From 146eea0595447179c179e118204338f8ed2f2307 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 12 Oct 2026 14:30:59 +0000
Subject: [PATCH] fix(deps): override image-size to 2.0.4 to resolve high
 dependabot alerts

Fixes GHSA-5p2g-fcmc-qvqq and GHSA-w3rx-r6r6-pgpr (image-size DoS via
infinite loop in JXL/HEIF/ICNS parsers), pulled in transitively via
expo > @expo/metro > metro.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011gKMnnTvrcVs5xiJttUQ7c
---
 package.json   |  1 +
 pnpm-lock.yaml | 20 ++++++--------------
 2 files changed, 7 insertions(+), 14 deletions(-)

diff --git a/package.json b/package.json
index d013fb6..c476885 100644
--- a/package.json
+++ b/package.json
@@ -24,6 +24,7 @@
       "brace-expansion@5": "5.0.12",
       "browserslist": "4.28.9",
       "compression": "1.8.2",
+      "image-size": "2.0.4",
       "js-yaml@3": "3.15.2",
       "js-yaml@4": "4.3.2",
       "nanoid@3": "3.3.19",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 8689656..ff5743e 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -11,6 +11,7 @@ overrides:
   brace-expansion@5: 5.0.12
   browserslist: 4.28.9
   compression: 1.8.2
+  image-size: 2.0.4
   js-yaml@3: 3.15.2
   js-yaml@4: 4.3.2
   nanoid@3: 3.3.19
@@ -1909,9 +1910,9 @@ packages:
     resolution: {integrity: sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==}
     engines: {node: '>= 4'}
 
-  image-size@1.2.1:
-    resolution: {integrity: sha512-rH+46sQJ2dlwfjfhCyNx5thzrv+dtmBIhPHk0zgRUukHzZ/kRueTJXoYYsclBaKcSMBWuGbOFXtioLpzTb5euw==}
-    engines: {node: '>=16.x'}
+  image-size@2.0.4:
+    resolution: {integrity: sha512-QRUkFFsRV/6fuESxb9Vkq+a0LkSrgKXuc2NEqfikiXxxN/G3tjWt5EVUlMaImRBZRZK/jRBEbYvpPYZL8t08Zw==}
+    engines: {node: '>=18'}
     hasBin: true
 
   imurmurhash@0.1.4:
@@ -2492,9 +2493,6 @@ packages:
   queue-microtask@1.2.3:
     resolution: {integrity: sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==}
 
-  queue@6.0.2:
-    resolution: {integrity: sha512-iHZWu+q3IdFZFX36ro/lKBkSvfkztY5Y7HMiPlOUjhupPcG2JMfst2KKEpu5XndviX/3UhFbRngUPNKtgvtZiA==}
-
   range-parser@1.2.1:
     resolution: {integrity: sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg==}
     engines: {node: '>= 0.6'}
@@ -5407,9 +5405,7 @@ snapshots:
 
   ignore@5.3.2: {}
 
-  image-size@1.2.1:
-    dependencies:
-      queue: 6.0.2
+  image-size@2.0.4: {}
 
   imurmurhash@0.1.4: {}
 
@@ -5834,7 +5830,7 @@ snapshots:
       flow-enums-runtime: 0.0.6
       graceful-fs: 4.2.11
       hermes-parser: 0.32.0
-      image-size: 1.2.1
+      image-size: 2.0.4
       invariant: 2.2.4
       jest-worker: 29.7.0
       jsc-safe-url: 0.2.4
@@ -6051,10 +6047,6 @@ snapshots:
 
   queue-microtask@1.2.3: {}
 
-  queue@6.0.2:
-    dependencies:
-      inherits: 2.0.4
-
   range-parser@1.2.1: {}
 
   react-devtools-core@6.1.5: