Replace vulnerable `image-size` dependency inherited through `excel4node`

[drewB]

Replace vulnerable image-size dependency inherited through excel4node

@forestadmin/plugin-export-advanced@1.1.49 has a vulnerable image parser through its Excel export dependency:

@forestadmin/plugin-export-advanced@1.1.49
└── excel4node@1.8.2
    └── image-size@1.2.1

Security advisories

Running npm audit reports two high-severity denial-of-service advisories:

• GHSA-w3rx-r6r6-pgpr: infinite loop when parsing malformed ICNS images.
• GHSA-5p2g-fcmc-qvqq: infinite loops in JXL and HEIF parsing.

The advisories cover image-size versions through 2.0.2, with no patched upstream release currently available. Updating within excel4node’s dependency range therefore does not resolve the findings.

Reproduction

mkdir forest-export-audit
cd forest-export-audit
npm init -y
npm install @forestadmin/plugin-export-advanced@1.1.49
npm audit
npm ls excel4node image-size

Requested change

Could the plugin adopt an Excel library or patched dependency chain that removes these vulnerabilities?