Hi Charles On Thu, 3 Sept 2026 at 00:21, Charles Plessy <[email protected]> wrote: > 1 Ship the r-bioc-* packages with their vendored HDF5 library and trust that > they will handle major security issues well. The Bioconductor project has > good > programmers, more than a decade of acheivements, and a full commitment to > security. Also, they might migrate before the Freeze.
... > My favorite is option 1. The release team is fine with option 1. Please see the packaging notes about embedded code copies [1], and please register the affected packages with the security team. Previously, you could add them yourself in the wiki, but now you can do it in salsa [2]. Regards Graham [1] https://wiki.debian.org/Packaging/EmbeddedCopies [2] https://salsa.debian.org/security-tracker-team/security-tracker/raw/master/data/embedded-code-copies
