Track image-size advisories: upstream is archived, Docusaurus needs to replace it #482

Two of the three findings in code scanning alert #120 are image-size, and unlike the third they cannot be fixed here. This issue keeps them visible rather than hiding them behind a suppression.

Both are infinite-loop denial of service: a box with a zero-valued size field in the JXL/HEIF parsers, and a zero-valued entry length in the ICNS parser. The offset never advances and the loop never exits.

Why we cannot fix it here

image-size reaches us transitively, and there is nothing to upgrade to:

• It arrives through @docusaurus/mdx-loader@3.10.2, which requires ^2.0.2.
• Both advisories record last_affected: 2.0.2, not a fixed version. 2.0.2 is the newest release on npm.
• Dependabot agrees independently — alerts Provide test coverage for flow protocols #17 and Deploy to Quay.io container registry #18 both carry first_patched_version: null.
• Docusaurus is already on its current release, 3.10.2.
• The upstream repository is archived. image-size/image-size was archived with its last push on 2026-06-03, a week before these advisories were published on 2026-06-10. No fix is coming.

What actually unblocks this

Docusaurus has to stop depending on it: meta/docusaurus#12231 — "Replace unmaintained dependency image-size with active CVEs", open since 2026-07-07, still status: needs triage.

When that lands and a Docusaurus release carries it, bumping @docusaurus/* in docs/package.json closes this issue and takes Scorecard's Vulnerabilities check to 10/10.

Exposure, so nobody panics reading the alert

Low. These are build-time dependencies of the static documentation site:

• The Dockerfile references no node or npm, and the jar is Java only. Nothing here ships in a riptide release.
• image-size parses images committed to this repository, which arrive through a reviewed pull request on a protected branch. The input is not attacker-controlled.
• The realistic worst case is a hung make docs build, not anything reachable in a running riptide.

Alternatives considered

Suppressing both IDs in docs/osv-scanner.toml would take the check to 10/10 today, and Scorecard does honor that file when it sits next to the manifest. It was rejected because a suppression on a permanently unfixed advisory tends to outlive the reason for it, and because 8/10 with a visible, explained finding is more honest than 10/10 with a hidden one.

That trade-off is worth revisiting if Docusaurus #12231 stalls for a long time.

How to pick this up

1. Check whether Replace unmaintained dependency image-size with active CVEs (CVSS 7.5) meta/docusaurus#12231 has landed and shipped in a release.
2. If so, bump @docusaurus/* in docs/package.json, run npm install in docs/, and confirm image-size is gone from docs/package-lock.json.
3. Verify with make docs.
4. Confirm the alert clears on the next Scorecard run.

If it has not landed, the useful contribution is upstream rather than here.

Related: #475 (OpenSSF badge), #481 (the nanoid half of the same alert).