Skip to content

External Libraries: Update getID3 to version 1.9.28. - #15878

Closed
desrosj wants to merge 1 commit into
WordPress:trunkfrom
desrosj:update/getid3-1.9.28
Closed

External Libraries: Update getID3 to version 1.9.28.#15878
desrosj wants to merge 1 commit into
WordPress:trunkfrom
desrosj:update/getid3-1.9.28

Conversation

@desrosj

@desrosj desrosj commented Nov 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Updates the bundled getID3 library from 1.9.26 to 1.9.28, which includes 1.9.27.

Trac ticket: https://core.trac.wordpress.org/ticket/66646

Changes

This applies bug fixes and hardening improvements.

How this follows previous updates

  • Only the audio and video subset of the library that WordPress bundles is updated. No modules are added, and none of the bundled modules gained a new dependency.
  • Before this change, all 18 bundled files (16 PHP files plus license.txt and readme.txt) were identical to upstream v1.9.26, so there are no local patches to carry forward. After it, all 18 are identical to upstream v1.9.28. Only 4 files changed: getid3.php, getid3.lib.php, module.audio-video.quicktime.php and module.tag.id3v2.php.
  • The getID3 exclusions in phpcompat.xml.dist match on file path, so they still apply. phpcs.xml.dist excludes src/wp-includes/ID3/ entirely.

Behavior change for reviewers

wp_add_id3_tag_data() stores reset( $list ) for each key in $data['id3v2']['comments']. #510 changes the shape of two of those keys:

  • involved_people_list (IPL and IPLS) used to be a list containing one array of pairs, so WordPress stored every pair. It's now the array of pairs itself, so reset() stores only the first array( 'position' => …, 'person' => … ) pair.
  • involved_people_list (TIPL) and musician_credits_list (TMCL) in ID3v2.4 tags used to be parsed as plain text frames. They are now parsed into the same pairs.

This only affects attachment metadata for audio files that have these frames, and it's displayed nowhere in core. It may be worth keeping the old shape for these keys in wp_add_id3_tag_data(), or deciding it's acceptable.

Testing

  • php -l on all bundled files: passes. Run on PHP 8.6.0-dev.
  • vendor/bin/phpcs --standard=phpcompat.xml.dist src/wp-includes/ID3/: clean.
  • Every bundled file was compared byte for byte against upstream v1.9.28.
  • I haven't run PHPUnit locally. This PR's CI is the first test run, including the wp_read_audio_metadata() and wp_read_video_metadata() tests in tests/phpunit/tests/media.php.

Use of AI Tools

  • AI assistance: Yes
  • Tool(s): Claude Code
  • Model(s): Claude Opus 5.5
  • Used for: Reviewing past getID3 updates, comparing the bundled files with upstream, reading the full 1.9.26 to 1.9.28 diff and its effect on wp_add_id3_tag_data(), running the checks above, and drafting this description. I reviewed the result.

🤖 Generated with Claude Code

https://claude.ai/code/session_011Y86gx1T9qpKZuJWesSGiZ

This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.

@desrosj @claude
External Libraries: Update getID3 to version 1.9.28.
36f4122 
This update includes the following fixes:

- Decompressing a compressed ID3v2 frame is now capped at a quarter of the memory limit, or 32 MB when the limit is unknown (GHSA-c2xw-vp6w-gpph).
- The QuickTime `stsd`, `dref`, `elst` and `keys` atom parsers no longer trust entry counts larger than the atom's data can hold, which prevents memory exhaustion from crafted files (GHSA-4pp3-6hmx-mfmg).
- On PHP < 8.0, `getid3_lib::XML2array()` refuses to parse XML if external entity loading cannot be disabled (GHSA-j649-xr34-mmmh).
- Embedded pictures are no longer passed through character set conversion, which corrupted them.
- The ID3v2 involved people (IPL, IPLS and TIPL) and musician credits (TMCL) frames are now parsed consistently into role and person pairs.
- `replaygain_album_peak` is copied from TXXX frames to the main replay gain data.

None of the changes are needed for PHP 8.6 compatibility.

As in previous updates, only the audio and video subset of the library that WordPress bundles is updated. All 18 bundled files remain identical to the upstream release.

References:
* [https://github.com/JamesHeinrich/getID3/releases/tag/v1.9.27 getID3 1.9.27 release notes]
* [https://github.com/JamesHeinrich/getID3/releases/tag/v1.9.28 getID3 1.9.28 release notes]
* [JamesHeinrich/getID3@v1.9.26...v1.9.28 Full list of changes in getID3 1.9.27 and 1.9.28]

Follow-up to r47601, r48278, r52254, r54376, r56975, r61253, r61889, r62087, r63520.

Props desrosj.
See #00000.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011Y86gx1T9qpKZuJWesSGiZ
@github-actions

github-actions Bot commented Nov 10, 2026

Copy link
Copy Markdown

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

  • All changes will be lost when closing a tab with a Playground instance.
  • All changes will be lost when refreshing the page.
  • A fresh instance is created each time the link below is clicked.
  • Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
    it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

@desrosj desrosj added the props-bot Adding this label triggers the Props Bot workflow for a PR. label Nov 10, 2026
@johnbillion
johnbillion marked this pull request as ready for review November 12, 2026 14:06
@github-actions

github-actions Bot commented Nov 12, 2026

Copy link
Copy Markdown

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs.

Core Committers: Use this line as a base for the props when committing in SVN:

Props desrosj.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

Props Bot commands

You can trigger Props Bot actions by commenting on this PR:

  • @propsbot add <username> to give props to a GitHub user. Requires write access.
  • @propsbot remove <username> to leave a user out of the props. Requires write access.
  • @propsbot refresh to refresh this list. Adding the props-bot label works too.

wporg-sync pushed a commit that referenced this pull request Nov 12, 2026
@desrosj
External Libraries: Update getID3 to version 1.9.28.
ff91766 
This update includes `1.9.27` and brings bug fixes and hardening improvements:
- Entry counts in the QuickTime `stsd`, `dref`, `elst`, and `keys` atoms are now capped to the data available, which prevents memory exhaustion from crafted files.
- Decompressing compressed ID3v2 frames is limited to a quarter of the PHP memory limit (or 32MB when unknown).
- `getid3_lib::XML2array()` refuses to parse when external entity loading cannot be disabled (PHP < 8.0 only).
- Embedded picture data is no longer run through character set conversion.
- `replaygain_album_peak` is now read from ID3v2 `TXXX` frames.

The involved people list frames (ID3v2.2 `IPL`, ID3v2.3 `IPLS`) and the ID3v2.4 `TIPL` and `TMCL` frames are now parsed into `position`/`person` pairs. Because `wp_add_id3_tag_data()` stores the first value for each key, the `involved_people_list` and `musician_credits_list` attachment metadata values for newly uploaded audio files will now contain only the first pair. These values are not displayed anywhere in Core, and this only applies to newly uploaded files (preexisting metadata values are unchanged).

Only the bundled audio/video subset was updated. No modules were added, and all bundled files are identical to upstream v1.9.28.

References:
* [https://github.com/JamesHeinrich/getID3/releases/tag/v1.9.27 getID3 1.9.27 release notes]
* [https://github.com/JamesHeinrich/getID3/releases/tag/v1.9.28 getID3 1.9.28 release notes]
* [JamesHeinrich/getID3@v1.9.26...v1.9.28 Full list of changes in getID3 1.9.28]

Developed in #15878.

Follow-up to r47601, r48278, r52254, r54376, r56975, r61253, r61889, r62087, r63520.

Props desrosj, johnbillion.
Fixes #66646.


git-svn-id: https://develop.svn.wordpress.org/trunk@65437 602fd350-edb4-49c9-b593-d223f7449a82
@github-actions

github-actions Bot commented Nov 12, 2026

Copy link
Copy Markdown

A commit was made that fixes the Trac ticket referenced in the description of this pull request.

SVN changeset: 65437
GitHub commit: ff91766

This PR will be closed, but please confirm the accuracy of this and reopen if there is more work to be done.

@github-actions github-actions Bot closed this Nov 12, 2026
wporg-sync pushed a commit to WordPress/WordPress that referenced this pull request Nov 12, 2026
@desrosj
External Libraries: Update getID3 to version 1.9.28.
9826725 
This update includes `1.9.27` and brings bug fixes and hardening improvements:
- Entry counts in the QuickTime `stsd`, `dref`, `elst`, and `keys` atoms are now capped to the data available, which prevents memory exhaustion from crafted files.
- Decompressing compressed ID3v2 frames is limited to a quarter of the PHP memory limit (or 32MB when unknown).
- `getid3_lib::XML2array()` refuses to parse when external entity loading cannot be disabled (PHP < 8.0 only).
- Embedded picture data is no longer run through character set conversion.
- `replaygain_album_peak` is now read from ID3v2 `TXXX` frames.

The involved people list frames (ID3v2.2 `IPL`, ID3v2.3 `IPLS`) and the ID3v2.4 `TIPL` and `TMCL` frames are now parsed into `position`/`person` pairs. Because `wp_add_id3_tag_data()` stores the first value for each key, the `involved_people_list` and `musician_credits_list` attachment metadata values for newly uploaded audio files will now contain only the first pair. These values are not displayed anywhere in Core, and this only applies to newly uploaded files (preexisting metadata values are unchanged).

Only the bundled audio/video subset was updated. No modules were added, and all bundled files are identical to upstream v1.9.28.

References:
* [https://github.com/JamesHeinrich/getID3/releases/tag/v1.9.27 getID3 1.9.27 release notes]
* [https://github.com/JamesHeinrich/getID3/releases/tag/v1.9.28 getID3 1.9.28 release notes]
* [JamesHeinrich/getID3@v1.9.26...v1.9.28 Full list of changes in getID3 1.9.28]

Developed in WordPress/wordpress-develop#15878.

Follow-up to r47601, r48278, r52254, r54376, r56975, r61253, r61889, r62087, r63520.

Props desrosj, johnbillion.
Fixes #66646.

Built from https://develop.svn.wordpress.org/trunk@65437


git-svn-id: http://core.svn.wordpress.org/trunk@64576 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@johnbillion johnbillion johnbillion approved these changes

Assignees

No one assigned

Labels

props-bot Adding this label triggers the Props Bot workflow for a PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@desrosj @johnbillion