On 18/11/2021 12:06, Marco d'Itri wrote:
On Nov 18, Matthew Vernon <matt...@debian.org> wrote:
Many large projects that use PCRE have made the switch now (e.g. git,
php); it does involve some work, but we are now at the stage where
PCRE3 should not be used, particularly if it might ever be exposed to
untrusted input.
For the records: I would love to switch, but it is not totally obvious
to me by looking at the configure script that tin supports pcre2.
A very cursory glance at http://bzr.tin.org/ suggests it includes an old
version of old-pcre in its own source repo, so I expect no pcre2 support.
Without looking at how tin uses pcre, I don't know how much work a port
is likely to be. The PCRE authors haven't been very proactive about
getting the word out about pcre2, which is a shame.
If PCRE2 isn't yet on the tin authors' radar, would you mind opening a
bug with them about it?
Thanks,
Matthew
