Skip to content

fix(deps): drop the image-size resolution that broke metro asset sizing #35

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sapta100ms wants to merge 2 commits into
base: main
Choose a base branch
from
Open

fix(deps): drop the image-size resolution that broke metro asset sizing #35

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
929eaad
fix(deps): drop the image-size resolution that broke metro asset sizing
sapta100ms Sep 4, 2026
f10eda7
docs(deps): record why image-size must not be pinned
sapta100ms Sep 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -145,9 +145,9 @@
"typescript": "^5.7.3"
},
"//resolutions": "Security overrides for dependabot alerts. Scoped descriptors (e.g. 'yaml@^2.2.1') only bump the vulnerable range and leave unaffected majors alone — e.g. yaml@^1.10.0 stays on 1.x, since the yaml advisory (GHSA-48c2-rrv3-qjmp) only affects >= 2.0.0.",
"//image-size": "Deliberately NOT pinned. metro requires image-size ^1.0.2 and calls it as `const getImageSize = require('image-size')` (metro/src/Assets.js), which needs v1's callable CommonJS export. v2 is ESM-first: require() returns an object with a named `imageSize` export, so pinning 2.x raises 'TypeError: getImageSize is not a function' on any bundle containing a PNG/JPEG asset. A 2.0.2 pin was added in #11 to patch GHSA-m5qc-5hw7-8vg7, which was correct at the time, but 1.2.1 patches that same advisory on the 1.x line and stays inside metro's major. The remaining advisories GHSA-w3rx-r6r6-pgpr and GHSA-5p2g-fcmc-qvqq cover <= 2.0.2 with no patched release, so no pin can fix them and 1.2.1 is no worse than 2.0.2. Leave this unpinned until upstream ships a fix metro can consume.",
"resolutions": {
"@types/react": "^19.0.6",
"image-size": "2.0.2",
"blob": "10.5.0",
"node-forge": "^1.4.0",
"fast-xml-parser": "^5.7.0",
Expand Down
21 changes: 16 additions & 5 deletions yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8273,12 +8273,14 @@ __metadata:
languageName: node
linkType: hard

"image-size@npm:2.0.2":
version: 2.0.2
resolution: "image-size@npm:2.0.2"
"image-size@npm:^1.0.2":
version: 1.2.1
resolution: "image-size@npm:1.2.1"
dependencies:
queue: "npm:6.0.2"
bin:
image-size: bin/image-size.js
checksum: 10c0/f09dd0f7cf8511cd20e4f756bdb5a7cb6d2240de3323f41bde266bed8373392a293892bf12e907e2995f52833fd88dd27cf6b1a52ab93968afc716cb78cd7b79
checksum: 10c0/f8b3c19d4476513f1d7e55c3e6db80997b315444743e2040d545cbcaee59be03d2eb40c46be949a8372697b7003fdb0c04925d704390a7f606bc8181e25c0ed4
languageName: node
linkType: hard

Expand Down Expand Up @@ -8345,7 +8347,7 @@ __metadata:
languageName: node
linkType: hard

"inherits@npm:2, inherits@npm:2.0.4, inherits@npm:^2.0.3, inherits@npm:^2.0.4, inherits@npm:~2.0.4":
"inherits@npm:2, inherits@npm:2.0.4, inherits@npm:^2.0.3, inherits@npm:^2.0.4, inherits@npm:~2.0.3, inherits@npm:~2.0.4":
version: 2.0.4
resolution: "inherits@npm:2.0.4"
checksum: 10c0/4e531f648b29039fb7426fb94075e6545faa1eb9fe83c29f0b6d9e7263aceb4289d2d4557db0d428188eeb449cc7c5e77b0a0b2c4e248ff2a65933a0dee49ef2
Expand Down Expand Up @@ -11242,6 +11244,15 @@ __metadata:
languageName: node
linkType: hard

"queue@npm:6.0.2":
version: 6.0.2
resolution: "queue@npm:6.0.2"
dependencies:
inherits: "npm:~2.0.3"
checksum: 10c0/cf987476cc72e7d3aaabe23ccefaab1cd757a2b5e0c8d80b67c9575a6b5e1198807ffd4f0948a3f118b149d1111d810ee773473530b77a5c606673cac2c9c996
languageName: node
linkType: hard

"quick-lru@npm:^4.0.1":
version: 4.0.1
resolution: "quick-lru@npm:4.0.1"
Expand Down