fix(deps): pin image-size to 1.2.1 in the react-native e2e app

[devin-ai-integration]

Summary

Automated dependency-vulnerability remediation run for this repo. Only one finding was actionable this run; everything else was either already remediated on main, has no fix, or needs a major bump.

• Pins image-size to ^1.2.1 via npm overrides in the React Native e2e app, closing a High Wiz finding (CVE-2025-71319) against e2e/react-native/package-lock.json
• Manifest + lockfile only (3 lockfile lines); no source changes, no major bumps
• The root yarn.lock was already on image-size 1.2.1 via root resolutions, so only the standalone npm lockfile needed the pin
• Most open Dependabot alerts for this repo are stale (already fixed by the resolutions on main); the rest require major upgrades or have no patched version

How did you test this change?

Backend/tooling change, no UI. npm install in the react-native e2e app resolves image-size@1.2.1, and the monorepo yarn install + yarn build:sdk were unaffected (20/20 packages build).

Are there any deployment considerations?

No — the change is limited to an e2e example app's dev dependency tree.

Implementation details

Findings addressed

Package	Ecosystem	Current → Target	Severity	Age	Source(s)	Advisory
image-size (in e2e/react-native)	npm	1.2.0 → 1.2.1	High	~2.5 months	Wiz	CVE-2025-71319

Not addressed (require a major version bump)

• nanoid 4.0.2 → 5.1.16 (5.x is ESM-only)
• react-router 6.30.4 → 7.18.0; @opentelemetry/core 1.30.1 → 2.8.0; svelte 4.2.19 → 5.55.7; @nestjs/core 10.4.22 → 11.1.18; file-type 20.4.1 → 21.3.2; ts-deepmerge 2.0.7 → 8.0.0; markdown-it 12.3.2 → 14.2.0; fast-xml-parser 4.5.6 → 5.7.0; uuid (legacy 3.x/7.x/8.x/9.x copies) → 11.1.1; @angular/* 19.2.x → 20.3.27; pytest 8.3.5 → 9.0.3
• Java/Android build-time transitives from the Gradle toolchain (bcprov-jdk18on — the only Critical, netty-*, jackson-*, wire-runtime, jose4j, jdom2, grpc-netty, commons-io, protobuf-java): not declared in any manifest here and Maven Central is not reachable from the automation environment.

Not addressed (no patched version)

extract-zip, image-size CVE-2025-71329/71330 (affect all versions incl. 2.x), @angular/* advisories with no fix, apollo-server-core, react-router-dom 6.30.4.

Stale alerts (already fixed on main)

vite (6.4.3), next (15.5.22/16.2.12), sqlparse (0.6.0), image-size in root yarn.lock (1.2.1), markdown-it 14.3.0, @opentelemetry/core 2.10.0 — all pinned by root resolutions / lockfiles already.

Deferred: NuGet OTel bumps in e2e/dotnet4/cs/packages.config

OpenTelemetry.Api/Exporter.OpenTelemetryProtocol 1.11.2, Exporter.Zipkin/Extensions.Propagators 1.9.0 → 1.15.3 and Resources.Azure beta → 1.15.1-beta.1 are in-major bumps, but nuget.org is not reachable from the automation environment so a restore/build could not be validated; Dependabot PRs #513 / #509 / #496 already target them.

Verification

• Install: npm (react-native e2e app) ✅ / yarn (monorepo) ✅ — only the known @highlight-run/rrvideo puppeteer postinstall failure (Chrome CDN unreachable)
• Build: yarn build:sdk ✅ 20/20
• Tests: unchanged by this diff; the react-native e2e app is not part of yarn test or CI
• Lint/format: prettier --check ✅ on both changed files

Note: the Require additional human oversight on bot PRs check is action_required by design on bot-authored PRs and needs a human approval.

Link to Devin session: https://app.devin.ai/sessions/4f3892ef6ba94c30abfeafe43b95a6e9

---

Note

Overview
Addresses CVE-2025-71319 by forcing transitive image-size from 1.2.0 → 1.2.1 in the React Native e2e example, which uses its own npm lockfile instead of the monorepo yarn resolutions.

Adds an overrides entry in e2e/react-native/package.json and updates package-lock.json accordingly. No application source changes.

^{Reviewed by Cursor Bugbot for commit 7870763. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring