Continuing with the trend of replacing insecure packages: qt5-webkit has been deprecated upstream for a long time already. It is still being community released, but it is on life support with only build fixes, and the webkit code itself hasn't been updated since 2013, so it's plagued with security issues by now. The "official" replacement qtwebengine has its own issues (eg. crashes on nouveau) and some projects are reluctant to move to it.
In this case removing the package is out of the question, as some important packages (such as Plasma) depend on it. Fontunately someone took up the job of maintaining a fork [1] based on the latest webkit code. The aim is to have this shipped with upstream Qt eventually, but that could still be many months away.
I've packaged this fork as qt5-webkit-ng. It should be a drop-in replacement for qt5-webkit, please test it and if it's good enough we can consider replacing the old qt5-webkit package with it.
El Sat, 21 Jan 2017 13:37:40 +0000, Antonio Rojas escribió:
Continuing with the trend of replacing insecure packages: qt5-webkit has been deprecated upstream for a long time already. It is still being community released, but it is on life support with only build fixes, and the webkit code itself hasn't been updated since 2013, so it's plagued with security issues by now. The "official" replacement qtwebengine has its own issues (eg. crashes on nouveau) and some projects are reluctant to move to it.
In this case removing the package is out of the question, as some important packages (such as Plasma) depend on it. Fontunately someone took up the job of maintaining a fork [1] based on the latest webkit code. The aim is to have this shipped with upstream Qt eventually, but that could still be many months away.
I've packaged this fork as qt5-webkit-ng. It should be a drop-in replacement for qt5-webkit, please test it and if it's good enough we can consider replacing the old qt5-webkit package with it.
Latest version 5.212.0 should have feature parity with the old qt5-webkit and be ready to replace it. If there are no objections, I will add replaces=(qt5-webkit) and drop the old insecure qt5-webkit in a few days. Please give it some testing if you haven't done so yet.
El Wed, 14 Jun 2017 16:53:29 +0000, Antonio Rojas escribió:
Latest version 5.212.0 should have feature parity with the old qt5-webkit and be ready to replace it. If there are no objections, I will add replaces=(qt5-webkit) and drop the old insecure qt5-webkit in a few days. Please give it some testing if you haven't done so yet.
Actually I just found out from the developer that his fork has been merged in upstream Qt already [1]. So I will simply update the qt5-webkit package to his latest release instead of replacing it with -ng
arch-dev-public@lists.archlinux.org