[sec-check] image-size 2.0.2 vulnerable to 2 HIGH DoS advisories (GHSA-w3rx-r6r6-pgpr, GHSA-5p2g-fcmc-qvqq) — no patched release

## Security Finding

**Severity**: high
**Type**: CVE / dependency

`image-size@2.0.2` (transitive, docusaurus build chain) is affected by two HIGH-severity advisories with **no patched release available** (`<=2.0.2` vulnerable, no `first_patched_version`):

- [GHSA-w3rx-r6r6-pgpr](https://github.com/advisories/GHSA-w3rx-r6r6-pgpr) — ICNS parser: denial of service through infinite loop
- [GHSA-5p2g-fcmc-qvqq](https://github.com/advisories/GHSA-5p2g-fcmc-qvqq) — JXL and HEIF parsers: denial of service through infinite loop

## Impact

Build-time only: `image-size` runs during `npm run build` (docusaurus image plugins) against images committed to the repo. An attacker who can land a crafted ICNS/JXL/HEIF image in the repo (e.g. via a docs PR) could hang the CI build. No runtime/visitor impact on the deployed static site.

## Recommendation

1. No upstream fix exists yet — track the advisories and bump as soon as a patched `image-size` ships.
2. Until then, risk is bounded: only build images from reviewed PRs (default CI behavior). Optionally add a CI file-type allowlist for `static/img` (reject ICNS/JXL/HEIF, which the site does not use).

---
*Filed by sec-check agent (ACMM L6 — full mode)*

Start by reviewing the Docusaurus build chain and running npm run build to confirm where transitive image-size@2.0.2 processes images. Inspect static/img and the CI configuration for the suggested file-type allowlist, while tracking GHSA-w3rx-r6r6-pgpr and GHSA-5p2g-fcmc-qvqq. Done means documenting a patched dependency bump when available or agreeing and validating a mitigation.

Written by the indexing model from the issue text.