M26: [Major] Dependency audit — exifr abandoned (only EXIF reader), piexifjs frozen, vite/jsdom/vitest major drift

[curtyo18]

Summary

Four packages in the manifests have either been abandoned upstream or are two majors behind current. Reviewing each per standards/dependency-discipline.md:

A. exifr — Important (load-bearing + abandoned)

packages/engine/package.json:21 — exifr ^7.1.0. Per the reviewer's claim, last release 2022-05-01 (~4 years stale). exifr is the only image-EXIF reader on the engine path. The tool's value depends on correct image date extraction; carrying an abandoned EXIF parser is a real liability.

Options:

1. Pin tightly with comment documenting the freeze and a tracking issue (do nothing structural now).
2. Evaluate alternatives — @exifr/parse, exiftool-vendored, piexifjs (also stale — see B), node-exif. Each has trade-offs around features, binary deps, and licensing.
3. Migrate to a current alternative as a tracked effort.

B. piexifjs — Important (devDep, frozen test-fixture-builder)

packages/engine/package.json:25-29 — piexifjs ^1.0.6, last release 2022-06-23. Used by packages/engine/src/scan/__fixtures__/build-fixtures.ts to write synthetic EXIF for tests. Since sharp is already a production dep, the fixture builder could use sharp's EXIF write path and drop piexifjs entirely.

C. vite ^5.4.0, jsdom ^25.0.0 (packages/ui/package.json)

Two majors behind current (vite 8.x, jsdom 29.x). Per dependency-discipline.md: major drift without a documented review is Important. UI-scoped per the user's "ignore UI" instruction, but the deps audit itself isn't UI work — listing for visibility.

D. vitest ^2.1.0 (root package.json)

Two majors behind (vitest 4.x). Engine + shared + UI all use it. vitest 4 removed defineWorkspace (the entry point in vitest.workspace.ts:1-7), so the bump will touch the workspace config file.

Background

From the 2026-05-17 multi-agent full-repo review. Verify each "last release" claim against the npm registry before acting; the reviewer's dates need a npm view <pkg> confirmation step in the PR.

Acceptance criteria

A. exifr

• npm view exifr time.modified confirms (or refutes) the 2022 date claim. Capture the actual last-release timestamp in the PR description.
• If confirmed stale: add a code comment at the only import site (packages/engine/src/scan/metadata-image.ts) documenting the choice to stay on exifr and the alternative options considered.
• Open a follow-up issue (or tracker note) to revisit if/when an alternative becomes attractive — not blocked by this PR.

B. piexifjs

• Audit: does sharp support writing arbitrary EXIF tags needed by the test fixtures? Read the sharp docs / try in a quick spike.
• If yes: rewrite __fixtures__/build-fixtures.ts to use sharp; remove piexifjs from packages/engine/package.json; delete __fixtures__/piexifjs.d.ts.
• If no: pin piexifjs to exact version, add a comment explaining the freeze.

C. vite + jsdom (UI)

• Excluded from this issue's scope per the user's "ignore UI" instruction. Filed only for visibility. Open a separate UI-scoped issue if a bump is wanted.

D. vitest

• Note the path forward: vitest 4 migration removes defineWorkspace in favor of projects in a root vitest.config.ts. Either: schedule the bump as a dedicated effort (small PR, but touches every package's vitest.config), or document the freeze with a comment in vitest.workspace.ts.

Files affected (likely)

• packages/engine/package.json — exifr / piexifjs notes or removal
• packages/engine/src/scan/__fixtures__/build-fixtures.ts — sharp-based rewrite if B path taken
• packages/engine/src/scan/__fixtures__/piexifjs.d.ts — delete if B path taken
• vitest.workspace.ts — comment about vitest 4 migration

Suggested approach

Smallest first: D (one comment + decision) → B (sharp spike + cleanup) → A (comment + register follow-up). C is excluded.

Out of scope

• The UI dependency drift (vite, jsdom) — separate UI-scoped issue if pursued.
• Switching to pnpm or yarn (unrelated to this audit; would be its own discussion).
• The @hono/node-ws and @preact/signals unused-deps — covered by closed #M11.

References

• Standards: standards/dependency-discipline.md
• Code: packages/engine/package.json, root package.json, vitest.workspace.ts