Track image-size advisories: upstream is archived, Docusaurus needs to replace it

Open
  • Is something wrong?
#482 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Quiet
Tech stack
javascript
Domain
documentation, security

Research direction

Check whether facebook/docusaurus#12231 has landed and shipped. If so, update the @docusaurus/* dependencies in docs/package.json, run npm install in docs/, and confirm image-size is absent from docs/package-lock.json. Run make docs and verify that the alert clears on the next Scorecard run.

Written by the indexing model from the issue text.

Description

dependencies help wanted javascript priority: low

Two of the three findings in code scanning alert #120 are image-size, and unlike the third they cannot be fixed here. This issue keeps them visible rather than hiding them behind a suppression.

Advisory Package Installed Patched version
GHSA-5p2g-fcmc-qvqq (CVE-2025-71329) image-size 2.0.2 none
GHSA-w3rx-r6r6-pgpr (CVE-2025-71330) image-size 2.0.2 none

Both are infinite-loop denial of service: a box with a zero-valued size field in the JXL/HEIF parsers, and a zero-valued entry length in the ICNS parser. The offset never advances and the loop never exits.

Why we cannot fix it here

image-size reaches us transitively, and there is nothing to upgrade to:

  • It arrives through @docusaurus/[email protected], which requires ^2.0.2.
  • Both advisories record last_affected: 2.0.2, not a fixed version. 2.0.2 is the newest release on npm.
  • Dependabot agrees independently — alerts #17 and #18 both carry first_patched_version: null.
  • Docusaurus is already on its current release, 3.10.2.
  • The upstream repository is archived. image-size/image-size was archived with its last push on 2026-06-03, a week before these advisories were published on 2026-06-10. No fix is coming.

What actually unblocks this

Docusaurus has to stop depending on it: facebook/docusaurus#12231 — "Replace unmaintained dependency image-size with active CVEs", open since 2026-07-07, still status: needs triage.

When that lands and a Docusaurus release carries it, bumping @docusaurus/* in docs/package.json closes this issue and takes Scorecard's Vulnerabilities check to 10/10.

Exposure, so nobody panics reading the alert

Low. These are build-time dependencies of the static documentation site:

  • The Dockerfile references no node or npm, and the jar is Java only. Nothing here ships in a riptide release.
  • image-size parses images committed to this repository, which arrive through a reviewed pull request on a protected branch. The input is not attacker-controlled.
  • The realistic worst case is a hung make docs build, not anything reachable in a running riptide.

Alternatives considered

Suppressing both IDs in docs/osv-scanner.toml would take the check to 10/10 today, and Scorecard does honor that file when it sits next to the manifest. It was rejected because a suppression on a permanently unfixed advisory tends to outlive the reason for it, and because 8/10 with a visible, explained finding is more honest than 10/10 with a hidden one.

That trade-off is worth revisiting if Docusaurus #12231 stalls for a long time.

How to pick this up

  1. Check whether facebook/docusaurus#12231 has landed and shipped in a release.
  2. If so, bump @docusaurus/* in docs/package.json, run npm install in docs/, and confirm image-size is gone from docs/package-lock.json.
  3. Verify with make docs.
  4. Confirm the alert clears on the next Scorecard run.

If it has not landed, the useful contribution is upstream rather than here.

Related: #475 (OpenSSF badge), #481 (the nanoid half of the same alert).

Dominant language
Java
Stars
2
Forks
0
Avg merge
1d 1h
Merged PRs (30d)
52

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Riptide-Labs/riptide

All issues in Riptide-Labs/riptide

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.