Update getID3 to version 1.9.28

[desrosj]

getID3 1.9.28 has been released. Core is currently at 1.9.26 as of r63520 (see #66059).

This update primarily contains hardening fixes, a few bug fixes.

Release notes: ​https://github.com/JamesHeinrich/getID3/releases/tag/v1.9.28
Full list of changes: ​https://github.com/JamesHeinrich/getID3/compare/v1.9.26...v1.9.28

Updates the bundled getID3 library from 1.9.26 to ​1.9.28, which includes ​1.9.27.

Changes

Three security fixes:

• ​GHSA-c2xw-vp6w-gpph: decompressing a compressed ID3v2 frame is now capped at a quarter of the memory limit, or 32 MB when the limit is unknown.
• ​GHSA-4pp3-6hmx-mfmg: the QuickTime stsd, dref, elst and keys atom parsers no longer trust entry counts larger than the atom's data can hold, which prevents memory exhaustion from crafted files.
• ​GHSA-j649-xr34-mmmh: on PHP < 8.0, getid3_lib::XML2array() refuses to parse XML if external entity loading cannot be disabled. On PHP 8.0 and later, this code doesn't run.

Bug fixes:

• ​#508: embedded pictures are no longer passed through character set conversion, which corrupted them.
• ​#510: the ID3v2 involved people (IPL, IPLS and TIPL) and musician credits (TMCL) frames are now parsed consistently into role and person pairs.
• ​#512: replaygain_album_peak is copied from TXXX frames to the main replay gain data.

None of the changes are needed for PHP 8.6 compatibility. The one PHP 8.6-related getID3 change, replacing is_integer(), shipped in 1.9.26.

How this follows previous updates

• Only the audio and video subset of the library that WordPress bundles is updated. No modules are added, and none of the bundled modules gained a new dependency.
• Before this change, all 18 bundled files (16 PHP files plus license.txt and readme.txt) were identical to upstream v1.9.26, so there are no local patches to carry forward. After it, all 18 are identical to upstream v1.9.28. Only 4 files changed: getid3.php, getid3.lib.php, module.audio-video.quicktime.php and module.tag.id3v2.php.
• The getID3 exclusions in phpcompat.xml.dist match on file path, so they still apply. phpcs.xml.dist excludes src/wp-includes/ID3/ entirely.

Behavior change for reviewers

wp_add_id3_tag_data() stores reset( $list ) for each key in $data['id3v2']['comments']. #510 changes the shape of two of those keys:

• involved_people_list (IPL and IPLS) used to be a list containing one array of pairs, so WordPress stored every pair. It's now the array of pairs itself, so reset() stores only the first array( 'position' => …, 'person' => … ) pair.
• involved_people_list (TIPL) and musician_credits_list (TMCL) in ID3v2.4 tags used to be parsed as plain text frames. They are now parsed into the same pairs.

This only affects attachment metadata for audio files that have these frames, and it's displayed nowhere in core. It may be worth keeping the old shape for these keys in wp_add_id3_tag_data(), or deciding it's acceptable.

Testing

• php -l on all bundled files: passes. Run on PHP 8.6.0-dev.
• vendor/bin/phpcs --standard=phpcompat.xml.dist src/wp-includes/ID3/: clean.
• Every bundled file was compared byte for byte against upstream v1.9.28.
• I haven't run PHPUnit locally. This PR's CI is the first test run, including the wp_read_audio_metadata() and wp_read_video_metadata() tests in tests/phpunit/tests/media.php.

Use of AI Tools

• AI assistance: Yes
• Tool(s): Claude Code
• Model(s): Claude Opus 5.5
• Used for: Reviewing past getID3 updates, comparing the bundled files with upstream, reading the full 1.9.26 to 1.9.28 diff and its effect on wp_add_id3_tag_data(), running the checks above, and drafting this description. I reviewed the result.

🤖 Generated with ​Claude Code

​https://claude.ai/code/session_011Y86gx1T9qpKZuJWesSGiZ