chore(deps): update cask sztheory/exifcleaner to v4 #39

2026-08-05T15:01:16Z

isityael commented

2026-08-05 15:01:16 +00:00

(Migrated from github.com)

This PR contains the following updates:

Package	Update	Change
szTheory/exifcleaner	major	`3.6.0` → `4.2.0`

Release Notes

szTheory/exifcleaner (szTheory/exifcleaner)

`v4.2.0`

Compare Source

Added

Romanian translation with contributor-preserved wording and reviewable per-key provenance
A user-initiated New Releases item in the Help menu
Complete first-run vocabulary across every supported locale

Changed

The empty intake is now one centered, responsive composition with a clear primary file action, secondary folder action, and truthful output-mode reassurance
ExifTool is updated to 13.59 for Unix and 32-bit-compatible Windows packages with pinned upstream SHA-256 verification
Packaged Electron disables RunAsNode, NODE_OPTIONS, and Node CLI inspection while leaving cookie encryption disabled
Translation tooling reports legacy gaps without overwriting community strings or presenting assisted drafts as human-reviewed work

Fixed

Re-running release automation for an already-published version exits quietly without downloading artifacts or mutating release state
Folder intake reports unsupported files and unreadable folders instead of dropping that accounting at the IPC boundary

`v4.1.0`

Compare Source

Added

Truthful per-file outcomes, before/after size display, stable table sorting, and immediately visible removed metadata
Native file and folder pickers with a visible output-mode summary and unsupported-file feedback
Architecture, code walkthrough, subsystem, contribution, and translation documentation with drift checks

Changed

New installs default to Save as copy; existing settings retain their chosen behavior
MP4/MOV cleaning explicitly clears QuickTime movie, track, and media date fields
Dependency and CI baselines were refreshed, with pinned Actions and an exact release-artifact inventory
Vietnamese locale handling uses the standard vi code; locale resources are independently reviewable

Fixed

RAF input is refused without mutation instead of producing an artifact that cannot meet the cleaning contract
Already-clean files no longer incur an unnecessary rewrite
Carriage-return and line-feed paths are rejected before reaching ExifTool
macOS window close/reopen follows the expected single-instance lifecycle

`v4.0.1`: ExifCleaner v4.0.1

Compare Source

ExifCleaner 4.0.1

ExifCleaner 4.0.1 is a focused data-safety and release-reliability update.

Data safety

Save as copy now preserves the original. The app writes to the actual collision-safe _cleaned path and Reveal follows that returned path.
RAW files always use a copy. Supported RAW formats never overwrite the submitted original, even when Save as copy is disabled.
RAW and video output is verified before success. Failed generated output is removed instead of being reported as complete.

Privacy

Remove macOS attributes is now connected to the processing path. When enabled, it clears extended attributes from the artifact that was actually written.
The macOS attribute command now passes filenames as fixed arguments rather than through a shell.

Release reliability

Installed builds now exercise the save-as-copy and advertised-format contracts on macOS, Windows, and Linux before release artifacts are accepted.
Release notes must match the package version, known gaps must remain machine-readable, and two-part internal tags are rejected from the public release namespace.
The release also includes the previously unreleased SIZE display, settings icon, PDF fixture, per-launch test-profile, and release-gate fixes from #300, #301, #305, #306, and #292.

Known limitations in 4.0.1

Impact: A cleaned MP4 may still include original create-date metadata values.
Scope: MP4 files with QuickTime CreateDate, TrackCreateDate, or MediaCreateDate values processed through ExifCleaner 4.0.0 or 4.0.1
Workaround: For sensitive MP4s, run ExifTool manually with -CreateDate= -TrackCreateDate= -MediaCreateDate= after cleaning, then verify those tags are absent.
Target fix: 4.1.0.
Issue: #240

See the README's known limitations by format before relying on irreversible removal from PDF or MKV files.

Downloads

Platform	File
Windows portable (recommended)	`ExifCleaner.4.0.1.exe`
Windows installer	`ExifCleaner.Setup.4.0.1.exe`
macOS (Apple Silicon)	`ExifCleaner-4.0.1-arm64.dmg`
macOS (Intel)	`ExifCleaner-4.0.1.dmg`
Linux (AppImage)	`ExifCleaner-4.0.1.AppImage`
Linux (Debian/Ubuntu)	`exifcleaner_4.0.1_amd64.deb`
Linux (Fedora/RHEL)	`exifcleaner-4.0.1.x86_64.rpm`

Verify downloads against the release's SHASUMS256.txt file.

Windows security checks

Windows portable (recommended): ExifCleaner.4.0.1.exe — SHA-256 7375676a911fccefd4d2731621bf9d815932153750d7b900e6e8ecec48028f12; VirusTotal report; submitted to Microsoft for malware analysis on 2026-08-02.
Windows installer: ExifCleaner.Setup.4.0.1.exe — SHA-256 ad77fe49f2e58d6df153e1a841ad784e15cef2d6a7bc38b771b89fb0d0a7bac4; VirusTotal report; submitted to Microsoft for malware analysis on 2026-08-02.

These unsigned artifacts may still trigger reputation-based warnings. The links above identify the exact release bytes; they are not a promise that every scanner reports zero detections.

Opening unsigned builds

ExifCleaner remains unsigned. Signing would require publishing the maintainer's verified legal identity; no signed build is being promised.

macOS

macOS 14 (Sonoma) and earlier: right-click or Control-click the app, choose Open, then choose Open again.
macOS 15 (Sequoia) and later: open the app once, then use System Settings → Privacy & Security → Open Anyway.

Windows

The portable build is the primary Windows download. If SmartScreen displays “Windows protected your PC,” choose More info → Run anyway after verifying the checksum.

Linux

Make the AppImage executable with chmod +x ExifCleaner-4.0.1.AppImage. The .deb and .rpm packages install normally.

Verification

Every artifact is built publicly from tagged source by GitHub Actions.
CI installs and exercises the native DMG, NSIS installer, and AppImage before assembling the draft.
SHASUMS256.txt identifies the exact bytes published with this release.
No automatic-update manifests are published; ExifCleaner continues to make zero network requests during normal use.

Only download ExifCleaner from the GitHub releases page.

Full changelog: https://github.com/szTheory/exifcleaner/compare/v4.0.0...v4.0.1

`v4.0.0`

Compare Source

Complete modernization of ExifCleaner after a 5-year hiatus. Every layer of the application has been rebuilt — from Electron 11 to 35, vanilla DOM to React 19, loose scripts to DDD architecture, zero tests to 265 unit + 42 E2E tests.

Security

Upgrade to Electron 35 (from 11) with all Chromium security patches
Content Security Policy (CSP) meta tag blocks eval, inline scripts, and remote resources
Electron Fuses disable runAsNode, NODE_OPTIONS, and --inspect in production builds
IPC payload validation with Zod schemas on all 16 channels
IPC sender verification — only the authorized BrowserWindow can invoke handlers
Navigation hardening — renderer cannot navigate to external URLs
Permission gate — all Chromium permission requests denied by default
Renderer fully sandboxed with contextIsolation, no Node.js access

Added

Preserve orientation metadata — option to keep EXIF rotation tag so photos don't flip (issues #209, #234)
Save as copy — create _cleaned copy instead of overwriting original (issues #218, #124)
Remove macOS extended attributes — strips xattr/quarantine metadata (issue #86)
Preserve file timestamps — keep original created/modified dates
Folder recursion — drop a folder to process all files inside recursively (issues #171, #231)
Metadata inspection — expand any file to see before/after metadata diff
Language switching — change language from settings without restarting (issue #244, 25 locales)
WebP support verified working (issue #264)
Settings panel with 5 privacy toggles, theme selector, and language picker
Dark mode with intentional design respecting OS prefers-color-scheme
Playwright E2E test suite (42 tests, 10 specs, ~30s)
Vitest unit test suite (265 tests, ~1.4s)
GitHub Actions CI — lint, typecheck, unit tests, E2E tests, cross-platform builds
GitHub Actions release workflow with macOS code signing and notarization
SHASUMS256.txt generated automatically for all release artifacts
Translations: Persian, Catalan, Croatian updates merged

Changed

React 19 SPA replaces vanilla DOM renderer — component architecture with BEM CSS design system
DDD architecture — domain types, application commands/queries, infrastructure adapters, composition root
TypeScript 5.7 strict mode with all additional safety flags (noUncheckedIndexedAccess, exactOptionalPropertyTypes, etc.)
electron-vite 5 + Vite 7 replaces electron-webpack — faster builds, HMR, ESM
electron-builder 26 (from 22) with macOS universal binary support (Intel + Apple Silicon)
ExifTool v13.50 (from 12.25) with checksum verification
Hand-rolled ExifTool wrapper replaces node-exiftool — implements -stay_open protocol directly (~240 lines)
Full ESM — "type": "module" throughout, verbatimModuleSyntax enforced
Platform requirements: macOS 10.15+, Windows 10+, Linux 64-bit (previously macOS 10.10+, Windows 7+)
Typed error handling with discriminated unions across 4 error domains

Removed

node-exiftool npm dependency (replaced by hand-rolled wrapper)
source-map-support (Node 22 has built-in source maps)
Spectre CSS framework (replaced by BEM CSS with custom properties)
electron-webpack and webpack (replaced by electron-vite)
Travis CI configuration (replaced by GitHub Actions)
Auto-update check on startup (never worked reliably, removed entirely)

Configuration

📅 Schedule: (in timezone Europe/Berlin)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [szTheory/exifcleaner](https://redirect.github.com/szTheory/exifcleaner) | major | `3.6.0` → `4.2.0` | --- ### Release Notes <details> <summary>szTheory/exifcleaner (szTheory/exifcleaner)</summary> ### [`v4.2.0`](https://redirect.github.com/szTheory/exifcleaner/blob/HEAD/CHANGELOG.md#420) [Compare Source](https://redirect.github.com/szTheory/exifcleaner/compare/v4.1.0...v4.2.0) ##### Added - Romanian translation with contributor-preserved wording and reviewable per-key provenance - A user-initiated **New Releases** item in the Help menu - Complete first-run vocabulary across every supported locale ##### Changed - The empty intake is now one centered, responsive composition with a clear primary file action, secondary folder action, and truthful output-mode reassurance - ExifTool is updated to 13.59 for Unix and 32-bit-compatible Windows packages with pinned upstream SHA-256 verification - Packaged Electron disables RunAsNode, `NODE_OPTIONS`, and Node CLI inspection while leaving cookie encryption disabled - Translation tooling reports legacy gaps without overwriting community strings or presenting assisted drafts as human-reviewed work ##### Fixed - Re-running release automation for an already-published version exits quietly without downloading artifacts or mutating release state - Folder intake reports unsupported files and unreadable folders instead of dropping that accounting at the IPC boundary ### [`v4.1.0`](https://redirect.github.com/szTheory/exifcleaner/blob/HEAD/CHANGELOG.md#410) [Compare Source](https://redirect.github.com/szTheory/exifcleaner/compare/v4.0.1...v4.1.0) ##### Added - Truthful per-file outcomes, before/after size display, stable table sorting, and immediately visible removed metadata - Native file and folder pickers with a visible output-mode summary and unsupported-file feedback - Architecture, code walkthrough, subsystem, contribution, and translation documentation with drift checks ##### Changed - New installs default to Save as copy; existing settings retain their chosen behavior - MP4/MOV cleaning explicitly clears QuickTime movie, track, and media date fields - Dependency and CI baselines were refreshed, with pinned Actions and an exact release-artifact inventory - Vietnamese locale handling uses the standard `vi` code; locale resources are independently reviewable ##### Fixed - RAF input is refused without mutation instead of producing an artifact that cannot meet the cleaning contract - Already-clean files no longer incur an unnecessary rewrite - Carriage-return and line-feed paths are rejected before reaching ExifTool - macOS window close/reopen follows the expected single-instance lifecycle ### [`v4.0.1`](https://redirect.github.com/szTheory/exifcleaner/releases/tag/v4.0.1): ExifCleaner v4.0.1 [Compare Source](https://redirect.github.com/szTheory/exifcleaner/compare/v4.0.0...v4.0.1) ### ExifCleaner 4.0.1 ExifCleaner 4.0.1 is a focused data-safety and release-reliability update. #### Data safety - **Save as copy now preserves the original.** The app writes to the actual collision-safe `_cleaned` path and Reveal follows that returned path. - **RAW files always use a copy.** Supported RAW formats never overwrite the submitted original, even when Save as copy is disabled. - **RAW and video output is verified before success.** Failed generated output is removed instead of being reported as complete. #### Privacy - **Remove macOS attributes is now connected to the processing path.** When enabled, it clears extended attributes from the artifact that was actually written. - The macOS attribute command now passes filenames as fixed arguments rather than through a shell. #### Release reliability - Installed builds now exercise the save-as-copy and advertised-format contracts on macOS, Windows, and Linux before release artifacts are accepted. - Release notes must match the package version, known gaps must remain machine-readable, and two-part internal tags are rejected from the public release namespace. - The release also includes the previously unreleased SIZE display, settings icon, PDF fixture, per-launch test-profile, and release-gate fixes from [#300](https://redirect.github.com/szTheory/exifcleaner/issues/300), [#301](https://redirect.github.com/szTheory/exifcleaner/issues/301), [#305](https://redirect.github.com/szTheory/exifcleaner/issues/305), [#306](https://redirect.github.com/szTheory/exifcleaner/issues/306), and [#292](https://redirect.github.com/szTheory/exifcleaner/issues/292).  #### Known limitations in 4.0.1 - Impact: A cleaned MP4 may still include original create-date metadata values. Scope: MP4 files with QuickTime CreateDate, TrackCreateDate, or MediaCreateDate values processed through ExifCleaner 4.0.0 or 4.0.1 Workaround: For sensitive MP4s, run ExifTool manually with -CreateDate= -TrackCreateDate= -MediaCreateDate= after cleaning, then verify those tags are absent. Target fix: 4.1.0. Issue: [#240](https://redirect.github.com/szTheory/exifcleaner/issues/240)  See the README's [known limitations by format](https://redirect.github.com/szTheory/exifcleaner#known-limitations-by-format) before relying on irreversible removal from PDF or MKV files. #### Downloads | Platform | File | | ---------------------------------- | ------------------------------ | | **Windows portable (recommended)** | `ExifCleaner.4.0.1.exe` | | Windows installer | `ExifCleaner.Setup.4.0.1.exe` | | macOS (Apple Silicon) | `ExifCleaner-4.0.1-arm64.dmg` | | macOS (Intel) | `ExifCleaner-4.0.1.dmg` | | Linux (AppImage) | `ExifCleaner-4.0.1.AppImage` | | Linux (Debian/Ubuntu) | `exifcleaner_4.0.1_amd64.deb` | | Linux (Fedora/RHEL) | `exifcleaner-4.0.1.x86_64.rpm` | Verify downloads against the release's `SHASUMS256.txt` file.  #### Windows security checks - **Windows portable (recommended):** `ExifCleaner.4.0.1.exe` — SHA-256 `7375676a911fccefd4d2731621bf9d815932153750d7b900e6e8ecec48028f12`; [VirusTotal report](https://www.virustotal.com/gui/file/7375676a911fccefd4d2731621bf9d815932153750d7b900e6e8ecec48028f12); submitted to Microsoft for malware analysis on 2026-08-02. - **Windows installer:** `ExifCleaner.Setup.4.0.1.exe` — SHA-256 `ad77fe49f2e58d6df153e1a841ad784e15cef2d6a7bc38b771b89fb0d0a7bac4`; [VirusTotal report](https://www.virustotal.com/gui/file/ad77fe49f2e58d6df153e1a841ad784e15cef2d6a7bc38b771b89fb0d0a7bac4); submitted to Microsoft for malware analysis on 2026-08-02. These unsigned artifacts may still trigger reputation-based warnings. The links above identify the exact release bytes; they are not a promise that every scanner reports zero detections.  #### Opening unsigned builds ExifCleaner remains unsigned. Signing would require publishing the maintainer's verified legal identity; no signed build is being promised. ##### macOS - **macOS 14 (Sonoma) and earlier:** right-click or Control-click the app, choose **Open**, then choose **Open** again. - **macOS 15 (Sequoia) and later:** open the app once, then use **System Settings → Privacy & Security → Open Anyway**. ##### Windows The portable build is the primary Windows download. If SmartScreen displays “Windows protected your PC,” choose **More info → Run anyway** after verifying the checksum. ##### Linux Make the AppImage executable with `chmod +x ExifCleaner-4.0.1.AppImage`. The `.deb` and `.rpm` packages install normally. #### Verification - Every artifact is built publicly from tagged source by GitHub Actions. - CI installs and exercises the native DMG, NSIS installer, and AppImage before assembling the draft. - `SHASUMS256.txt` identifies the exact bytes published with this release. - No automatic-update manifests are published; ExifCleaner continues to make zero network requests during normal use. Only download ExifCleaner from the [GitHub releases page](https://redirect.github.com/szTheory/exifcleaner/releases). **Full changelog:** <https://github.com/szTheory/exifcleaner/compare/v4.0.0...v4.0.1> ### [`v4.0.0`](https://redirect.github.com/szTheory/exifcleaner/blob/HEAD/CHANGELOG.md#400) [Compare Source](https://redirect.github.com/szTheory/exifcleaner/compare/v3.6.0...v4.0.0) Complete modernization of ExifCleaner after a 5-year hiatus. Every layer of the application has been rebuilt — from Electron 11 to 35, vanilla DOM to React 19, loose scripts to DDD architecture, zero tests to 265 unit + 42 E2E tests. ##### Security - Upgrade to Electron 35 (from 11) with all Chromium security patches - Content Security Policy (CSP) meta tag blocks eval, inline scripts, and remote resources - Electron Fuses disable runAsNode, NODE\_OPTIONS, and --inspect in production builds - IPC payload validation with Zod schemas on all 16 channels - IPC sender verification — only the authorized BrowserWindow can invoke handlers - Navigation hardening — renderer cannot navigate to external URLs - Permission gate — all Chromium permission requests denied by default - Renderer fully sandboxed with contextIsolation, no Node.js access ##### Added - **Preserve orientation metadata** — option to keep EXIF rotation tag so photos don't flip (issues [#209](https://redirect.github.com/szTheory/exifcleaner/issues/209), [#234](https://redirect.github.com/szTheory/exifcleaner/issues/234)) - **Save as copy** — create `_cleaned` copy instead of overwriting original (issues [#218](https://redirect.github.com/szTheory/exifcleaner/issues/218), [#124](https://redirect.github.com/szTheory/exifcleaner/issues/124)) - **Remove macOS extended attributes** — strips xattr/quarantine metadata (issue [#86](https://redirect.github.com/szTheory/exifcleaner/issues/86)) - **Preserve file timestamps** — keep original created/modified dates - **Folder recursion** — drop a folder to process all files inside recursively (issues [#171](https://redirect.github.com/szTheory/exifcleaner/issues/171), [#231](https://redirect.github.com/szTheory/exifcleaner/issues/231)) - **Metadata inspection** — expand any file to see before/after metadata diff - **Language switching** — change language from settings without restarting (issue [#244](https://redirect.github.com/szTheory/exifcleaner/issues/244), 25 locales) - **WebP support** verified working (issue [#264](https://redirect.github.com/szTheory/exifcleaner/issues/264)) - **Settings panel** with 5 privacy toggles, theme selector, and language picker - **Dark mode** with intentional design respecting OS `prefers-color-scheme` - Playwright E2E test suite (42 tests, 10 specs, \~30s) - Vitest unit test suite (265 tests, \~1.4s) - GitHub Actions CI — lint, typecheck, unit tests, E2E tests, cross-platform builds - GitHub Actions release workflow with macOS code signing and notarization - SHASUMS256.txt generated automatically for all release artifacts - Translations: Persian, Catalan, Croatian updates merged ##### Changed - **React 19 SPA** replaces vanilla DOM renderer — component architecture with BEM CSS design system - **DDD architecture** — domain types, application commands/queries, infrastructure adapters, composition root - **TypeScript 5.7** strict mode with all additional safety flags (noUncheckedIndexedAccess, exactOptionalPropertyTypes, etc.) - **electron-vite 5 + Vite 7** replaces electron-webpack — faster builds, HMR, ESM - **electron-builder 26** (from 22) with macOS universal binary support (Intel + Apple Silicon) - **ExifTool v13.50** (from 12.25) with checksum verification - **Hand-rolled ExifTool wrapper** replaces node-exiftool — implements -stay\_open protocol directly (\~240 lines) - **Full ESM** — `"type": "module"` throughout, `verbatimModuleSyntax` enforced - Platform requirements: macOS 10.15+, Windows 10+, Linux 64-bit (previously macOS 10.10+, Windows 7+) - Typed error handling with discriminated unions across 4 error domains ##### Removed - `node-exiftool` npm dependency (replaced by hand-rolled wrapper) - `source-map-support` (Node 22 has built-in source maps) - Spectre CSS framework (replaced by BEM CSS with custom properties) - `electron-webpack` and webpack (replaced by electron-vite) - Travis CI configuration (replaced by GitHub Actions) - Auto-update check on startup (never worked reliably, removed entirely) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Berlin) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://redirect.github.com/renovatebot/renovate).

chatgpt-codex-connector[bot] (Migrated from github.com) reviewed

2026-08-05 15:03:34 +00:00

chatgpt-codex-connector[bot] (Migrated from github.com) left a comment

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7fb865287f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

### 💡 Codex Review Here are some automated review suggestions for this pull request. **Reviewed commit:** `7fb865287f` <details> <summary>ℹ️ About Codex in GitHub</summary> [Your team has set up Codex to review pull requests in this repo](https://chatgpt.com/codex/cloud/settings/general). Reviews are triggered when you - Open a pull request for review - Mark a draft as ready - Comment "@codex review". If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". </details>

Casks/exifcleaner.rb

					
				@ -1,5 +1,5 @@

				cask "exifcleaner" do

				  version "3.6.0"

				  version "4.2.0"

				  sha256 "459b296b000a7cd614713772e9b4ecf1604d3bb10926ab2346e8ea88e44df323"

Update the checksum with the version bump

Bumping version changes the download URL to ExifCleaner-4.2.0.dmg, but the cask still carries the prior 3.6.0 SHA-256 (459b296...). For every install or upgrade of this cask, Homebrew will fetch the 4.2.0 DMG and fail checksum verification before installing, so the update is unusable until the sha256 is refreshed for the new artifact.

Useful? React with 👍 / 👎.

**![P1 Badge](https://img.shields.io/badge/P1-orange?style=flat) Update the checksum with the version bump** Bumping `version` changes the download URL to `ExifCleaner-4.2.0.dmg`, but the cask still carries the prior 3.6.0 SHA-256 (`459b296...`). For every install or upgrade of this cask, Homebrew will fetch the 4.2.0 DMG and fail checksum verification before installing, so the update is unusable until the `sha256` is refreshed for the new artifact. Useful? React with 👍 / 👎.

Sign in to join this conversation.

No reviewers