I’m guessing it’s also related to the recent SQLite zero-day. SQLite is public-domain, and so it’s not unusual for projects to simply include the code directly

I’m guessing it’s also related to the recent SQLite zero-day. SQLite is public-domain, and so it’s not unusual for projects to simply include the code directly in their source distributions, which will either build it in or will provide a `./configure` option to use an already-built form (this is used by distro packagers). When the “build it in” option is used, then it’s statically linked.