[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#1000004: pcre-ocaml: depends on obsolete pcre3 library



Hi,

On 24/11/2021 15:42, Stéphane Glondu wrote:

Le 18/11/2021 à 12:49, Matthew Vernon a écrit :
Your package still depends on the old, obsolete PCRE3[0] libraries
(i.e. libpcre3-dev). This has been end of life for a while now, and
upstream do not intend to fix any further bugs in it. Accordingly, I
would like to remove the pcre3 libraries from Debian, preferably in
time for the release of Bookworm.

The newer PCRE2 library was first released in 2015, and has been in
Debian since stretch. Upstream's documentation for PCRE2 is available
here: https://pcre.org/current/doc/html/

Many large projects that use PCRE have made the switch now (e.g. git,
php); it does involve some work, but we are now at the stage where
PCRE3 should not be used, particularly if it might ever be exposed to
untrusted input.

I had a look, and the new API looks very different. Is there a porting
guide somewhere?

I'm afraid not - I did ask upstream to consider this https://github.com/PhilipHazel/pcre2/issues/51 but I don't think one is going to be forthcoming.

Besides, I'm not sure it makes sense to port pcre-ocaml to pcre2 while
keeping the same OCaml API, which mimics the PCRE one. Moreover,
pcre-ocaml is widely used and has many reverse dependencies in Debian:

I don't know how tricky it will be to port pcre-ocaml to pcre2; I know a number of languages have successfully ported their PCRE bindings to PCRE2 (e.g. PHP who wrote about it https://wiki.php.net/rfc/pcre2-migration ). The regex syntax itself hasn't changed.

Regards,

Matthew


Reply to: