I apologize for not personally trying hard to push this through, but if we don't unblock 2.16.3 in the next few days, it makes the Stable Release process more difficult since we can't "practice" with easier webkit2gtk point releases first.
Proposal for initial webkit2gtk updates in Debian 9 ------------------------------------------------------------------------ Here's my thinking as to how the first webkit2gtk stable update could work. 1. A new webkit2gtk point release is released. 2. Since regressions are generally found within the first week and to try to limit the work needed by the SRMs, we wait a week before uploading to the s-p-u queue. 3. A SRM accepts it. 4. An email is sent out to the maintainers of the rdeps asking them to please test their package with the new webkit2gtk version in s-p-u within the next 2 weeks. 5. If no regressions are reported, the update is released in the next Debian 9 point release. Here's a filtered list of rdeps: https://paste.debian.net/961084/ These updates are also being done across all Linux distributions so I believe the risk of a regression with this process is fairly low. If that process goes well, then we can consider how we will handle the new major release later this year. Later webkit2gtk updates ------------------------------------ Based on the schedule of prior Debian point releases, I am concerned about the longer gap between point releases later in Stretch's life. I don't think it makes sense for Debian users to have to wait 4-5 months for security updates. Maybe testing can still be done in s-p-u but Security can push webkit2gtk versions from there out sooner. Regressions from NOT updating ----------------------------------------------- On the other hand, if we do not update webkit2gtk there will be regressions too. A major recent example was Google changing their websites which broke Google login (breaking a key part of GNOME Online Accounts, Evolution, etc.) and the beta version of YouTube. This was fixed a few weeks ago in 2.16.2 (and 2.14.7 but 2.14 is unsupported now). https://launchpad.net/bugs/1687019 More diff info ------------------- The debdiffs themselves are difficult to read. Here are the 2.16.2 and the 2.16.3 updates: https://launchpadlibrarian.net/319531521/webkit2gtk_2.16.1-1_2.16.2-1.diff.gz https://launchpadlibrarian.net/321119967/webkit2gtk_2.16.2-1_2.16.3-1.diff.gz webkit2gtk still uses trac and svn and there's no git mirror yet: https://trac.webkit.org/log/webkit/releases/WebKitGTK/webkit-2.16 To see colored diffs, just select the radio buttons next to the 2 commits you want to diff and click View Changes. I believe 2.16.2 was 216485 and 2.16.3 is 217366. To view individual commits, you have to click the radio buttons for the current and the previous commits and click View Changes. Thanks, Jeremy Bicha