Bump the minor-updates group across 1 directory with 3 updates

[dependabot]

Bumps the minor-updates group with 3 updates in the / directory: exifreader, check-package-lock and eslint.

Updates exifreader from 4.42.0 to 4.44.0

Release notes

Sourced from exifreader's releases.

4.44.0: Real tags for XMP rdf:value children, and XMP parsing repairs

Changed

• The value of an XMP tag that comes from an rdf:value element with child elements is now an object of regular tags instead of the parser's internal nodes. Each child is keyed by its local name (Inner instead of my:Inner) and has value, attributes, and description like any other tag, which is what the TypeScript definitions have described all along. The description of the tag itself follows the new names, for example Inner: 42 where it used to be my:Inner: 42.
• The content of an rdf:value element is now parsed much as the content of the tag element itself would have been. A list written directly inside rdf:value is therefore a list tag now, so a qualified value written as an rdf:Alt with xml:lang keeps both its text and its language where it used to come back as raw parser nodes. Such a list also takes the place of any sibling elements inside the same rdf:value.
• Two further consequences of that parsing, if you read these values: a child without a namespace prefix lands under the name undefined, as an element without a prefix does everywhere else in the output, so two such children collapse into one; and a child that holds elements of its own, without being marked rdf:parseType="Resource" itself, is kept without them.
• The value object of such a tag still has no prototype, as it has since 4.43.0. A child of it named __proto__ is kept under that name, and so is one nested further down.

Fixed

• An XMP element or attribute named __proto__ is now kept as a tag under that name. Such a name was used in a plain property assignment, which JavaScript takes as a request to replace the prototype of the object holding the tag, so the tag was lost and the fields of the tag object showed up as properties of the object it should have been stored in, including among the top level XMP tags.
• The description of an XMP tag written as a list is now always a string. When ExifReader has a description function for the tag that neither handles a list nor throws on one, for example tiff:Orientation or tiff:XResolution, the list itself became the description, where the TypeScript definitions promise a string. The descriptions of the list items joined together are used instead.
• An XMP tag with more than one rdf:value child element is no longer lost or returned without a value. The last rdf:value now wins, which is how a repeated tag is handled.
• An XMP tag with more than one rdf:Bag, rdf:Seq, or rdf:Alt element is no longer dropped from the output. The last one now wins, as it does for any other repeated element.
• An XMP packet in need of a namespace repair no longer loses all of its tags when a comment, processing instruction, or CDATA section before the root element contains something that looks like a tag. The repair now also places the declarations correctly in a self-closing root element and no longer cuts the root tag short at a > inside a quoted attribute value.
• An XMP packet in need of a namespace repair no longer loses all of its tags when its root element declares one of its prefixes with an empty namespace URI, as in xmlns:p="", and that prefix also appears somewhere other than as an element or attribute name.
• An XMP packet in need of a namespace repair no longer loses all of its tags when an attribute value on its root element contains text that looks like a namespace declaration, as in note='xmlns:p="urn:z"', and the prefix it names is used in the packet without a real declaration.
• An XMP tag written as a list (rdf:Bag, rdf:Seq, or rdf:Alt) is no longer dropped from the output when ExifReader has a description function for the tag that throws on a list, for example exif:GPSLatitude, exif:GPSLongitude, or exif:ColorSpace. Such a tag is now returned with its list value, and its description is the descriptions of the list items joined together.

Full Changelog: mattiasw/ExifReader@v4.43.0...v4.44.0

4.43.0: Denial-of-service hardening for HEIC, AVIF, Exif, MPF and XMP

Changed

• An XMP tag value that comes from an rdf:value element with child elements is now an object without a prototype, so that a child element named __proto__ can be kept under its own name. Such an object has no inherited methods, so e.g. hasOwnProperty cannot be called on it.

Fixed

• A PNG tIME chunk with a date field too wide for its zero-padded width, e.g. a month byte of 200, no longer makes load() throw a RangeError that also discards all other metadata in the file. The field is now rendered at its natural width in the Modify Date description.
• A Photoshop 8BIM resource whose declared size runs past the end of the available data no longer makes load() throw. The resource value is truncated to the bytes that are present, and the walk also stops cleanly when the data ends in the middle of a resource header, so the resources preceding a malformed one are still returned.
• A namespace prefix named after a JavaScript object property, for example __proto__ or constructor, is now handled like any other prefix when a missing namespace declaration is repaired. An XMP element or attribute without a prefix and named after such a property is now handled like any other one too. Such an element previously got a wrong value, or was lost altogether, and its description could come back as an inherited JavaScript value instead of text.
• An XMP packet no longer loses all of its tags when its root element declares a namespace prefix containing a dot, such as xmlns:xmp.iid="...", that name also appears before a colon somewhere in the packet, and some other prefix is used where it is not declared. A prefix of any shape was lost the same way when its declaration put whitespace around the equals sign, as in xmlns:xmp = "...".

Security

• Fixed a denial-of-service vulnerability where a crafted HEIC or AVIF file could make metadata parsing allocate far more memory, and take far longer, than the size of the file warrants. The item list of an iloc box was bounded by the size of the whole file rather than by the length the box itself declares. Items and their extents are now bounded by the length their own box declares, or by the end of the available data when that comes first.
• Fixed a second denial-of-service vulnerability of the same class, one level up in the generic box walk. A HEIC or AVIF box was only checked for where it started inside its container, never for how far it read, which made the iloc bound bypassable by wrapping each iloc in a container. A box is now bounded by the container that declares it, and one that over-declares is read only as far as its container reaches.
• Fixed a denial-of-service vulnerability where a crafted image or XMP file could make ExifReader spend quadratic time repairing an undeclared XML namespace prefix before parsing. Both quadratic paths, de-duplicating the found prefixes and scanning the packet for prefix usages, are now linear. This affects environments where a DOM parser is available: web browsers, and Node.js when the domParser option is used or when @xmldom/xmldom is installed.
• Fixed a denial-of-service vulnerability where a crafted image could make Exif parsing decode far more tag data than the file actually contains. Each tag value was bounded on its own, but nothing bounded their sum. The decoded values of an IFD and the sub-IFDs it points to are now bounded together by a small multiple of the size of the data being parsed.
• Fixed a denial-of-service vulnerability where a crafted JPEG could make MPF (Multi-Picture Format) parsing allocate far more memory than the size of the file warrants. Nothing bounded the number of extracted sub-image copies or their sum, so a file of around 128 KiB could retain more than a gigabyte. The total size of the extracted sub-images is now bounded to a small multiple of the input size, and offsets or sizes of 2 GiB or more are handled.

Full Changelog: mattiasw/ExifReader@v4.42.0...v4.43.0

Changelog

Sourced from exifreader's changelog.

[4.44.0] - 2026-08-21

Changed

• The value of an XMP tag that comes from an rdf:value element with child elements is now an object of regular tags instead of the parser's internal nodes. Each child is keyed by its local name (Inner instead of my:Inner) and has value, attributes, and description like any other tag, which is what the TypeScript definitions have described all along. The description of the tag itself follows the new names, for example Inner: 42 where it used to be my:Inner: 42.
• The content of an rdf:value element is now parsed much as the content of the tag element itself would have been. A list written directly inside rdf:value is therefore a list tag now, so a qualified value written as an rdf:Alt with xml:lang keeps both its text and its language where it used to come back as raw parser nodes. Such a list also takes the place of any sibling elements inside the same rdf:value.
• Two further consequences of that parsing, if you read these values: a child without a namespace prefix lands under the name undefined, as an element without a prefix does everywhere else in the output, so two such children collapse into one; and a child that holds elements of its own, without being marked rdf:parseType="Resource" itself, is kept without them.
• The value object of such a tag still has no prototype, as it has since 4.43.0. A child of it named __proto__ is kept under that name, and so is one nested further down, which is new (see the entry below).

Fixed

• An XMP element or attribute named __proto__ is now kept as a tag under that name. Such a name was used in a plain property assignment, which JavaScript takes as a request to replace the prototype of the object holding the tag, so the tag was lost and the fields of the tag object (value, attributes, and description) showed up as properties of the object it should have been stored in, including among the top level XMP tags, where the image had no such tags. The value of an rdf:value element with child elements was the only place already protected, since 4.43.0.
• The description of an XMP tag written as a list is now always a string. When ExifReader has a description function for the tag that neither handles a list nor throws on one, for example tiff:Orientation or tiff:XResolution, the function handed the list back unchanged and the list itself became the description, where the TypeScript definitions promise a string. The descriptions of the list items joined together are used instead, which is what a list without a description function gets. Together with the entry below about a description function that throws, a list description is now a string whatever the function does with it.
• An XMP tag with more than one rdf:value child element is no longer lost or returned without a value. The repeated elements were collected into a list that the value parser did not recognize, which left the tag with a value of undefined and the description "undefined", and which threw for an item of an rdf:Bag, rdf:Seq, or rdf:Alt, dropping the whole list tag. The last

... (truncated)

Commits

• ea2fd0b 4.44.0
• ac88702 Update changelog for 4.44.0
• 5181400 Ignore XMP namespace declarations inside quoted attribute values
• 94a1abd Keep an XMP tag named proto instead of replacing a prototype
• 76c0fbd Parse the children of an XMP rdf:value element as tags
• 52dfeb3 Recognize XMP namespace declarations with an empty namespace URI
• 7422ea2 Keep an XMP list tag whose description function throws
• f76d401 Fix XMP namespace repair inserting declarations into a comment
• d26a227 Bump globals from 17.9.0 to 17.11.0 in the all-dependencies group
• b3fc865 4.43.0
• Additional commits viewable in compare view

Updates check-package-lock from 1.14.17 to 1.14.18

Release notes

Sourced from check-package-lock's releases.

v1.14.18

What's Changed

• update deps by @​gemal in gemal/node-check-package-lock#494

Full Changelog: gemal/node-check-package-lock@v1.14.17...v1.14.18

Commits

• 66a48a9 chore: release 1.14.18 [skip ci]
• 105e6a7 Merge pull request #494 from gemal/1
• 222b998 update deps
• See full diff in compare view

Updates eslint from 10.8.1 to 10.9.0

Release notes

Sourced from eslint's releases.

v10.9.0

Features

• 08de88e feat: handle underflow in no-loss-of-precision (#21218) (Rithish S)
• 55db479 feat: add checkConditionalExpressions to no-unmodified-loop-condition (#21175) (sethamus)

Bug Fixes

• 2ba3025 fix: prevent unsafe no-var autofix with hoisted functions (#21213) (sethamus)
• 8e69622 fix: Prevent no-var autofix when var is shadowed by catch parameter (#21204) (Yang Hyeonjong)
• 684b579 fix: prefer-template invalid autofix creates a tagged template call (#21207) (김채영)

Documentation

• 9ef407a docs: use eslint.config.* wherever config file names are listed (#21216) (Marry (Subin Yang))
• 87f66f4 docs: Update README (GitHub Actions Bot)
• 585ef37 docs: update architecture documentation (#21112) (Francesco Trotta)
• f3993b0 docs: Update README (GitHub Actions Bot)
• ffc87d6 docs: fix broken links in Further Reading sections (#21203) (Minsu)
• 1a761e1 docs: update moved JSX specification links (#21198) (Imran Mustafa)
• 4d00ca4 docs: update ESLint peer dependency to ^10.0.0 in shareable configs (#21202) (lumir)
• 510d1a2 docs: Update README (GitHub Actions Bot)

Chores

• 899dbf1 chore: update github/codeql-action action to v4.37.7 (#21243) (renovate[bot])
• 9aa3873 chore: update ecosystem plugins (#21235) (ESLint Bot)
• dc1e7a8 chore: update ecosystem plugins (#21208) (ESLint Bot)
• f878d21 ci: bump pnpm/action-setup from 6.0.9 to 6.0.10 (#21200) (dependabot[bot])
• 4891e50 ci: bump github/codeql-action from 4.37.4 to 4.37.6 (#21199) (dependabot[bot])

Commits

• c27bc92 10.9.0
• fa831d9 Build: changelog update for 10.9.0
• 899dbf1 chore: update github/codeql-action action to v4.37.7 (#21243)
• 08de88e feat: handle underflow in no-loss-of-precision (#21218)
• 9ef407a docs: use eslint.config.* wherever config file names are listed (#21216)
• 9aa3873 chore: update ecosystem plugins (#21235)
• 2ba3025 fix: prevent unsafe no-var autofix with hoisted functions (#21213)
• dc1e7a8 chore: update ecosystem plugins (#21208)
• 87f66f4 docs: Update README
• 8e69622 fix: Prevent no-var autofix when var is shadowed by catch parameter (#21204)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	exifreader@​4.42.0 ⏵ 4.44.0	+1		+1	+1
	check-package-lock@​1.14.17 ⏵ 1.14.18	+3		+1	+1
	eslint@​10.8.1 ⏵ 10.9.0	+1

View full report