Hi Graham, > On Thu, 3 Sept 2026 at 00:21, Charles Plessy <[email protected]> wrote: > > 1 Ship the r-bioc-* packages with their vendored HDF5 library and trust > > that > > they will handle major security issues well. The Bioconductor project > > has good > > programmers, more than a decade of acheivements, and a full commitment to > > security. Also, they might migrate before the Freeze. > > ... > > > My favorite is option 1.
Le Thu, Sep 03, 2026 at 02:56:24PM +0000, Graham Inggs a écrit : > > The release team is fine with option 1. Please see the packaging > notes about embedded code copies [1], and please register the affected > packages with the security team. Previously, you could add them > yourself in the wiki, but now you can do it in salsa [2]. > > [1] https://wiki.debian.org/Packaging/EmbeddedCopies > [2] > https://salsa.debian.org/security-tracker-team/security-tracker/raw/master/data/embedded-code-copies Many thanks to you and the release team for letting us doing this! I will work on it next week. Charles -- Charles Plessy Nagahama, Yomitan, Okinawa, Japan Debian Med packaging team http://www.debian.org/devel/debian-med Tooting from home https://framapiaf.org/@charles_plessy - You do not have my permission to use this email to train an AI -
