On 09/10/16 23:56, Adam Borowski wrote: > Another issue is, as mentioned in the TC discussion, the inability to fix > any non-trivial security bugs in stable. I can't quite imagine the Security > Team hunting for a specific old version of grunt and all of its extensive > dependencies to rebuild the buggy package. Such state hits the definition > of "contrib" exactly, why not actually use it for this purpose? Demotion of > libjs-handlebars would require changing or demoting two more packages: > prometheus and kcov, which would be a hassle but not the end of the world.
Prometheus being in contrib basically means the work I have done for the past year is worthless, as users could as well just grab unofficial packages from other places. I am not saying this to justify the mess with handlebars, I want to find a solution, but putting this in contrib or non-free is not an option for me. -- Martín Ferrari (Tincho)
