Broken and defunct libv8-3.14 urgently needs removal
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
libv8-3.14 (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
I am the upstream author of r-cran-v8, the R bindings for libv8.
The libv8-3.14 package has been superseded in Debian by libnode-dev. Both packages provide "libv8-dev" however libv8-3.14 is broken beyond repair with many security problems and crashes when compiled with recent versions of GCC.
Debian has removed libv8-3.14 from stable and modified libnode-dev to provide a drop-in replacement. This works great and r-cran-v8 now uses this.
Unfortunately Ubuntu also still has the broken libv8-3.14 (in disco and eoan). And when users compile the R bindings from source via "apt-get install libv8-dev", unfortunately apt installs the old, broken version of v8, rather than the virtual one from libnode-dev.
There are two solutions:
- Remove libv8-3.14 alltogether
- Modify libv8-3.14 such that it no longer provides libv8-dev, but only libv8-3.14-dev. Therefore users will get the working version when they do apt-get install libv8-dev.
I hope this can be resolved before the next LTS!
Thanks for reporting.
I've subscribed the Ubuntu archive admins to take a look at this.
Just a note: while the package was removed from Debian stable/testing, it looks like it is still present in unstable https:/ /tracker. debian. org/pkg/ libv8-3. 14.