Replace unmaintained dependency image-size with active CVEs (CVSS 7.5)

Have you read the Contributing Guidelines on issues?

• I have read the Contributing Guidelines on issues.

Prerequisites

• I'm using the latest version of Docusaurus.
• I have tried the npm run clear or yarn clear command.
• I have tried rm -rf node_modules yarn.lock package-lock.json and re-installing packages.
• I have tried creating a repro with https://new.docusaurus.io.
• I have read the console error message carefully (if applicable).

Description

MDX Loader pulls in image-size. This dependency is now archived, see https://github.com/image-size/image-size#tired-maintainer-doesnt-want-your-slop

Two active CVES: CVE-2025-71329, CVE-2025-71330 CVE CWE: 835

See https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities for practical info.

I image there will be an alternative fork out there somewhere, or another util that could be used.

Reproducible demo

No response

Steps to reproduce

$ yarn why image-size
yarn why v1.22.22
[1/4]   Why do we have the module "image-size"...?
[2/4]   Initialising dependency graph...
[3/4]   Finding dependency...
[4/4]   Calculating file sizes...
=> Found "[email protected]"
info Reasons this module exists
   - "@docusaurus#core#@docusaurus#mdx-loader" depends on it
   - Hoisted from "@docusaurus#core#@docusaurus#mdx-loader#image-size"
info Disk size without dependencies: "748KB"
info Disk size with unique dependencies: "748KB"
info Disk size with transitive dependencies: "748KB"
info Number of shared dependencies: 0

Expected behavior

Less CVEs in my pipelines ;(

Actual behavior

2 CVEs in my pipeline :(

Your environment

Self-service

• I'd be willing to fix this bug myself.