On 21.11.18 16:02, Boyuan Yang wrote: > X-Debbugs-CC: [email protected] [email protected] > > 在 2018-11-21三的 15:23 +0100，Matthias Klose写道： >> Package: src:yaml-cpp >> Version: 0.5.3-0.1 >> X-Debbugs-CC: Boyuan Yang <[email protected]> >> >> yaml-cpp was just updated to 0.5.3, a version released in 2016. Is this >> appropriate, when there is are newer releases available? Are there any >> concerns >> with the 0.6.x releases? > > The 0.5.3 version was an old release with many bugfixes. Yaml-cpp 0.6.x (seems > to) have ABI break that needs transition. I'm not sure if we could finished it > before Buster freeze. > > I'm aware of the 2 CVEs; however it seems that upstream hasn't reach a final > conclusion yet. > > Besides, Andreas Tille wishes no longer be the uploader of the package and the > other 2 maintainers are not responding to the email. However Simon Quigley > expressed interest in the package recently and I believe he should join the > discussion. > > I'm not into maintaining yaml-cpp on a long-term basis (I jumped in simply > because of boost1.67 transition and that this package is a dependency of > librime and a series of packages in the Input Method Team). Please consider > making tests and properly uploading new versions as you want (of course, try > not to break downstream software).
ok, thanks for the notification. However, please note the 0.5.3 already seems to introduce an ABI break, as discussed today on #debian-release.
