From 59bcb9eb5a236dc1f9d55b945e91503c8f432d26 Mon Sep 17 00:00:00 2001 From: lcf2212dev Date: Mon, 10 Aug 2026 23:42:31 -0300 Subject: [PATCH] fix: resolve image-size to image-size-next (CVE-2025-71329/71330) Metro pulls image-size@^1.0.2 which resolves to an unmaintained package with open DoS CVEs. Force a Yarn resolution to the community drop-in image-size-next@2.1.0 (same public API, MIT). Closes #57888 --- package.json | 3 ++- yarn.lock | 11 +++++------ 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/package.json b/package.json index 918a4426006..6844d711584 100644 --- a/package.json +++ b/package.json @@ -131,6 +131,7 @@ "@xmldom/xmldom": "^0.8.13", "fast-xml-parser": "^4.5.6", "yaml": "^2.8.3", - "fast-uri": "^3.1.2" + "fast-uri": "^3.1.2", + "image-size": "npm:image-size-next@2.1.0" } } diff --git a/yarn.lock b/yarn.lock index c7dd749e97a..623003172ce 100644 --- a/yarn.lock +++ b/yarn.lock @@ -5317,12 +5317,11 @@ ignore@^7.0.5: resolved "https://registry.yarnpkg.com/ignore/-/ignore-7.0.5.tgz#4cb5f6cd7d4c7ab0365738c7aea888baa6d7efd9" integrity sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg== -image-size@^1.0.2: - version "1.1.1" - resolved "https://registry.yarnpkg.com/image-size/-/image-size-1.1.1.tgz#ddd67d4dc340e52ac29ce5f546a09f4e29e840ac" - integrity sha512-541xKlUw6jr/6gGuk92F+mYM5zaFAc5ahphvkqvNe2bQ6gVBkd6bfrmVJ2t4KDAfikAYZyIqTnktX3i6/aQDrQ== - dependencies: - queue "6.0.2" +image-size@^1.0.2, "image-size@npm:image-size-next@2.1.0": + version "2.1.0" + resolved "https://registry.yarnpkg.com/image-size-next/-/image-size-next-2.1.0.tgz#f0c2d5ea995f6beb974b17c02265d924647a360f" + integrity sha512-OUXyc22p+zA9CmiJbuYygTcoHbmZ9tFnJ0NX8LcgfewtrKJnfM+zYwsfrNdoKqz9WsSPTR++2yz+Fqz7Rzvvjg== + import-fresh@^3.2.1, import-fresh@^3.3.0: version "3.3.0"