From 929eaad478a888ecb0e6a1131190b7c64575f41c Mon Sep 17 00:00:00 2001 From: Saptarshi Das Date: Fri, 4 Sep 2026 12:48:07 +0530 Subject: [PATCH 1/2] fix(deps): drop the image-size resolution that broke metro asset sizing The resolutions block pinned image-size to 2.0.2, crossing the major boundary of metro's own requirement (^1.0.2). That pin achieved nothing and broke image asset bundling. It achieved nothing because both open advisories cover every published version with no fix available: #113 GHSA-w3rx-r6r6-pgpr high <= 2.0.2 -> NONE ICNS parser infinite loop #114 GHSA-5p2g-fcmc-qvqq high <= 2.0.2 -> NONE JXL/HEIF parser infinite loops 2.0.2 sits inside both ranges, so forcing it left the repo exactly as exposed as before. It broke bundling because image-size v2 is ESM-first: require() returns an object with a named `imageSize` export rather than a callable function, and file-path input moved to a separate ./fromFile entry. metro/src/Assets.js:6 does `const getImageSize = require("image-size")` and calls it at :31 and :140, which raises TypeError: getImageSize is not a function on any bundle containing a PNG or JPEG asset. Reproduced directly against the installed copy; with 1.2.1 the same call returns 512x86. Removing the resolution restores 1.2.1, metro's intended major. This is security-neutral: of the three image-size advisories, the only one with a fix (GHSA-m5qc-5hw7-8vg7, this repo's already-closed #14) is patched in 1.2.1 for the 1.x line, and the other two affect 1.2.1 and 2.0.2 alike. Nothing reopens. #113 and #114 cannot be closed by any version bump and need a risk decision instead -- see the PR description. Verified: yarn install --immutable, typecheck, jest and prepack (bob build, all three targets) pass, and only image-size 1.2.1 resolves. Co-Authored-By: Claude Opus 5 (1M context) --- package.json | 1 - yarn.lock | 21 ++++++++++++++++----- 2 files changed, 16 insertions(+), 6 deletions(-) diff --git a/package.json b/package.json index 036b3ff..1681702 100644 --- a/package.json +++ b/package.json @@ -147,7 +147,6 @@ "//resolutions": "Security overrides for dependabot alerts. Scoped descriptors (e.g. 'yaml@^2.2.1') only bump the vulnerable range and leave unaffected majors alone — e.g. yaml@^1.10.0 stays on 1.x, since the yaml advisory (GHSA-48c2-rrv3-qjmp) only affects >= 2.0.0.", "resolutions": { "@types/react": "^19.0.6", - "image-size": "2.0.2", "blob": "10.5.0", "node-forge": "^1.4.0", "fast-xml-parser": "^5.7.0", diff --git a/yarn.lock b/yarn.lock index 827f0d9..8d34031 100644 --- a/yarn.lock +++ b/yarn.lock @@ -8273,12 +8273,14 @@ __metadata: languageName: node linkType: hard -"image-size@npm:2.0.2": - version: 2.0.2 - resolution: "image-size@npm:2.0.2" +"image-size@npm:^1.0.2": + version: 1.2.1 + resolution: "image-size@npm:1.2.1" + dependencies: + queue: "npm:6.0.2" bin: image-size: bin/image-size.js - checksum: 10c0/f09dd0f7cf8511cd20e4f756bdb5a7cb6d2240de3323f41bde266bed8373392a293892bf12e907e2995f52833fd88dd27cf6b1a52ab93968afc716cb78cd7b79 + checksum: 10c0/f8b3c19d4476513f1d7e55c3e6db80997b315444743e2040d545cbcaee59be03d2eb40c46be949a8372697b7003fdb0c04925d704390a7f606bc8181e25c0ed4 languageName: node linkType: hard @@ -8345,7 +8347,7 @@ __metadata: languageName: node linkType: hard -"inherits@npm:2, inherits@npm:2.0.4, inherits@npm:^2.0.3, inherits@npm:^2.0.4, inherits@npm:~2.0.4": +"inherits@npm:2, inherits@npm:2.0.4, inherits@npm:^2.0.3, inherits@npm:^2.0.4, inherits@npm:~2.0.3, inherits@npm:~2.0.4": version: 2.0.4 resolution: "inherits@npm:2.0.4" checksum: 10c0/4e531f648b29039fb7426fb94075e6545faa1eb9fe83c29f0b6d9e7263aceb4289d2d4557db0d428188eeb449cc7c5e77b0a0b2c4e248ff2a65933a0dee49ef2 @@ -11242,6 +11244,15 @@ __metadata: languageName: node linkType: hard +"queue@npm:6.0.2": + version: 6.0.2 + resolution: "queue@npm:6.0.2" + dependencies: + inherits: "npm:~2.0.3" + checksum: 10c0/cf987476cc72e7d3aaabe23ccefaab1cd757a2b5e0c8d80b67c9575a6b5e1198807ffd4f0948a3f118b149d1111d810ee773473530b77a5c606673cac2c9c996 + languageName: node + linkType: hard + "quick-lru@npm:^4.0.1": version: 4.0.1 resolution: "quick-lru@npm:4.0.1" From f10eda7940da5954f5a7d78902602b23b6d6c118 Mon Sep 17 00:00:00 2001 From: Saptarshi Das Date: Fri, 4 Sep 2026 14:35:02 +0530 Subject: [PATCH 2/2] docs(deps): record why image-size must not be pinned Adds a //image-size note beside the existing //resolutions note, so the 2.x pin is not reintroduced by a future alert sweep. Explains that metro needs v1's callable require() export, that 1.2.1 patches the same advisory the old pin targeted, and that the two remaining advisories have no patched release at all. Co-Authored-By: Claude Opus 5 (1M context) --- package.json | 1 + 1 file changed, 1 insertion(+) diff --git a/package.json b/package.json index 1681702..cf520ca 100644 --- a/package.json +++ b/package.json @@ -145,6 +145,7 @@ "typescript": "^5.7.3" }, "//resolutions": "Security overrides for dependabot alerts. Scoped descriptors (e.g. 'yaml@^2.2.1') only bump the vulnerable range and leave unaffected majors alone — e.g. yaml@^1.10.0 stays on 1.x, since the yaml advisory (GHSA-48c2-rrv3-qjmp) only affects >= 2.0.0.", + "//image-size": "Deliberately NOT pinned. metro requires image-size ^1.0.2 and calls it as `const getImageSize = require('image-size')` (metro/src/Assets.js), which needs v1's callable CommonJS export. v2 is ESM-first: require() returns an object with a named `imageSize` export, so pinning 2.x raises 'TypeError: getImageSize is not a function' on any bundle containing a PNG/JPEG asset. A 2.0.2 pin was added in #11 to patch GHSA-m5qc-5hw7-8vg7, which was correct at the time, but 1.2.1 patches that same advisory on the 1.x line and stays inside metro's major. The remaining advisories GHSA-w3rx-r6r6-pgpr and GHSA-5p2g-fcmc-qvqq cover <= 2.0.2 with no patched release, so no pin can fix them and 1.2.1 is no worse than 2.0.2. Leave this unpinned until upstream ships a fix metro can consume.", "resolutions": { "@types/react": "^19.0.6", "blob": "10.5.0",