------------------------------------------------------------------- Fri Dec 27 19:35:38 UTC 2024 - Michael Gorse - Update to version 2.46.5 (boo#1234851): + Fix the build with GBM and release logs disabled. + Fix several crashes and rendering issues. + Security fixes: CVE-2024-54479, CVE-2024-54502, CVE-2024-54505, CVE-2024-54508. + Changes in version 2.46.4: + Improve memory consumption and performance of Canvas getImageData. + Fix preserve-3D intersection rendering. + Fix video dimensions since GStreamer 1.24.9. + Fix the HTTP-based remote Web Inspector not loading in Chromium. + Fix content filters not working on about:blank iframes. + Fix several crashes and rendering issues. + Security fixes: CVE-2024-44308, CVE-2024-44309. - Drop webkit2gtk3-CVE-2024-44308.patch and webkit2gtk3-CVE-2024-44309.patch: fixed upstream. - Drop webkit2gtk3-old-soup.patch: fixed upstream. - Rebase webkit2gtk3-gstreamer1.8.patch. ------------------------------------------------------------------- Mon Nov 25 19:47:45 UTC 2024 - Michael Gorse - Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register after a slow path (boo#1233631 CVE-2024-44308). - Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management issue (boo#1233632 CVE-2024-44309). ------------------------------------------------------------------- Thu Nov 7 16:45:53 UTC 2024 - Michael Gorse - Update to version 2.46.3 (boo#1232747): + Flatten layers to a plane when preseve-3d style is set. + Fix DuckDuckGo links by adding a user agent quirk. + Fix several crashes and rendering issues. + Security fixes: CVE-2024-44244, CVE-2024-44296. - Rebase SLE 12 patches: + webkit-process.patch + webkit2gtk3-old-gtk.patch + webkit2gtk3-glib244.patch + webkit2gtk3-gstreamer1.8.patch - Drop bug281495.patch: fixed upstream. ------------------------------------------------------------------- Wed Oct 23 02:35:53 UTC 2024 - Michael Gorse - Add webkit2gtk3-old-libdrm.patch: support older versions of libdrm. ------------------------------------------------------------------- Thu Oct 17 20:12:29 UTC 2024 - Michael Gorse - Update to version 2.46.0 (boo#1231039): + Use Skia instead of cairo for 2D rendering and enable GPU rendering by default. + Enable offscreen canvas by default. + Add support for system tracing with Sysprof. + Implement printing using the Print portal. + Add new API to load settings from a config file. + Add a new setting to enable or disable the 2D canvas acceleration (enabled by default). + Undeprecate console messages API and make it available in 6.0 API. + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185, CVE-2024-54508, CVE-2024-54534. - Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be needed anymore. - Add webkit2gtk3-angle-s390x.patch: fix the build on s390x. - Add webkit2gtk3-old-soup.patch: fix the build with libsoup < 2.67.4. - Use gcc 13 to match what is tested upstream. - Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building sysprof capture for now. - Rebase SLE patches: webkit-process.patch webkit2gtk3-gstreamer-1.16.patch webkit2gtk3-old-fontconfig.patch webkit2gtk3-epoxy140.patch webkit2gtk3-old-gtk.patch webkit2gtk3-glib244.patch webkit2gtk3-gstreamer1.8.patch webkit2gtk3-icu52.patch webkit2gtk3-restore-atk.patch webkit2gtk3-no-libepoxy.patch webkit2gtk3-no-gcrypt.patch - Add webkit2gtk3-cxx23-cmake.patch: cmake 3.20 doesn't recognize CXX23. Set it using CXXFLAGS instead. - Add webkit2gtk3-old-zlib.patch: don't use crc32_z. - Add webkit2gtk3-i586-build-fix.patch: back out roundeven functions. - Add bug281495.patch: fix crash in ProcessLauncher socket monitor callback. - Disable skia. Our fontconfig is too old. ------------------------------------------------------------------- Mon Aug 19 18:48:55 UTC 2024 - Michael Gorse - Update to version 2.44.3 (boo#1228613 boo#1228693 boo#1228694 boo#1228695 boo#1228697): + Fix web process cache suspend/resume when sandbox is enabled. + Fix accelerated images dissapearing after scrolling. + Fix video flickering with DMA-BUF sink. + Fix pointer lock on X11. + Fix movement delta on mouse events in GTK3. + Undeprecate console message API and make it available in 2022 API. + Fix several crashes and rendering issues. + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780, CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838, CVE-2024-27851. - Rebase webkit2gtk3-gstreamer1.8.patch. ------------------------------------------------------------------- Tue May 28 18:26:52 UTC 2024 - Michael Gorse - Update to version 2.44.2 (boo#1225071): + Make gamepads visible on axis movements, and not only on button presses. + Disable the gst-libav AAC decoder. + Make user scripts and style sheets visible in the Web Inspector. + Use the geolocation portal where available, with the existing geoclue as fallback if the portal is not usable. + Use the printing portal when running sandboxed. + Use the file transfer portal for drag and drop when running sandboxed. + Avoid notifying an empty cursor rectangle to input methods. + Remove empty bar shown in detached inspector windows. + Consider keycode when activating application accelerators. + Fix the build with ENABLE_WEBAUDIO disabled. + Fix several crashes and rendering issues. + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820, CVE-2024-27833. - Changes in version 2.44.1: + Fix handling of lifetime of web view child dialogs in GTK4. + Do not schedule layer flushes when drawing area size is empty. + Fix videos with alpha when using the DMA-BUF sink. + Fix the build with USE_GBM=OFF. + Fix the build in 32bit platforms + Fix several crashes and rendering issues. - Update keyring (taken from rawhide). - Drop webkit2gtk3-271108.patch: fixed upstream. - Rebase webkit2gtk3-icu52.patch. - Disable using the printing portal in webkit2gtk3-old-gtk.patch. ------------------------------------------------------------------- Wed Mar 20 18:43:41 UTC 2024 - Michael Gorse - Update to version 2.44.0 (boo#1222010): + Make the DOM accessibility tree reachable from UI process with GTK4. + Removed the X11 and WPE renderers in favor of DMA-BUF. + Improved vblank synchronization when rendering. + Removed key event reinjection in GTK4 to make keyboard shortcuts work in web sites. + Fix gamepads detection by correctly handling focused window in GTK4. + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263, CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956, CVE-2023-42843. - Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream. - Drop webkit2gtk3-gcrypt-build-fix.patch ,and add webkit2gtk3-no-gcrypt.patch: revert upstream change to allow libgcrypt to be disabled. - Rebase webkit2gtk3-disable-dmabuf-nvidia.patch, webkit2gtk3-gstreamer-1.16.patch, webkit2gtk3-old-gtk.patch, webkit2gtk3-old-fontconfig.patch, webkit2gtk3-gstreamer-1.16.patch, webkit2gtgk3-restore-atk.patch, and webkit2gtk3-no-libepoxy.patch. - Drop webkit2gtk3-llint-build-fix.patch: no longer needed. - Add webkit2gtk3-271108.patch: Fix build on 32bit arches (https://bugs.webkit.org/show_bug.cgi?id=271108). - Add webkit2gtk3-epoxy140.patch: support epoxy 1.4.0. - Drop webkit2gtk3-gstreamer1.12.patch: folded into webkit2gtk3-gstreamer1.8.patch. - Drop webkit2gtk3-icu60.patch: folded into webkit2gtk3-icu52.patch. - Drop webkit2gtk3-old-glib.patch: folded into webkit2gtk3-glib244.patch. - Explicitly disable gtk 4, since it is now on by default. - Disable web codecs: brings in new code, and our gstreamer is too old. - Disable libbacktrace: we don't have it in SLE. - Use WebAssembly on aarch64. It is the upstream default and no longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON, -DENABLE_WEBASSEMBLY=OFF and -DENABLE_SAMPLING_PROFILER=OFF for the same reason. ------------------------------------------------------------------- Tue Feb 6 11:49:42 UTC 2024 - Michael Gorse - Update to version 2.42.5 (boo#1219604): + Fix webkit_web_context_allow_tls_certificate_for_host to handle IPv6 URIs produced by SoupURI. + Ignore stops with offset zero before last one when rendering gradients with cairo. + Write bwrapinfo.json to disk for xdg-desktop-portal. + Fix gamepads detection by correctly handling focused window in GTK4. + Fix several crashes and rendering issues. + Security fixes: CVE-2024-23222 (boo#1219113), CVE-2024-23206, CVE-2024-23213, CVE-2024-23271. - Drop webkit2gtk3-gstreamer-build-fix.patch: fixed upstream. - Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86 architectures. - Rebase webkit2gtk3-gstreamer1.12.patch and webkit2gtk3-gstreamer1.8.patch. ------------------------------------------------------------------- Sat Dec 16 13:51:42 UTC 2023 - Michael Gorse - Update to version 2.42.4 (boo#1218032): + Fix incorrect random images incorrectly displayed as backgrounds of
elements. + Fix videos displayed aliased after being resized e.g. in YouTube. + Fix several crashes and rendering issues. + Security fixes: CVE-2023-42883. - Rebase webkit2gtk3-gstreamer1.8.patch. ------------------------------------------------------------------- Wed Dec 6 20:56:26 UTC 2023 - Michael Gorse - Update to version 2.42.3 (boo#1217844): + Fix flickering while playing videos with DMA-BUF sink. + Fix color picker being triggered in the inspector when typing "tan". + Do not special case the "sans" font family name. + Fix build failure with libxml2 version 2.12.0 due to an API change. + Fix several crashes and rendering issues. + Security fixes: CVE-2023-42916, CVE-2023-42917. ------------------------------------------------------------------- Fri Nov 17 22:12:23 UTC 2023 - Michael Gorse - Update to version 2.42.2 (boo#1217210): + Bump Safari version in user agent header. + Fix CSP regression that broke Unity WebGL applications. + Fix the build with GBM disabled. + Fix several crashes and rendering issues. + Security fixes: CVE-2023-41983, CVE-2023-42852. - Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf renderer for NVIDIA proprietary drivers (boo#1216778). - Add webkit2gtk3-gstreamer-build-fix.patch: fix the build with !ENABLE(MEDIA_STREAM). ------------------------------------------------------------------- Mon Oct 23 18:53:47 UTC 2023 - Mike Gorse - Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider of EglDestroyImage Found" (boo#1216483). ------------------------------------------------------------------- Mon Oct 9 19:39:24 UTC 2023 - Michael Gorse - Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867 boo#1215868 boo#1215869 boo#1215870 boo#1218033) boo#1222905): + Fix enable-html5-database setting to properly enable/disable IndexedDB API. + Fix the build with GBM disabled. + Fix several crashes and rendering issues. + Security fixes: CVE-2023-41993, CVE-2023-40414. + Changes in version 2.42.0: + New renderer based on DMA-BUF shared buffers. + Add new permission request to handle DOM paste access requests. + Add API to configure experimental features at runtime. + Add API to set the percentage of volume space that can be used for data storage. + GBM is no longer required for WebGL implementation. + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359, CVE-2023-42890, CVE-2014-1745, CVE-2024-23226. - Drop webkit2gtk3-default-value.patch: fixed upstream. - Use gcc 12, and drop webkit2gtk3-gcc9.patch. - Add webkit2gtk3-old-fontconfig.patch: support older versions of fontconfig. - Add webkit2gtk3-gstreamer1.16.patch, and rebase webkit2gtk3-gstreamer1.12.patch and webkit2gtk3-gstreamer1.8.patch. - Rebase webkit2gtk3-icu60.patch, webkit2gtk3-icu52.patch, webkit2gtk3-old-glib.patch, webkit2gtk3-glib244.patch, webkit2gtk3-restore-atk.patch, and webkit2gtk3-no-libepoxy.patch. - Disable JPEGXL. - Add webkit2gtk3-gcrypt-build-fix.patch: fix the build with ENABLE_WEB_CRYPTO disabled. ------------------------------------------------------------------- Mon Aug 28 19:35:27 UTC 2023 - Michael Gorse - Simplify webkit2gtk3-icu60.patch. - Rebase webkit2gtk3-icu52.patch. ------------------------------------------------------------------- Wed Aug 2 20:09:18 UTC 2023 - Michael Gorse - Update to version 2.40.5 (boo#1213905 boo#1213379 boo#1213581): + Fix several crashes and rendering issues. + Security fixes: CVE-2023-38133, CVE-2023-38572, CVE-2023-38592, CVE-2023-38594, CVE-2023-38595, CVE-2023-38597, CVE-2023-38599, CVE-2023-38600, CVE-2023-38611, CVE-2023-37450, CVE-2023-39434, CVE-2023-40451. ------------------------------------------------------------------- Wed Jul 12 00:22:27 UTC 2023 - Michael Gorse - Update to version 2.40.3 (boo#1212863): + Make memory pressure monitor honor memory.memsw.usage_in_bytes if exists. + Include key modifiers in wheel events. + Apply cookie blocking policy to WebSocket handshakes. + Remove accidental dependency on GLib 2.70. + Fix the build with BUBBLEWRAP_SANDBOX disabled. + Fix several crashes and rendering issues. + Security fixes: CVE-2023-32439, CVE-2023-32435, CVE-2023-32393, CVE-2023-35074. - Add unifdef BuildRequires: New dependency. - Remove libbrotlidec from BuildRequires. No longer needed. - Drop webkit2gtk3-CVE-2023-28204.patch and webkit2gtk3-CVE-2023-32373.patch: fixed upstream. - Rebase webkit-process.patch, old-wayland-scanner.patch, webkit2gtk3-gstreamer1.12.patch, webkit2gtk3-gstreamer1.8.patch, webkit2gtk3-glib244.patch, webkit2gtk3-icu60.patch, webkit2gtk3-icu52.patch, webkit2gtk3-old-gtk.patch, and webkit2gtk3-restore-atk.patch. - Add webkit2gtk3-old-ruby.patch: lower ruby version dependency. - Add webkit2gtk3-no-libepoxy.patch: back out libepoxy dependency. - Add webkit2gtk3-gcc9.patch: fix build failure with gcc 9. - Disable avif. We don't have it on SLE-12. - Define USE_GSTREAMER_TRANSCODER=false: gstreamer not new enough. - Disable gbm: our version isn't new enough. - Disable MEDIA_STREAM. It has been disabled until now, and it's better to minimize the amount of gstreamer code that we need to patch. - Add webkit2gtk3-default-value.patch: fix for gcc 9. - Drop python3 conditional, and use python 3.6. - Increase MemPerProcess to guard against running out of memory. - Disable GLES2 on aarch64: fixes the build. ------------------------------------------------------------------- Thu Jun 8 20:24:50 UTC 2023 - Michael Gorse - Add security patches (boo#1211846): + webkit2gtk3-CVE-2023-28204.patch (boo#1211659 CVE-2023-28204) + webkit2gtk3-CVE-2023-32373.patch (boo#1211658 CVE-2023-32373) - Drop webkit2gtk3-restore-npapi.patch. It is becoming increasingly difficult to maintain, and it resurrected unmaintained code that we probably shouldn't carry anyhow (jsc#ped-2876). ------------------------------------------------------------------- Fri Apr 21 20:23:04 UTC 2023 - Michael Gorse - Update to version 2.38.6 (boo#1210295 boo#1210731): + Enable the Asynchronous Clipboard API to make certain pages work (e.g. GithHub started recently requiring it). + Support :has() CSS selectors in content filters. + Apply basic font properties as font variation settings. + The Bubblewrap sandbox no longer requires setting an application identifier via GApplication to operate correctly. Using GApplication is still recommended, but optional. + Improvements to the GStreamer multimedia playback, in particular around MSE, WebRTC, and seeking. + Fix the build with journald support enabled when using elogind instead of the systemd libraries. + Fix the build with Link-Time Optimization enabled (-flto=auto). + Fix context menus not working in the remote Web Inspector. + Fix usage of the remote Web Inspector over HTTP. + Fix debug logs not being emitted in release builds. + Fix several crashes and rendering issues. + Security fixes: CVE-2022-0108, CVE-2023-28205, CVE-2022-32885, CVE-2023-27932, CVE-2023-27954. - Rebase webkit2gtk3-gstreamer1.12.patch and webkit2gtk3-gstreamer1.8.patch. ------------------------------------------------------------------- Fri Mar 3 07:25:00 UTC 2023 - Michael Gorse - Update to version 2.38.5 (boo#1208328): + Fix large memory allocation when uploading content. + Fix scrolling after a history navigation with PSON enabled. + Always update the active uri of WebKitFrame. + Fix the build on Ubuntu 20.04. + Fix several crashes and rendering issues. + Security fixes: CVE-2023-23529. - Rebase webkit2gtk3-gstreamer1.12.patch. - Downgrade back to gcc 9. Building with 10 leads to unresolvable dependencies. - Fix webkit2gtk3-gstreamer1.8.patch: it wrongly removed a needed include. ------------------------------------------------------------------- Tue Feb 7 16:28:41 UTC 2023 - Michael Gorse - Update to version 2.38.4 (boo#1207997): + Improve GStreamer multimedia playback across the board with improved codec selection logic, better handling of latency, and improving frame discard to avoid audio/video desynchronizationg, among other fixes. + Disable HLS media playback by default, which makes web sites use MSE instead. If needed WEBKIT_GST_ENABLE_HLS_SUPPORT=1 can be set in the environment to enable it back. + Disable threaded rendering in GTK4 builds by default, as it was causing crashes. + Fix MediaSession API not showing artwork images. + Fix MediaSession MPRIS usage when running inside a Flatpak sandbox. + Fix input element controls to correctly scale when applying a zoom factor different than the default. + Fix leakage of Web processes in certain situations. + Fix the injected bundle not being found when running inside a sandbox. + Fix the build with ENABLE_INTROSPECTION when cross-compiling. + FIx the build with ENABLE_WEBGL disabled. + Fix the build with GStreamer-based WebRTC enabled. + Fix the build with USE_GTK4 enabled. + Fix several crashes and rendering issues. + Security fixes: CVE-2023-23517, CVE-2023-23518, CVE-2022-42826, CVE-2022-32919, CVE-2022-46705, CVE-2022-46725. - Rebase webkit2gtk3-gstreamer1.12.patch, webkit2gtk3-gstreamer1.8.patch, and webkit2gtk3-glib244.patch. ------------------------------------------------------------------- Thu Dec 22 15:32:11 UTC 2022 - Michael Gorse - Update to version 2.38.3 (boo#1206474 boo#1206750)): + Fix runtime critical warnings from media player. + Fix network process crash when fetching website data on ephemeral session. + Fix the build with Ruby 3.2. + Fix several crashes and rendering issues. + Security fixes: CVE-2022-42852, CVE-2022-42856, CVE-2022-42867, CVE-2022-46692, CVE-2022-46698, CVE-2022-46699, CVE-2022-46700. - Rebase webkit2gtk3-gstreamer1.12.patch. ------------------------------------------------------------------- Tue Nov 8 21:18:14 UTC 2022 - Michael Gorse - Update to version 2.38.2 (boo#1205120 boo#1205123 boo#1205124): + Fix scrolling issues in some sites having fixed background. + Fix prolonged buffering during progressive live playback. + Fix the build with accessibility disabled. + Fix several crashes and rendering issues. + Security fixes: CVE-2022-42799, CVE-2022-42823, CVE-2022-42824. - Rebase webkit2gtk3-restore-npapi.patch, webkit2gtk3-old-gtk.patch, webkit2gtk3-gstreamer1.12.patch, webkit2gtk3-icu60.patch, webkit2gtk3-icu52.patch - Rebase webkit2gtk3-old-glib.patch. It is now a copy of the SLE 15 glib patch. Split out changes specific to SLE 12 and add webkit2gtk3-glib244.patch. - Add webkit2gtk3-restore-atk.patch: restore atk implementation. Our glib is too old to handle the newer AT-SPI code. - Pass -DENABLE_DOCUMENTATION=OFF to configure, we did not build the API docs in the past, and I see no reason to start now. - Drop pkgconfig(libnotify) BuildRequires: No longer needed, nor used if available. - Pass -DUSE_SYSTEM_MALLOC=ON on all architectures, to work around webkit#243535. - Exclude s390 from the build. It has not been building for some time, and we are not shipping s390 updates anyhow. Drop webkit2gtk3-s390-build-fix.patch. ------------------------------------------------------------------- Tue Nov 8 21:18:14 UTC 2022 - Michael Gorse - Update to version 2.38.1: + Make xdg-dbus-proxy work if host session bus address is an abstract socket. + Use a single xdg-dbus-proxy process when sandbox is enabled. + Fix high resolution video playback due to unimplemented changeType operation. + Ensure GSubprocess uses posix_spawn() again and inherit file descriptors. + Fix player stucking in buffering (paused) state for progressive streaming. + Do not try to preconnect on link click when link preconnect setting is disabled. + Fix close status code returned when the client closes a WebSocket in some cases. + Fix media player duration calculation. + Fix several crashes and rendering issues. + Security fixes: CVE-2022-46691. ------------------------------------------------------------------- Tue Nov 8 21:18:14 UTC 2022 - Michael Gorse - Update to version 2.38.0 boo#1205121 boo#1205122): + New media controls UI style. + Add new API to set WebView’s Content-Security-Policy for web extensions support. + Make it possible to use the remote inspector from other browsers using WEBKIT_INSPECTOR_HTTP_SERVER env var. + MediaSession is enabled by default, allowing remote media control using MPRIS. + Add support for PDF documents using PDF.js. + Security fixes: CVE-2022-32888, CVE-2022-32923, CVE-2022-42863, CVE-2022-48503, CVE-2022-32933, CVE-2023-42833. ------------------------------------------------------------------- Mon Sep 19 14:06:24 UTC 2022 - Michael Gorse - Update to version 2.36.8 (boo#1203530): + Fix jumpy elements when scrolling GitLab and other web sites. + Fix WebKitWebView:web-process-terminated signal not being emitted for the first web view when sandboxing is enabled. + Fix hang when opening HTML