Package: release.debian.org Severity: normal Tags: trixie X-Debbugs-Cc: [email protected] Control: affects -1 + src:request-tracker5 User: [email protected] Usertags: pu
[ Reason ] Firefox v148 has introduced a change to how they handle JavaScript which breaks CKEditor 4, which is used by Request Tracker. Mozilla have introduced a work around that looks for version 4 of CKEditor. Unfortunately how we built CKEditor in the request-tracker5 package we weren't setting the version number, which means that Firefox doesn't apply the workaround. The bug report for Firefox is here: https://bugzilla.mozilla.org/show_bug.cgi?id=2002481 While Firefox v148 isn't in Trixie, many end users of Request Tracker installations are likely to be running the latest version of Firefox. [ Impact ] The impact for users is that they can't add comments to tickets if Request Tracker is installed using our packages. This has already been noticed in the RT forum: https://forum.bestpractical.com/t/rt-5-wysiwyg-editor-not-working-in-firefox-148/41587 [ Tests ] I have manually tested using Firefox v148, and the current nightly build against the current package in Trixie and with my fixed packages. The old package shows the behaviour as described, the new package works as expected. [ Risks ] There is very low risk. It is a two line change in a build script to set the version of CKEditor that is being built. [ Checklist ] [x] *all* changes are documented in the d/changelog [x] I reviewed all changes and I approve them [x] attach debdiff against the package in (old)stable [x] the issue is verified as fixed in unstable [ Changes ] There is a two line change to debian/scripts/build-final-ckeditor.sh which sets the --version. When --version isn't provided then it defaults to "DEV". I have also wrapped the lines to 80 characters to make it easier to read. [ Other info ] I will create a request to add a fixed version to Bookworm as well. request-tracker4 in bookworm (and older) also suffers from this issue. Bug report: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1129517
diff -Nru request-tracker5-5.0.7+dfsg/debian/changelog request-tracker5-5.0.7+dfsg/debian/changelog --- request-tracker5-5.0.7+dfsg/debian/changelog 2025-10-08 21:16:58.000000000 +1300 +++ request-tracker5-5.0.7+dfsg/debian/changelog 2026-03-02 22:17:44.000000000 +1300 @@ -1,3 +1,12 @@ +request-tracker5 (5.0.7+dfsg-4+deb13u2) trixie-proposed-updates; urgency=medium + + * Set a version for ckeditor when we build it to allow Firefox v148 to + correctly detect that it needs a work around, see: + https://bugzilla.mozilla.org/show_bug.cgi?id=2002481 + (Closes: #1129090) + + -- Andrew Ruthven <[email protected]> Mon, 02 Mar 2026 22:17:44 +1300 + request-tracker5 (5.0.7+dfsg-4+deb13u1) trixie-security; urgency=medium * Apply upstream patch which fixes several security vulnerabilities: diff -Nru request-tracker5-5.0.7+dfsg/debian/scripts/build-final-ckeditor.sh request-tracker5-5.0.7+dfsg/debian/scripts/build-final-ckeditor.sh --- request-tracker5-5.0.7+dfsg/debian/scripts/build-final-ckeditor.sh 2025-10-08 21:16:58.000000000 +1300 +++ request-tracker5-5.0.7+dfsg/debian/scripts/build-final-ckeditor.sh 2026-03-02 22:17:44.000000000 +1300 @@ -25,7 +25,8 @@ cp -a $DOCFONTSRC $SRC/plugins/ # --add-exports is from https://github.com/ckeditor/ckbuilder/issues/34 -java --add-exports java.desktop/sun.java2d=ALL-UNNAMED -jar /usr/bin/ckbuilder \ +java --add-exports java.desktop/sun.java2d=ALL-UNNAMED -jar \ + /usr/bin/ckbuilder --version 4.20.1 \ --build $SRC $DEST --skip-omitted-in-build --build-config $BUILD_CONFIG (
