Of course you can replace the dependency, but do you know if it is 100% compatible? My point was that as long as the maintainers don't give us the reason for t

Of course you can replace the dependency, but do you know if it is 100% compatible? My point was that as long as the maintainers don't give us the reason for the static link or the custom dependency, we can assume we can replace it, but we don't know. Could be that it works, but it uses an insecure cipher, could be that there is a silent corruption. Nothing is impossible, just means you have to reedit and patch each time and know you running untested things for a secure application.