We plan to remove the freemarker.debug package in the next release (2.3.35), because it uses RMI (a legacy Java remote method call protocol), which is for a while seen as a security concern. While this feature is not active by default (you had to start a debugger client, and a debugger server explicitly), the mere presence of these classes is flagged at some places.
I believe practically nobody uses the debugger feature, that's why even though it breaks backward compatibility, I guess it's an OK compromise to do this now. But I wanted to communicate this, just in case someone has problems with this, or needs to prepare for this.
