------------------------------------------------------------------- Wed Dec 6 20:53:58 UTC 2023 - Michael Gorse - Update to version 2.42.3 (boo#1217844): + Fix flickering while playing videos with DMA-BUF sink. + Fix color picker being triggered in the inspector when typing "tan". + Do not special case the "sans" font family name. + Fix build failure with libxml2 version 2.12.0 due to an API change. + Fix several crashes and rendering issues. + Security fixes: CVE-2023-42916, CVE-2023-42917. ------------------------------------------------------------------- Fri Nov 17 22:11:13 UTC 2023 - Michael Gorse - Update to version 2.42.2 (boo#1217210): + Bump Safari version in user agent header. + Fix CSP regression that broke Unity WebGL applications. + Fix the build with GBM disabled. + Fix several crashes and rendering issues. + Security fixes: CVE-2023-41983, CVE-2023-42852. - Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf renderer for NVIDIA proprietary drivers (boo#1216778). - Add webkit2gtk3-gstreamer-build-fix.patch: fix the build with !ENABLE(MEDIA_STREAM). ------------------------------------------------------------------- Mon Oct 23 18:52:17 UTC 2023 - Mike Gorse - Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider of EglDestroyImage Found" (boo#1216483). ------------------------------------------------------------------- Mon Oct 9 17:07:32 UTC 2023 - Michael Gorse - Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867 boo#1215868 boo#1215869 boo#1215870): + Fix enable-html5-database setting to properly enable/disable IndexedDB API. + Fix the build with GBM disabled. + Fix several crashes and rendering issues. + Security fixes: CVE-2023-41993. + Changes in version 2.42.0: + New renderer based on DMA-BUF shared buffers. + Add new permission request to handle DOM paste access requests. + Add API to configure experimental features at runtime. + Add API to set the percentage of volume space that can be used for data storage. + GBM is no longer required for WebGL implementation. + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359. - Rebase webkitgtk-memfd-build-fix.patch. - Revise webkit2gtk3-gstreamer-1.16.patch to reinstate version checks removed upstream. - Disable JPEGXL. - Drop webkit2gtk3-nested-wayland-compositor.patch, and disable wayland target. The patch no longer applies. Wayland systems should fall back to using xwayland. - Add webkit2gtk3-old-fontconfig.patch: support older versions of fontconfig. ------------------------------------------------------------------- Wed Aug 2 20:00:08 UTC 2023 - Michael Gorse - Update to version 2.40.5 (boo#1213905 boo#1213379 boo#1213581 boo#1215230): + Fix several crashes and rendering issues. + Security fixes: CVE-2023-38133, CVE-2023-38572, CVE-2023-38592, CVE-2023-38594, CVE-2023-38595, CVE-2023-38597, CVE-2023-38599, CVE-2023-38600, CVE-2023-38611, CVE-2023-37450, CVE-2023-40397, CVE-2023-39434, CVE-2023-40451. ------------------------------------------------------------------- Tue Jul 11 21:50:07 UTC 2023 - Michael Gorse - Update to version 2.40.3 (boo#1212863): + Make memory pressure monitor honor memory.memsw.usage_in_bytes if exists. + Include key modifiers in wheel events. + Apply cookie blocking policy to WebSocket handshakes. + Remove accidental dependency on GLib 2.70. + Fix the build with BUBBLEWRAP_SANDBOX disabled. + Fix several crashes and rendering issues. + Security fixes: CVE-2023-32439, CVE-2023-32435, CVE-2023-32393, CVE-2023-28198, CVE-2023-32370, CVE-2023-30574. - Add unifdef, gbm, and libdrm BuildRequires: New dependencies. - Drop no-forced-sse.patch: Due to changes in the code, trying to build without SSE2 support fails even with this patch. We are forced to give up on this, SSE2 support is now mandatory for all build targets. - Drop webkit2gtk3-CVE-2023-28204.patch and webkit2gtk3-CVE-2023-32373.patch: fixed upstream. - Add webkit2gtk3-nested-wayland-compositor.patch: reinstate the nested wayland compositor. Our wpebackend-fdo is not new enough to build without it. - Add webkit2gtk3-gstreamer-1.16.patch: fix the build with gstreamer 1.16. - Disable MEDIA_STREAM. It has been disabled until now, and it's better to minimize the amount of gstreamer code that we need to - Disable avif. It isn't available prior to SLE-15-SP4. - Remove libbrotlidec from BuildRequires. No longer needed. ------------------------------------------------------------------- Thu Jun 8 20:22:27 UTC 2023 - Michael Gorse - Add security patches (boo#1211846): + webkit2gtk3-CVE-2023-28204.patch (boo#1211659 CVE-2023-28204) + webkit2gtk3-CVE-2023-32373.patch (boo#1211658 CVE-2023-32373) - Drop webkit2gtk3-restore-npapi.patch. It is becoming increasingly difficult to maintain, and it resurrected unmaintained code that we probably shouldn't carry anyhow (jsc#ped-2876). ------------------------------------------------------------------- Fri Apr 21 20:20:46 UTC 2023 - Michael Gorse - Update to version 2.38.6 (boo#1210295 boo#1210731): + Enable the Asynchronous Clipboard API to make certain pages work (e.g. GithHub started recently requiring it). + Support :has() CSS selectors in content filters. + Apply basic font properties as font variation settings. + The Bubblewrap sandbox no longer requires setting an application identifier via GApplication to operate correctly. Using GApplication is still recommended, but optional. + Improvements to the GStreamer multimedia playback, in particular around MSE, WebRTC, and seeking. + Fix the build with journald support enabled when using elogind instead of the systemd libraries. + Fix the build with Link-Time Optimization enabled (-flto=auto). + Fix context menus not working in the remote Web Inspector. + Fix usage of the remote Web Inspector over HTTP. + Fix debug logs not being emitted in release builds. + Fix several crashes and rendering issues. + Security fixes: CVE-2022-0108, CVE-2023-28205, CVE-2022-32885, CVE-2023-27932, CVE-2023-27954. ------------------------------------------------------------------- Thu Feb 16 14:01:21 UTC 2023 - Michael Gorse - Update to version 2.38.5 (boo#1208328): + Fix large memory allocation when uploading content. + Fix scrolling after a history navigation with PSON enabled. + Always update the active uri of WebKitFrame. + Fix the build on Ubuntu 20.04. + Fix several crashes and rendering issues. + Security fixes: CVE-2023-23529. - Drop webkit2gtk3-gstreamer-build-fix.patch: fixed upstream. ------------------------------------------------------------------- Tue Feb 7 15:43:26 UTC 2023 - Michael Gorse - Update to version 2.38.4 (boo#1207997): + Improve GStreamer multimedia playback across the board with improved codec selection logic, better handling of latency, and improving frame discard to avoid audio/video desynchronizationg, among other fixes. + Disable HLS media playback by default, which makes web sites use MSE instead. If needed WEBKIT_GST_ENABLE_HLS_SUPPORT=1 can be set in the environment to enable it back. + Disable threaded rendering in GTK4 builds by default, as it was causing crashes. + Fix MediaSession API not showing artwork images. + Fix MediaSession MPRIS usage when running inside a Flatpak sandbox. + Fix input element controls to correctly scale when applying a zoom factor different than the default. + Fix leakage of Web processes in certain situations. + Fix the injected bundle not being found when running inside a sandbox. + Fix the build with ENABLE_INTROSPECTION when cross-compiling. + FIx the build with ENABLE_WEBGL disabled. + Fix the build with GStreamer-based WebRTC enabled. + Fix the build with USE_GTK4 enabled. + Fix several crashes and rendering issues. + Security fixes: CVE-2023-23517, CVE-2023-23518, CVE-2022-42826, CVE-2022-32919, CVE-2022-46705, CVE-2022-46725. - Add webkit2gtk3-gstreamer-build-fix.patch: fix the build with gstreamer 1.16.3. ------------------------------------------------------------------- Thu Dec 22 15:01:31 UTC 2022 - Michael Gorse - Update to version 2.38.3 (boo#1206474 boo#1206750): + Fix runtime critical warnings from media player. + Fix network process crash when fetching website data on ephemeral session. + Fix the build with Ruby 3.2. + Fix several crashes and rendering issues. + Security fixes: CVE-2022-42852, CVE-2022-42856, CVE-2022-42867, CVE-2022-46692, CVE-2022-46698, CVE-2022-46699, CVE-2022-46700. ------------------------------------------------------------------- Wed Nov 9 20:05:43 UTC 2022 - Michael Gorse - Increase mem_per_process again; attempt to fix build failure. ------------------------------------------------------------------- Tue Nov 8 21:21:27 UTC 2022 - Michael Gorse - Update to version 2.38.2 (boo#1205120 boo#1205123 boo#1205124): + Fix scrolling issues in some sites having fixed background. + Fix prolonged buffering during progressive live playback. + Fix the build with accessibility disabled. + Fix several crashes and rendering issues. + Security fixes: CVE-2022-42799, CVE-2022-42823, CVE-2022-42824. - Update no-forced-sse.patch with quilt. - Rebase webkit2gtk3-restore-npapi.patch and webkit2gtk3-memfd-build-fix.patch. - Pass -DENABLE_DOCUMENTATION=OFF to configure, we did not build the API docs in the past, and I see no reason to start now. - Drop pkgconfig(libnotify) BuildRequires: No longer needed, nor used if available. - Pass -DUSE_SYSTEM_MALLOC=ON on all architectures, to work around webkit#243535. ------------------------------------------------------------------- Tue Nov 8 21:21:27 UTC 2022 - Michael Gorse - Update to version 2.38.1: + Make xdg-dbus-proxy work if host session bus address is an abstract socket. + Use a single xdg-dbus-proxy process when sandbox is enabled. + Fix high resolution video playback due to unimplemented changeType operation. + Ensure GSubprocess uses posix_spawn() again and inherit file descriptors. + Fix player stucking in buffering (paused) state for progressive streaming. + Do not try to preconnect on link click when link preconnect setting is disabled. + Fix close status code returned when the client closes a WebSocket in some cases. + Fix media player duration calculation. + Fix several crashes and rendering issues. + Security fixes: CVE-2022-46691. ------------------------------------------------------------------- Tue Nov 8 21:21:27 UTC 2022 - Michael Gorse - Update to version 2.38.0 boo#1205121 boo#1205122): + New media controls UI style. + Add new API to set WebView’s Content-Security-Policy for web extensions support. + Make it possible to use the remote inspector from other browsers using WEBKIT_INSPECTOR_HTTP_SERVER env var. + MediaSession is enabled by default, allowing remote media control using MPRIS. + Add support for PDF documents using PDF.js. + Security fixes: CVE-2022-32888, CVE-2022-32923, CVE-2022-42863, CVE-2022-48503, CVE-2022-32933. ------------------------------------------------------------------- Mon Sep 19 14:02:19 UTC 2022 - Michael Gorse - Update to version 2.36.8 (boo#1203530): + Fix jumpy elements when scrolling GitLab and other web sites. + Fix WebKitWebView:web-process-terminated signal not being emitted for the first web view when sandboxing is enabled. + Fix hang when opening HTML