fix(deps): resolve image-size dependabot alerts

[mattinannt]

Summary

Follow-up to #83. Resolves the newly surfaced Dependabot alerts that have an upstream fix.

Fixed

• image-size (high) — GHSA-5p2g-fcmc-qvqq (JXL/HEIF parsers) and GHSA-w3rx-r6r6-pgpr (ICNS parser): infinite-loop DoS. Pulled in via expo > @expo/metro > metro. Added a pnpm override to 2.0.4 (metro pins ^1.0.2). Verified metro's usage (require("image-size").default(buffer)) still works with the v2 CJS build, and the playground Android/iOS bundles build.

Not fixable yet (no patched release exists upstream; npm latest is still a vulnerable version)

• node-forge 1.4.0 (high) — GHSA-86w9-cpqp-85rv, via expo > @expo/cli. Build-time CLI tooling only.
• braces 3.0.3 (high) — GHSA-vfj7-8cjw-p6xm, via metro-file-map > micromatch. Dev/build tooling only.
• sprintf-js 1.0.3 (moderate) — GHSA-hp3w-g68c-fv3c, via babel-jest > ... > js-yaml > argparse. Dev/test tooling only.

All three are transitive dependencies of the playground app only; none ship in @formbricks/react-native. They need to be re-checked once upstream releases patches.

Test plan

Ran locally:

• pnpm lint
• pnpm check-types
• pnpm test
• pnpm build
• pnpm audit: 5 → 3 remaining (all without upstream fix)

🤖 Generated with Claude Code

https://claude.ai/code/session_011gKMnnTvrcVs5xiJttUQ7c

---

Generated by Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 6bd00146-9fd3-4557-9083-8a7b914fa4fd

---

📥 Commits

Reviewing files that changed from the base of the PR and between 5ba39dd and 146eea0.

---

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

---

📒 Files selected for processing (1)

• package.json

---

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

---

Walkthrough

The pnpm overrides configuration now pins image-size to version 2.0.4.

Priority: ⬆️ High

Merge Risk: ⚪ Minimal · up to 146ee

The image-size override and lockfile are aligned; this change is ready to merge after normal checks.

Pre-merge checks | 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description check		The description directly explains the image-size override, the resolved security alerts, remaining alerts, and validation performed.
Title check		The title clearly and concisely identifies the dependency fix for the image-size Dependabot alerts.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}