Dear Maintainer,

we use debian-slim to create docker images for java based services. In
the context of the current CVEs[1] we found that the
openjdk-11-jre-headless depends to libfreetype6 in contrast to some other
distributions. Beside that we found other dependencies where we
are surprised that these packages are needed e.g. libasound2 for a
headless java setup. Is there a reason for libfreetype or it is possible
to remove this dependency to get rid of the linked CVEs[1]?

$ apt-cache depends openjdk-11-jre-headless
openjdk-11-jre-headless
  Hängt ab von: ca-certificates-java
  Hängt ab von: java-common
  Hängt ab von: libcups2
  Hängt ab von: liblcms2-2
  Hängt ab von: libjpeg62-turbo
  Hängt ab von: libfontconfig1
  Hängt ab von: libnss3
  Hängt ab von: util-linux
  Hängt ab von: libasound2
  Hängt ab von: libc6
  Hängt ab von: libfreetype6
  Hängt ab von: libgcc-s1
  Hängt ab von: libharfbuzz0b
  Hängt ab von: libpcsclite1
  Hängt ab von: libstdc++6
  Hängt ab von: zlib1g

Cheers
Sascha

[1] https://security-tracker.debian.org/tracker/CVE-2022-27406