image-size dependency has three high-severity CVEs with no fixes

[resolute-oil]

The problem

image-size has three reported high-severity CVEs with no upstream fix (the project appears to be archived).

# npm audit report

image-size  *
Severity: high
image-size: ICNS parser allows denial of service through an infinite loop - https://github.com/advisories/GHSA-w3rx-r6r6-pgpr
image-size: JXL and HEIF parsers allow denial of service through infinite loops - https://github.com/advisories/GHSA-5p2g-fcmc-qvqq
No fix available
node_modules/image-size
  @percy/cli-upload  *
  Depends on vulnerable versions of image-size
  node_modules/@percy/cli-upload
    @percy/cli  *
    Depends on vulnerable versions of @percy/cli-upload
    node_modules/@percy/cli

3 high severity vulnerabilities

Environment

• Node version: v26.5.0 (locally)
• @percy/cli version: 1.32.5
• Version of Percy SDK you’re using: gem "percy-capybara", "~> 5.0"
• If needed, a build or snapshot ID:
• OS version: MacOS / Ubuntu (GitHub CI)
• Type of shell command-line [interface]:

Details

There's not much more to describe other than image-size has a few vulnerabilities that are causing CI jobs to fail.

Debug logs

See above.

Code to reproduce issue

$ npm audit