[Pkg-javascript-devel] V8 depends from outdated and unmaintained libv8 with security issues

[Jérémy Lal]

cc-ing to -devel, because advices about libraries are scarce in javascript
land.

Le ven. 8 févr. 2019 à 11:48, Jérémy Lal <kapouer at melix.org> a écrit :

> Le ven. 8 févr. 2019 à 10:31, Jeroen Ooms <jeroen at berkeley.edu> a écrit :
>
>> On Fri, Feb 8, 2019 at 9:44 AM Jérémy Lal <kapouer at melix.org> wrote:
>> >
>> >
>> >
>> > Le ven. 8 févr. 2019 à 07:36, Jeroen Ooms <jeroen at berkeley.edu> a
>> écrit :
>> >>
>> >> For those following this discussion: there is now a version of
>> >> r-cran-v8 that uses libnode-dev in sid. Is there anything we need to
>> >> do to get r-cran-v8 back in buster?
>> >>
>> >
>> > Hi Jeroen,
>> >
>> > your work made me realize the debian nodejs source package might just
>> need
>> > to provide a libv8-dev package with headers in /usr/include/v8 and a
>> pkgconfig
>> > file that tell to use -lnode ?
>> > Would that be all ?
>>
>> That would be absolutely fantastic, yes.  Also a symlink from
>> libv8.so-> libnode.so woulde be handy, because libv8 doesn't use
>> pkg-config anywhere else so most bindings just test for linking with
>> -lv8.
>>
>
> Ok then no pkgconfig and a symlink instead.
> I suppose i need to ask a removal of libv8 from unstable (it's removed
> from testing) to
> be able to "take" libv8-dev. Or maybe declare a libv8-in-nodejs-dev
> package ?
> In any case i don't know if i should make a libv8-xx package (which would
> basically be
> symlinks to libnode).
> Any advice is welcome...
>

>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-javascript-devel/attachments/20190208/da31e471/attachment.html>