Track image-size advisories: upstream is archived, Docusaurus needs to replace it

[indigo423]

Two of the three findings in code scanning alert #120 are image-size, and unlike the third they cannot be fixed here. This issue keeps them visible rather than hiding them behind a suppression.

Advisory	Package	Installed	Patched version
GHSA-5p2g-fcmc-qvqq (CVE-2025-71329)	image-size	2.0.2	none
GHSA-w3rx-r6r6-pgpr (CVE-2025-71330)	image-size	2.0.2	none

Both are infinite-loop denial of service: a box with a zero-valued size field in the JXL/HEIF parsers, and a zero-valued entry length in the ICNS parser. The offset never advances and the loop never exits.

Why we cannot fix it here

image-size reaches us transitively, and there is nothing to upgrade to:

• It arrives through @docusaurus/mdx-loader@3.10.2, which requires ^2.0.2.
• Both advisories record last_affected: 2.0.2, not a fixed version. 2.0.2 is the newest release on npm.
• Dependabot agrees independently — alerts Provide test coverage for flow protocols #17 and Deploy to Quay.io container registry #18 both carry first_patched_version: null.
• Docusaurus is already on its current release, 3.10.2.
• The upstream repository is archived. image-size/image-size was archived with its last push on 2026-06-03, a week before these advisories were published on 2026-06-10. No fix is coming.

What actually unblocks this

Docusaurus has to stop depending on it: facebook/docusaurus#12231 — "Replace unmaintained dependency image-size with active CVEs", open since 2026-07-07, still status: needs triage.

When that lands and a Docusaurus release carries it, bumping @docusaurus/* in docs/package.json closes this issue and takes Scorecard's Vulnerabilities check to 10/10.

Exposure, so nobody panics reading the alert

Low. These are build-time dependencies of the static documentation site:

• The Dockerfile references no node or npm, and the jar is Java only. Nothing here ships in a riptide release.
• image-size parses images committed to this repository, which arrive through a reviewed pull request on a protected branch. The input is not attacker-controlled.
• The realistic worst case is a hung make docs build, not anything reachable in a running riptide.

Alternatives considered

Suppressing both IDs in docs/osv-scanner.toml would take the check to 10/10 today, and Scorecard does honor that file when it sits next to the manifest. It was rejected because a suppression on a permanently unfixed advisory tends to outlive the reason for it, and because 8/10 with a visible, explained finding is more honest than 10/10 with a hidden one.

That trade-off is worth revisiting if Docusaurus #12231 stalls for a long time.

How to pick this up

1. Check whether Replace unmaintained dependency image-size with active CVEs (CVSS 7.5) facebook/docusaurus#12231 has landed and shipped in a release.
2. If so, bump @docusaurus/* in docs/package.json, run npm install in docs/, and confirm image-size is gone from docs/package-lock.json.
3. Verify with make docs.
4. Confirm the alert clears on the next Scorecard run.

If it has not landed, the useful contribution is upstream rather than here.

Related: #475 (OpenSSF badge), #481 (the nanoid half of the same alert).

[indigo423]

Re-verified live today; nothing has changed upstream, and there is still no action available here.

@docusaurus/core latest is 3.10.2 — no newer release exists. The canary @docusaurus/mdx-loader still requires image-size ^2.0.2, which proves nothing has merged yet. npm image-size latest is 2.0.2 (2025-04-02), the upstream repo is archived: true (last push 2026-06-03), and both GHSAs still record last_affected: 2.0.2 with no fix, modified 2026-08-07. Lockfile sites: docs/package-lock.json:3623 and :10548-10554.

New since this issue was written: facebook/docusaurus#12388 "replace image-size with measureImage hook", opened 2026-08-25, still open with no reviews. #12235 remains open; #12234 is closed.

Suggest converting this to a watch rather than leaving it as actionable work, since there is nothing to do until upstream moves. The earliest machine-checkable signal is:

npm view @docusaurus/mdx-loader@canary dependencies.image-size

returning undefined. When that happens, the faster lever is the existing overrides block at docs/package.json:44-49 rather than waiting on a full Docusaurus bump.

No osv-scanner.toml exists in the repo, so there is currently no suppression mechanism recording why this advisory stays open.