chore(deps): drop the archived image-size dependency by waleedlatif1 · Pull Request #6485 · simstudioai/sim

waleedlatif1 · 2026-08-10T05:54:26Z

Summary

Removes the image-size dependency, which is archived upstream and carries two unpatched high-severity DoS advisories (Dependabot feat(mistral-OCR): added mistral tool and block for parsing pdfs #217/feat(mistal-ocr): added file upload to mistal ocr tool in production #218 — GHSA-w3rx-r6r6-pgpr, GHSA-5p2g-fcmc-qvqq). Both list no patched version, so there is nothing to bump to.
Its only consumer was readOgImageDimensions in lib/content/registry-factory.ts, which probes intrinsic dimensions of repo-committed OG covers under public/. It now uses sharp — already a direct dependency, already used server-side, and a Next.js default server-external package — instead of a third-party parser.
The vulnerable parsers were ICNS/JXL/HEIF, formats this app never reads, so real-world exposure was nil. Dropping the dep resolves the alerts outright rather than dismissing them.

Net effect is a smaller tree: one dependency gone, ~10 lines changed, no new parsing code to own.

Verification

Diffed sharp against image-size@2.0.2 over every file in apps/sim/public (208 images):

0 disagreements on every raster format — JPEG, PNG, WebP, GIF.
3 SVGs differ by exactly 0.75× (sharp applies 72/96 DPI scaling; image-size reads the raw attribute) and favicon.ico is unsupported by sharp. None is an og:image, and neither SVG nor ICO is accepted by the social crawlers.

All 40 ogImage entries across blog and library resolve to real files with readable dimensions — no post changes behavior.

Notes

pptxgenjs still pulls image-size@1.2.1 transitively, but it's a sandbox-bundle dep that never reaches those parsers, and no fixed version exists to move it to.
sharp.metadata() parses headers only; it does not decode pixels.

Type of Change

Bug fix (security)

Testing

New og-image.test.ts guards the content invariant: every local ogImage must exist, expose dimensions, and be a crawler-accepted format. 41 tests.
Mutation-checked both branches — pointing a cover at an SVG and deleting a cover each turn it red. The format assertion exists because the mutation showed a dimensions-only check passes on SVG.
bun run lint, bun run type-check, and bun run lint:check clean.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

vercel · 2026-08-10T05:54:32Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 10, 2026 6:07am

cursor · 2026-08-10T05:54:38Z

PR Summary

Low Risk
Security-focused dependency swap on existing OG metadata probing with added content tests; no auth, payment, or core runtime path changes.

Overview
Removes the direct image-size dependency (archived, unpatched DoS advisories) and reads local Open Graph cover dimensions in readOgImageDimensions via sharp.metadata() instead, with a warning when width/height cannot be read.

Adds og-image.test.ts so every local blog/library ogImage file exists, has readable dimensions, and uses a crawler-safe raster format (jpeg/png/webp/gif)—not SVG, which can pass dimension checks but break social previews.

^{Reviewed by Cursor Bugbot for commit e53b246. Configure here.}

greptile-apps · 2026-08-10T05:57:07Z

Greptile Summary

The PR removes the direct archived image-size dependency and uses the existing server-side sharp dependency to read dimensions for committed OG images.

Replaces imageSize(buffer) with asynchronous sharp(buffer).metadata().
Adds coverage ensuring local OG images exist, have dimensions, and use crawler-compatible formats.
Updates the application manifest and Bun lockfile to remove the direct dependency while retaining its transitive version.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/lib/content/registry-factory.ts	Replaces the local OG-image metadata parser with the existing, deployment-packaged `sharp` dependency while preserving fallback behavior.
apps/sim/lib/content/og-image.test.ts	Adds Node-based invariant tests for local OG-image existence, dimensions, and crawler-supported formats.
apps/sim/package.json	Removes the archived direct `image-size` dependency.
bun.lock	Removes the direct `image-size@2.0.2` resolution while preserving the transitive `image-size@1.2.1` dependency required by `pptxgenjs`.

_{Reviews (2): Last reviewed commit: "improvement(content): read OG dimensions..." | Re-trigger Greptile}

…dable

…ke parser

waleedlatif1 · 2026-08-10T06:07:59Z

@greptile

waleedlatif1 · 2026-08-10T06:08:02Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit e53b246. Configure here.}

chore(deps): drop the archived image-size dependency

0fafe0c

waleedlatif1 requested a review from a team as a code owner August 10, 2026 05:54

vercel Bot deployed to Preview August 10, 2026 05:59 View deployment

improvement(content): cover GIF and warn when OG dimensions are unrea…

14448a7

…dable

vercel Bot temporarily deployed to Preview August 10, 2026 06:00 Inactive

improvement(content): read OG dimensions via sharp instead of a bespo…

e53b246

…ke parser

vercel Bot temporarily deployed to Preview August 10, 2026 06:07 Inactive

cursor Bot reviewed Aug 10, 2026

View reviewed changes

waleedlatif1 merged commit 4228b04 into staging Aug 10, 2026
31 checks passed

waleedlatif1 deleted the worktree-image-size-dos-fix branch August 10, 2026 06:14

waleedlatif1 mentioned this pull request Aug 10, 2026

v0.7.66: provenance logs, nuqs consolidation #6487

Merged

Navigation Menu

Uh oh!

chore(deps): drop the archived image-size dependency - #6485

chore(deps): drop the archived image-size dependency#6485
waleedlatif1 merged 3 commits into
stagingfrom
worktree-image-size-dos-fix

waleedlatif1 commented Aug 10, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Aug 10, 2026 •

edited

Loading

Uh oh!

cursor Bot commented Aug 10, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Aug 10, 2026 •

edited

Loading

Important Files Changed

Uh oh!

waleedlatif1 commented Aug 10, 2026

Uh oh!

waleedlatif1 commented Aug 10, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

waleedlatif1 commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Verification

Notes

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

greptile-apps Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

waleedlatif1 commented Aug 10, 2026

Uh oh!

waleedlatif1 commented Aug 10, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

waleedlatif1 commented Aug 10, 2026 •

edited

Loading

vercel Bot commented Aug 10, 2026 •

edited

Loading

cursor Bot commented Aug 10, 2026 •

edited

Loading

greptile-apps Bot commented Aug 10, 2026 •

edited

Loading