Bug#989307: DSA-4923-1: upgrading libwebkit2gtk-4.0-37 on buster pulls in xdg-desktop-portal

[Olaf Meeuwissen]

Hi,

I also noted this, belatedly, due to running different machines with
stable and testing.  On a machine running testing, I wouldn't have
minded much, but on a machine running stable security upgrades should
not pull in extra packages (unless (Pre-)Depends:).  Seeing that a
Recommends: is by default installed, the new dependencies were pulled
in as I didn't pay close attention :-/

Curious as to how this can be corrected.  Just removing the packages
from the Recommends: isn't going to remove the installed packages.  All
I can think of is adding a Conflicts: but that would probably be a bit
confusing.

In the mean time, I'll just `apt purge` the added packages.  In my case
these were the

    Package changes:
    + fuse 2.9.9-1+deb10u1 amd64
    - libjavascriptcoregtk-4.0-18 2.30.6-1~deb10u1 amd64
    + libjavascriptcoregtk-4.0-18 2.32.1-1~deb10u1 amd64
    + libpipewire-0.2-1 0.2.5-1 amd64
    - libwebkit2gtk-4.0-37 2.30.6-1~deb10u1 amd64
    + libwebkit2gtk-4.0-37 2.32.1-1~deb10u1 amd64
    + xdg-desktop-portal 1.2.0-1 amd64
    + xdg-desktop-portal-gtk 1.2.0-1 amd64

resulting from applying the security upgrade (courtesy of etckeeper).

Hope this helps,
--
Olaf Meeuwissen, LPIC-2            FSF Associate Member since 2004-01-27
 GnuPG key: F84A2DD9/B3C0 2F47 EA19 64F4 9F13  F43E B8A4 A88A F84A 2DD9
 Support Free Software                        https://my.fsf.org/donate
 Join the Free Software Foundation              https://my.fsf.org/join