build(deps): bump exifreader from 4.41.3 to 4.42.0

[dependabot]

Bumps exifreader from 4.41.3 to 4.42.0.

Release notes

Sourced from exifreader's releases.

4.42.0: ICC parsing hardened against oversized profiles

Changed

• An ICC profile whose declared size is larger than all the data available for the file no longer produces ICC tags. This affects files truncated to fewer bytes than the ICC profile declares, and partial reads using the length option, which could previously still return tags for such a profile.

Security

• Fixed a denial-of-service vulnerability where a crafted WebP, HEIC, or AVIF file could trigger excessive memory allocation during ICC metadata parsing (GHSA-wx94-r5p4-hx2f). Reported by @​arpitjain099.

Full Changelog: mattiasw/ExifReader@v4.41.4...v4.42.0

4.41.4: XMP allocation fix and security documentation

Security

• Documented that passing a string to load() makes ExifReader treat it as a URL or a local file path and perform a network request or a file read, so an untrusted string must never be passed to it. Passing the image bytes instead avoids server-side request forgery and local file access (GHSA-mjwm-rcx3-79hc).
• Documented that all returned metadata is untrusted input. Tag values and the raw XMP packet come from the image unchanged and can contain HTML-like markup, so they must be escaped or sanitized before being inserted into a page as HTML to avoid cross-site scripting (GHSA-hhgj-2jxm-r7x6).
• Fixed a denial-of-service vulnerability where a crafted image could declare an XMP metadata block far larger than the file itself and make the synchronous parser allocate memory proportional to that declared size instead of to the actual data. The XMP block size is now bounded to the bytes that are really present (GHSA-q53f-v5gx-7j78).

Full Changelog: mattiasw/ExifReader@v4.41.3...v4.41.4

Changelog

Sourced from exifreader's changelog.

[4.42.0] - 2026-08-05

Changed

• An ICC profile whose declared size is larger than all the data available for the file no longer produces ICC tags. This affects files truncated to fewer bytes than the ICC profile declares, and partial reads using the length option, which could previously still return tags for such a profile.

Security

• Fixed a denial-of-service vulnerability where a crafted WebP, HEIC, or AVIF file could trigger excessive memory allocation during ICC metadata parsing (GHSA-wx94-r5p4-hx2f). Reported by @​arpitjain099.

[4.41.4] - 2026-08-05

Security

• Documented that passing a string to load() makes ExifReader treat it as a URL or a local file path and perform a network request or a file read, so an untrusted string must never be passed to it. Passing the image bytes instead avoids server-side request forgery and local file access (GHSA-mjwm-rcx3-79hc).
• Documented that all returned metadata is untrusted input. Tag values and the raw XMP packet come from the image unchanged and can contain HTML-like markup, so they must be escaped or sanitized before being inserted into a page as HTML to avoid cross-site scripting (GHSA-hhgj-2jxm-r7x6).
• Fixed a denial-of-service vulnerability where a crafted image could declare an XMP metadata block far larger than the file itself and make the synchronous parser allocate memory proportional to that declared size instead of to the actual data. The XMP block size is now bounded to the bytes that are really present (GHSA-q53f-v5gx-7j78).

Commits

• da72057 4.42.0
• d04cdb9 Update changelog for 4.42.0
• ef09820 Fix excessive memory allocation in ICC parsing (GHSA-wx94-r5p4-hx2f)
• aa2a310 4.41.4
• 53fd8ed Update changelog for 4.41.4
• c858ed0 Fix unbounded XMP metadata allocation
• a17a90d Document that returned metadata is untrusted
• 704ff2a Document SSRF risk of load() string input
• 45aab45 Bump the all-dependencies group with 4 updates
• e86c086 Bump shell-quote from 1.8.4 to 1.10.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
freetoolshed	Ready	Preview	Aug 10, 2026 4:30am