Security: vulnerable dependency image-size (CVE-2025-71329/71330) — maintained drop-in available

## Context

This package depends on npm **`image-size`**. Upstream is **archived** and the latest release (**2.0.2**) remains affected by:

- **CVE-2025-71329** — DoS via infinite loop (JXL/HEIF/JP2 zero-size boxes)
- **CVE-2025-71330** — DoS via infinite loop (ICNS zero entry length)

`npm audit fix` will **not** switch package names automatically.

## Maintained drop-in

Community MIT fork with the same public API as `image-size@2.0.2`:

- **npm:** https://www.npmjs.com/package/image-size-next (`image-size-next@2.1.0`)
- **GitHub:** https://github.com/lcf2212dev/image-size-next
- **Announcement:** https://github.com/lcf2212dev/image-size-next/blob/main/ANNOUNCE.md

Not affiliated with the original `image-size` maintainer — honest community fork only.

## Migration options

**A — Direct dependency**

```bash
npm install image-size-next
```

```diff
- import { imageSize } from 'image-size'
+ import { imageSize } from 'image-size-next'
```

**B — Force transitive resolution (npm 8.3+)**

```json
{
"overrides": {
"image-size": "npm:image-size-next@2.1.0"
}
}
```

## Ask

Happy to open a PR for **`birken-react-native-community-image-editor`** if useful. Thanks for maintaining open source.

Start by inspecting package.json and searching for the imageSize import shown in the issue. Confirm whether the maintained image-size-next package preserves the current API and check the existing project validation commands. Done means the vulnerable image-size dependency is replaced or overridden without breaking the image editor's existing behavior.

索引モデルが issue の本文から書いたものです。