Regarding wordpress and libphp-phpmailer. 5.0.1 will no longer depend on libphp-phpmailer but use the one shipped with WordPress.
Except, its about as old :/ WordPress upstream are aware of it [1], we'll see what they do next. - Craig 1: https://core.trac.wordpress.org/ticket/40472#comment:25 On Sat, 8 Dec 2018 at 11:28, Craig Small <csm...@debian.org> wrote: > WordPress probably uses its own version which, I assume, they will > maintain afterwards. > > I'll see if I can find more about what they're doing with it for the > longer term. > > The easiest way for me is to just drop the depends. > > - Craig > > > On Sat, 8 Dec. 2018, 02:06 Salvatore Bonaccorso <car...@debian.org wrote: > >> Control: severity -1 serious >> >> As mentioned in >> https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.27 the 5.2 >> branch is deprecated and will not recieve security updates anymore >> after 31st December 2018. >> >> This is not an issue per se, as we usually need to backport fixes to >> older versions in general for bugfixes but in particular for >> security-fixes; but starting buster with a know deprecated and not >> supported version given upstream actively develops on the 6.x branch >> looks somehow problematic for the buster release cycle. >> >> For this concern, I'm raising the severity to RC. >> >> there are a couple of packages with Depends or Build-Depends on >> libphp-phpmailer, and I'm X-Debbugs-CC'ing those here. >> >> # Broken Depends: >> cacti: cacti >> tt-rss: tt-rss >> wordpress: wordpress >> >> # Broken Build-Depends: >> wordpress: libphp-phpmailer (>= 5.2.14) >> >> Regards, >> Salvatore >> >