fix(deps): alias image-size to image-size-next@2.1.1 (CVE-2025-71329/71330)

[lcf2212dev]

Why this PR

codeceptjs-resemblehelper is a CodeceptJS visual-diff helper (canonical repo codeceptjs/codeceptjs-resemblehelper). Default master pins runtime image-size@2.0.2 exactly and src/index.ts does const sizeOf = require("image-size") before ResembleJS. That is the 2.x line (image-size-next@2.1.1), not 1.2.2.

Published codeceptjs-resemblehelper@2.0.0 still depends on image-size@2.0.2 (dependencies). Upstream image-size is archived. That coordinate remains affected by:

• CVE-2025-71329 / GHSA-5p2g-fcmc-qvqq — DoS via infinite loop on JXL/HEIF/JP2 zero-size boxes
• CVE-2025-71330 / GHSA-w3rx-r6r6-pgpr — DoS via infinite loop on ICNS zero entry length

There is no patched release on the original package name. npm audit fix cannot rename the coordinate. This is a follow-up to #162 with a one-line alias so installs stop fetching the vulnerable tarball.

Change

Alias the published 2.x runtime dependency:

- "image-size": "2.0.2"
+ "image-size": "npm:image-size-next@2.1.1"

Call sites left untouched:

• src/index.ts:9 const sizeOf = require("image-size");

image-size-next@2.1.1 is a MIT community fork with the same 2.x public API. Compare: lcf2212dev/image-size-next@v2.0.2...v2.1.1

This is the 2.x pin (2.x named imageSize export (CJS also exposes exports.default / exports.imageSize). Do not use image-size-next@1.2.2 here (CJS 1.x default export / Metro line).)

Hub: lcf2212dev/image-size-next#3

I maintain image-size-next and am not affiliated with the original image-size author, nor with this project. Happy to drop the alias if you prefer vendoring the size helper.

Test plan

• install resolves image-size → image-size-next@2.1.1
• existing require/import of image-size needs no source edits
• image width/height behaviour on the call sites above is unchanged