fix(mdx-loader): replace image-size with measureImage hook

[kennym]

Pre-flight checklist

• I have read the Contributing Guidelines on pull requests.
• If this is a code change: I have written unit tests and/or added dogfooding pages to fully verify the new behavior.
• If this is a new API or substantial change: the PR has an accompanying issue (closes Replace unmaintained dependency image-size with active CVEs (CVSS 7.5) #12231). Working plan posted on the issue; this is a draft so maintainers can review the approach before it is marked ready. The previous swap-only attempt is break(mdx-loader): replace unmaintained image-size dependency with image-dimensions #12235.
• A significant portion of this PR was authored with AI assistance (Cursor), per CONTRIBUTING.md — AI-assisted PRs. I reviewed the design against Replace unmaintained dependency image-size with active CVEs (CVSS 7.5) #12231 / break(mdx-loader): replace unmaintained image-size dependency with image-dimensions #12235, ran the tests listed below, and am accountable for the code.

Motivation

@docusaurus/mdx-loader depends on archived image-size@^2.0.2 (CVE-2025-71329 / CVE-2025-71330). There is no published patched release.

#12235 replaced it with image-dimensions only. That drops SVG (unsupported by that library) and has no escape hatch for long-tail formats.

This draft follows the markdown.hooks pattern from #11283:

• Add optional siteConfig.markdown.hooks.measureImage({ imagePath }).
• Default: SVG via a small local width/height/viewBox parser; raster via image-dimensions; on failure log and return null (no throw/catch).
• Remove image-size completely.
• Document that BMP/ICO/TIFF/PSD/JXL/ICNS are no longer auto-measured unless the site provides a custom hook.

Question for maintainers: is preserving SVG enough for a 3.x fix, or is dropping the long-tail formats v4-only?

Test Plan

• pnpm exec vitest run packages/docusaurus-mdx-loader/src/remark/transformImage packages/docusaurus/src/server/__tests__/configValidation.test.ts (Node 24)
• New coverage: SVG attributes, viewBox fallback, measureImage override, config validation
• Existing transformImage snapshots still emit width/height for PNG fixtures
• Showcase user.test.ts and admin/scripts/resizeImage.js no longer import image-size

Test links

Deploy preview: https://deploy-preview-12388--docusaurus-2.netlify.app/

Docs: website/docs/api/docusaurus.config.js.mdx (markdown.hooks.measureImage)

Related issues/PRs

• Closes Replace unmaintained dependency image-size with active CVEs (CVSS 7.5) #12231
• Alternative to break(mdx-loader): replace unmaintained image-size dependency with image-dimensions #12235
• Hook pattern from feat(core): Add siteConfig.markdown.hooks, deprecate siteConfig.onBrokenMarkdownLinks #11283

[meta-cla]

Hi @kennym!

Thank you for your pull request and welcome to our community.

Action Required

In order to merge any pull request (code, docs, etc.), we require contributors to sign our Contributor License Agreement, and we don't seem to have one on file for you.

Process

In order for us to review and merge your suggested changes, please sign at https://code.facebook.com/cla. If you are contributing on behalf of someone else (eg your employer), the individual CLA may not be sufficient and your employer may need to sign the corporate CLA.

Once the CLA is signed, our tooling will perform checks and validations. Afterwards, the pull request will be tagged with CLA signed. The tagging process may take up to 1 hour after signing. Please give it that time before contacting us about it.

If you have received this in error or have any questions, please contact us at cla@meta.com. Thanks!

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	image-dimensions@​2.5.1

View full report

[netlify]

✅ [V2]

Built without sensitive environment variables

Name	Link
🔨 Latest commit	6f97dc4
🔍 Latest deploy log	https://app.netlify.com/projects/docusaurus-2/deploys/6a8d9963acc50100086baaa6
😎 Deploy Preview	https://deploy-preview-12388--docusaurus-2.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[meta-cla]

Thank you for signing our Contributor License Agreement. We can now accept your code for this (and any) Meta Open Source project. Thanks!

[kennym]

@slorber @Josh-Cena any feedback here?