Bugzilla Bug 221311

flex is not a common package to use, although there are a few of the packages
using it. As sometimes we need to know what does use flex (for version bumps,
or to audit possible mistakes in its use, like clashing symbols), it would be
quite better if instead of having it in system, the packages using it would
depend on it properly.

http://tinderbox.dev.gentoo.org/misc/dindex/sys-devel/flex reports the packages
depending on flex at build-time, here are more than that using it though as I
recall when last flex vulnerability was found.
Out of a quick check, php is missing there.

As a side note, http://tinderbox.dev.gentoo.org/misc/rindex/sys-devel/flex
lists packages depending on flex at runtime, which is probably a mistake as
flex is used only at build time in 99% of its use cases.

If we can all check our build logs to see what at least _checked_ for flex and
then look up if it's not in the list of packages already, we should be able to
get this done quickly.

Once this is done, it's probably best to simply update the profiles.