With other libraries such as zlib, libjpeg, jasper etc there are mechanisms for using the system-provided library. This should be done for lcms as well.
Just as with other 'shared libraries', I am not in favor of this because we do extensive testing with the version of the libraries shipped with ghostscript using many test suites not available to others. Any differences between our libraries and the system libraries (version skew) can cause problems. To the degree that system libraries can be 'shared', Artifex will only support bugs that are reproducible with the non-shared third party libraries that are shipped with Ghostscript.
The reason it is the right thing to do is that very often there are security bugs with these types of library. For an operating system distribution it is much safer to have only one copy of each security bug, rather than several scattered around in various bundled forms. Every project that uses any other project has this issue of testing, and yet virtually no-one else bundles libraries. I'm not asking for something new in ghostscript: this is already done for the majority of other shared library components.
fixed in 12097. Although, this comes with the same caveats as other libraries: building Ghostscript against anything other than our included sources may give undefined/undesirable results. Any problems reported must be reproducible with the sources included in the Ghostscript distribution. In the case of lcms, there is at least one bug which is fixed in our sources which is not, to my knowledge, in any "official" lcms release. Requires lcms, *not* lcms2.