fix(devtools): don't warn about devtool props

Author: harlan-zw

CHANGELOG.md

@@ -1,6 +1,29 @@
 # Changelog
 
 
+## v6.2.4...main
+
+[compare changes](https://github.com/nuxt-modules/og-image/compare/v6.2.4...main)
+
+### 🩹 Fixes
+
+- Hydration-issue warning due to SSR generated DateTime value ([#535](https://github.com/nuxt-modules/og-image/pull/535))
+- Sanitize component props ([#543](https://github.com/nuxt-modules/og-image/pull/543))
+- Harden security defaults ([#540](https://github.com/nuxt-modules/og-image/pull/540))
+- Whitelist component props to prevent cache key DoS ([#544](https://github.com/nuxt-modules/og-image/pull/544))
+
+### 🏡 Chore
+
+- Bump deps ([a8a65b66](https://github.com/nuxt-modules/og-image/commit/a8a65b66))
+- Bump deps ([bcad7915](https://github.com/nuxt-modules/og-image/commit/bcad7915))
+- Artifact ([284540a7](https://github.com/nuxt-modules/og-image/commit/284540a7))
+- Sync ([e7deb1f7](https://github.com/nuxt-modules/og-image/commit/e7deb1f7))
+
+### ❤️ Contributors
+
+- Harlan Wilton ([@harlan-zw](https://github.com/harlan-zw))
+- Loïs Bégué ([@khatastroffik](https://github.com/khatastroffik))
+
 ## v6.2.2...main
 
 [compare changes](https://github.com/nuxt-modules/og-image/compare/v6.2.2...main)

src/runtime/server/og-image/context.ts

@@ -174,16 +174,19 @@ export async function resolveContext(e: H3Event): Promise<H3Error | OgImageRende
   // Whitelist props: only allow props declared in the component's defineProps.
   // Components without defineProps accept no props. Prevents cache key inflation
   // from arbitrary query params (DoS vector).
+  // colorMode and timestamp are always allowed: colorMode is used by the renderer
+  // (styleDirectives, html template) and timestamp is a devtools cache-buster.
   if (normalised.component && normalised.options.props && typeof normalised.options.props === 'object') {
+    const builtinProps = new Set(['colorMode', 'timestamp'])
     const allowedProps = normalised.component.propNames || []
     const allowedSet = new Set(allowedProps)
     const raw = normalised.options.props as Record<string, any>
     const filtered: Record<string, any> = {}
     for (const key of Object.keys(raw)) {
-      if (allowedSet.has(key))
+      if (allowedSet.has(key) || builtinProps.has(key))
         filtered[key] = raw[key]
       else if (import.meta.dev)
-        logger.warn(`[Nuxt OG Image] Prop "${key}" is not declared by component "${normalised.component.pascalName}" and was dropped. Declared props: ${allowedProps.join(', ')}`)
+        logger.warn(`[Nuxt OG Image] Prop "${key}" is not declared by component "${normalised.component.pascalName}". Declared props: ${allowedProps.join(', ')}`)
     }
     normalised.options.props = filtered
   }