Security: vulnerable dependency image-size (CVE-2025-71329/71330) — maintained drop-in available

Nobody has claimed this yet.

## Context

This package depends on npm **`image-size`**. Upstream is **archived** and the latest release (**2.0.2**) remains affected by:

- **CVE-2025-71329** — DoS via infinite loop (JXL/HEIF/JP2 zero-size boxes)
- **CVE-2025-71330** — DoS via infinite loop (ICNS zero entry length)

`npm audit fix` will **not** switch package names automatically.

## Maintained drop-in

Community MIT fork with the same public API as `image-size@2.0.2`:

- **npm:** https://www.npmjs.com/package/image-size-next (`image-size-next@2.1.0`)
- **GitHub:** https://github.com/lcf2212dev/image-size-next
- **Announcement:** https://github.com/lcf2212dev/image-size-next/blob/main/ANNOUNCE.md

Not affiliated with the original `image-size` maintainer — honest community fork only.

## Migration options

**A — Direct dependency**

```bash
npm install image-size-next
```

```diff
- import { imageSize } from 'image-size'
+ import { imageSize } from 'image-size-next'
```

**B — Force transitive resolution (npm 8.3+)**

```json
{
"overrides": {
"image-size": "npm:image-size-next@2.1.0"
}
}
```

## Ask

Happy to open a PR for **`appdmg-tf`** if useful. Thanks for maintaining open source.

cc @LinusU

Start by locating appdmg-tf's dependency manifest and checking whether image-size is used directly or transitively. Compare the existing usage with image-size-next@2.1.0, choose the direct dependency or npm override path, and verify that the package continues to build and behave as before.

Written by the indexing model from the issue text.