On 31 Oct 2015, at 7:48 PM, Michael Felt <mamf...@gmail.com> wrote: > I would like to repspond positively on this suggestion that "something" be > done. > It could be updated, and fortunately expat is not a package with frequent > (security) updates, > but it is external. What may have been good before is perhaps not as correct > anymore. > > a) expat needs to be closer to mainstream: there are many features > in expat that have been introduced since then. > The embedded expat is not packaged as an internal (aka static) library - but > appears as a separate library. > > I ran into this problem when packaging something else that needed the latest > and greatest (i.e., 2.0.1 as base). > > My solution is to repackage apr, apr-util and httpd after removing > the internal expat - so that I have latest and greatest for both - and can > update it, > in principle - separate from apr. > > I would vote to make external expat the default and/or just remove expat from > apr.
Unfortunately our version rules forbid the removal of expat from APR(-util) v1.x, as this would break APR for people who are using expat already. Adding the option to link to an external expat is definitely an option, on condition there is a backwards-compatible guarantee on behaviour from the APR library. Regards, Graham —
