Metro depends transitively on image-size for asset dimension detection during bundling. The image-size GitHub repository was archived by its maintainer on June 3, 2026.
The maintainer's note on the repo explains the reasoning:
"Archiving this repo, because I don't want to deal with the same LLM generated 'security advisory' about an infinite loop over and over again... At some point I'll revive this project to address actual issues, but on Codeberg. This repo on github will not be updated."
This isn't a report about a specific unresolved CVE — the maintainer has been vocal about fatigue with automated/low-signal security advisories for this package, and there's no indication the underlying reports are considered practically significant by the maintainer. Flagging this here purely as a dependency health note, not as a request to action any specific advisory (and not intended to summon or reference the image-size maintainer directly, per their stated preference).
Why this is worth tracking for Metro
The GitHub repo is now read-only; future development, if any, will happen on Codeberg per the maintainer's note.
Automated dependency scanners (Snyk, npm audit, Dependabot) may continue to flag image-size findings against downstream consumers of Metro, with no GitHub-side release path to resolve them even if a fix is warranted.
Worth Metro's maintainers being aware of this status ahead of time, in case a future need arises to pin, fork, or replace this dependency.
Ask
No urgent action requested. Flagging for visibility only — e.g., useful to know if the Metro team is already tracking image-size's status, or has thoughts on whether a dependency change is warranted down the line.
Environment
react-native@0.86.0
@react-native/community-cli-plugin@0.86.0
metro@0.84.4
image-size@1.2.1
Metro depends transitively on image-size for asset dimension detection during bundling. The image-size GitHub repository was archived by its maintainer on June 3, 2026.
The maintainer's note on the repo explains the reasoning:
"Archiving this repo, because I don't want to deal with the same LLM generated 'security advisory' about an infinite loop over and over again... At some point I'll revive this project to address actual issues, but on Codeberg. This repo on github will not be updated."
This isn't a report about a specific unresolved CVE — the maintainer has been vocal about fatigue with automated/low-signal security advisories for this package, and there's no indication the underlying reports are considered practically significant by the maintainer. Flagging this here purely as a dependency health note, not as a request to action any specific advisory (and not intended to summon or reference the image-size maintainer directly, per their stated preference).
Why this is worth tracking for Metro
The GitHub repo is now read-only; future development, if any, will happen on Codeberg per the maintainer's note.
Automated dependency scanners (Snyk, npm audit, Dependabot) may continue to flag image-size findings against downstream consumers of Metro, with no GitHub-side release path to resolve them even if a fix is warranted.
Worth Metro's maintainers being aware of this status ahead of time, in case a future need arises to pin, fork, or replace this dependency.
Ask
No urgent action requested. Flagging for visibility only — e.g., useful to know if the Metro team is already tracking image-size's status, or has thoughts on whether a dependency change is warranted down the line.
Environment
react-native@0.86.0
@react-native/community-cli-plugin@0.86.0
metro@0.84.4
image-size@1.2.1