Quoting "anatoly techtonik" <techtonik@gmail.com>:
Then why can't you wait until upstream developers, whose product bundles that library, confirm, validate, test and release fix for that error in their source package together with release announcement? Also in the case of Trac/jQuery.
Again, many applications have many libraries and tools as embedded code copies. jQuery alone is used by 58 Debian packages. As I'm already repeating myself I'll stop now arguing about the issue. Btw. inside of Debian nor Ubuntu I'm not aware of other opinions in this matter.