[request-tracker-maintainers] Bug#1130053: trixie-pu: package request-tracker5/5.0.7+dfsg-4+deb13u1

[Andrew Ruthven]

Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: request-tracker5 at packages.debian.org
Control: affects -1 + src:request-tracker5
User: release.debian.org at packages.debian.org
Usertags: pu

[ Reason ]
Firefox v148 has introduced a change to how they handle JavaScript which
breaks CKEditor 4, which is used by Request Tracker. Mozilla have introduced a
work around that looks for version 4 of CKEditor. Unfortunately how we built
CKEditor in the request-tracker5 package we weren't setting the version number,
which means that Firefox doesn't apply the workaround.

The bug report for Firefox is here:
  https://bugzilla.mozilla.org/show_bug.cgi?id=2002481

While Firefox v148 isn't in Trixie, many end users of Request Tracker
installations are likely to be running the latest version of Firefox.

[ Impact ]
The impact for users is that they can't add comments to tickets if Request
Tracker is installed using our packages. This has already been noticed in the
RT forum:
  https://forum.bestpractical.com/t/rt-5-wysiwyg-editor-not-working-in-firefox-148/41587

[ Tests ]
I have manually tested using Firefox v148, and the current nightly build
against the current package in Trixie and with my fixed packages. The old
package shows the behaviour as described, the new package works as expected.

[ Risks ]
There is very low risk. It is a two line change in a build script to set
the version of CKEditor that is being built.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]
There is a two line change to debian/scripts/build-final-ckeditor.sh which sets
the --version. When --version isn't provided then it defaults to "DEV". I have
also wrapped the lines to 80 characters to make it easier to read.

[ Other info ]
I will create a request to add a fixed version to Bookworm as well.
request-tracker4 in bookworm (and older) also suffers from this issue. Bug
report: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1129517
-------------- next part --------------
diff -Nru request-tracker5-5.0.7+dfsg/debian/changelog request-tracker5-5.0.7+dfsg/debian/changelog
--- request-tracker5-5.0.7+dfsg/debian/changelog	2025-10-08 21:16:58.000000000 +1300
+++ request-tracker5-5.0.7+dfsg/debian/changelog	2026-03-02 22:17:44.000000000 +1300
@@ -1,3 +1,12 @@
+request-tracker5 (5.0.7+dfsg-4+deb13u2) trixie-proposed-updates; urgency=medium
+
+  * Set a version for ckeditor when we build it to allow Firefox v148 to
+    correctly detect that it needs a work around, see:
+    https://bugzilla.mozilla.org/show_bug.cgi?id=2002481
+    (Closes: #1129090)
+
+ -- Andrew Ruthven <andrew at etc.gen.nz>  Mon, 02 Mar 2026 22:17:44 +1300
+
 request-tracker5 (5.0.7+dfsg-4+deb13u1) trixie-security; urgency=medium
 
   * Apply upstream patch which fixes several security vulnerabilities:
diff -Nru request-tracker5-5.0.7+dfsg/debian/scripts/build-final-ckeditor.sh request-tracker5-5.0.7+dfsg/debian/scripts/build-final-ckeditor.sh
--- request-tracker5-5.0.7+dfsg/debian/scripts/build-final-ckeditor.sh	2025-10-08 21:16:58.000000000 +1300
+++ request-tracker5-5.0.7+dfsg/debian/scripts/build-final-ckeditor.sh	2026-03-02 22:17:44.000000000 +1300
@@ -25,7 +25,8 @@
 cp -a $DOCFONTSRC $SRC/plugins/
 
 # --add-exports is from https://github.com/ckeditor/ckbuilder/issues/34
-java --add-exports java.desktop/sun.java2d=ALL-UNNAMED -jar /usr/bin/ckbuilder \
+java --add-exports java.desktop/sun.java2d=ALL-UNNAMED -jar \
+    /usr/bin/ckbuilder --version 4.20.1 \
     --build $SRC $DEST --skip-omitted-in-build --build-config $BUILD_CONFIG
 
 (