From 93593786da958d94fed298f086c3f558f9988c9e Mon Sep 17 00:00:00 2001 From: lcf2212dev Date: Fri, 14 Aug 2026 14:35:30 -0300 Subject: [PATCH] fix: resolve image-size to image-size-next@1.2.2 Metro depends on image-size@^1.0.2. Pin the specifier to the 1.x drop-in image-size-next@1.2.2 (CVE-2025-71329 / CVE-2025-71330) via Yarn's npm: alias so Assets.js and tests keep importing 'image-size'. No API change. 1.2.2 is published on the legacy dist-tag; npm latest remains 2.1.1. --- packages/metro/package.json | 2 +- yarn.lock | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/packages/metro/package.json b/packages/metro/package.json index 33cf3e17de..32c96d5b5c 100644 --- a/packages/metro/package.json +++ b/packages/metro/package.json @@ -34,7 +34,7 @@ "flow-enums-runtime": "^0.0.6", "graceful-fs": "^4.2.4", "flow-parser": "0.327.0", - "image-size": "^1.0.2", + "image-size": "npm:image-size-next@1.2.2", "invariant": "^2.2.4", "jest-worker": "^29.7.0", "jsc-safe-url": "^0.2.2", diff --git a/yarn.lock b/yarn.lock index d26551a116..30bbbec4f2 100644 --- a/yarn.lock +++ b/yarn.lock @@ -3497,10 +3497,10 @@ ignore@^7.0.5: resolved "https://registry.yarnpkg.com/ignore/-/ignore-7.0.5.tgz#4cb5f6cd7d4c7ab0365738c7aea888baa6d7efd9" integrity sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg== -image-size@^1.0.2: - version "1.0.2" - resolved "https://registry.yarnpkg.com/image-size/-/image-size-1.0.2.tgz#d778b6d0ab75b2737c1556dd631652eb963bc486" - integrity sha512-xfOoWjceHntRb3qFCrh5ZFORYH8XCdYpASltMhZ/Q0KZiOwjdE/Yl2QCiWdwD+lygV5bMCvauzgu5PxBX/Yerg== +"image-size@npm:image-size-next@1.2.2": + version "1.2.2" + resolved "https://registry.yarnpkg.com/image-size-next/-/image-size-next-1.2.2.tgz#40997f20d5918fed93717c7cb1acc58b7e15d361" + integrity sha512-Pd3CJ2+Ifk2H2jWikkoz2BSZgnuF3Qsea4gQmj2gtiOtYpGWBl7elj8EXnFMiY5PaYNruTTLD0hQ0UWK7pz9xA== dependencies: queue "6.0.2"