Bug#1116301: evolution: Evolution crash when clicking on some UI elements (like attachments) with libwebkit2gtk-4.1-0 > 2.49.4

[Salvatore Bonaccorso]

Hi,

On Wed, Oct 08, 2025 at 01:23:57PM +0200, Alberto Garcia wrote:
> On Sat, Oct 04, 2025 at 11:43:56AM +0200, Alberto Garcia wrote:
> > > Berto, what are your plans for pushing webkit2gtk 2.50 to Debian 12
> > > and 13? If you push this initial major update as a regular stable
> > > update, then we can update evolution at the same time. However, the
> > > next point releases are not scheduled until November 15. [1]
> > 
> > Hi, sorry, I could not reply to this earlier, I'm on vacation these
> > days.
> 
> I'm back now.
> 
> So we would only need to apply this patch to prevent a regression in
> Evolution before updating WebKitGTK, is that right?
> 
> https://salsa.debian.org/gnome-team/evolution/-/blob/debian/3.56.2-4/debian/patches/I-3124-JavaScript-Correct-dictionary-objects-creation-Web.patch
> 
> (I assume that a patched Evolution would work with old and new
> versions of WebKitGTK, we should double check that)
> 
> It seems like a harmless change to me, but as I said none of the open
> WebKitGTK CVEs seem so critical, so if you want to wait until the next
> point release it's fine with me (there is of course the possibility
> that new CVEs appear in the next few weeks).

or alternatively if more pressing evolution might be released earlier
via a SUA (https://lists.debian.org/debian-stable-announce/) once it
is in the proposed-updaes quueues and accepted byt he stable managers.

> Do security updates expect that users are running the most recent
> point release?

or other speaking: all updates deployed for the stable release
applied. E.g. configurations where only the security archive is
configured is not really something users should do, as security
updates and other bugfix updates are released via point releases.

But I hope I understood your question correctly.

Regards,
Salvatore