Re: git: f45b1d07f50b - main - many: Unsupported Go dep; deprecate and schedule for removal

On Fri, Dec 05, 2025 at 05:07:34PM +0100, Robert Clausecker wrote:
> Hi Adam,
> 
> Please follow Porter's Handbook which gives 1 month for security issues
> or 2 months for build issues.  Note that a CVE in the toolchain does not
> mean that applications built with it are affected, that's only the case
> if the application uses the affected component, so it's usually not a
> security issue.
> 
> IMHO it should be 3 months though.

While the Porter's Handbook provides general timelines, it is not always
possible or desirable to follow those rules strictly in every situation.
When dealing with toolchain deprecations or unmaintained software,
waiting the full duration can lead to larger maintenance burdens or
security exposure across the ports tree.

In such cases, portmgr approval allows us to deviate from the standard
timelines when it is in the best interest of the project. This
flexibility is intentional and ensures that we can address issues
promptly and responsibly.

As I wrote earlier, if a port is removed, and is still of interest, it
remains easy to retrieve it from the Git history should someone wish to
revive or maintain it later.

-- 
Mathieu Arnold