diff --git a/package.json b/package.json
index 036b3ff..cf520ca 100644
--- a/package.json
+++ b/package.json
@@ -145,9 +145,9 @@
     "typescript": "^5.7.3"
   },
   "//resolutions": "Security overrides for dependabot alerts. Scoped descriptors (e.g. 'yaml@^2.2.1') only bump the vulnerable range and leave unaffected majors alone — e.g. yaml@^1.10.0 stays on 1.x, since the yaml advisory (GHSA-48c2-rrv3-qjmp) only affects >= 2.0.0.",
+  "//image-size": "Deliberately NOT pinned. metro requires image-size ^1.0.2 and calls it as `const getImageSize = require('image-size')` (metro/src/Assets.js), which needs v1's callable CommonJS export. v2 is ESM-first: require() returns an object with a named `imageSize` export, so pinning 2.x raises 'TypeError: getImageSize is not a function' on any bundle containing a PNG/JPEG asset. A 2.0.2 pin was added in #11 to patch GHSA-m5qc-5hw7-8vg7, which was correct at the time, but 1.2.1 patches that same advisory on the 1.x line and stays inside metro's major. The remaining advisories GHSA-w3rx-r6r6-pgpr and GHSA-5p2g-fcmc-qvqq cover <= 2.0.2 with no patched release, so no pin can fix them and 1.2.1 is no worse than 2.0.2. Leave this unpinned until upstream ships a fix metro can consume.",
   "resolutions": {
     "@types/react": "^19.0.6",
-    "image-size": "2.0.2",
     "blob": "10.5.0",
     "node-forge": "^1.4.0",
     "fast-xml-parser": "^5.7.0",
diff --git a/yarn.lock b/yarn.lock
index 827f0d9..8d34031 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -8273,12 +8273,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"image-size@npm:2.0.2":
-  version: 2.0.2
-  resolution: "image-size@npm:2.0.2"
+"image-size@npm:^1.0.2":
+  version: 1.2.1
+  resolution: "image-size@npm:1.2.1"
+  dependencies:
+    queue: "npm:6.0.2"
   bin:
     image-size: bin/image-size.js
-  checksum: 10c0/f09dd0f7cf8511cd20e4f756bdb5a7cb6d2240de3323f41bde266bed8373392a293892bf12e907e2995f52833fd88dd27cf6b1a52ab93968afc716cb78cd7b79
+  checksum: 10c0/f8b3c19d4476513f1d7e55c3e6db80997b315444743e2040d545cbcaee59be03d2eb40c46be949a8372697b7003fdb0c04925d704390a7f606bc8181e25c0ed4
   languageName: node
   linkType: hard
 
@@ -8345,7 +8347,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"inherits@npm:2, inherits@npm:2.0.4, inherits@npm:^2.0.3, inherits@npm:^2.0.4, inherits@npm:~2.0.4":
+"inherits@npm:2, inherits@npm:2.0.4, inherits@npm:^2.0.3, inherits@npm:^2.0.4, inherits@npm:~2.0.3, inherits@npm:~2.0.4":
   version: 2.0.4
   resolution: "inherits@npm:2.0.4"
   checksum: 10c0/4e531f648b29039fb7426fb94075e6545faa1eb9fe83c29f0b6d9e7263aceb4289d2d4557db0d428188eeb449cc7c5e77b0a0b2c4e248ff2a65933a0dee49ef2
@@ -11242,6 +11244,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"queue@npm:6.0.2":
+  version: 6.0.2
+  resolution: "queue@npm:6.0.2"
+  dependencies:
+    inherits: "npm:~2.0.3"
+  checksum: 10c0/cf987476cc72e7d3aaabe23ccefaab1cd757a2b5e0c8d80b67c9575a6b5e1198807ffd4f0948a3f118b149d1111d810ee773473530b77a5c606673cac2c9c996
+  languageName: node
+  linkType: hard
+
 "quick-lru@npm:^4.0.1":
   version: 4.0.1
   resolution: "quick-lru@npm:4.0.1"