fix(metro): replace unmaintained image-size dependency

[ufolux]

Summary

Metro only needs dimensions for its explicitly supported asset formats. The generic image-size detector also enables unrelated parsers, including JXL, HEIF, JP2, and ICNS parsers affected by CVE-2025-71329 and CVE-2025-71330.

This change:

• replaces the archived image-size dependency with an exact probe-image-size@7.3.0 dependency
• selects one parser from probe-image-size/sync based on Metro's existing asset type allowlist instead of auto-detecting content
• adds a small Metro-owned KTX1/KTX2 header parser
• rejects malformed and format-mismatched image assets with a contextual error
• reuses the first asset Buffer already read for hashing and removes image-size from yarn.lock

Changelog: [Fix] Select image parsers by Metro asset type and replace the unmaintained image-size dependency

Fixes #1607
Refs #1762

Test plan

• ./node_modules/.bin/flow check
• node node_modules/eslint/bin/eslint.js . --cache
• node node_modules/prettier/bin/prettier.cjs --check .
• node scripts/build.js
• node node_modules/jest/bin/jest.js --runInBand --silent — 141/141 suites passed; 2564 tests passed, 14 skipped, 0 failed
• Added regression coverage for PNG, JPEG, GIF, BMP, WebP, PSD, SVG, TIFF, KTX1, KTX2, format mismatches, truncated headers, and malformed JXL/HEIF/ICNS zero-length payloads.

[meta-cla]

Hi @ufolux!

Thank you for your pull request and welcome to our community.

Action Required

In order to merge any pull request (code, docs, etc.), we require contributors to sign our Contributor License Agreement, and we don't seem to have one on file for you.

Process

In order for us to review and merge your suggested changes, please sign at https://code.facebook.com/cla. If you are contributing on behalf of someone else (eg your employer), the individual CLA may not be sufficient and your employer may need to sign the corporate CLA.

Once the CLA is signed, our tooling will perform checks and validations. Afterwards, the pull request will be tagged with CLA signed. The tagging process may take up to 1 hour after signing. Please give it that time before contacting us about it.

If you have received this in error or have any questions, please contact us at cla@meta.com. Thanks!

[meta-cla]

Thank you for signing our Contributor License Agreement. We can now accept your code for this (and any) Meta Open Source project. Thanks!

[robhogan]

unmaintained image-size dependency
replaces the archived image-size dependency

AFAICT, only the GitHub repository is archived, because it's moved to Codeberg. The npm dependency is not marked deprecated.

GHSA-5p2g-fcmc-qvqq and GHSA-w3rx-r6r6-pgpr

Metro only processes local image assets, so an attacker would need to already have write access to your file system in order to exploit these, so the attack vector mentioned doesn't exist for Metro - I don't think a relevant vulnerability is demonstrated.

Those concerns aside, this isn't objectively a good swap - it's almost three times bigger, requires Metro to own KTX parsing because it doesn't support it, and it introduces new points of failure in the form of new dependencies.

https://pkg-size.dev/image-size - 1 package, 378KB
https://pkg-size.dev/probe-image-size - 11 packages totalling 935KB