On Mon, 22 Jun 2026, 13:45:08 +0200, Takashi Iwai wrote: > On Mon, 22 Jun 2026 12:05:14 +0200, Manfred Hollstein wrote: > > [...] > > While we certainly cannot force upstream to change their opinion on > > Cargo, I'll definitely keen to see how they'll deal with security > > updates in that dependency chain as Takashi pointed out. > > I believe that most of the security update problem is rather > distro-specific. Basically for the upstream, they just need to fix > the latest code or update Config.toml for the dependent crates, and > release; that's all. > > OTOH, for us distros that ship the older versions, we need to handle > differently, and Rust packaging makes a bit harder than others > (although it's always doable).
Dein Wort in Gottes Ohr... :-) Perhaps we shouldn't release from the official tarballs anymore, similar to what Maurizio is doing with xfwl4 ;-) > Takashi Cheers. l8er manfred
signature.asc
Description: PGP signature
