fix(docs): replace vulnerable image-size dependency in Docusaurus

[jkim323]

The Docusaurus documentation build resolves image-size@2.0.2 through @docusaurus/mdx-loader. This version is affected by GHSA-5p2g-fcmc-qvqq and GHSA-w3rx-r6r6-pgpr, which can cause infinite-loop denial of service while parsing crafted JXL, HEIF, or ICNS input.

Replace the vulnerable transitive implementation with the exact image-size-next@2.1.1 npm alias while preserving the image-size dependency key and API surface expected by @docusaurus/mdx-loader. Regenerate the lockfile from the canonical public npm registry and remove advisory exceptions that are no longer required.

Acceptance Criteria

• docs/docusaurus/package.json overrides image-size with the exact alias npm:image-size-next@2.1.1.
• docs/docusaurus/package-lock.json resolves the alias from the canonical public npm registry with recorded SHA-512 integrity.
• The installed Docusaurus dependency graph no longer contains image-size@2.0.2.
• The alias preserves the image-size/fromFile API required by @docusaurus/mdx-loader.
• The malicious ICNS regression probe completes without hanging its parent process.
• Docusaurus type checking, tests, and the production build pass.
• The Docusaurus npm audit reports no vulnerability for either image-size advisory.
• GHSA-5p2g-fcmc-qvqq and GHSA-w3rx-r6r6-pgpr are removed from Dependency Review exceptions, including obsolete rationale.
• Remaining audit allowlist or OpenVEX records for image-size@2.0.2 are reviewed and either retained with valid version-scoped rationale or updated through the governed security process.

Out of Scope

• Removing the temporary alias before the upstream Docusaurus dependency graph is safe.
• Replacing unrelated deprecated dependencies tracked by fix(docs): remove deprecated dependencies from Docusaurus install #2790.
• Broad changes to Docusaurus image handling or documentation behavior.

Related

• Implemented by fix(build): replace vulnerable image-size dependency #2792.
• Security context: Dependabot alert 252.
• Related but distinct: fix(docs): remove deprecated dependencies from Docusaurus install #2790.

Follow-up

Create a separate maintenance issue to remove the exact alias after an official Docusaurus release no longer resolves an affected image-size package without the override.