chore(deps): drop image-size from root lockfile (builder-bob 0.43, metro 0.84.6)

[romainsalles]

Why

Fixes the open HIGH Dependabot alerts on the root yarn.lock:

• #793 — image-size CVE-2025-71329 (vulnerable >= 1.2.0, <= 2.0.2, patched 2.0.3)
• #795 — image-size CVE-2025-71330 (vulnerable >= 0.6.3, <= 2.0.2, patched 2.0.3)

There is no patched 1.x, and forcing image-size 2.x onto metro breaks it, so the fix removes the dependency path instead.

Approach

image-size 1.2.1 only reached the root lockfile through metro:

• react-native-builder-bob@^0.36 depended on metro-config@^0.80.9, which pulled metro@0.80.12 → image-size@^1.0.2. Bob 0.41+ moved metro-config to devDependencies.
• metro@0.84.4 (via @react-native/community-cli-plugin@^0.84.3) still depended on image-size; metro 0.84.5+ dropped it (same as test-projects/rn-purchasely-test in chore(deps): patch HIGH CVEs (brace-expansion, basic-ftp, image-size) #320).

Changes:

• react-native-builder-bob ^0.36.0 → ^0.43.1 in the 5 packages (purchasely, google, amazon, huawei, android-player). Locked at 0.43.1; 0.43.2 was published yesterday, so I kept it out for now.
• Re-resolved the metro family (metro, metro-config, metro-cache, ...) to 0.84.6 and bumped the example's metro-cache / metro-config ranges ^0.84.0 → ^0.84.6.

Resolved versions

• image-size: gone from yarn.lock (was 1.2.1)
• metro + metro-*: 0.84.6 (were 0.80.12 + 0.84.4)
• react-native-builder-bob: 0.43.1 (was 0.36.0)
• Other shared packages: only new versions added next to the existing ones, nothing existing upgraded or downgraded. Bob 0.43 brings its own typescript@^6.0.3 as a dependency; tsc for the typescript target is still resolved from the workspace (5.9.3), checked in bob's source and in the output below.

Builder-bob 0.36 → 0.43 changelog review

No breaking change for our config (source: src, output: lib, targets commonjs, module, ["typescript", { project: "tsconfig.build.json" }], no esm, no codegenConfig). Relevant changes: config is now validated with arktype (ours passes), tasks run in parallel with workers, tsc is resolved through node resolution from the package root, .d.ts extensions are rewritten only for ESM/nodenext.

Build output

Built all 5 packages (yarn all:prepare) on main and on this branch, then diffed lib/: 111 files byte-identical (JS, source maps, .d.ts, same lib/typescript/packages/<pkg>/src/... layout). The only difference: lib/module/package.json ({"type":"module"}) is no longer emitted. Bob skips it on purpose when esm is off, because the module output uses extensionless imports (see the comment in bob's utils/compile.js; most likely the 0.38.0 change "fix generating package.json when esm is enabled"). Our packages have no exports or react-native field, so Metro resolves main (lib/commonjs, still with its {"type":"commonjs"} marker), and bundlers reading module now treat lib/module as auto-detected rather than strict ESM.

Local checks (Node 22, yarn 3.6.1)

• yarn install --immutable: OK
• yarn typecheck: OK
• yarn lint: OK
• yarn test: 6 suites, 291 tests passed
• yarn all:prepare: OK (5 packages)
• yarn workspace example react-native bundle --platform android --dev false: OK on Metro v0.84.6 (bundle + 19 assets copied)

🤖 Generated with Claude Code

[greptile-apps]

Automatic reviews are disabled for this repository.