Several ways to solve this.
First, actual GFCI protection does not require a ground wire. It's better to have both GFCI and ground. But GFCI alone is still highly useful. For instance, GFCI is much better at stopping electrocutions, which is what the requirement is all about.
Extend the box
I don't like removing the box. It's delicate "dental" work and if you aren't experienced at it, you risk goring up the drywall, or worse, the old wires (and then you're really in trouble!) The original box was nailed at the joist before the drywall went up, and may be steel (and might even be grounded!) "After-drywall" retrofit boxes are plastic, hokey, weak, and clamp to the drywall... likely it'll flop around, or tear out of the wall when trying to pull a stubborn plug. No thanks. On the other hand, if you're a drywall god, then properly fit new-work boxes, but honestly I still prefer metal boxes.
So how do you make a box bigger? Here's an unrelated question. How do you attach surface conduit like Wiremold to an existing flush-mount box? With an extension adapter box that brings it out an inch or two and has side ports for the Wiremold. We only care about the first part. It's not the normal parts source, but it works.
Put the GFCI protection elsewhere
GFCI, after all, is not a socket. It is a system of protection that can protect any part of a circuit, including many sockets. You only know it from the convenient GFCI + receptacle "combo" that you're used to seeing. It comes in other forms also, such as a separate "box" or a breaker.
This will protect all of the circuit that is downstream from the GFCI. However, this itself may be a problem. If other parts of the circuit have any defects -- such as crossed neutrals with other circuits, or a hard-wired device which in fact does have a ground fault -- the device will trip and refuse to reset. Then a time-consuming search for defects will be necessary.
At the circuit breaker
The breaker version replaces the circuit breaker on that circuit, with a combo unit that is both a circuit breaker and a GFCI. It provides GFCI protection for the entire circuit. This can be expensive or impossible, depending on the model of service panel (breaker box) your home has. For instance, GFCI breakers for Pushmatic are hard to get.
This requires opening up the breaker panel and replacing the breaker. This is short work for an electrician.
Somewhere along the cable
It is possible to fit a junction box just outside the breaker panel, run the circuit's cable to this junction box, and fit a GFCI device at that location - then run a short cable to the breaker panel so the GFCI can get supply. That allows you to use a GFCI module like a deadface (which you notice looks a lot like a GFCI+receptacle combo) -- or simply use the normal combo device (if Code allows; there are new rules about bathroom and kitchen receptacles not supplying sockets anywhere else.)
Since US circuits are generally wired as a chain, another option is to find a receptacle location upstream of the bathroom, and locate the GFCI device there, wiring it it protect the downstream parts of the circuit including the bathroom.
Labeling and Testing
If you GFCI protect another receptacle, you put a sticker on the receptacle that says GFCI Protected Outlet. Receptacles that are GFCI protected are allowed to be 3-prong even if they're not grounded.
If that receptacle does not have a genuine ground, also label the receptacle No Equipment Ground.
The stickers are what the electrical inspector is looking for. They are not special, you can print them on a printer.
How do you do a serious test of a socket that is GFCI protected? With an external tester. An external tester won't work on a socket with "no equipment ground" and that's not a defect, that's expected. Plug it into a three prong adapter (cheater) and run a long length of wire from the grounding tab on the adapter, to somewhere you can get a solid ground. E.G. the ground bonding wire exiting your service panel.
Best Answer
The answer is: Don't.
Outlets are black, beige or white, and rarely dark brown or gray. Beige came into style by the 60s and white by the 90s. Yours are probably beige.
Leave the old receptacle boxes alone. They ARE grounded, there's nothing wrong with them, they obviously do have enough wire to reach the old receptacles. That's all you need.
"Modern" receptacles are the same size. Just change your receptacles from whatever's in there now, to a quality $3-4 each midgrade receptacle. If replacing backstabs, get receptacles with screw-and-clamp terminals - the wires poke in the back, but clamp by tightening down the screw terminals. Slick.
If the wires are ALL 12 AWG and the breaker is 20 amps, you can use 15/20A receptacles which have a "T" shape on the neutral slot.
If you had "back stab" types before, don't cut them off because you'll lose precious wire length. Instead, pull steadily on the wire while twisting the receptacle back and forth (not enough to deform the wire), and the wire will ease out. It will have scratches but will work fine with screw-and-clamp or side terminal screws. Don't use it again on a "back stab", in fact never use backstabs ever because they stink. Also don't pry it out with a wire nipper because you'll nick the wire.
GFCI
Ground faults are current following abnormal paths, such as through a human who is being electrocuted. Mainly, they protect people and pets from shock. Usual cause: bathroom mistake or defective plug-in appliance.
If you want GFCI, remember the first rule: Only the first GFCI device needs to be GFCI. Everything downstream can be plain old outlets, and they inherit GFCI protection because they are fed off the "load" terminals of the first GFCI. That's how the GFCI can be a circuit breaker. It can also be a new receptacle you insert at the front of the chain, for instance 1 foot from the service panel. I do that all the time. GFCI receptacles are cheaper than breakers.
Honestly it depends what threats you're worried about, but if you're distrust your old wiring, or want to follow the latest code, I'd consider AFCI instead, or both.
AFCI
Arc faults are loose connections, broken wire etc. causing current to leap across a gap. This makes a lot of heat and starts fires. If you've heard the unique "sizzle", it also sounds like that on the wires. AFCI's have a computer inside which listens for that peculiar electrical noise. Usual cause: defective in-wall wiring or receptacles; sometimes bad appliance.
Generally the cheapest way to get AF protection is with an AFCI circuit breaker.
Combo AFCI+GFCI
You can also get combo AFCI/GFCI breakers, but they are expensive. Watch for ones which will indicate why they tripped, otherwise you'll go bonkers.
Another way to get combo AFCI is to use an AFCI breaker, but a GFCI receptacle in the first point in the chain. This makes it more obvious what tripped.