This is a bad practice that can lead to bugs due to outdated
dependencies or security bugs when dependencies are patched
but jruby is not rebuild.

This also should reduce jruby binary package size.

Le 21/06/2015 15:31, Miguel Landaeta a écrit :

It looks like the embedded dependencies are also relocated under the
org.jruby namespace. Removing them could lead to incompatibilities with
applications importing them.

I'd rather document the inclusion with a Built-Using field rather than
diverging from upstream.

Emmanuel Bourg

Hi Emmanuel,

That's right, I don't intend to diverge from upstream on this,
especially since this is a complex package. Although, this is a bug
that should be documented until is fixed (at upstream, but I see it
unlikely anyway).
so I have to document myself about it first.

Question: let's say jruby embeds a copy of libasm4-java and we
document this with Built-Using: libasm4-java (= 5.0.4-1) but in the
future, a security vulnerability is reported and fixed in
libasm4-java 5.0.4-2.

Is jruby going to FTBFS in sid when libasm4-java or any of the
embedded libraries get updated and the version using during last time
is not available anymore?

Cheers,