fix: resolve image-size to image-size-next@1.2.2 (CVE-2025-71329/71330)

[lcf2212dev]

Summary

Please treat this pull request with care and review the modified files directly. The change is small and not a critical / API change: Metro still imports image-size and still uses the same 1.x default-export API (getImageSize(buffer)).

I work at CAIXA Econômica Federal, a large Brazilian state-owned bank, with more than 84,000 employees and more than 150,000 clients. Our new banking app is still in beta and is already released to 100,000 clients.

The architecture is React Native with rspack. A host app manages hundreds of federated mini-apps. Clearing CVE-2025-71329 and CVE-2025-71330 is part of our CI/CD process. The security criteria for this bank project are extremely strict — scanners block the pipeline while image-size@1.0.2 remains the resolved dependency.

image-size-next@1.2.2 was built exclusively for Metro. Metro depends on image-size@^1.0.2 (the 1.x default-export API). The 2.x line is a different surface and is not what this PR installs. 1.2.2 is published on npm with the legacy dist-tag so it does not become latest (latest remains 2.1.1).

This replaces closed PR #1853, which incorrectly targeted image-size-next@2.1.0 and rewired imports. That was the wrong major for Metro.

This PR	packages/metro/package.json + yarn.lock only
Specifier	"image-size": "npm:image-size-next@1.2.2"
Source / tests	unchanged (import / jest.mock('image-size'))
npm 1.2.2	https://www.npmjs.com/package/image-size-next/v/1.2.2
Diff vs upstream v1.2.1	lcf2212dev/image-size-next@v1.2.1...v1.2.2

Please look at that compare. The delta is the DoS bounds checks (zero-size JXL/HEIF/JP2 boxes; zero-length ICNS entries) on the same 1.x tree Metro already consumes.

Not affiliated with the original image-size author.

Note on upstream status: the GitHub repo for image-size was archived because the project moved to Codeberg; the npm package itself is not deprecated. This PR is not claiming otherwise. The remaining problem for us is that 1.0.2 as resolved by Metro is still flagged for those two CVEs, and that fails a regulated bank CI/CD gate.

CLA is already signed for lcf2212dev.

Changelog: [Fix] Resolve image-size to image-size-next@1.2.2 (CVE-2025-71329 / CVE-2025-71330)

Test plan

• Confirmed image-size-next@1.2.2 keeps the 1.x CJS shape Metro uses (module.exports = imageSize, plus exports.default).
• Assets.js and Assets-test.js still import / mock 'image-size' — no source change.
• Yarn classic lockfile entry: image-size@npm:image-size-next@1.2.2 → 1.2.2 (queue@6.0.2 already present).
• Recommend CI: workspace install + packages/metro Assets tests + a smoke that getAssetSize still reads png/jpg dimensions.
• Confirm no remaining image-size@^1.0.2 in the root yarn.lock.

[robhogan]

Sorry, we're not going to take a dependency on an untrusted third party package.

When I say "untrusted" it's nothing personal and I appreciate the effort to help. We have to be careful about depending on any third party package and especially when they're new and don't have widespread adoption or a track record of maintenance. If we did that, we'd make ourselves and our users more vulnerable.

The way forward to deal with this audit noise (again, not an actual risk to Metro users) is to either get this fixed upstream, to switch to an equivalent, proven package if there is one, or to vendor the code we need, bringing it inside Metro.

In the mean time you can locally resolve to your image-size-next within your own project if you want to, but we wont accept it as a dependency of Metro at this stage.

[lcf2212dev]

Thanks for the clear decision, and no offense taken — I understand the trust/supply-chain bar.

We’ll pin image-size-next@1.2.2 via resolutions in our own repos for now.

If you’d rather take the vendoring path you mentioned (the small image-size surface Metro actually uses in Assets.js, brought in-tree, no new npm dependency), I’m happy to prepare that as a follow-up. Just say if that’s useful and I’ll follow your preferred shape.

Either way, thanks for the review.