------------------------------------------------------------------- Mon Dec 8 15:15:56 UTC 2025 - Michael Gorse - Update to version 2.50.3 (bsc#1254473 bsc#1254498 bsc#1254509): + Fix seeking and looping of media elements that set the "loop" property. + Fix several crashes and rendering issues. + Security fixes: CVE-2025-13947, CVE-2025-43421, CVE-2025-43458, CVE-2025-66287. - Drop webkit2gtk3-undefined-symbol.patch: fixed upstream. - Rebase webkit2gtk3-gstreamer-1.16.patch and webkit2gtk3-gstreamer1.8.patch. - Use %limit_build. Also define %dwz_low_mem_die_limit and %dwz_max_die_limit, similar to what we have in wpewebkit. This should simplify the logic for limiting jobs and will hopefully help with intermittent build failures. ------------------------------------------------------------------- Mon Nov 24 19:07:06 UTC 2025 - Michael Gorse - Update to version 2.50.2 (bsc#1254165 bsc#1254166 bsc#1254167 bsc#1254168 bsc#1254169 bsc#1254170 bsc#1254171 bsc#1254172 bsc#1254174 bsc#1254176 bsc#1254177 bsc#1254179 bsc#1254208): + Prevent unsafe URI schemes from participating in media playback. + Make jsc_value_array_buffer_get_data() function introspectable. + Fix logging in to Google accounts that have a WebAuthn second factor configured. + Fix loading webkit://gpu when there are no threads configured for GPU rendering. + Fix rendering gradiants that use the CSS hue interpolation method. + Fix pasting image data from the clipboard. + Fix font-family selection when the font name contains spaces. + Fix the build with standard C libraries that lack execinfo.h, like Musl or uClibc. + Fix capturing canvas snapshots in the Web Inspector. + Fix several crashes and rendering issues. + Security fixes: CVE-2025-43392, CVE-2025-43425, CVE-2025-43427, CVE-2025-43429, CVE-2025-43430, CVE-2025-43431, CVE-2025-43432, CVE-2025-43434, CVE-2025-43440, CVE-2025-43443, CVE-2025-13502. - Rebase webkit2gtk3-glib244.patch and webkit2gtk3-icu52.patch. - Add webkit2gtk3-undefined-symbol.patch: fix a build failure. ------------------------------------------------------------------- Tue Oct 14 16:59:14 UTC 2025 - Michael Gorse - Update to version 2.50.1 (boo#1251975): + Improve text rendering performance. + Fix audio playback broken on instagram. + Fix rendering of layers with fractional transforms. + Fix the build with ENABLE(VIDEO) disabled. + Fix the build in s390x. + Fix several crashes and rendering issues. + Security fixes: CVE-2025-43343. + Changes in version 2.50.0 (boo#1250439 boo#1250440 boo#1250441 boo#1250442): + Improved rendering performance by recording each layer once and replaying every dirty region in different worker threads. + Enable damage propagation to the UI process by default. + CSS property font-variant-emoji is now enabled by default. + Font synthesis properties (bold/italic) are now properly handled. + Ensure web view is focused on tap gesture. + Added new API to get the theme color of a WebKitWebView. + Security fixes: CVE-2025-43272, CVE-2025-43342, CVE-2025-43356, CVE-2025-43368, CVE-2025-43419. - Add webkit2gtk3-no-mediastream.patch: fix the build with MEDIA_STREAM disabled. - Force the garbage collector to run more often when compiling on i586 and arm. Needed to avoid running out of memory. - Tweak _constraints to match factory. + Rebase SLE patches: - webkit2gtk3-gstreamer-1.16.patch - webkit2gtk3-epoxy140.patch - webkit2gtk3-glib262.patch - webkit2gtk3-icu65.patch - webkit2gtk3-old-gtk.patch - webkit2gtk3-gstreamer1.8.patch - webkit2gtk3-icu52.patch - webkit2gtk3-restore-atk.patch - webkit2gtk3-sle12-deps.patch - webkit2gtk3-no-libepoxy.patch - webkit2gtk3-no-gcrypt.patch - webkit2gtk3-i586-build-fix.patch - webkit2gtk3-old-libdrm.patch - Add webkit2gtk3-old-perl.patch: Support perl 5.18. ------------------------------------------------------------------- Tue Aug 5 17:00:25 UTC 2025 - Michael Gorse - Update to version 2.48.5 (boo#1247562 boo#1247563 boo#1247564 boo#1247595 boo#1247596 boo#1247597 boo#1247598 boo#1247599 boo#1247600 boo#1247742): + Fix several crashes. + Security fixes: CVE-2025-31273, CVE-2025-31278, CVE-2025-43211, CVE-2025-43212, CVE-2025-43216, CVE-2025-43227, CVE-2025-43228, CVE-2025-43240, CVE-2025-43265, CVE-2025-6558. + Changes in version 2.48.4: + Improve emoji font selection with USE_SKIA=ON. + Improve playback of multimedia streams from blob URLs. + Fix the build with USE_SKIA_OPENTYPE_SVG=ON and USE_SYSPROF_CAPTURE=ON. + Fix the build on LoongArch with USE_SKIA=ON. + Fix crash when using a WebKitWebView widget in an offscreen window. + Fix several crashes and rendering issues. + Changes in version 2.48.3: + Fix a crash introduced by the new threaded rendering implementation using Skia API. + Improve rendering performance by recording layers once and replaying every dirty region in different worker threads. + Fix a crash when setting WEBKIT_SKIA_GPU_PAINTING_THREADS=0. + Fix a reference cycle in webkitmediastreamsrc preventing its disposal. - Rebase webkit2gtk3-glib262.patch, webkit2gtk3-gstreamer1.8.patch, and webkit2gtk3-old-gtk.patch. ------------------------------------------------------------------- Wed May 21 18:50:40 UTC 2025 - Michael Gorse - Update to version 2.48.2 (boo#1243282 boo#1243286 boo#1243288 boo#1243289 boo#1243424 boo#1243596): + Enable CSS Overscroll Behavior by default. + Change threaded rendering implementation to use Skia API instead of WebCore display list that is not thread safe. + Fix rendering when device scale factor change comes before the web view geometry update. + Fix network process crash on exit. + Fix the build with ENABLE_RESOURCE_USAGE=OFF. + Fix several crashes and rendering issues. + Security fixes: CVE-2025-24223, CVE-2025-31204, CVE-2025-31205, CVE-2025-31206, CVE-2025-31215, CVE-2025-31257. - Drop 8bee9eb9.patch: fixed upstream. - Rebase webkit2gtk3-gstreamer-1.16.patch and webkit2gtk3-gstreamer1.8.patch. ------------------------------------------------------------------- Mon Apr 7 18:38:08 UTC 2025 - Michael Gorse - Update to version 2.48.1 (boo#1240958 boo#1240961 boo#1240962 boo#1240963 boo#1240964 boo#1240986 boo#1240987): + Limit the data stored in session state. + Remove the empty area below the title bar in Web Inspector when not docked. + Fix the build with GST_DISABLE_GST_DEBUG. + Fix the build with GStreamer < 1.20. + Fix the build with video disabled. + Fix the build with clang 20. + Security fixes: CVE-2024-54551, CVE-2025-24208, CVE-2025-24209, CVE-2025-24213, CVE-2025-24216, CVE-2025-24264, CVE-2025-30427. + Changes in version 2.48.0 (boo#1239863 boo#1239864): + Move tiles rendering to worker threads when rendering with the GPU. + Fix preserve-3D intersection rendering. + Added new function for creating Promise objects to JavaScripotCore GLib API. + The MediaRecorder backend gained WebM support (requires at least GStreamer 1.24.9) and audio bitrate configuration support. + Fix invalid DPI-aware font size conversion. + Bring back support for OpenType-SVG fonts using Skia SVG module. + Add metadata (title and creation/modification date) to the PDF document generated for printing. + Propagate the font’s computed locale to HarfBuzz. + The GPU process build is now enabled for WebGL, but the web process is still used by default. The runtime flag UseGPUProcessForWebGL can be used to use the GPU process for WebGL. + Security fixes: CVE-2024-44192, CVE-2024-54467, CVE-2025-24201, CVE-2025-24189. - Drop 7d784721.patch: Fixed upstream. - Disable speech synthesis. It has been disabled until now, and we don't have flite or spiel in SLE. - Add 8bee9eb9.patch: fix the build on non-x86 architectures. - Add webkit2gtk3-iochannel-network-cache.patch: backport upstream patch to stop using IOChannel in NetworkCache: hopefully fixes crashes in the network process. - Add webkit2gtk3-glib262.patch, copied from SLE-15-SP2: support glib 2.62 again. - Add webkit2gtk3-icu65.patch, copied from SLE-15-SP2: support icu 65. - Replace webkit2gtk3-old-ruby.patch with webkit2gtk3-sle12-deps.patch to collect a few harmless change to relax version requirements. webkit2gtk3-old-fontconfig.patch is now a copy of the SLE-15-SP2 patch. - Rebase patches: + webkit2gtk3-gstreamer-1.16.patch + webkit2gtk3-old-fontconfig.patch + webkit2gtk3-epoxy140.patch + webkit2gtk3-old-gtk.patch + webkit2gtk3-glib244.patch + webkit2gtk3-gstreamer1.8.patch + webkit2gtk3-icu52.patch + webkit2gtk3-old-zlib.patch + webkit2gtk3-restore-atk.patch + webkit2gtk3-i586-build-fix.patch + webkit2gtk3-no-gcrypt.patch + webkit2gtk3-old-libdrm.patch ------------------------------------------------------------------- Fri Mar 14 00:48:29 UTC 2025 - Michael Gorse - Add 7d784721.patch: WebGL context primitive restart can be toggled from WebContent process (boo#1239547 CVE-2025-24201). ------------------------------------------------------------------- Tue Feb 11 16:07:34 UTC 2025 - Michael Gorse - Update to version 2.46.6 (boo#1236946): + Fix a crash when enabling Skia CPU rendering. + Fix several crashes and rendering issues. + Security fixes: CVE-2025-24143, CVE-2025-24150, CVE-2025-24158, CVE-2025-24162. - Rebase webkit2gtk3-gstreamer1.8.patch. - Update webkit2gtk3-glib244.patch to fix a warning. ------------------------------------------------------------------- Fri Dec 27 19:35:38 UTC 2024 - Michael Gorse - Update to version 2.46.5 (boo#1234851): + Fix the build with GBM and release logs disabled. + Fix several crashes and rendering issues. + Security fixes: CVE-2024-54479, CVE-2024-54502, CVE-2024-54505, CVE-2024-54508, CVE-2024-54543. + Changes in version 2.46.4: + Improve memory consumption and performance of Canvas getImageData. + Fix preserve-3D intersection rendering. + Fix video dimensions since GStreamer 1.24.9. + Fix the HTTP-based remote Web Inspector not loading in Chromium. + Fix content filters not working on about:blank iframes. + Fix several crashes and rendering issues. + Security fixes: CVE-2024-44308, CVE-2024-44309. - Drop webkit2gtk3-CVE-2024-44308.patch and webkit2gtk3-CVE-2024-44309.patch: fixed upstream. - Drop webkit2gtk3-old-soup.patch: fixed upstream. - Rebase webkit2gtk3-gstreamer1.8.patch. ------------------------------------------------------------------- Mon Nov 25 19:47:45 UTC 2024 - Michael Gorse - Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register after a slow path (boo#1233631 CVE-2024-44308). - Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management issue (boo#1233632 CVE-2024-44309). ------------------------------------------------------------------- Thu Nov 7 16:45:53 UTC 2024 - Michael Gorse - Update to version 2.46.3 (boo#1232747): + Flatten layers to a plane when preseve-3d style is set. + Fix DuckDuckGo links by adding a user agent quirk. + Fix several crashes and rendering issues. + Security fixes: CVE-2024-44244, CVE-2024-44296. - Rebase SLE 12 patches: + webkit-process.patch + webkit2gtk3-old-gtk.patch + webkit2gtk3-glib244.patch + webkit2gtk3-gstreamer1.8.patch - Drop bug281495.patch: fixed upstream. ------------------------------------------------------------------- Wed Oct 23 02:35:53 UTC 2024 - Michael Gorse - Add webkit2gtk3-old-libdrm.patch: support older versions of libdrm. ------------------------------------------------------------------- Thu Oct 17 20:12:29 UTC 2024 - Michael Gorse - Update to version 2.46.0 (boo#1231039): + Use Skia instead of cairo for 2D rendering and enable GPU rendering by default. + Enable offscreen canvas by default. + Add support for system tracing with Sysprof. + Implement printing using the Print portal. + Add new API to load settings from a config file. + Add a new setting to enable or disable the 2D canvas acceleration (enabled by default). + Undeprecate console messages API and make it available in 6.0 API. + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185, CVE-2024-54534, CVE-2024-27856, CVE-2025-43480. - Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be needed anymore. - Add webkit2gtk3-angle-s390x.patch: fix the build on s390x. - Add webkit2gtk3-old-soup.patch: fix the build with libsoup < 2.67.4. - Use gcc 13 to match what is tested upstream. - Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building sysprof capture for now. - Rebase SLE patches: webkit-process.patch webkit2gtk3-gstreamer-1.16.patch webkit2gtk3-old-fontconfig.patch webkit2gtk3-epoxy140.patch webkit2gtk3-old-gtk.patch webkit2gtk3-glib244.patch webkit2gtk3-gstreamer1.8.patch webkit2gtk3-icu52.patch webkit2gtk3-restore-atk.patch webkit2gtk3-no-libepoxy.patch webkit2gtk3-no-gcrypt.patch - Add webkit2gtk3-cxx23-cmake.patch: cmake 3.20 doesn't recognize CXX23. Set it using CXXFLAGS instead. - Add webkit2gtk3-old-zlib.patch: don't use crc32_z. - Add webkit2gtk3-i586-build-fix.patch: back out roundeven functions. - Add bug281495.patch: fix crash in ProcessLauncher socket monitor callback. - Disable skia. Our fontconfig is too old. ------------------------------------------------------------------- Mon Aug 19 18:48:55 UTC 2024 - Michael Gorse - Update to version 2.44.3 (boo#1228613 boo#1228693 boo#1228694 boo#1228695 boo#1228697): + Fix web process cache suspend/resume when sandbox is enabled. + Fix accelerated images dissapearing after scrolling. + Fix video flickering with DMA-BUF sink. + Fix pointer lock on X11. + Fix movement delta on mouse events in GTK3. + Undeprecate console message API and make it available in 2022 API. + Fix several crashes and rendering issues. + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780, CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838, CVE-2024-27851. - Rebase webkit2gtk3-gstreamer1.8.patch. ------------------------------------------------------------------- Tue May 28 18:26:52 UTC 2024 - Michael Gorse - Update to version 2.44.2 (boo#1225071): + Make gamepads visible on axis movements, and not only on button presses. + Disable the gst-libav AAC decoder. + Make user scripts and style sheets visible in the Web Inspector. + Use the geolocation portal where available, with the existing geoclue as fallback if the portal is not usable. + Use the printing portal when running sandboxed. + Use the file transfer portal for drag and drop when running sandboxed. + Avoid notifying an empty cursor rectangle to input methods. + Remove empty bar shown in detached inspector windows. + Consider keycode when activating application accelerators. + Fix the build with ENABLE_WEBAUDIO disabled. + Fix several crashes and rendering issues. + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820, CVE-2024-27833. - Changes in version 2.44.1: + Fix handling of lifetime of web view child dialogs in GTK4. + Do not schedule layer flushes when drawing area size is empty. + Fix videos with alpha when using the DMA-BUF sink. + Fix the build with USE_GBM=OFF. + Fix the build in 32bit platforms + Fix several crashes and rendering issues. - Update keyring (taken from rawhide). - Drop webkit2gtk3-271108.patch: fixed upstream. - Rebase webkit2gtk3-icu52.patch. - Disable using the printing portal in webkit2gtk3-old-gtk.patch. ------------------------------------------------------------------- Wed Mar 20 18:43:41 UTC 2024 - Michael Gorse - Update to version 2.44.0 (boo#1222010): + Make the DOM accessibility tree reachable from UI process with GTK4. + Removed the X11 and WPE renderers in favor of DMA-BUF. + Improved vblank synchronization when rendering. + Removed key event reinjection in GTK4 to make keyboard shortcuts work in web sites. + Fix gamepads detection by correctly handling focused window in GTK4. + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263, CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956, CVE-2023-42843, CVE-2024-54658. - Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream. - Drop webkit2gtk3-gcrypt-build-fix.patch ,and add webkit2gtk3-no-gcrypt.patch: revert upstream change to allow libgcrypt to be disabled. - Rebase webkit2gtk3-disable-dmabuf-nvidia.patch, webkit2gtk3-gstreamer-1.16.patch, webkit2gtk3-old-gtk.patch, webkit2gtk3-old-fontconfig.patch, webkit2gtk3-gstreamer-1.16.patch, webkit2gtgk3-restore-atk.patch, and webkit2gtk3-no-libepoxy.patch. - Drop webkit2gtk3-llint-build-fix.patch: no longer needed. - Add webkit2gtk3-271108.patch: Fix build on 32bit arches (https://bugs.webkit.org/show_bug.cgi?id=271108). - Add webkit2gtk3-epoxy140.patch: support epoxy 1.4.0. - Drop webkit2gtk3-gstreamer1.12.patch: folded into webkit2gtk3-gstreamer1.8.patch. - Drop webkit2gtk3-icu60.patch: folded into webkit2gtk3-icu52.patch. - Drop webkit2gtk3-old-glib.patch: folded into webkit2gtk3-glib244.patch. - Explicitly disable gtk 4, since it is now on by default. - Disable web codecs: brings in new code, and our gstreamer is too old. - Disable libbacktrace: we don't have it in SLE. - Use WebAssembly on aarch64. It is the upstream default and no longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON, -DENABLE_WEBASSEMBLY=OFF and -DENABLE_SAMPLING_PROFILER=OFF for the same reason. ------------------------------------------------------------------- Tue Feb 6 11:49:42 UTC 2024 - Michael Gorse - Update to version 2.42.5 (boo#1219604): + Fix webkit_web_context_allow_tls_certificate_for_host to handle IPv6 URIs produced by SoupURI. + Ignore stops with offset zero before last one when rendering gradients with cairo. + Write bwrapinfo.json to disk for xdg-desktop-portal. + Fix gamepads detection by correctly handling focused window in GTK4. + Fix several crashes and rendering issues. + Security fixes: CVE-2024-23222 (boo#1219113), CVE-2024-23206, CVE-2024-23213, CVE-2024-23271. - Drop webkit2gtk3-gstreamer-build-fix.patch: fixed upstream. - Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86 architectures. - Rebase webkit2gtk3-gstreamer1.12.patch and webkit2gtk3-gstreamer1.8.patch. ------------------------------------------------------------------- Sat Dec 16 13:51:42 UTC 2023 - Michael Gorse - Update to version 2.42.4 (boo#1218032): + Fix incorrect random images incorrectly displayed as backgrounds of
elements. + Fix videos displayed aliased after being resized e.g. in YouTube. + Fix several crashes and rendering issues. + Security fixes: CVE-2023-42883. - Rebase webkit2gtk3-gstreamer1.8.patch. ------------------------------------------------------------------- Wed Dec 6 20:56:26 UTC 2023 - Michael Gorse - Update to version 2.42.3 (boo#1217844): + Fix flickering while playing videos with DMA-BUF sink. + Fix color picker being triggered in the inspector when typing "tan". + Do not special case the "sans" font family name. + Fix build failure with libxml2 version 2.12.0 due to an API change. + Fix several crashes and rendering issues. + Security fixes: CVE-2023-42916, CVE-2023-42917. ------------------------------------------------------------------- Fri Nov 17 22:12:23 UTC 2023 - Michael Gorse - Update to version 2.42.2 (boo#1217210): + Bump Safari version in user agent header. + Fix CSP regression that broke Unity WebGL applications. + Fix the build with GBM disabled. + Fix several crashes and rendering issues. + Security fixes: CVE-2023-41983, CVE-2023-42852. - Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf renderer for NVIDIA proprietary drivers (boo#1216778). - Add webkit2gtk3-gstreamer-build-fix.patch: fix the build with !ENABLE(MEDIA_STREAM). ------------------------------------------------------------------- Mon Oct 23 18:53:47 UTC 2023 - Mike Gorse - Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider of EglDestroyImage Found" (boo#1216483). ------------------------------------------------------------------- Mon Oct 9 19:39:24 UTC 2023 - Michael Gorse - Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867 boo#1215868 boo#1215869 boo#1215870 boo#1218033) boo#1222905): + Fix enable-html5-database setting to properly enable/disable IndexedDB API. + Fix the build with GBM disabled. + Fix several crashes and rendering issues. + Security fixes: CVE-2023-41993, CVE-2023-40414. + Changes in version 2.42.0: + New renderer based on DMA-BUF shared buffers. + Add new permission request to handle DOM paste access requests. + Add API to configure experimental features at runtime. + Add API to set the percentage of volume space that can be used for data storage. + GBM is no longer required for WebGL implementation. + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359, CVE-2023-42890, CVE-2014-1745, CVE-2024-23226, CVE-2023-42875, CVE-2023-42970, CVE-2023-43000. - Drop webkit2gtk3-default-value.patch: fixed upstream. - Use gcc 12, and drop webkit2gtk3-gcc9.patch. - Add webkit2gtk3-old-fontconfig.patch: support older versions of fontconfig. - Add webkit2gtk3-gstreamer1.16.patch, and rebase webkit2gtk3-gstreamer1.12.patch and webkit2gtk3-gstreamer1.8.patch. - Rebase webkit2gtk3-icu60.patch, webkit2gtk3-icu52.patch, webkit2gtk3-old-glib.patch, webkit2gtk3-glib244.patch, webkit2gtk3-restore-atk.patch, and webkit2gtk3-no-libepoxy.patch. - Disable JPEGXL. - Add webkit2gtk3-gcrypt-build-fix.patch: fix the build with ENABLE_WEB_CRYPTO disabled. ------------------------------------------------------------------- Mon Aug 28 19:35:27 UTC 2023 - Michael Gorse - Simplify webkit2gtk3-icu60.patch. - Rebase webkit2gtk3-icu52.patch. ------------------------------------------------------------------- Wed Aug 2 20:09:18 UTC 2023 - Michael Gorse - Update to version 2.40.5 (boo#1213905 boo#1213379 boo#1213581): + Fix several crashes and rendering issues. + Security fixes: CVE-2023-38133, CVE-2023-38572, CVE-2023-38592, CVE-2023-38594, CVE-2023-38595, CVE-2023-38597, CVE-2023-38599, CVE-2023-38600, CVE-2023-38611, CVE-2023-37450, CVE-2023-39434, CVE-2023-40451. ------------------------------------------------------------------- Wed Jul 12 00:22:27 UTC 2023 - Michael Gorse - Update to version 2.40.3 (boo#1212863): + Make memory pressure monitor honor memory.memsw.usage_in_bytes if exists. + Include key modifiers in wheel events. + Apply cookie blocking policy to WebSocket handshakes. + Remove accidental dependency on GLib 2.70. + Fix the build with BUBBLEWRAP_SANDBOX disabled. + Fix several crashes and rendering issues. + Security fixes: CVE-2023-32439, CVE-2023-32435, CVE-2023-32393, CVE-2023-35074. - Add unifdef BuildRequires: New dependency. - Remove libbrotlidec from BuildRequires. No longer needed. - Drop webkit2gtk3-CVE-2023-28204.patch and webkit2gtk3-CVE-2023-32373.patch: fixed upstream. - Rebase webkit-process.patch, old-wayland-scanner.patch, webkit2gtk3-gstreamer1.12.patch, webkit2gtk3-gstreamer1.8.patch, webkit2gtk3-glib244.patch, webkit2gtk3-icu60.patch, webkit2gtk3-icu52.patch, webkit2gtk3-old-gtk.patch, and webkit2gtk3-restore-atk.patch. - Add webkit2gtk3-old-ruby.patch: lower ruby version dependency. - Add webkit2gtk3-no-libepoxy.patch: back out libepoxy dependency. - Add webkit2gtk3-gcc9.patch: fix build failure with gcc 9. - Disable avif. We don't have it on SLE-12. - Define USE_GSTREAMER_TRANSCODER=false: gstreamer not new enough. - Disable gbm: our version isn't new enough. - Disable MEDIA_STREAM. It has been disabled until now, and it's better to minimize the amount of gstreamer code that we need to patch. - Add webkit2gtk3-default-value.patch: fix for gcc 9. - Drop python3 conditional, and use python 3.6. - Increase MemPerProcess to guard against running out of memory. - Disable GLES2 on aarch64: fixes the build. ------------------------------------------------------------------- Thu Jun 8 20:24:50 UTC 2023 - Michael Gorse - Add security patches (boo#1211846): + webkit2gtk3-CVE-2023-28204.patch (boo#1211659 CVE-2023-28204) + webkit2gtk3-CVE-2023-32373.patch (boo#1211658 CVE-2023-32373) - Drop webkit2gtk3-restore-npapi.patch. It is becoming increasingly difficult to maintain, and it resurrected unmaintained code that we probably shouldn't carry anyhow (jsc#ped-2876). ------------------------------------------------------------------- Fri Apr 21 20:23:04 UTC 2023 - Michael Gorse - Update to version 2.38.6 (boo#1210295 boo#1210731): + Enable the Asynchronous Clipboard API to make certain pages work (e.g. GithHub started recently requiring it). + Support :has() CSS selectors in content filters. + Apply basic font properties as font variation settings. + The Bubblewrap sandbox no longer requires setting an application identifier via GApplication to operate correctly. Using GApplication is still recommended, but optional. + Improvements to the GStreamer multimedia playback, in particular around MSE, WebRTC, and seeking. + Fix the build with journald support enabled when using elogind instead of the systemd libraries. + Fix the build with Link-Time Optimization enabled (-flto=auto). + Fix context menus not working in the remote Web Inspector. + Fix usage of the remote Web Inspector over HTTP. + Fix debug logs not being emitted in release builds. + Fix several crashes and rendering issues. + Security fixes: CVE-2022-0108, CVE-2023-28205, CVE-2022-32885, CVE-2023-27932, CVE-2023-27954. - Rebase webkit2gtk3-gstreamer1.12.patch and webkit2gtk3-gstreamer1.8.patch. ------------------------------------------------------------------- Fri Mar 3 07:25:00 UTC 2023 - Michael Gorse - Update to version 2.38.5 (boo#1208328): + Fix large memory allocation when uploading content. + Fix scrolling after a history navigation with PSON enabled. + Always update the active uri of WebKitFrame. + Fix the build on Ubuntu 20.04. + Fix several crashes and rendering issues. + Security fixes: CVE-2023-23529. - Rebase webkit2gtk3-gstreamer1.12.patch. - Downgrade back to gcc 9. Building with 10 leads to unresolvable dependencies. - Fix webkit2gtk3-gstreamer1.8.patch: it wrongly removed a needed include. ------------------------------------------------------------------- Tue Feb 7 16:28:41 UTC 2023 - Michael Gorse - Update to version 2.38.4 (boo#1207997): + Improve GStreamer multimedia playback across the board with improved codec selection logic, better handling of latency, and improving frame discard to avoid audio/video desynchronizationg, among other fixes. + Disable HLS media playback by default, which makes web sites use MSE instead. If needed WEBKIT_GST_ENABLE_HLS_SUPPORT=1 can be set in the environment to enable it back. + Disable threaded rendering in GTK4 builds by default, as it was causing crashes. + Fix MediaSession API not showing artwork images. + Fix MediaSession MPRIS usage when running inside a Flatpak sandbox. + Fix input element controls to correctly scale when applying a zoom factor different than the default. + Fix leakage of Web processes in certain situations. + Fix the injected bundle not being found when running inside a sandbox. + Fix the build with ENABLE_INTROSPECTION when cross-compiling. + FIx the build with ENABLE_WEBGL disabled. + Fix the build with GStreamer-based WebRTC enabled. + Fix the build with USE_GTK4 enabled. + Fix several crashes and rendering issues. + Security fixes: CVE-2023-23517, CVE-2023-23518, CVE-2022-42826, CVE-2022-32919, CVE-2022-46705, CVE-2022-46725. - Rebase webkit2gtk3-gstreamer1.12.patch, webkit2gtk3-gstreamer1.8.patch, and webkit2gtk3-glib244.patch. ------------------------------------------------------------------- Thu Dec 22 15:32:11 UTC 2022 - Michael Gorse - Update to version 2.38.3 (boo#1206474 boo#1206750)): + Fix runtime critical warnings from media player. + Fix network process crash when fetching website data on ephemeral session. + Fix the build with Ruby 3.2. + Fix several crashes and rendering issues. + Security fixes: CVE-2022-42852, CVE-2022-42856, CVE-2022-42867, CVE-2022-46692, CVE-2022-46698, CVE-2022-46699, CVE-2022-46700. - Rebase webkit2gtk3-gstreamer1.12.patch. ------------------------------------------------------------------- Tue Nov 8 21:18:14 UTC 2022 - Michael Gorse - Update to version 2.38.2 (boo#1205120 boo#1205123 boo#1205124): + Fix scrolling issues in some sites having fixed background. + Fix prolonged buffering during progressive live playback. + Fix the build with accessibility disabled. + Fix several crashes and rendering issues. + Security fixes: CVE-2022-42799, CVE-2022-42823, CVE-2022-42824. - Rebase webkit2gtk3-restore-npapi.patch, webkit2gtk3-old-gtk.patch, webkit2gtk3-gstreamer1.12.patch, webkit2gtk3-icu60.patch, webkit2gtk3-icu52.patch - Rebase webkit2gtk3-old-glib.patch. It is now a copy of the SLE 15 glib patch. Split out changes specific to SLE 12 and add webkit2gtk3-glib244.patch. - Add webkit2gtk3-restore-atk.patch: restore atk implementation. Our glib is too old to handle the newer AT-SPI code. - Pass -DENABLE_DOCUMENTATION=OFF to configure, we did not build the API docs in the past, and I see no reason to start now. - Drop pkgconfig(libnotify) BuildRequires: No longer needed, nor used if available. - Pass -DUSE_SYSTEM_MALLOC=ON on all architectures, to work around webkit#243535. - Exclude s390 from the build. It has not been building for some time, and we are not shipping s390 updates anyhow. Drop webkit2gtk3-s390-build-fix.patch. ------------------------------------------------------------------- Tue Nov 8 21:18:14 UTC 2022 - Michael Gorse - Update to version 2.38.1: + Make xdg-dbus-proxy work if host session bus address is an abstract socket. + Use a single xdg-dbus-proxy process when sandbox is enabled. + Fix high resolution video playback due to unimplemented changeType operation. + Ensure GSubprocess uses posix_spawn() again and inherit file descriptors. + Fix player stucking in buffering (paused) state for progressive streaming. + Do not try to preconnect on link click when link preconnect setting is disabled. + Fix close status code returned when the client closes a WebSocket in some cases. + Fix media player duration calculation. + Fix several crashes and rendering issues. + Security fixes: CVE-2022-46691. ------------------------------------------------------------------- Tue Nov 8 21:18:14 UTC 2022 - Michael Gorse - Update to version 2.38.0 boo#1205121 boo#1205122): + New media controls UI style. + Add new API to set WebView’s Content-Security-Policy for web extensions support. + Make it possible to use the remote inspector from other browsers using WEBKIT_INSPECTOR_HTTP_SERVER env var. + MediaSession is enabled by default, allowing remote media control using MPRIS. + Add support for PDF documents using PDF.js. + Security fixes: CVE-2022-32888, CVE-2022-32923, CVE-2022-42863, CVE-2022-48503, CVE-2022-32933, CVE-2023-42833. ------------------------------------------------------------------- Mon Sep 19 14:06:24 UTC 2022 - Michael Gorse - Update to version 2.36.8 (boo#1203530): + Fix jumpy elements when scrolling GitLab and other web sites. + Fix WebKitWebView:web-process-terminated signal not being emitted for the first web view when sandboxing is enabled. + Fix hang when opening HTML