------------------------------------------------------------------- Wed Aug 2 20:09:18 UTC 2023 - Michael Gorse - Update to version 2.40.5 (boo#1213905): + Fix several crashes and rendering issues. + Security fixes: CVE-2023-38133, CVE-2023-38572, CVE-2023-38592, CVE-2023-38594, CVE-2023-38595, CVE-2023-38597,, CVE-2023-38599,, CVE-2023-38600, CVE-2023-38611. ------------------------------------------------------------------- Wed Jul 12 00:22:27 UTC 2023 - Michael Gorse - Update to version 2.40.3 (boo#1212863): + Make memory pressure monitor honor memory.memsw.usage_in_bytes if exists. + Include key modifiers in wheel events. + Apply cookie blocking policy to WebSocket handshakes. + Remove accidental dependency on GLib 2.70. + Fix the build with BUBBLEWRAP_SANDBOX disabled. + Fix several crashes and rendering issues. + Security fixes: CVE-2023-32439, CVE-2023-32435. - Add unifdef BuildRequires: New dependency. - Remove libbrotlidec from BuildRequires. No longer needed. - Drop webkit2gtk3-CVE-2023-28204.patch and webkit2gtk3-CVE-2023-32373.patch: fixed upstream. - Rebase webkit-process.patch, old-wayland-scanner.patch, webkit2gtk3-gstreamer1.12.patch, webkit2gtk3-gstreamer1.8.patch, webkit2gtk3-glib244.patch, webkit2gtk3-icu60.patch, webkit2gtk3-icu52.patch, webkit2gtk3-old-gtk.patch, and webkit2gtk3-restore-atk.patch. - Add webkit2gtk3-old-ruby.patch: lower ruby version dependency. - Add webkit2gtk3-no-libepoxy.patch: back out libepoxy dependency. - Add webkit2gtk3-gcc9.patch: fix build failure with gcc 9. - Disable avif. We don't have it on SLE-12. - Define USE_GSTREAMER_TRANSCODER=false: gstreamer not new enough. - Disable gbm: our version isn't new enough. - Disable MEDIA_STREAM. It has been disabled until now, and it's better to minimize the amount of gstreamer code that we need to patch. - Add webkit2gtk3-default-value.patch: fix for gcc 9. - Drop python3 conditional, and use python 3.6. - Increase MemPerProcess to guard against running out of memory. - Disable GLES2 on aarch64: fixes the build. ------------------------------------------------------------------- Thu Jun 8 20:24:50 UTC 2023 - Michael Gorse - Add security patches (boo#1211846): + webkit2gtk3-CVE-2023-28204.patch (boo#1211659 CVE-2023-28204) + webkit2gtk3-CVE-2023-32373.patch (boo#1211658 CVE-2023-32373) - Drop webkit2gtk3-restore-npapi.patch. It is becoming increasingly difficult to maintain, and it resurrected unmaintained code that we probably shouldn't carry anyhow (jsc#ped-2876). ------------------------------------------------------------------- Fri Apr 21 20:23:04 UTC 2023 - Michael Gorse - Update to version 2.38.6 (boo#1210295 boo#1210731): + Enable the Asynchronous Clipboard API to make certain pages work (e.g. GithHub started recently requiring it). + Support :has() CSS selectors in content filters. + Apply basic font properties as font variation settings. + The Bubblewrap sandbox no longer requires setting an application identifier via GApplication to operate correctly. Using GApplication is still recommended, but optional. + Improvements to the GStreamer multimedia playback, in particular around MSE, WebRTC, and seeking. + Fix the build with journald support enabled when using elogind instead of the systemd libraries. + Fix the build with Link-Time Optimization enabled (-flto=auto). + Fix context menus not working in the remote Web Inspector. + Fix usage of the remote Web Inspector over HTTP. + Fix debug logs not being emitted in release builds. + Fix several crashes and rendering issues. + Security fixes: CVE-2022-0108, CVE-2023-28205, CVE-2022-32885, CVE-2023-27932, CVE-2023-27954. - Rebase webkit2gtk3-gstreamer1.12.patch and webkit2gtk3-gstreamer1.8.patch. ------------------------------------------------------------------- Fri Mar 3 07:25:00 UTC 2023 - Michael Gorse - Update to version 2.38.5 (boo#1208328): + Fix large memory allocation when uploading content. + Fix scrolling after a history navigation with PSON enabled. + Always update the active uri of WebKitFrame. + Fix the build on Ubuntu 20.04. + Fix several crashes and rendering issues. + Security fixes: CVE-2023-23529. - Rebase webkit2gtk3-gstreamer1.12.patch. - Downgrade back to gcc 9. Building with 10 leads to unresolvable dependencies. - Fix webkit2gtk3-gstreamer1.8.patch: it wrongly removed a needed include. ------------------------------------------------------------------- Tue Feb 7 16:28:41 UTC 2023 - Michael Gorse - Update to version 2.38.4 (boo#1207997): + Improve GStreamer multimedia playback across the board with improved codec selection logic, better handling of latency, and improving frame discard to avoid audio/video desynchronizationg, among other fixes. + Disable HLS media playback by default, which makes web sites use MSE instead. If needed WEBKIT_GST_ENABLE_HLS_SUPPORT=1 can be set in the environment to enable it back. + Disable threaded rendering in GTK4 builds by default, as it was causing crashes. + Fix MediaSession API not showing artwork images. + Fix MediaSession MPRIS usage when running inside a Flatpak sandbox. + Fix input element controls to correctly scale when applying a zoom factor different than the default. + Fix leakage of Web processes in certain situations. + Fix the injected bundle not being found when running inside a sandbox. + Fix the build with ENABLE_INTROSPECTION when cross-compiling. + FIx the build with ENABLE_WEBGL disabled. + Fix the build with GStreamer-based WebRTC enabled. + Fix the build with USE_GTK4 enabled. + Fix several crashes and rendering issues. + Security fixes: CVE-2023-23517, CVE-2023-23518, CVE-2022-42826. - Rebase webkit2gtk3-gstreamer1.12.patch, webkit2gtk3-gstreamer1.8.patch, and webkit2gtk3-glib244.patch. ------------------------------------------------------------------- Thu Dec 22 15:32:11 UTC 2022 - Michael Gorse - Update to version 2.38.3 (boo#1206474 boo#1206750)): + Fix runtime critical warnings from media player. + Fix network process crash when fetching website data on ephemeral session. + Fix the build with Ruby 3.2. + Fix several crashes and rendering issues. + Security fixes: CVE-2022-42852, CVE-2022-42856, CVE-2022-42867, CVE-2022-46692, CVE-2022-46698, CVE-2022-46699, CVE-2022-46700. - Rebase webkit2gtk3-gstreamer1.12.patch. ------------------------------------------------------------------- Tue Nov 8 21:18:14 UTC 2022 - Michael Gorse - Update to version 2.38.2 (boo#1205120 boo#1205123 boo#1205124): + Fix scrolling issues in some sites having fixed background. + Fix prolonged buffering during progressive live playback. + Fix the build with accessibility disabled. + Fix several crashes and rendering issues. + Security fixes: CVE-2022-42799, CVE-2022-42823, CVE-2022-42824. - Rebase webkit2gtk3-restore-npapi.patch, webkit2gtk3-old-gtk.patch, webkit2gtk3-gstreamer1.12.patch, webkit2gtk3-icu60.patch, webkit2gtk3-icu52.patch - Rebase webkit2gtk3-old-glib.patch. It is now a copy of the SLE 15 glib patch. Split out changes specific to SLE 12 and add webkit2gtk3-glib244.patch. - Add webkit2gtk3-restore-atk.patch: restore atk implementation. Our glib is too old to handle the newer AT-SPI code. - Pass -DENABLE_DOCUMENTATION=OFF to configure, we did not build the API docs in the past, and I see no reason to start now. - Drop pkgconfig(libnotify) BuildRequires: No longer needed, nor used if available. - Pass -DUSE_SYSTEM_MALLOC=ON on all architectures, to work around webkit#243535. - Exclude s390 from the build. It has not been building for some time, and we are not shipping s390 updates anyhow. Drop webkit2gtk3-s390-build-fix.patch. ------------------------------------------------------------------- Tue Nov 8 21:18:14 UTC 2022 - Michael Gorse - Update to version 2.38.1: + Make xdg-dbus-proxy work if host session bus address is an abstract socket. + Use a single xdg-dbus-proxy process when sandbox is enabled. + Fix high resolution video playback due to unimplemented changeType operation. + Ensure GSubprocess uses posix_spawn() again and inherit file descriptors. + Fix player stucking in buffering (paused) state for progressive streaming. + Do not try to preconnect on link click when link preconnect setting is disabled. + Fix close status code returned when the client closes a WebSocket in some cases. + Fix media player duration calculation. + Fix several crashes and rendering issues. + Security fixes: CVE-2022-46691. ------------------------------------------------------------------- Tue Nov 8 21:18:14 UTC 2022 - Michael Gorse - Update to version 2.38.0 boo#1205121 boo#1205122): + New media controls UI style. + Add new API to set WebView’s Content-Security-Policy for web extensions support. + Make it possible to use the remote inspector from other browsers using WEBKIT_INSPECTOR_HTTP_SERVER env var. + MediaSession is enabled by default, allowing remote media control using MPRIS. + Add support for PDF documents using PDF.js. + Security fixes: CVE-2022-32888, CVE-2022-32923, CVE-2022-42863, CVE-2022-48503. ------------------------------------------------------------------- Mon Sep 19 14:06:24 UTC 2022 - Michael Gorse - Update to version 2.36.8 (boo#1203530): + Fix jumpy elements when scrolling GitLab and other web sites. + Fix WebKitWebView:web-process-terminated signal not being emitted for the first web view when sandboxing is enabled. + Fix hang when opening HTML