Bump exifreader from 4.36.2 to 4.41.0

[dependabot]

Bumps exifreader from 4.36.2 to 4.41.0.

Release notes

Sourced from exifreader's releases.

4.41.0: Build custom bundles with npx exifreader build

Added

• npx exifreader build command to (re)build a custom bundle from the exifreader configuration in your package.json. This is the supported replacement for the automatic postinstall rebuild and works the same way with npm, yarn, and pnpm.

Changed

• Custom builds that exclude image formats or metadata groups are now smaller. The metadata merge pipeline no longer carries the merge handlers for excluded PNG, JPEG XL, ICC, and XMP data, so for example a JPEG plus Exif build drops by around 0.8 KiB gzipped.

Deprecated

• The automatic custom build via the npm postinstall script is deprecated and will be removed in v5. Use npx exifreader build instead.

Fixed

• Custom builds now transpile to ES5 even when run with NODE_ENV=production. @babel/preset-env is applied unconditionally in babel.config.json instead of only under Babel's default env.
• Custom builds now install their build toolchain in a unique OS temporary directory instead of temporarily moving exifreader's own node_modules aside, so an interrupted or concurrent build can no longer strand or corrupt the install.

Full Changelog: mattiasw/ExifReader@v4.40.5...v4.41.0

4.40.5: Cap ICC mluc record count against DoS/

Security

• Cap mluc record count to prevent DoS from crafted ICC profiles with huge numRecords. @​ulsreall

Full Changelog: mattiasw/ExifReader@v4.40.4...v4.40.5

4.40.4: ICC profile parsing hardening/

Fixed

• Malformed ICC profiles whose declared length is too small to hold the tag table, or that contain a tag offset pointing past the end of the profile, now return the header tags parsed so far instead of nothing. Three internal bounds checks compared against the wrong length value and never fired, so such a profile ran past its end and all tags were discarded.

Security

• Prevent a denial-of-service (excessive memory use) from crafted ICC mluc

... (truncated)

Changelog

Sourced from exifreader's changelog.

[4.41.0] - 2026-06-08

Added

• npx exifreader build command to (re)build a custom bundle from the exifreader configuration in your package.json. This is the supported replacement for the automatic postinstall rebuild and works the same way with npm, yarn, and pnpm.

Changed

• Custom builds that exclude image formats or metadata groups are now smaller. The metadata merge pipeline no longer carries the merge handlers for excluded PNG, JPEG XL, ICC, and XMP data, so for example a JPEG plus Exif build drops by around 0.8 KiB gzipped.

Deprecated

• The automatic custom build via the npm postinstall script is deprecated and will be removed in v5. Use npx exifreader build instead.

Fixed

• Custom builds now transpile to ES5 even when run with NODE_ENV=production. @babel/preset-env is applied unconditionally in babel.config.json instead of only under Babel's default env.
• Custom builds now install their build toolchain in a unique OS temporary directory instead of temporarily moving exifreader's own node_modules aside, so an interrupted or concurrent build can no longer strand or corrupt the install.

[4.40.5] - 2026-06-03

Security

• Cap mluc record count to prevent DoS from crafted ICC profiles with huge numRecords.

[4.40.4] - 2026-06-03

Fixed

• Malformed ICC profiles whose declared length is too small to hold the tag table, or that contain a tag offset pointing past the end of the profile, now return the header tags parsed so far instead of nothing. Three internal bounds checks compared against ArrayBuffer.length (which is always undefined) rather than the data's byte length, so they never fired; such a profile ran past its end, threw an out-of-bounds DataView read, and the surrounding try/catch discarded all the tags.

Security

... (truncated)

Commits

• 1874a9e 4.41.0
• 4ccdefb Update changelog for 4.41.0
• b812800 Shrink custom builds, drop dead Photoshop comments
• 26e42c4 Isolate the custom-build toolchain in an OS temp dir
• db7a734 Add npx exifreader build for custom builds without a postinstall script
• 7a37c8d Bump the all-dependencies group with 7 updates
• 4120c83 4.40.5
• 422027f Update changelog for 4.40.5
• 981ae21 Bump launch-editor from 2.6.1 to 2.14.1
• 5773335 Cap mluc record count to prevent DoS from crafted ICC profiles
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for exifreader since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.