Control: tags -1 -security
Control: severity -1 wishlist
On Sun, Aug 30, 2026 at 11:50:19AM -0400, Scott Talbert wrote:
> In fact, we already do use the system pcre2 (you can check the build logs
> and also notice that libwxbase3.2-1t64 depends on libpcre2-32-0). So, this
> is not really a bug since we're not using the bundled copy of pcre2.
Sigh, I even thought to check this but only looked at the dependencies
of libwxgtk3.2-1t64 whereas the dependency would obviously be from base.
> Since we're already excluding other bundled libraries in d/copyright, we can
> probably add pcre to this during our next upstream upload so it's clearer
> that the bundled copy isn't being used.
Makes sense - if it's not in the tree we build from we can't
accidentally use it, and people won't report vulnerabilities in
bundled copies to us if they are excluded at the repacking stage.
We should probably exclude all of 3rdparty if we can. Both nanosvg and
catch seem to be packaged. It looks like nanosvg support needs to be
enabled using --with-nanosvg at configure time so that's probably
unused. It looks like upstream's configure only wants to use the
bundled catch. Presumably it's only used for the testsuite and doesn't
actually get compiled into the packaged binaries though.
Anyway, this isn't actually a security bug, so untagging and lowering
the severity.
Cheers,
Olly
