Release version 0.28.9

[kevinbackhouse]

I'd like to do a 0.28.9 bugfix release. We've received a large number of security reports (probably all AI-generated). None of them are serious, but I'd like to do a release to fix them. I've already got several PRs open, although there's a few more to work through.

Please add anything that ought to be included to the 0.28.9 milestone.

[kevinbackhouse]

Links for the previous release (v0.28.8):

• Release version 0.28.8 #3467
• https://github.com/Exiv2/exiv2/releases/tag/v0.28.8

[kevinbackhouse]

By the way, quite a few of the reported "security" issues are variants of this one: #9303. A large file can cause a deep recursion during parsing, which causes the program to hit the stack limit and crash. (The default stack limit is only 8192KB on Ubuntu, so it's pretty easy to hit.) I'm planning to fix them like #9304, but that involves adding a new parameter to our public API, so I think it will break ABI compatibility. Any thoughts on how to fix them without break ABI compatibility? Or should I just delay those fixes for 0.29.0 instead?

[kmilos]

I'll probably backport a few tag updates while we're at it...

[gh-andre]

@kevinbackhouse

which causes the program to hit the stack limit and crash

Production code should not use call recursion for reasons you described. Recursion tasks should be processed in a loop, with a recursion stack maintained by the application. The recursive file iterator in std::filesystem is a good example how recursion is managed without running into call stack limits.