multimedia/mpv CVE-2018-6360

Hi,

multimedia/mpv is currently at 0.22.0 (from 2016) and seems to be
affected by CVE-2018-6360
(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6360).

I tried to update to 0.29.1 but configure stops because FFmpeg 4.0 or
newer is needed (we only have 2.8.15).

Is there a specific reason why FFmpeg is kept on the 2.8 branch?

Or should we try to backport the patch to the ancient 0.22.0 version?

Best regards,
Ingo