Update getID3 to version 1.9.26

[Soean]

Follow up to #64914.

getID3 1.9.26 has been released. The bundled copy in src/wp-includes/ID3/ is currently at 1.9.25.

This release is mostly bug fixes and hardening for malformed or truncated media files, plus one new format:

• ID3v2 frame reading is now clamped to the file size.
• APE and Lyrics3 tag detection no longer performs negative seeks on very small files.
• Added a bounds check to the QuickTime ES descriptor length parser.
• The LAME integer_version array is initialised to avoid undefined array key notices on malformed MP3 headers.
• RIFF INFO ITRK is now mapped to track_number.
• is_integer() has been replaced with is_int(), and error-suppressed @list() destructuring has been replaced with array_pad(), which removes a number of PHP 8.5 warnings.
• Command paths passed to the Windows vorbiscomment.exe helper are now escaped with escapeshellarg(). This helper is not used by WordPress, but the fix is part of the release.
• JPEG XL support has been added (bare codestream and ISO BMFF container).

One point worth noting: in [61889], LIBXML_NOENT was removed from GETID3_LIBXML_OPTIONS in WordPress, which left getid3.lib.php in a locally patched state. Upstream has adopted the same change in 1.9.26, so that file no longer needs a local patch and all bundled files are byte-identical to the upstream release again.

As with previous updates, only the audio/video subset of the library that WordPress bundles is updated. The new upstream modules (module.audio-video.isobmff.php, module.graphic.jpegxl.php) are not added, and none of the bundled modules gained a new hard dependency.

Release notes: ​https://github.com/JamesHeinrich/getID3/releases/tag/v1.9.26
Full list of changes: ​https://github.com/JamesHeinrich/getID3/compare/v1.9.25...v1.9.26

The release hardens parsing of malformed or truncated files (ID3v2 frame size clamped to filesize, no negative seeks for APE/Lyrics3 on small files, bounds check in the QuickTime ES descriptor length parser), replaces the error-suppressed @list() destructuring with array_pad(), switches is_integer() to is_int(), and escapes command paths for the Windows vorbiscomment.exe helper.

Notably, 1.9.26 also incorporates the change from [61889] (removing LIBXML_NOENT from GETID3_LIBXML_OPTIONS) upstream, so getid3.lib.php no longer needs a local patch. All 16 bundled files are now identical to upstream v1.9.26 again.

Only the bundled audio/video subset was updated. The new upstream modules (module.audio-video.isobmff.php, module.graphic.jpegxl.php, …) are not included, consistent with prior updates, none of the bundled modules gained a new hard dependency.

References:

• ​getID3 1.9.26 release notes
• ​Full list of changes

Trac ticket: https://core.trac.wordpress.org/ticket/66059

[SergeyBiryukov]

In 63520:

External Libraries: Update getID3 to version 1.9.26.

The release hardens parsing of malformed or truncated files (ID3v2 frame size clamped to filesize, no negative seeks for APE/Lyrics3 on small files, bounds check in the QuickTime ES descriptor length parser), replaces the error-suppressed @list() destructuring with array_pad(), switches is_integer() to is_int(), and escapes command paths for the Windows vorbiscomment.exe helper.

Notably, 1.9.26 also incorporates the change from r61889 (removing LIBXML_NOENT from GETID3_LIBXML_OPTIONS) upstream, so getid3.lib.php no longer needs a local patch. All 16 bundled files are now identical to upstream v1.9.26 again.

Only the bundled audio/video subset was updated. The new upstream modules (module.audio-video.isobmff.php, module.graphic.jpegxl.php, …) are not included, consistent with prior updates, none of the bundled modules gained a new hard dependency.

References:

• ​getID3 1.9.26 release notes
• ​Full list of changes in getID3 1.9.26

Developed in ​https://github.com/WordPress/wordpress-develop/pull/13420.

Follow-up to r47601, r48278, r52254, r54376, r56975, r61253, r61889, r62087.

Props Soean, mukesh27.
Fixes #66059.