On Mon, Sep 29, 2025 at 12:09 PM Romain Manni-Bucau <[email protected]> wrote: > > Hi Elliotte, > > Can we target it for next round? > I'm not yet sure of the best way to solve it but it looks like it needs > more love since all EE specs + microprofile + SPI based loading with a > hardocoded default have this issue and I doubt we want to list all spec x > impl x vendor + others deps there (would lead to a list >= 100 at minimum > for the well known OSS ones).
I am completely OK with a list of 100+ known exclusions. This is not a challenge in 2025. If you have a more general way, please do submit a PR but let's not let the perfect be the enemy of the good. Right now projects have false positives about this specific json dependency. Removing those false positives is an improvement, and it doesn't get in the way of further work in the future, so let's merge it. -- Elliotte Rusty Harold [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
