Log message:
exiv2: update to 0.28.9.

What's Changed

    Stop the parser from backtracking by @kevinbackhouse in #9309
    Fix copy-paste error in WebPImage::inject_VP8X height check (backport #9280) \ 
by @mergify[bot] in #9314
    Use readOrThrow in MatroskaVideo::decodeBlock for EOF detection (backport \ 
#9282) by @mergify[bot] in #9315
    Fix wrong variable in findXmp XMP trailer search loop (backport #9284) by \ 
@mergify[bot] in #9316
    Bound setMediaStream search to the trak atom size (backport #9286) by \ 
@mergify[bot] in #9319
    Use integer division in TiffBinaryArray::doCount (backport #9288) by \ 
@mergify[bot] in #9330
    Add orientation handling and tests for Sony camera files (backport #9295) by \ 
@mergify[bot] in #9335
    Add Tokina 80-400. (backport #9296) by @mergify[bot] in #9336
    Add more CanonFileInfo tags (backport #9312) by @mergify[bot] in #9338
    Add new Exif 3.1 tags (backport #9298) by @mergify[bot] in #9337
    Revert "Bound setMediaStream search to the trak atom size" by \ 
@kmilos in #9340
    Add enforce to avoid out-of-bounds read by @kevinbackhouse in #9308
    Add Pentax HDF tag (backport #9317) by @mergify[bot] in #9344
    Revert to Windows 2022 to fix build failure by @kevinbackhouse in #9350
    Update CodeCov keybase url (backport #9327) by @mergify[bot] in #9348
    Add try-catch around std::stoi (backport #9305) by @mergify[bot] in #9357
    Update SECURITY.md by @kevinbackhouse in #9355
    Fix/issue 3318 dx tiff xmp (backport #9341) by @mergify[bot] in #9342
    fix out-of-bounds iterator in readStringWcharTag (backport #9310) by \ 
@mergify[bot] in #9360
    enforce minimum FileTypeBox length in Jp2Image::readMetadata (backport \ 
#9313) by @mergify[bot] in #9362
    enforce minimum FileTypeBox length in Jp2Image::printStructure (backport \ 
#9318) by @mergify[bot] in #9351
    Change type of allocate64 to uint64_t (backport #9307) by @mergify[bot] in #9353
    Fix off-by-one error by @kevinbackhouse in #9377
    Fix totalRead calculation (backport #9379) by @mergify[bot] in #9382
    change unique_ptr to vector (backport #3427) by @mergify[bot] in #9384
    Fix missing throw by @kevinbackhouse in #9385
    Make the io_test more reliable by @kevinbackhouse in #9387
    Check for duplicates in RiffVideo::readInfoListChunk by @kevinbackhouse in #9369
    Avoid using destNode after deleting by @kevinbackhouse in #9367
    Add new camera and lens model IDs (backport #9339) by @mergify[bot] in #9398
    Fix issue 9324 by @kevinbackhouse in #9325
    catch stoul exceptions in CanonMakerNote print0x000a/print0x000c (backport \ 
#9320) by @mergify[bot] in #9372
    Add regression test (backport #9397) by @mergify[bot] in #9401
    Use std::vector for RemoteIo::Impl::blocksMap_ by @kevinbackhouse in #9392
    Replace lowblock/highBlock with startBlock/stopBlock and add more error \ 
checking by @kevinbackhouse in #9403
    Limit EPS AI7 thumbnail preview decoding size (backport #9378) by \ 
@mergify[bot] in #9406
    Fix TimeValue::read() losing sign for -00:MM / -00MM timezone offsets \ 
(backport #9390) by @mergify[bot] in #9411
    Improve performance of decodeAi7Thumbnail (backport #9407) by @mergify[bot] \ 
in #9409
    Check snprintf result to avoid out-of-bounds access by @kevinbackhouse in #9410
    Use BasicIo::mmap() to avoid quadratic memory allocation by @kevinbackhouse \ 
in #9420
    Update DeclareOneNamespace() implementation to match XMP-Toolkit-SDK by \ 
@kevinbackhouse in #9418
    Remove nRealData variable by @kevinbackhouse in #9428
    Call CreateFileMapping correctly on Windows by @kevinbackhouse in #9431
    Check that object->ifdOffset() is within bounds by @kevinbackhouse in #9438
    Avoid integer overflow on 32-bit architectures by @kevinbackhouse in #9439
    Use Safe::add by @kevinbackhouse in #9434
    Use std::llround for double to int64_t cast by @kevinbackhouse in #9433
    Remove unnecessary curl settings by @kevinbackhouse in #9448
    Fix incorrect image size for OS/2 1.x / Windows 2.x BMP files (backport \ 
#9450) by @mergify[bot] in #9451
    Remove unnecessary resize by @kevinbackhouse in #9455
    Nul-terminate strings by @kevinbackhouse in #9454
    Refresh translations by @kmilos in #9453
    Release Exiv2 version 0.28.9 by @kevinbackhouse in #9459
    Fix doxygen error by @kevinbackhouse in #9463
    Remove macos-15-intel by @kevinbackhouse in #9466

Log message:
exiv2: updated to 0.28.8

0.28.8

This release fixes three low-severity vulnerabilities:

* \ 
[CVE-2026-25884](https://github.com/Exiv2/exiv2/security/advisories/GHSA-9mxq-4j5g-5wrp)
* \ 
[CVE-2026-27596](https://github.com/Exiv2/exiv2/security/advisories/GHSA-3wgv-fg4w-75x7)
* \ 
[CVE-2026-27631](https://github.com/Exiv2/exiv2/security/advisories/GHSA-p2pw-7935-c73j)

Log message:
exiv2: update to 0.28.7.

Headline Features of Exiv2 v0.27.4
----------------------------------

1) Bug and security fixes:
   - bmff read-only support (.CR3, .HEIC, .HEIF, .AVIF and JXL/bmff).
   - Security process is defined.  https://github.com/Exiv2/exiv2/security/policy
   - 3 benign ASAN issues.  First CVE in 18 months.  Patched in 2hrs, Fixed in 24hrs.
   - DNG 1.6 and Exif 2.32 support.
   - More easyaccess APIs and documentation.
   - Localization support on Crowdin.
   - Updated Catalan localisation.

2) Changes to downloadable build bundles:
   - Revised documentation and man page.
   - MinGW/msys2 bundle built with C++11 (for Qt users).

3) Build and Test:
   - Test suite is implemented in python.
   - Support for building on ARM (raspberry pi).
   - Localisation is tested.

4) Book "Image Metadata and Exiv2 Architecture".
   - https://clanmills.com/exiv2/book/
   - https://clanmills.com/exiv2/book/IMaEA.pdf

Log message:
exiv2: update to 0.28.6.

Changes from version 0.28.5 to 0.28.6
-------------------------------------

This release fixes two low-severity vulnerabilities:

* \ 
[CVE-2025-54080](https://github.com/Exiv2/exiv2/security/advisories/GHSA-496f-x7cq-cq39)
* \ 
[CVE-2025-55304](https://github.com/Exiv2/exiv2/security/advisories/GHSA-m54q-mm9w-fp6g)

Log message:
exiv2: Catch up with SunOS iconv const change.

Log message:
exiv2: needs C++ filesystem

Log message:
exiv2: update to 0.28.5.

This release fixes a use-after-free vulnerability in `tiffcomposite_int.cpp`:

* \ 
[CVE-2025-26623](https://github.com/Exiv2/exiv2/security/advisories/GHSA-38h4-fx85-qcx7)

Versions prior to v0.28.0, such as v0.27.7, are not affected by CVE-2025-26623.

Log message:
graphics/gexiv2: Require c++17

Upstream documents that a C++17 compiler is needed to build the
library and to build programs against the library.  (While they
further document that programs built against the library must pass
--std=c++17, that is left unhandled.)