Skip to content

update image-size to 2.0.2 to prevent CWE-835 #11061

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 2 commits into from
+6 −15
Closed

update image-size to 2.0.2 to prevent CWE-835 #11061

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d60a0cc
update image-size to 2.0.2 to prevent CWE-835
renebaudisch Apr 4, 2025
9445b38
update image-size to 2.0.2 to prevent CWE-835 in mdx-loader also
renebaudisch Apr 4, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,7 +104,7 @@
"eslint-plugin-react-hooks": "^4.6.0",
"eslint-plugin-regexp": "^1.15.0",
"husky": "^8.0.3",
"image-size": "^1.0.2",
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This will only upgrade our monorepo, not third-party Docusaurus sites

Our mdx-loader package should also upgrade to v2 otherwise this creates a dependency duplicate that we won't even use

Copy link
Author

@renebaudisch renebaudisch Apr 4, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've seen the fix on 1.2.1 but when I check out image-size node_modules folder there is 1.2.0 used:

image

I'm pretty sure you are totally right by what you are telling me, it's just tools that seek for vulnerabilities like snyk will list you because of this exploit and this give people a bad meaning if they do not understand fully what happens.

BTW, I do not have a CLA and I don't know if my organization wants to do this again, this has been a pain doing it for AMP decades ago, but I still updated mdx-loader and pushed it as you can see.

About third-party websites, I dunno understand I guess. Wouldn't this just lead to merge this PR to the next release so it would be fixed in 3.7.1 or 3.7.2 at least, so each consumer would just need to fetch and update?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If your site gets 1.2.0, then you can use your package manager features to upgrade the deps to latest compatible version, or fully re-generate the lockfile.

I technically can't merge a PR if the CLA is not signed

Wouldn't this just lead to merge this PR to the next release so it would be fixed in 3.7.1 or 3.7.2 at least, so each consumer would just need to fetch and update?

Users of v2.0 and v3.0 can already upgrade to image-size 1.2.1. If we merge this PR, we only prevent them from using an older version, but they can already upgrade the lib on their own.

"image-size": "^2.0.2",
"jest": "^29.7.0",
"jest-environment-jsdom": "^29.7.0",
"jest-serializer-ansi-escapes": "^3.0.0",
Expand Down
5 changes: 5 additions & 0 deletions yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9854,6 +9854,11 @@ image-size@^1.0.2:
dependencies:
queue "6.0.2"

image-size@^2.0.2:
version "2.0.2"
resolved "https://registry.yarnpkg.com/image-size/-/image-size-2.0.2.tgz#84a7b43704db5736f364bf0d1b029821299b4bdc"
integrity sha512-IRqXKlaXwgSMAMtpNzZa1ZAe8m+Sa1770Dhk8VkSsP9LS+iHD62Zd8FQKs8fbPiagBE7BzoFX23cxFnwshpV6w==

import-fresh@^3.2.1, import-fresh@^3.3.0:
version "3.3.0"
resolved "https://registry.yarnpkg.com/import-fresh/-/import-fresh-3.3.0.tgz#37162c25fcb9ebaa2e6e53d5b4d88ce17d9e0c2b"
Expand Down
Loading