Hi everyone,

Since we're a couple people working on core-updates at the same time, it
might be a good idea to coordinate a bit (of course, other volunteers
welcome :) ).

One conundrum we have for now: glibc 2.38 has a couple of new CVEs, and
we have three options:
1) change glibc to track the 2.38 release branch → world rebuild.
2) graft glibc → bad user experience (and we're not supposed to graft
outside of master).
3) switch to 2.39 → world rebuild + possibly more work fixing new build
failures.

glibc 2.39 should hopefully release tomorrow (01/02/2024)

What is everyone's opinion regarding those?

IMO, option 2 is the one I'd like to avoid, and between 1 and 3 I'd
ideally prefer 3 but we don't know yet if there is going to be a lot of
breakage because of that (feels like usually it's toolchain updates, not
glibc updates that cause them the most).

Also, I see that most of the patches that were requested to be merged
into c-u (like the big pages for jemalloc) actually got pushed, are
there any other (well-tested) ones we can go for at the same time as the
glibc rebuild?  I will stress that this is about *core* packages now,
I feel that it's too late to introduce more complications and delay the
update any longer.

Best,
-- 
Josselin Poiret