On Thu, Oct 29, 2026 at 1:43 PM chengkai <[email protected]> wrote: > @anchao: > Hi, Tomek, > Let me put it this way: I'm not going to make promises or speeches about > security. Let's let actions do the talking. If PR #20686 > https://github.com/apache/nuttx/pull/20686 gets merged, I will take > ownership of all CVE issues related to this code going forward. Would that > work for you?
This sounds fine at first but someone with more experience will see a strong dependency here - what happens when you are not available? Who will take this job of updating the code, functionalities, and security issues? This organization is a bigger problem over the code itself. Thus everyone proposes to keep the zlib external and just maintain the glue. Can you please see if this is possible? Yeah lets get back to GitHub and talk on dev@ within its own thread. -- CeDeROM, SQ7MHZ, http://www.tomek.cedro.info
