chore(deps): bump exifreader from 4.39.0 to 4.40.1

[dependabot]

Bumps exifreader from 4.39.0 to 4.40.1.

Release notes

Sourced from exifreader's releases.

4.40.1: Robustness fixes for malformed and truncated input

Fixed

• Truncated or malformed metadata no longer throws an uncaught error out of load and loadView. This fixes several crashes on crafted input, including a short WebP VP8X chunk, a truncated PNG iCCP chunk in async mode, a HEIC/AVIF Exif item whose TIFF header offset points outside the file, a truncated JPEG MPF segment, and a unicode string whose region ends on an odd byte.
• HEIC and AVIF files that store Exif or XMP via iloc construction_method 1 (the idat box) are now read at the correct offset. The box was previously parsed as a full box, which shifted its content offset by 4 bytes.
• The buffer assembled for multi-extent HEIC and AVIF items is now capped to the source file size. This prevents a memory-amplification path from overlapping extents.
• length: 'auto' over a URL no longer corrupts the buffer when a Range-ignoring server returns a full 200 response during the fallback read. The Node (non-fetch) path now falls back correctly on a 416 response instead of rejecting.

Security

• Fix denial-of-service from an uncaught exception when parsing crafted HEIC/AVIF files with malformed ISO-BMFF boxes (GHSA-g77h-45rf-hcx4). Reported by @​YHalo-wyh.

4.40.0: Adaptive minimal-fetch and HEIC/AVIF iloc fixes

Added

• New includeOffsets option (with expanded: true) returns a metadataRange object, {start, end, complete, blocks: [{type, start, end}, ...]}, describing exactly where metadata sits in the file, so you can persist just the metadata-bearing prefix instead of the whole image. Supports JPEG, PNG, WebP, HEIC, AVIF, JPEG XL (container), GIF, and standalone XMP/XML. (#121)
• New length: 'auto' option adaptively fetches only the bytes that contain metadata via HTTP Range requests (or filesystem reads / File.slice locally), reporting the minimal slice as metadataRange.buffer, bytes read as metadataRange.fetched, and IO-call count as metadataRange.requests. Requires expanded: true and includeOffsets: true.

Fixed

• HEIC/AVIF: correctly read Exif and XMP from iloc items using constructionMethod 1 (idat); these were previously read from the wrong file offset, producing garbage tags or none. constructionMethod 2 items are now skipped cleanly instead of returning garbage.
• HEIC/AVIF: multi-extent Exif and XMP items are now parsed end-to-end; previously only the first extent was read, dropping any tags that spilled into a second extent.

4.39.1: Fall back to Windows-1252 for IPTC text without a Coded Character Set

... (truncated)

Changelog

Sourced from exifreader's changelog.

[4.40.1] - 2026-05-30

Fixed

• Truncated or malformed metadata no longer throws an uncaught error out of load/loadView. Fixed several crashes on crafted input: a short WebP VP8X chunk, a truncated PNG iCCP chunk (async mode), a HEIC/AVIF Exif item whose TIFF header offset points outside the file, a truncated JPEG MPF segment, and a unicode string whose region ends on an odd byte (reachable via ICC multiLocalizedUnicode).
• HEIC/AVIF files that store Exif or XMP via iloc construction_method 1 (the idat box) are now read at the correct offset. The idat box was parsed as a full box, shifting its content offset by 4 bytes.
• Capped the buffer assembled for multi-extent HEIC/AVIF items to the source file size, preventing a memory-amplification path from overlapping extents.
• length: 'auto' over a URL no longer corrupts the buffer when a Range-ignoring server returns a full 200 response during the fallback read, and the Node (non-fetch) path now falls back correctly on a 416 response instead of rejecting.

Security

• Fix denial-of-service from an uncaught exception when parsing crafted HEIC/AVIF files with malformed ISO-BMFF boxes (GHSA-g77h-45rf-hcx4). Reported by @​YHalo-wyh.

[4.40.0] - 2026-05-29

Added

• includeOffsets option which, together with expanded: true, returns a metadataRange object describing where metadata sits in the file: {start, end, complete, blocks: [{type, start, end}, ...]}. Useful for persisting only the metadata-bearing prefix of an image instead of the whole file. Supports JPEG, PNG, WebP, HEIC, AVIF, JPEG XL (container), GIF, and standalone XMP/XML; plain TIFF and bare JPEG XL codestreams are not supported in this version because they lack a leading metadata container. #121
• bin/profile.js: profiler script that parses images in a folder and reports per-format timing stats. Supports --iterations, --warmup, --type, --dir, --include-io, and --probe-bytes (bisects the minimum prefix length needed to extract metadata equivalent to the full file, useful for I/O-optimization work).
• length: 'auto' option to load() adaptively fetches only the bytes that contain metadata, using HTTP Range requests (or filesystem reads / File.slice for local inputs). The minimal byte slice is returned as metadataRange.buffer, the number of bytes read as metadataRange.fetched, and the IO-call count as

... (truncated)

Commits

• 0ea9d58 4.40.1
• 8d824bf Update changelog for 4.40.1
• 8c8728f Harden metadata parsing against malformed and truncated input
• 00878ca Handle malformed and truncated ISO-BMFF boxes gracefully
• 8cb0261 4.40.0
• 4b83b10 Update changelog for 4.40.0
• 3c5e77a Add Claude skills dir to .gitignore
• b34dddd Bump the all-dependencies group with 3 updates
• 7f7125c Add length: 'auto' for adaptive minimal-fetch of metadata
• f36c46f Fix HEIC/AVIF iloc constructionMethod 1 (idat) and multi-extent parsing
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.