fix(deps): alias image-size to image-size-next@1.2.2 (CVE-2025-71329/71330)

[lcf2212dev]

Why this PR

Published datauri@4.1.0 still depends on image-size@1.0.0 (exact pin, copied into the npm tarball by tools/pkg-json.js from this repo's devDependencies). Upstream image-size is archived. The last 1.x release (1.2.1) is still affected by:

• CVE-2025-71329 / GHSA-5p2g-fcmc-qvqq — DoS via infinite loop on JXL/HEIF/JP2 zero-size boxes
• CVE-2025-71330 / GHSA-w3rx-r6r6-pgpr — DoS via infinite loop on ICNS zero entry length

There is no patched version on the original package name. npm audit fix will not rename the coordinate. This is a follow-up to #45 with a one-line drop-in so consumers stop pulling the vulnerable tarball.

Change

Alias the published 1.x dependency (this repo is major 1, CJS imageSize(buffer) in src/datauri/css.ts):

- "image-size": "1.0.0"
+ "image-size": "npm:image-size-next@1.2.2"

image-size-next@1.2.2 is a MIT community fork with the same 1.x public API. Compare: lcf2212dev/image-size-next@v1.2.1...v1.2.2

This is the 1.x pin. Do not use image-size-next@2.1.1 here (that line is ESM+CJS 2.x and is not a drop-in for this tree).

Hub: lcf2212dev/image-size-next#3

I maintain image-size-next and am not affiliated with the original image-size author. Happy to switch to vendoring or dropping the CSS dimension helper if you prefer.

Test plan

• npm ci resolves image-size → image-size-next@1.2.2
• npm test (CSS width/height path still calls imageSize on the file buffer)
• npm run build / pkg-json writes "image-size": "npm:image-size-next@1.2.2" into lib/datauri/package.json