Skip to content

chore(deps): bump exifreader from 4.41.0 to 4.41.1 - #1369

Open
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/exifreader-4.41.1
Open

chore(deps): bump exifreader from 4.41.0 to 4.41.1#1369
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/exifreader-4.41.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 17, 2026

Copy link
Copy Markdown
Contributor

Bumps exifreader from 4.41.0 to 4.41.1.

Release notes

Sourced from exifreader's releases.

4.41.1: ESM deep-import fix and HEIC/AVIF DoS security fix

Fixed

  • The src directory is now correctly declared as ES modules through a nested package.json type marker that ships with the npm package. Node-native ESM deep imports such as import 'exifreader/src/exif-reader.js' work now instead of crashing, and require() of the same files works on Node 22.12 and later. The default entry points are unchanged.

Security

  • Fixed a denial-of-service vulnerability (GHSA-pj96-35fp-cfcc) where a crafted HEIC or AVIF file could trigger excessive memory allocation and crash the process during metadata parsing. See the advisory for details. Reported by @​alienkeric.

Full Changelog: mattiasw/ExifReader@v4.41.0...v4.41.1

Changelog

Sourced from exifreader's changelog.

[4.41.1] - 2026-07-18

Fixed

  • The src directory is now correctly declared as ES modules through a nested package.json type marker that ships with the npm package. Node-native ESM deep imports such as import 'exifreader/src/exif-reader.js' work now instead of crashing, and require() of the same files works on Node 22.12 and later. The default entry points are unchanged.

Security

  • Fixed a denial-of-service vulnerability where a crafted HEIC or AVIF file could trigger excessive memory allocation and crash the process during metadata parsing (GHSA-pj96-35fp-cfcc). Reported by @​alienkeric.
Commits
  • 20dfd6e 4.41.1
  • 7440989 Update changelog for 4.41.1
  • 17b901c Fix denial-of-service on crafted HEIC/AVIF metadata (GHSA-pj96-35fp-cfcc)
  • 6e2a930 Bump the all-dependencies group with 2 updates
  • 30623d3 Bump systeminformation from 5.31.6 to 5.31.17
  • 2718a31 Bump websocket-driver from 0.7.4 to 0.7.5
  • 252bc74 Bump ws from 8.18.0 to 8.21.0
  • 87fc9d8 Bump the all-dependencies group across 1 directory with 6 updates
  • f3de2e6 Upgrade actions/checkout to v7
  • 9c308b3 Bump the all-dependencies group with 4 updates
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump exifreader from 4.41.0 to 4.41.1
4995cd2 
Bumps [exifreader](https://github.com/mattiasw/ExifReader) from 4.41.0 to 4.41.1.
- [Release notes](https://github.com/mattiasw/ExifReader/releases)
- [Changelog](https://github.com/mattiasw/ExifReader/blob/main/CHANGELOG.md)
- [Commits](mattiasw/ExifReader@v4.41.0...v4.41.1)

---
updated-dependencies:
- dependency-name: exifreader
  dependency-version: 4.41.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Sep 17, 2026
@github-actions

github-actions Bot commented Sep 17, 2026

Copy link
Copy Markdown
Contributor

Frontend chunk report (ja-JP)

Diffs
Chunk Before After Δ Δ (%)
(total) 7.07 MiB 7.06 MiB $\color{green}{\text{-10.4 KiB}}$ $\color{green}{\text{0\%}}$
common ja-JP/1C46ST5L6-p4rcaVRz2.js
15.9 KiB 5.3 KiB $\color{green}{\text{-10.6 KiB}}$ $\color{green}{\text{-67\%}}$
exif-reader ja-JP/1C46ST5L6-BdcCGolO.js
110.9 KiB 111.1 KiB $\color{orange}{\text{+264 B}}$ $\color{orange}{\text{0\%}}$
Added (1)
Chunk Size
../../node_modules/.pnpm/exifreader@4.41.1/node_modules/exifreader/src/exif-reader.js ja-JP/1C46ST5L6-DmJ7xIQ3.js
122 B
Removed (1)
Chunk Size
../../node_modules/.pnpm/exifreader@4.41.0/node_modules/exifreader/src/exif-reader.js ja-JP/1C46ST5L6-CxucZH05.js
122 B
Startup
Chunk Before After Δ Δ (%)
(total) 1.46 MiB 1.45 MiB $\color{green}{\text{-10.6 KiB}}$ $\color{green}{\text{-1\%}}$
common ja-JP/1C46ST5L6-p4rcaVRz2.js
15.9 KiB 5.3 KiB $\color{green}{\text{-10.6 KiB}}$ $\color{green}{\text{-67\%}}$
os ja-JP/1C46ST5L6-DrYjnA5e.js
578.8 KiB 578.8 KiB 0 B 0%
src/_boot_.ts ja-JP/1C46ST5L6-zVLjGkSt.js
269.1 KiB 269.1 KiB 0 B 0%
i18n ja-JP/1C46ST5L6-BPPwz-kY.js
255.6 KiB 255.6 KiB 0 B 0%
photoswipe ja-JP/1C46ST5L6-Cil9XeyA.js
71.5 KiB 71.5 KiB 0 B 0%
runtime-core.esm-bundler ja-JP/1C46ST5L6-B1FXiCpj.js
48.2 KiB 48.2 KiB 0 B 0%
dist ja-JP/1C46ST5L6-D2kET-xj2.js
30.8 KiB 30.8 KiB 0 B 0%
store ja-JP/1C46ST5L6-BPSerVq0.js
26.9 KiB 26.9 KiB 0 B 0%
MkNotification ja-JP/1C46ST5L6-53_76lsN2.js
25.8 KiB 25.8 KiB 0 B 0%
built ja-JP/1C46ST5L6-3zSiEfM_.js
21.2 KiB 21.2 KiB 0 B 0%
reactivity.esm-bundler ja-JP/1C46ST5L6-CGANOlW1.js
20.5 KiB 20.5 KiB 0 B 0%
runtime-dom.esm-bundler ja-JP/1C46ST5L6-BqhUWBVI.js
16.3 KiB 16.3 KiB 0 B 0%
tinycolor ja-JP/1C46ST5L6-PEGdpOg42.js
14.8 KiB 14.8 KiB 0 B 0%
achievements ja-JP/1C46ST5L6-D9RpeXtc.js
10.8 KiB 10.8 KiB 0 B 0%
widgets ja-JP/1C46ST5L6-BmQQwPDf.js
10.7 KiB 10.7 KiB 0 B 0%
theme ja-JP/1C46ST5L6-BZsQqVkL2.js
9.7 KiB 9.7 KiB 0 B 0%
pref-migrate ja-JP/1C46ST5L6-CWdDi3GO2.js
9.7 KiB 9.7 KiB 0 B 0%
MkCustomEmoji ja-JP/1C46ST5L6-2pjMSEr62.js
7.7 KiB 7.7 KiB 0 B 0%
MkAnimBg ja-JP/1C46ST5L6-k77Vt1qr2.js
4.7 KiB 4.7 KiB 0 B 0%
MkFollowButton ja-JP/1C46ST5L6-DgABc2Ys2.js
4 KiB 4 KiB 0 B 0%
navbar ja-JP/1C46ST5L6-BBnEjUWH.js
3.5 KiB 3.5 KiB 0 B 0%
MkUrl ja-JP/1C46ST5L6-lD5uOiOW2.js
3 KiB 3 KiB 0 B 0%
MkSwiper ja-JP/1C46ST5L6-BHTpSK9V2.js
2.9 KiB 2.9 KiB 0 B 0%
MkTabs ja-JP/1C46ST5L6-BzlAEAdX2.js
2.7 KiB 2.7 KiB 0 B 0%
MkCode ja-JP/1C46ST5L6-FjvmzvHy2.js
2.6 KiB 2.6 KiB 0 B 0%
is-birthday ja-JP/1C46ST5L6-ciCobkAu2.js
2.4 KiB 2.4 KiB 0 B 0%
lookup ja-JP/1C46ST5L6-D2T8GKnO.js
2.2 KiB 2.2 KiB 0 B 0%
MkSparkle ja-JP/1C46ST5L6-DEiDPc712.js
2.1 KiB 2.1 KiB 0 B 0%
_dark ja-JP/1C46ST5L6-pUDJON262.js
2 KiB 2 KiB 0 B 0%
_light ja-JP/1C46ST5L6-DczAiIBm.js
1.9 KiB 1.9 KiB 0 B 0%
media-proxy ja-JP/1C46ST5L6-r2g30rHU.js
1.7 KiB 1.7 KiB 0 B 0%
hotkey ja-JP/1C46ST5L6-8ogfLv4r.js
1.6 KiB 1.6 KiB 0 B 0%
MkStickyContainer ja-JP/1C46ST5L6-DP9dZU1h2.js
1.5 KiB 1.5 KiB 0 B 0%
config ja-JP/1C46ST5L6-BvirHXA9.js
1.4 KiB 1.4 KiB 0 B 0%
MkInfo ja-JP/1C46ST5L6-EmHyEWmF.js
1.2 KiB 1.2 KiB 0 B 0%
preload-helper ja-JP/1C46ST5L6-CYrt_hbD.js
1.2 KiB 1.2 KiB 0 B 0%
fetch-releases ja-JP/1C46ST5L6-CbH4uzYx.js
1.1 KiB 1.1 KiB 0 B 0%
webgl ja-JP/1C46ST5L6-wb3e_Vqx2.js
1 KiB 1 KiB 0 B 0%
use-scroll-position-keeper ja-JP/1C46ST5L6-CowA8cyN2.js
990 B 990 B 0 B 0%
misskey-api ja-JP/1C46ST5L6-CnSg1GRB.js
986 B 986 B 0 B 0%
instance ja-JP/1C46ST5L6-BFOu2K9x.js
921 B 921 B 0 B 0%
rolldown-runtime ja-JP/1C46ST5L6-Cyuzqnbw.js
826 B 826 B 0 B 0%
MkLoading ja-JP/1C46ST5L6-DA-kMIvI2.js
748 B 748 B 0 B 0%
get-note-summary ja-JP/1C46ST5L6-Cxpbu0oB.js
704 B 704 B 0 B 0%
page ja-JP/1C46ST5L6-Bhhw95kM.js
688 B 688 B 0 B 0%
d-cherrypick ja-JP/1C46ST5L6-CgRY0VHS.js
645 B 645 B 0 B 0%
i ja-JP/1C46ST5L6-BJexfDMF.js
631 B 631 B 0 B 0%
l-cherrypick ja-JP/1C46ST5L6-DjuJ1X8h.js
491 B 491 B 0 B 0%
clear-cache ja-JP/1C46ST5L6-CCG6hRmw2.js
472 B 472 B 0 B 0%
emoji-base ja-JP/1C46ST5L6-BWqNnsCl2.js
435 B 435 B 0 B 0%
use-interval ja-JP/1C46ST5L6-DEN8fuaH.js
384 B 384 B 0 B 0%
get-bg-color ja-JP/1C46ST5L6-Bp8r3aDH2.js
190 B 190 B 0 B 0%
isChromatic ja-JP/1C46ST5L6-Dd9satMa2.js
172 B 172 B 0 B 0%
is-device-darkmode ja-JP/1C46ST5L6-CHGi6RJT2.js
93 B 93 B 0 B 0%
_plugin-vue_export-helper ja-JP/1C46ST5L6-BDNMzG2s.js
84 B 84 B 0 B 0%

Startup chunks are the Vite entry for src/_boot_.ts and its static imports.

Largest
Chunk Before After Δ Δ (%)
src/widgets/WidgetDice.vue ja-JP/1C46ST5L6-vv5PoCFB2.js
672.9 KiB 672.9 KiB 0 B 0%
../../node_modules/.pnpm/mediabunny@1.46.0/node_modules/mediabunny/dist/modules/src/index.js ja-JP/1C46ST5L6-D1vsveVb.js
614.7 KiB 614.7 KiB 0 B 0%
os ja-JP/1C46ST5L6-DrYjnA5e.js
578.8 KiB 578.8 KiB 0 B 0%
../../node_modules/.pnpm/@sentry+vue@10.57.0_vue@3.5.35_typescript@5.9.3_/node_modules/@sentry/vue/build/esm/index.js ja-JP/1C46ST5L6-BWOgn5VW.js
439.7 KiB 439.7 KiB 0 B 0%
src/_boot_.ts ja-JP/1C46ST5L6-zVLjGkSt.js
269.1 KiB 269.1 KiB 0 B 0%
i18n ja-JP/1C46ST5L6-BPPwz-kY.js
255.6 KiB 255.6 KiB 0 B 0%
src/components/MkAutocomplete.vue ja-JP/1C46ST5L6-DnW-Qvmy.js
233.6 KiB 233.6 KiB 0 B 0%
chart-vline ja-JP/1C46ST5L6-COy-gLfb.js
198 KiB 198 KiB 0 B 0%
MkCode.core ja-JP/1C46ST5L6-hIHISHxE.js
168.9 KiB 168.9 KiB 0 B 0%
../../node_modules/.pnpm/@misskey-dev+emoji-data@17.0.3/node_modules/@misskey-dev/emoji-data/built/indexes/ja-JP_hira.json ja-JP/1C46ST5L6-CkPkMN1g.js
162.6 KiB 162.6 KiB 0 B 0%
../../node_modules/.pnpm/@misskey-dev+emoji-data@17.0.3/node_modules/@misskey-dev/emoji-data/built/indexes/ja-JP.json ja-JP/1C46ST5L6-DREqPuap.js
136.8 KiB 136.8 KiB 0 B 0%
index.es ja-JP/1C46ST5L6-C7ulV0aI2.js
126.9 KiB 126.9 KiB 0 B 0%
exif-reader ja-JP/1C46ST5L6-BdcCGolO.js
110.9 KiB 111.1 KiB $\color{orange}{\text{+264 B}}$ $\color{orange}{\text{0\%}}$
../../node_modules/.pnpm/@misskey-dev+emoji-data@17.0.3/node_modules/@misskey-dev/emoji-data/built/indexes/en-US.json ja-JP/1C46ST5L6-BqTTr1aC.js
95.6 KiB 95.6 KiB 0 B 0%
init-chart ja-JP/1C46ST5L6-COux1a7K.js
88.7 KiB 88.7 KiB 0 B 0%
src/pages/settings/preferences.vue ja-JP/1C46ST5L6-DGzGD08N2.js
88.4 KiB 88.4 KiB 0 B 0%
../../node_modules/.pnpm/@syuilo+aiscript@0.19.0/node_modules/@syuilo/aiscript/built/esm/index.js ja-JP/1C46ST5L6-BkCkxLhr.js
83.4 KiB 83.4 KiB 0 B 0%
matter ja-JP/1C46ST5L6-Bd99WqkX2.js
82 KiB 82 KiB 0 B 0%
MkNoteDetailed ja-JP/1C46ST5L6-UAuFo5mx2.js
75.5 KiB 75.5 KiB 0 B 0%
photoswipe ja-JP/1C46ST5L6-Cil9XeyA.js
71.5 KiB 71.5 KiB 0 B 0%
src/widgets/WidgetWeather.vue ja-JP/1C46ST5L6-CdOgRqb8.js
55 KiB 55 KiB 0 B 0%
runtime-core.esm-bundler ja-JP/1C46ST5L6-B1FXiCpj.js
48.2 KiB 48.2 KiB 0 B 0%
search-index:settings ja-JP/1C46ST5L6-BiAoTcHr.js
46.5 KiB 46.5 KiB 0 B 0%
qr-code-styling ja-JP/1C46ST5L6-B9efEXMN.js
45.4 KiB 45.4 KiB 0 B 0%
src/pages/drop-and-fusion.vue ja-JP/1C46ST5L6-aTpaYdKQ.js
44.3 KiB 44.3 KiB 0 B 0%
../../node_modules/.pnpm/qr-scanner@1.4.2/node_modules/qr-scanner/qr-scanner-worker.min.js ja-JP/1C46ST5L6-CJaXo3yu.js
42.9 KiB 42.9 KiB 0 B 0%
src/components/MkCropperDialog.vue ja-JP/1C46ST5L6-DO3U-YOC.js
40.9 KiB 40.9 KiB 0 B 0%
MkAchievements ja-JP/1C46ST5L6-D3CNfgyF2.js
40.6 KiB 40.6 KiB 0 B 0%
src/ui/deck.vue ja-JP/1C46ST5L6-1pwh1_cT.js
38.9 KiB 38.9 KiB 0 B 0%
src/pages/reversi/game.vue ja-JP/1C46ST5L6-4w7W1RBd.js
37.3 KiB 37.3 KiB 0 B 0%

Frontend Bundle Report

Bundles Modules Entries Imports Size
Static Dynamic Rendered Gzip Brotli
Before 523 3,738 23 9,461 381 12 MiB 3.4 MiB 2.9 MiB
After 523 3,738 23 9,461 381 12 MiB 3.4 MiB 2.9 MiB
Δ 0 0 0 0 0 $\color{orange}{\text{+575 B}}$ $\color{orange}{\text{+132 B}}$ $\color{orange}{\text{+180 B}}$
Δ (%) 0% 0% 0% 0% 0% $\color{orange}{\text{+0\%}}$ $\color{orange}{\text{+0\%}}$ $\color{orange}{\text{+0\%}}$
Top 10
  • /node_modules/.pnpm/temml@0.12.1/node_modules/temml/dist/temml.mjs: 3% (323 KiB)
  • /node_modules/.pnpm/chart.js@4.5.1/node_modules/chart.js/dist/chart.js: 2% (313 KiB)
  • /node_modules/.pnpm/@sentry-internal+replay@10.57.0/node_modules/@sentry-internal/replay/build/npm/esm/index.js: 2% (212 KiB)
  • /packages/frontend/src/pages/settings/preferences.vue?vue&type=script&setup=true&lang.ts: 2% (204 KiB)
  • /node_modules/.pnpm/@misskey-dev+emoji-data@17.0.3/node_modules/@misskey-dev/emoji-data/built/indexes/ja-JP_hira.json: 2% (196 KiB)
  • /node_modules/.pnpm/matter-js@0.20.0/node_modules/matter-js/build/matter.js: 1% (178 KiB)
  • /node_modules/.pnpm/@misskey-dev+emoji-data@17.0.3/node_modules/@misskey-dev/emoji-data/built/indexes/ja-JP.json: 1% (171 KiB)
  • /node_modules/.pnpm/v-code-diff@1.13.1_vue@3.5.35_typescript@5.9.3_/node_modules/v-code-diff/dist/index.es.js: 1% (158 KiB)
  • /node_modules/.pnpm/@syuilo+aiscript@0.19.0/node_modules/@syuilo/aiscript/built/esm/parser/parser.js: 1% (148 KiB)
  • /node_modules/.pnpm/@misskey-dev+emoji-data@17.0.3/node_modules/@misskey-dev/emoji-data/built/indexes/en-US.json: 1% (128 KiB)
Hot Modules (Self Size)
Module Bundles Rendered Share Gzip Brotli Imports Imported By
/node_modules/.pnpm/temml@0.12.1/node_modules/temml/dist/temml.mjs 1 323 KiB 3% 70 KiB 57 KiB 0 0
/node_modules/.pnpm/chart.js@4.5.1/node_modules/chart.js/dist/chart.js 1 313 KiB 2% 72 KiB 60 KiB 2 20
/node_modules/.pnpm/@sentry-internal+replay@10.57.0/node_modules/@sentry-internal/replay/build/npm/esm/index.js 1 212 KiB 2% 52 KiB 44 KiB 2 1
/packages/frontend/src/pages/settings/preferences.vue?vue&type=script&setup=true&lang.ts 1 204 KiB 2% 22 KiB 17 KiB 36 1
/node_modules/.pnpm/@misskey-dev+emoji-data@17.0.3/node_modules/@misskey-dev/emoji-data/built/indexes/ja-JP_hira.json 1 196 KiB 2% 35 KiB 31 KiB 0 1
/node_modules/.pnpm/matter-js@0.20.0/node_modules/matter-js/build/matter.js 1 178 KiB 1% 34 KiB 29 KiB 0 3
/node_modules/.pnpm/@misskey-dev+emoji-data@17.0.3/node_modules/@misskey-dev/emoji-data/built/indexes/ja-JP.json 1 171 KiB 1% 37 KiB 33 KiB 0 1
/node_modules/.pnpm/v-code-diff@1.13.1_vue@3.5.35_typescript@5.9.3_/node_modules/v-code-diff/dist/index.es.js 1 158 KiB 1% 41 KiB 36 KiB 1 1
/node_modules/.pnpm/@syuilo+aiscript@0.19.0/node_modules/@syuilo/aiscript/built/esm/parser/parser.js 1 148 KiB 1% 14 KiB 10 KiB 0 1
/node_modules/.pnpm/@misskey-dev+emoji-data@17.0.3/node_modules/@misskey-dev/emoji-data/built/indexes/en-US.json 1 128 KiB 1% 26 KiB 22 KiB 0 1
/node_modules/.pnpm/@vue+runtime-core@3.5.35/node_modules/@vue/runtime-core/dist/runtime-core.esm-bundler.js 1 125 KiB 1% 29 KiB 26 KiB 2 1
/node_modules/.pnpm/@dice-roller+rpg-dice-roller@5.5.1/node_modules/@dice-roller/rpg-dice-roller/lib/esm/bundle.js 1 105 KiB 1% 19 KiB 16 KiB 2 1
/node_modules/.pnpm/photoswipe@5.4.4/node_modules/photoswipe/dist/photoswipe.esm.js 1 96 KiB 1% 22 KiB 19 KiB 0 1
/node_modules/.pnpm/mediabunny@1.46.0/node_modules/mediabunny/dist/modules/src/isobmff/isobmff-demuxer.js 1 88 KiB 1% 16 KiB 14 KiB 13 1
/node_modules/.pnpm/@shikijs+vscode-textmate@10.0.2/node_modules/@shikijs/vscode-textmate/dist/index.js 1 80 KiB 1% 16 KiB 14 KiB 0 0

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code packages/frontend

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants