Hi Nick, hmm. Maybe I am loosing my eyesight... I looked at both
http://www.apache.org/dist/apr/CHANGES-APR-1.6 and http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.6 and find no mentioning of expat or its removal from the packages. But that is the change-log and I now find it on the apr home page :-) All good now. Thanks Martin On Mon, Jun 26, 2017 at 11:21 AM, Nick Kew <n...@apache.org> wrote: > On Mon, 2017-06-26 at 10:55 +0200, Martin Knoblauch wrote: > > > > So my question now is - was the removal of expat from apr-util > > intentional? I see no mentioning in the release notes. > > The perils of bundling! It is indeed clear in the release notes > for the APR 1.6 twins, where it even mentions that you might need a > libexpat-devel package. But I guess you meant HTTPD release notes, > which should at least point you to APR release notes! > > APR-UTIL 1.6 brings some other changes to dependencies, as it > builds with more up-to-date versions of MySQL and OpenSSL, > and supports Apple's crypto lib. It's unlikely you need to know > any of that building httpd, but it's still a release note. > > Unbundling expat from APR rids us of this kind of issue, and > perhaps more importantly the troubling issue of expat security > issues living on in APR after they are fixed in expat. > > -- > Nick Kew > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org > For additional commands, e-mail: users-h...@httpd.apache.org > > -- ------------------------------------------------------ Martin Knoblauch email: k n o b i AT knobisoft DOT de www: http://www.knobisoft.de
