We shipped release package with the 3rd party source for mswin environment especially.
The current status is here:
libyaml: psych gem, ruby repo and package always bundled it.
libffi: only ruby package bundled it. fiddle gem and repo are not bundled.
zlib: gem, ruby repo and package don't bundled.
I propose we stop bundling the third-party source for security and maintenance reasons. Because we have vcpkg for mswin environment today. So, vcpkg provides the runtime for psych, fiddle and zlib.
The users who want to use newer version of libyaml or libffi environment can use this option like gem install psych -- --with-libyaml-source-dir=$(pwd)/libyaml-0.2.5.