El Sat, 21 Jan 2017 13:37:40 +0000, Antonio Rojas escribió: > Continuing with the trend of replacing insecure packages: qt5-webkit has > been deprecated upstream for a long time already. It is still being > community released, but it is on life support with only build fixes, and > the webkit code itself hasn't been updated since 2013, so it's plagued > with security issues by now. The "official" replacement qtwebengine has > its own issues (eg. crashes on nouveau) and some projects are reluctant > to move to it. > > In this case removing the package is out of the question, as some > important packages (such as Plasma) depend on it. Fontunately someone > took up the job of maintaining a fork [1] based on the latest webkit > code. The aim is to have this shipped with upstream Qt eventually, but > that could still be many months away. > > I've packaged this fork as qt5-webkit-ng. It should be a drop-in > replacement for qt5-webkit, please test it and if it's good enough we > can consider replacing the old qt5-webkit package with it. > > [1] https://github.com/annulen/webkit/wiki
Latest version 5.212.0 should have feature parity with the old qt5-webkit and be ready to replace it. If there are no objections, I will add replaces=(qt5-webkit) and drop the old insecure qt5-webkit in a few days. Please give it some testing if you haven't done so yet.