[MelvinBot]

Details

Overrides transitive image-size 1.0.2 → 2.0.4 to fix GHSA-w3rx-r6r6-pgpr (ICNS infinite-loop DoS, patched in 2.0.3). No 1.x release is patched. Drops the now-unused queue dep from the lockfile.

Usage: Not used by this library's code. It's only pulled in by metro (via the react-native peer dep) in our local dev install; metro never runs here (build is tsc + babel). Nothing ships to consumers.

Lockfile was edited by hand (registry metadata) since npm install wasn't available in my environment; CI's npm ci validates it.

Change Log

• 2.0.4 — validate image count in ICO/CUR files; more tests
• 2.0.3 — fix infinite loops (the CVE fix); update build tooling
• 2.0.2 — fix DoS via crafted payloads
• 2.0.0 — dual CJS/ESM, Uint8Array instead of Buffer, no dependencies, drops sync file API
• 1.2.0 / 1.1.0 — JPEG-XL, KTX2, AVIF/HEIC/HEIF support

Related Issues

$ https://github.com/Expensify/Expensify/issues/695884

Manual Tests

1. npm ci succeeds; npm ls image-size shows 2.0.4 only.
2. npm run build, npm run ts, npx eslint src pass.
3. Confirm the Dependabot alert closes after merge.

Linked PRs

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[blimpich]

I have read the CLA Document and I hereby sign the CLA

[blimpich]

@MelvinBot merge in main

[blimpich]

Closing: react-native-x-maps is unused and is being archived in https://github.com/Expensify/Expensify/issues/695996.

– written by Claude on Ben's behalf