Salvatore Bonaccorso wrote:
> If you fix the vulnerability please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
>
> The project is dead-upstream TTBOMK, so not sure if/what we can do at
> all for this issue. Removal seems not possible as per:
>
> carnil@respighi:~$ dak rm --suite=unstable -n -R tiles
> Will remove the following packages from unstable:
>
> libtiles-java | 3.0.7-5 | all
> libtiles-java-doc | 3.0.7-5 | all
> tiles | 3.0.7-5 | source
>
> Maintainer: Debian Java Maintainers
> <pkg-java-maintain...@lists.alioth.debian.org>
>
> ------------------- Reason -------------------
>
> ----------------------------------------------
>
> Checking reverse dependencies...
> # Broken Build-Depends:
> libspring-java: libtiles-java (>= 3.0)
>
> Dependency problem found.
>
> carnil@respighi:~$
>
> But maybe we can set it as "no-dsa", is it only used as build
> dependency for libspring-java and not sensible outside?
Spring is already marked as unsupported, so we can simply extend that.
Cheers,
Moritz
__
This is the maintainer address of Debian's Java team
<https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-java-maintainers>.
Please use
debian-j...@lists.debian.org for discussions and questions.
