I totally understand that, I am just trying to get infos to you as debian maintainer from my (at the moment admittedly almost non-existing) involvement upstream. Exiv2 0.26 will likely not get into testing. Upstream does backport a lot of security fixes to 0.26, but negated creating a dot release on request, and is focussing on 0.27. It was planned to release an rc in early 2018, but from what I read in the issue tracker, that's not going to happen asap.
signature.asc
Description: OpenPGP digital signature
