2014-06-20 7:16 GMT+02:00 Ian Wallace <[email protected]>: > Diane - Thanks for the idea on symlinking. I am working with the current > upstream devs to try and figure out which versions of the JS they really > need. In one part we have JSQuery versions from 1.2.1 all the way through > 1.9.1. All of them can't be in use ... I am going to try and prune first > before fixing this.
Smart move. We treat JavaScript libraries just like regular libraries: if they come embedded in your upstream tarball, we should make sure to package them separately, and at package build time remove the upstream-provided files and instead use the ones from the Debian package. It's a bit more upfront packaging work, but it provides increased security: if an issue is found in e.g. jQuery, you just need to update the jQuery Debian package once, and all packages that use it are automatically fixed. If you don't do that, you need to audit all Debian packages to find embedded copies of jQuery, and update all these packages. +Emilien -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected] Archive: https://lists.debian.org/canqxmqhmh0y8jzi3-69+nx0ft-j3_egfbzlh9enbhjwdvn4...@mail.gmail.com
