fix(deps): alias image-size to image-size-next@1.2.2 (CVE-2025-71329/71330)

[lcf2212dev]

Why this PR

@haul-bundler/core is the Haul bundler core (React Native, Metro-era webpack). Default master lists runtime image-size@^0.8.3 in packages/haul-core (0.x → 1.x / Metro CJS pin) so asset transformers can read PNG/JPG dimensions. Other workspace packages are unchanged.

Published @haul-bundler/core@0.23.0 still depends on image-size@^0.8.3 (dependencies). Upstream image-size is archived. That coordinate remains affected by:

• CVE-2025-71329 / GHSA-5p2g-fcmc-qvqq — DoS via infinite loop on JXL/HEIF/JP2 zero-size boxes
• CVE-2025-71330 / GHSA-w3rx-r6r6-pgpr — DoS via infinite loop on ICNS zero entry length

There is no patched release on the original package name. npm audit fix cannot rename the coordinate. This is a follow-up to #770 with a one-line alias so installs stop fetching the vulnerable tarball.

Change

Alias the published 1.x runtime dependency in packages/haul-core/package.json:

- "image-size": "^0.8.3"
+ "image-size": "npm:image-size-next@1.2.2"

Call sites left untouched:

• packages/haul-core/typings/image-size/index.d.ts:1 declare module 'image-size' {
• packages/haul-core/src/webpack/loaders/assetLoader.ts:2 import { imageSize } from 'image-size';

image-size-next@1.2.2 is a MIT community fork with the same 1.x public API. Compare: lcf2212dev/image-size-next@v1.2.1...v1.2.2

This is the 1.x pin (CJS default-export require('image-size') / import sizeOf from 'image-size' (0.x/1.x). Do not use image-size-next@2.1.1 here (ESM+CJS 2.x named imageSize export).)

Note: image-size-next@1.2.2 declares engines.node >= 16. This package currently lists engines.node >=10.x. If you still need older Node, vendoring the size helper is the alternative; the original image-size line has no patched tarball on any Node version.

Hub: lcf2212dev/image-size-next#3

I maintain image-size-next and am not affiliated with the original image-size author, nor with this project. Happy to drop the alias if you prefer vendoring the size helper.

Test plan

• install resolves image-size → image-size-next@1.2.2
• existing require/import of image-size needs no source edits
• image width/height behaviour on the call sites above is unchanged