fix: replace vulnerable image-size with image-size-next (CVE-2025-71329/71330)

[lcf2212dev]

Summary

Metro depends on image-size@^1.0.2, used in Assets.js to read image dimensions. Upstream image-size is archived and remains affected by:

• CVE-2025-71329 — DoS infinite loop (JXL/HEIF/JP2 zero-size boxes)
• CVE-2025-71330 — DoS infinite loop (ICNS zero entry length)

This PR switches the direct dependency and source/tests to the community MIT drop-in image-size-next@2.1.0, which keeps the same public API (default / imageSize export used as getImageSize(buffer)).

npm	https://www.npmjs.com/package/image-size-next
GitHub	https://github.com/lcf2212dev/image-size-next
Related RN resolution PR	react/react-native#57895

Not affiliated with the original image-size maintainer.

Code changes

• packages/metro/package.json — image-size → image-size-next@2.1.0
• packages/metro/src/Assets.js — import from image-size-next
• packages/metro/src/__tests__/Assets-test.js — jest mock path
• yarn.lock — lock entry for image-size-next@2.1.0

Changelog: [Fix] Replace vulnerable archived image-size with maintained drop-in image-size-next@2.1.0 (CVE-2025-71329 / CVE-2025-71330)

Test plan

• Confirmed image-size-next@2.1.0 exposes a default/imageSize export compatible with getImageSize(buffer) as used in Assets.js.
• Updated Assets-test.js mocks to image-size-next.
• Recommend CI: monorepo install + Metro package tests (especially Assets-test.js) + smoke resolving png/jpg asset dimensions via getAssetSize.
• Confirm no remaining from 'image-size' / require('image-size') under packages/metro.

Note

A monorepo-level Yarn resolution was proposed on React Native (#57895) as a temporary shield for nested installs. Landing the dependency change here is the durable fix for all Metro consumers.

(Replaces closed PR #1852 — fresh branch with signed commit.)

[robhogan]

Upstream image-size is archived

This is incorrect. The GitHub repo is archived because the maintainer has recently moved the project to Codeberg. The npm distribution is not archived or deprecated.

Aside from that, I’m very wary of accepting dependencies on new packages proposed by the creators of that package with no proven record of trust - that is a real security risk, whereas the CVEs are audit noise that don’t impact Metro users.

[lcf2212dev]

Aside from that, I’m very wary of accepting dependencies on new packages proposed by the creators of that package with no proven record of trust - that is a real security risk, whereas the CVEs are audit noise that don’t impact Metro users.

Thanks for your attention, @robhogan . I tried that because in our banking app we use React Native with Re.pack for federation. Because of this, we have to manage hundreds of repositories within this project. Is there anything that can be done in metro to eliminate these security alerts from GitHub?