chore: update metro to drop vulnerable image-size 1.x

[dannyhw]

Summary

Follow-up to #1486. The last copy of image-size@1.2.1 (flagged by the ICNS/JXL/HEIF infinite-loop DoS advisories) came in through metro@0.84.4, via @react-native/community-cli-plugin@0.86.3 in the tester apps. Metro 0.84.5+ no longer depends on image-size.

@react-native/community-cli-plugin already allows metro ^0.84.3, so this is a lockfile-only update within existing ranges. No package.json changes, no overrides.

• metro and metro-* 0.84.4 → 0.84.6 (@expo/metro still pins its own 0.84.5, which also doesn't use image-size)
• image-size@1.2.1 is removed; only 2.0.4 (used by @callstack/repack) remains
• Updated alongside metro within their ranges: terser 5.51.2 (metro's minifier), @babel/parser/@babel/types, acorn

Resolves the remaining image-size Dependabot alerts (lockfile path).

Test plan

• pnpm build, pnpm typecheck, pnpm test (repack 354, integration 128, metro-compat 47, dev-server 28, resolver-cases 13, tester-app 14)
• Release bundles for tester-app (Rspack iOS/Android, webpack iOS), MF v1 and v2 host/mini, Expo app, Expo widget production build, and website build all succeed
• Release bundle sizes are byte-for-byte the same as before, so minification is unaffected

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
repack-website	Ready	Preview	Oct 9, 2026 8:37pm UTC

[changeset-bot]

⚠️ No Changeset found

Latest commit: 957cdd8

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR