adds fontconfig to the production Docker image (~7MB increase)

Root Cause

A customer uploaded an SVG favicon containing a <text> element. When Ghost tried to rasterize it to PNG (via the /content/images/size/w256h256/format/png/ endpoint), Sharp's bundled librsvg needed fontconfig to resolve fonts for the text. Two problems:

1. Sharp 0.34.2 (librsvg 2.60.0) segfaults when fontconfig is missing — killing the Ghost process instantly with no error log. Sharp 0.34.5 (librsvg 2.61.2) handles this gracefully.
2. The production Docker image (node:22-bookworm-slim) has no fontconfig installed, so even without the segfault, SVG <text> elements render as empty placeholders.

This caused a boot loop: every page load triggered a favicon resize request → process crash → restart → crash again.

Reproduction

Confirmed segfault in a clean node:22-bookworm-slim container (same base as production):

$ docker run --rm node:22-bookworm-slim bash -c '
  npm install sharp@0.34.2 && node -e "
  require(\"sharp\")(Buffer.from(
    \"<svg xmlns='http://www.w3.org/2000/svg'><text>A</text></svg>\"
  )).resize(256).png().toBuffer()"'

Fontconfig error: Cannot load default config file: No such file: (null)
Segmentation fault (exit 139)

Same test with sharp@0.34.5 → succeeds (no segfault, but text renders as placeholder).
Same test with sharp@0.34.5 + fontconfig installed → succeeds with correct text rendering.

Changes

Change	Why
Bump @tryghost/image-transform to 1.4.13 (Sharp 0.34.2 → 0.34.5)	Prevents segfault — librsvg 2.61.2 handles missing fontconfig gracefully instead of crashing
Add fontconfig to Dockerfile.production runtime layer	Provides font resolution so SVG <text> elements render correctly (~7MB image size increase)

Test plan

• Verified Sharp 0.34.2 segfaults in node:22-bookworm-slim (no fontconfig)
• Verified Sharp 0.34.5 does not segfault in same environment
• Verified fontconfig survives the build-essential purge step in Dockerfile
• Verified correct SVG text rendering with fontconfig on staging preview
• Verified fontconfig adds ~7MB to production image size

[coderabbitai]

Walkthrough

The pull request makes two small changes: it updates the dependency @tryghost/image-transform in ghost/core/package.json from 1.4.6 to 1.4.13, and it modifies Dockerfile.production to add fontconfig to the apt-get install line alongside libjemalloc2. Both changes are single-line edits and do not modify application control flow or error handling.

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The PR title mentions fixing font rendering for SVGs with text elements, which aligns with the primary objective of addressing a crash when converting SVGs with elements to PNG format by installing fontconfig.
Description check	✅ Passed	The pull request description clearly relates to the changeset, providing detailed context about a crash bug, root cause analysis, and explaining both changes (dependency bump and Docker image modification).

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cmraible/fix-favicon-crash

📝 Coding Plan

• Generate coding plan for human review comments

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.10%. Comparing base (822bf33) to head (e045202).
⚠️ Report is 29 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #26863      +/-   ##
==========================================
+ Coverage   73.08%   73.10%   +0.02%     
==========================================
  Files        1535     1536       +1     
  Lines      121270   121299      +29     
  Branches    14645    14651       +6     
==========================================
+ Hits        88633    88681      +48     
- Misses      31609    31610       +1     
+ Partials     1028     1008      -20     

Flag	Coverage Δ
admin-tests	54.36% <ø> (+0.06%)	⬆️
e2e-tests	73.10% <ø> (+0.02%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.