build(deps): patch development dependency DoS

package.json

@@ -31,9 +31,10 @@
     "format": "oxfmt --check .",
     "format:fix": "oxfmt .",
     "typecheck": "tsc --noEmit",
-    "test": "jest",
+    "test": "node tools/dependency-security-check.mjs && jest",
     "prepare": "pnpm run build",
     "release": "release-it",
+    "security:check": "node tools/dependency-security-check.mjs && pnpm audit --audit-level high",
     "expo-module": "expo-module"
   },
   "devDependencies": {

patches/image-size@1.2.1.patch

@@ -0,0 +1,48 @@
+diff --git a/dist/types/icns.js b/dist/types/icns.js
+index f2bfafef3723cb423b110304815e56e3f97f81e0..f7344cdaab5e31a23a64832ead7b5ba837e4831c 100644
+--- a/dist/types/icns.js
++++ b/dist/types/icns.js
+@@ -65,9 +65,12 @@ const ICON_TYPE_SIZE = {
+ };
+ function readImageHeader(input, imageOffset) {
+     const imageLengthOffset = imageOffset + ENTRY_LENGTH_OFFSET;
++    const imageLength = (0, utils_1.readUInt32BE)(input, imageLengthOffset);
++    if (imageLength < SIZE_HEADER)
++        throw new TypeError('Invalid ICNS entry length');
+     return [
+         (0, utils_1.toUTF8String)(input, imageOffset, imageLengthOffset),
+-        (0, utils_1.readUInt32BE)(input, imageLengthOffset),
++        imageLength,
+     ];
+ }
+ function getImageSize(type) {
+diff --git a/dist/types/utils.js b/dist/types/utils.js
+index 5224bbafe87551ac415cb3de234820ccc0ff6e2c..10eb100aefb42e684abf3305bb1b4de2a1463e02 100644
+--- a/dist/types/utils.js
++++ b/dist/types/utils.js
+@@ -49,10 +49,11 @@ function readUInt(input, bits, offset, isBigEndian) {
+ }
+ exports.readUInt = readUInt;
+ function readBox(input, offset) {
+-    if (input.length - offset < 4)
++    if (input.length - offset < 8)
+         return;
+-    const boxSize = (0, exports.readUInt32BE)(input, offset);
+-    if (input.length - offset < boxSize)
++    const declaredSize = (0, exports.readUInt32BE)(input, offset);
++    const boxSize = declaredSize === 0 ? input.length - offset : declaredSize;
++    if (boxSize < 8 || input.length - offset < boxSize)
+         return;
+     return {
+         name: (0, exports.toUTF8String)(input, 4 + offset, 8 + offset),
+@@ -67,9 +68,7 @@ function findBox(input, boxName, offset) {
+             break;
+         if (box.name === boxName)
+             return box;
+-        // Fix the infinite loop by ensuring offset always increases
+-        // If box.size is 0, advance by at least 8 bytes (the size of the box header)
+-        offset += box.size > 0 ? box.size : 8;
++        offset += box.size;
+     }
+ }
+ exports.findBox = findBox;

pnpm-workspace.yaml

@@ -1,3 +1,9 @@
+audit:
+  # image-size has no fixed release. The pnpm patch below fixes both advisories,
+  # and security:check exercises the patched parsers before audit runs.
+  ignore:
+    - GHSA-w3rx-r6r6-pgpr
+    - GHSA-5p2g-fcmc-qvqq
 minimumReleaseAge: 20160
 minimumReleaseAgeExclude:
   # Grandfather the exact lockfile from 2026-08-04. Future versions still have
@@ -37,6 +43,7 @@ minimumReleaseAgeExclude:
   - "magic-*"
   # Let the security fix through the global release-age gate.
   - brace-expansion@1.1.18
+  - nanoid@3.3.18
 # pnpm 11 no longer reads the `pnpm` key from package.json, and `overrides` has
 # no other home, so this file carries the old Yarn pins and scoped security
 # fixes. Yarn's `**/a/b` globs become pnpm's `a>b` selectors.
@@ -46,3 +53,5 @@ overrides:
   brace-expansion@<1.1.18: ^1.1.18
   brace-expansion@>=4.0.0 <5.0.9: ^5.0.9
   xcode>uuid: 11.1.1
+patchedDependencies:
+  image-size@1.2.1: patches/image-size@1.2.1.patch