<div dir="ltr"><div class="gmail_extra"><br><div class="gmail_quote">On 13 November 2015 at 08:03, <span dir="ltr"><<a href="mailto:jackie.huang@windriver.com" target="_blank">jackie.huang@windriver.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div id=":e3" class="a3s" style="overflow:hidden">Jackie Huang (4):<br>
libav: fix CVE-2015-3395<br>
libav: fix CVE-2015-6820<br>
libav: fix CVE-2015-6823<br>
libav: fix CVE-2015-6824<br>
<br>
Kai Kang (1):<br>
libav: fix CVE-2015-1872</div></blockquote></div><br>I'd tend to lean towards squashing these int a single "libav: fix CVEs" commit which adds all five of those patches in a single operation (but as separate patches for tracking), but it's hard to have a strong opinion either way.</div><div class="gmail_extra"><br></div><div class="gmail_extra">However is the Pending upstream-status appropriate? Is this the right time to bring up swapping libav for ffmpeg again?</div><div class="gmail_extra"><br></div><div class="gmail_extra">Ross</div></div>