fix: resolve image-size to image-size-next (CVE-2025-71329/71330)

[lcf2212dev]

Summary

metro@^0.87.0 (pulled into this monorepo) depends on image-size@^1.0.2, which currently resolves to an archived / unmaintained package still affected by:

• CVE-2025-71329 — DoS infinite loop (JXL/HEIF/JP2 zero-size boxes)
• CVE-2025-71330 — DoS infinite loop (ICNS zero entry length)

This PR adds a Yarn resolutions entry so nested image-size installs resolve to the community MIT drop-in image-size-next@2.1.0 (same public API as image-size@2.x, drop-in for Metro’s usage), and updates yarn.lock accordingly.

• npm: https://www.npmjs.com/package/image-size-next
• GitHub: https://github.com/lcf2212dev/image-size-next

Not affiliated with the original image-size maintainer.

Relates to #57888

Changelog:

[GENERAL] [SECURITY] - Force resolution of vulnerable image-size to maintained image-size-next@2.1.0 (CVE-2025-71329 / CVE-2025-71330)

Test Plan:

• Confirmed with Yarn classic 1.22.x that "resolutions": { "image-size": "npm:image-size-next@2.1.0" } installs image-size-next@2.1.0 into the image-size slot used by Metro.
• yarn.lock updated to the published tarball + integrity for image-size-next@2.1.0.
• Recommend CI: full install + existing Metro/asset pipeline tests.

Notes for reviewers

• Longer-term fix may live in facebook/metro (change the direct dependency). This monorepo resolution unblocks RN consumers immediately.
• npm audit fix cannot rename packages; an override/resolution is required.

(Replaces closed PR #57894 — fresh branch with signed commit.)

[robhogan]

The root package.json / yarn.lock are not distributed to RN consumers (only contributors), so this doesn’t do what it claims to do. The right place to change Metro dependencies is Metro.

Just to be clear as well, the CVEs listed are audit noise - they pose no risk to RN / Metro users because Metro never loads images from untrusted sources.