fix: replace vulnerable image-size with image-size-next (CVE-2025-71329/71330)

[lcf2212dev]

Summary

Metro depends on image-size@^1.0.2, used in Assets.js to read image dimensions. Upstream image-size is archived and remains affected by:

• CVE-2025-71329 — DoS infinite loop (JXL/HEIF/JP2 zero-size boxes)
• CVE-2025-71330 — DoS infinite loop (ICNS zero entry length)

This PR switches the direct dependency and source/tests to the community MIT drop-in image-size-next@2.1.0, which keeps the same public API (default / imageSize export used as getImageSize(buffer)).

npm	https://www.npmjs.com/package/image-size-next
GitHub	https://github.com/lcf2212dev/image-size-next
Related RN resolution PR	react/react-native#57894

Not affiliated with the original image-size maintainer.

Code changes

• packages/metro/package.json — image-size → image-size-next@2.1.0
• packages/metro/src/Assets.js — import from image-size-next
• packages/metro/src/__tests__/Assets-test.js — jest mock path
• yarn.lock — lock entry for image-size-next@2.1.0

Test plan

• yarn install in monorepo
• Run Metro asset tests: package metro / Assets-test.js
• Smoke: resolve dimensions for png/jpg asset via getAssetSize
• Confirm no remaining require('image-size') / from 'image-size' in packages/metro

Note

A monorepo-level Yarn resolution was also proposed on React Native (#57894) as a temporary shield for nested installs. Landing the dependency change here is the durable fix for all Metro consumers.

[lcf2212dev]

Closing in favor of a new PR with a properly signed commit (no force-push on this branch).