fix(mdx-loader): replace image-size with measureImage hook

[kennym]

Pre-flight checklist

• I have read the Contributing Guidelines on pull requests.
• If this is a code change: I have written unit tests and/or added dogfooding pages to fully verify the new behavior.
• If this is a new API or substantial change: the PR has an accompanying issue (closes Replace unmaintained dependency image-size with active CVEs (CVSS 7.5) #12231). Working plan posted on the issue; this is a draft so maintainers can review the approach before it is marked ready. The previous swap-only attempt is break(mdx-loader): replace unmaintained image-size dependency with image-dimensions #12235.
• A significant portion of this PR was authored with AI assistance (Cursor), per CONTRIBUTING.md — AI-assisted PRs. I reviewed the design against Replace unmaintained dependency image-size with active CVEs (CVSS 7.5) #12231 / break(mdx-loader): replace unmaintained image-size dependency with image-dimensions #12235, ran the tests listed below, and am accountable for the code.

Motivation

@docusaurus/mdx-loader depends on archived image-size@^2.0.2 (CVE-2025-71329 / CVE-2025-71330). There is no published patched release.

#12235 replaced it with image-dimensions only. That drops SVG (unsupported by that library) and has no escape hatch for long-tail formats.

This draft follows the markdown.hooks pattern from #11283:

• Add optional siteConfig.markdown.hooks.measureImage({ imagePath }).
• Default: SVG via a small local width/height/viewBox parser; raster via image-dimensions; on failure log and return null (no throw/catch).
• Remove image-size completely.
• Document that BMP/ICO/TIFF/PSD/JXL/ICNS are no longer auto-measured unless the site provides a custom hook.

Question for maintainers: is preserving SVG enough for a 3.x fix, or is dropping the long-tail formats v4-only?

Test Plan

• pnpm exec vitest run packages/docusaurus-mdx-loader/src/remark/transformImage packages/docusaurus/src/server/__tests__/configValidation.test.ts (Node 24)
• New coverage: SVG attributes, viewBox fallback, measureImage override, config validation
• Existing transformImage snapshots still emit width/height for PNG fixtures
• Showcase user.test.ts and admin/scripts/resizeImage.js no longer import image-size

Test links

Deploy preview: https://deploy-preview-12388--docusaurus-2.netlify.app/

Docs: website/docs/api/docusaurus.config.js.mdx (markdown.hooks.measureImage)

Related issues/PRs

• Closes Replace unmaintained dependency image-size with active CVEs (CVSS 7.5) #12231
• Alternative to break(mdx-loader): replace unmaintained image-size dependency with image-dimensions #12235
• Hook pattern from feat(core): Add siteConfig.markdown.hooks, deprecate siteConfig.onBrokenMarkdownLinks #11283

[meta-cla]

Hi @kennym!

Thank you for your pull request and welcome to our community.

Action Required

In order to merge any pull request (code, docs, etc.), we require contributors to sign our Contributor License Agreement, and we don't seem to have one on file for you.

Process

In order for us to review and merge your suggested changes, please sign at https://code.facebook.com/cla. If you are contributing on behalf of someone else (eg your employer), the individual CLA may not be sufficient and your employer may need to sign the corporate CLA.

Once the CLA is signed, our tooling will perform checks and validations. Afterwards, the pull request will be tagged with CLA signed. The tagging process may take up to 1 hour after signing. Please give it that time before contacting us about it.

If you have received this in error or have any questions, please contact us at cla@meta.com. Thanks!

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	image-dimensions@​2.5.1

View full report

[netlify]

✅ [V2]

Built without sensitive environment variables

Name	Link
🔨 Latest commit	6f97dc4
🔍 Latest deploy log	https://app.netlify.com/projects/docusaurus-2/deploys/6a8d9963acc50100086baaa6
😎 Deploy Preview	https://deploy-preview-12388--docusaurus-2.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[meta-cla]

Thank you for signing our Contributor License Agreement. We can now accept your code for this (and any) Meta Open Source project. Thanks!

[kennym]

@slorber @Josh-Cena any feedback here?

[jeffersonlicet]

+1

[kennym]

@slorber @Josh-Cena sorry for following up again, but what is the hold up?

It's been 5 business days without a word.

We have a security SLA and this issue currently drags it down.

[kennym]

bump

[kennym]

@slorber @Josh-Cena friendly bump

[slorber]

It's been 5 business days without a word.

I'm sorry but this is how OSS works 🤷‍♂️

We have a security SLA and this issue currently drags it down.

Even if I merged this today, this is not really the plan for release in v3.x as a patch release.

The image-size vulnerabilities are only theoretical DoS vulnerabilities, not really impactful. You can safely ignore them.

We don't particularly want to release a breaking change in v3 for a vulnerability that is reported by broken security tooling (https://overreacted.io/npm-audit-broken-by-design/) and that nobody encounters in practice.

---

If you really care about a fix for a theoretical thing, it remains possible to ship it on your own and make it available for the community:

• Create a package that uses the exact same api as image-size (we only use ìmport {imageSizeFromFile} from 'image-size/fromFile') but uses image-dimension` under the hood
• Publish it to npm so that others can leverage it if they want
• Make your bundle resolve your package instead of image-size (alias with "image-size": "npm:my-wrapper-package")

---

Edit: an alternative to alias already exists. Not vetted; use this carefully. The maintainer has only ever published this package, so you must be cautious and check what's actually distributed (not just on GitHub, the actual code that runs)

https://github.com/lcf2212dev/image-size-next