chore(deps): update dependency exifreader to v4.42.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
exifreader	4.41.0 → 4.42.0

---

Release Notes

mattiasw/ExifReader (exifreader)

v4.42.0

Compare Source

Changed

• An ICC profile whose declared size is larger than all the data available for
  the file no longer produces ICC tags. This affects files truncated to fewer
  bytes than the ICC profile declares, and partial reads using the length
  option, which could previously still return tags for such a profile.

Security

• Fixed a denial-of-service vulnerability where a crafted WebP, HEIC, or AVIF
  file could trigger excessive memory allocation during ICC metadata parsing
  (GHSA-wx94-r5p4-hx2f).
  Reported by @​arpitjain099.

v4.41.4

Compare Source

Security

• Documented that passing a string to load() makes ExifReader treat it as a
  URL or a local file path and perform a network request or a file read, so an
  untrusted string must never be passed to it. Passing the image bytes instead
  avoids server-side request forgery and local file access
  (GHSA-mjwm-rcx3-79hc).
• Documented that all returned metadata is untrusted input. Tag values and the
  raw XMP packet come from the image unchanged and can contain HTML-like markup,
  so they must be escaped or sanitized before being inserted into a page as HTML
  to avoid cross-site scripting
  (GHSA-hhgj-2jxm-r7x6).
• Fixed a denial-of-service vulnerability where a crafted image could declare an
  XMP metadata block far larger than the file itself and make the synchronous
  parser allocate memory proportional to that declared size instead of to the
  actual data. The XMP block size is now bounded to the bytes that are really
  present
  (GHSA-q53f-v5gx-7j78).

v4.41.3

Compare Source

Fixed

• Custom builds no longer include the modules that were excluded from them,
  and consumer bundlers can again tree-shake the source modules. A regression
  in 4.41.1 made the new src/package.json hide the root sideEffects
  declaration from bundlers, which roughly doubled the size of custom builds.

v4.41.2

Compare Source

Fixed

• A HEIC or AVIF file whose iloc box is cut off in the middle of an item
  header now returns the metadata items that are fully present, instead of
  discarding the whole box. This matters for truncated files and for partial
  reads with the length option.

v4.41.1

Compare Source

Fixed

• The src directory is now correctly declared as ES modules through a nested
  package.json type marker that ships with the npm package. Node-native ESM
  deep imports such as import 'exifreader/src/exif-reader.js' work now
  instead of crashing, and require() of the same files works on Node 22.12
  and later. The default entry points are unchanged.

Security

• Fixed a denial-of-service vulnerability where a crafted HEIC or AVIF file
  could trigger excessive memory allocation and crash the process during
  metadata parsing
  (GHSA-pj96-35fp-cfcc).
  Reported by @​alienkeric.

---

Configuration

📅 Schedule: (in timezone Europe/Paris)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.