chore(deps): bump exiftool-vendored from 35.20.0 to 37.1.0

[dependabot]

Bumps exiftool-vendored from 35.20.0 to 37.1.0.

Release notes

Sourced from exiftool-vendored's releases.

Release 37.1.0

• 📦 Updated to batch-cluster v19.0.0, which closes several ways an ExifTool child process could be leaked, and two ways a task's promise could be dropped: pending work now keeps the event loop alive (a task queued while the pool was momentarily empty used to be abandoned, with node exiting 0 and no error), and .end() now rejects still-queued tasks instead of leaving them unsettled. await exiftool.end() is now a barrier — it waits for in-flight spawns and recycling, so await exiftool.end(); process.exit(0) can no longer orphan a child — and may take slightly longer to resolve than in v37.0.0.

• ✨ Documented maxFailedTasksPerProcess on ExifToolOptions. It stays disabled (0), matching batch-cluster v19's new default. Enabling it suits ExifTool poorly: a rejected task nearly always means the file was bad, not that ExifTool is sick, and -stay_open mode keeps working after per-file errors, so recycling costs a Perl interpreter startup per bad file. Sick processes are still recycled by taskTimeoutMillis, stream errors, and healthCheckCommand.

• ✨ Documented batch-cluster's new killProcessGroup option on ExifToolOptions, defaulting to false. It only matters for a processFactory that spawns with detached: true, which ExifTool's default factory does not. TypeScript consumers who build a complete ExifToolOptions object by hand must add this new required property; Partial<ExifToolOptions> callers are unaffected.

  Commits

  Full Changelog: photostructure/exiftool-vendored.js@37.0.0...37.1.0

Release 37.0.0

• 💔 BREAKING: malformed UTF-8 in ExifTool JSON output is now marked with Unicode replacement character U+FFFD (�) instead of ASCII question mark (?). For example, malformed bytes dc 4b previously surfaced as ?K and now surface as �K. This applies to both read() and readRaw(), including scalar and list values and calls that override readArgs. Valid Unicode and authored question marks are unchanged.

  • The original malformed string bytes are available without rereading the media through an optional sparse invalidUtf8Bytes sidecar. It mirrors tag paths, uses numeric object keys for damaged list items, stores each leaf as a Uint8Array, and is absent when no malformed strings were found:

    const tags = await exiftool.read(file);
    tags.City; // "�K"
    tags.invalidUtf8Bytes?.City; // Uint8Array([0xdc, 0x4b])

    exiftool-vendored does not guess a legacy charset. Consumers may decode

... (truncated)

Changelog

Sourced from exiftool-vendored's changelog.

v37.1.0

• 📦 Updated to batch-cluster v19.0.0, which closes several ways an ExifTool child process could be leaked, and two ways a task's promise could be dropped: pending work now keeps the event loop alive (a task queued while the pool was momentarily empty used to be abandoned, with node exiting 0 and no error), and .end() now rejects still-queued tasks instead of leaving them unsettled. await exiftool.end() is now a barrier — it waits for in-flight spawns and recycling, so await exiftool.end(); process.exit(0) can no longer orphan a child — and may take slightly longer to resolve than in v37.0.0.

• ✨ Documented maxFailedTasksPerProcess on ExifToolOptions. It stays disabled (0), matching batch-cluster v19's new default. Enabling it suits ExifTool poorly: a rejected task nearly always means the file was bad, not that ExifTool is sick, and -stay_open mode keeps working after per-file errors, so recycling costs a Perl interpreter startup per bad file. Sick processes are still recycled by taskTimeoutMillis, stream errors, and healthCheckCommand.

• ✨ Documented batch-cluster's new killProcessGroup option on ExifToolOptions, defaulting to false. It only matters for a processFactory that spawns with detached: true, which ExifTool's default factory does not. TypeScript consumers who build a complete ExifToolOptions object by hand must add this new required property; Partial<ExifToolOptions> callers are unaffected.

v37.0.0

• 💔 BREAKING: malformed UTF-8 in ExifTool JSON output is now marked with Unicode replacement character U+FFFD (�) instead of ASCII question mark (?). For example, malformed bytes dc 4b previously surfaced as ?K and now surface as �K. This applies to both read() and readRaw(), including scalar and list values and calls that override readArgs. Valid Unicode and authored question marks are unchanged.

  • The original malformed string bytes are available without rereading the media through an optional sparse invalidUtf8Bytes sidecar. It mirrors tag paths, uses numeric object keys for damaged list items, stores each leaf as a Uint8Array, and is absent when no malformed strings were found:

    const tags = await exiftool.read(file);
    tags.City; // "�K"
    tags.invalidUtf8Bytes?.City; // Uint8Array([0xdc, 0x4b])

    exiftool-vendored does not guess a legacy charset. Consumers may decode only these captured bytes using camera, tag, locale, or user-specific evidence while retaining the U+FFFD value as a deterministic fallback.

... (truncated)

Commits

• 3994c12 Release 37.1.0
• c76fbe6 feat: update to batch-cluster v19.0.0 and add new ExifToolOptions properties ...
• a047c4a chore(deps): update actions/checkout and actions/setup-node to latest versions
• c3264df Release 37.0.0
• d765d72 docs(cleanup): correct resource lifecycle guarantees
• 384e756 feat(read)!: mark malformed UTF-8 with U+FFFD and expose original bytes
• f3cf2e1 chore(deps): hold TypeScript at 6.x; move ncu policy to .ncurc.js
• 7289fa0 chore(deps): update typedoc and typescript-eslint to latest versions
• 36b19aa Release 36.1.0
• ca1304a feat: add typed exact tag edits
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
afilmory	Ready	Preview	Aug 9, 2026 9:46pm