exiftool 12.25

[edspiner]

Created with brew bump-formula-pr.

[nandahkrishna]

This isn't marked as the production release yet: https://exiftool.org/history.html

[carlocab]

Thanks for the PR anyway, @edspiner. We only update exiftool to stable releases.

[edspiner]

yeah I know (which is weird that ExifTool authors didn't mark new releases as stable) but version 12.24 introduced an important security fix to CVE-2021-22204. This is a dangerous security vulnerability as it allows code execution and exploit code is publicly available.

[mistydemeo]

Reviewing the CVE report, this sounds serious. Let's skip our normal policy for this one version and switch back to stable versions when the next one comes out.

[SMillerDev]

Can we ask the exiftools authors to mark it stable in the meantime? We can't be the only ones who don't want to use unstable software.

[edspiner]

Can we ask the exiftools authors to mark it stable in the meantime? We can't be the only ones who don't want to use unstable software.

OS vendors have distributed via security patches repositories as their own patches. Is there such an option within homebrew?

[carlocab]

We can apply patches in the formula (grep for patch do for an example), but it seems simpler to just use the version that's already fixed.

[mistydemeo]

Agreed, at this point I think using this release is the simplest way to ensure we're shipping a fix.

[carlocab]

How are production releases for this tagged? Is that some future new release is cut, and then tagged as a production release, or is an older tag labelled as a production release after some time?

If it's the former, switching back to the stable release is easy (it just involves a version bump). If it's the latter, then that could possibly involve a version downgrade, which I'd like to avoid.

[mistydemeo]

Is that some future new release is cut, and then tagged as a production release

It's this, which makes things quite convenient for us. We can simply switch over to a new production release when it comes out.

[BrewTestBot]

🤖 A scheduled task has triggered a merge.