QtWebKit needs to be deprecated

[veprbl]

QtWebKit was deprecated in Qt 5.6. We are now using an outdated unofficial port:

nixpkgs/pkgs/development/libraries/qt-5/5.12/default.nix

Lines 40 to 49 in b0705bc

	# Community port of the now unmaintained upstream qtwebkit.
	qtwebkit = rec {
	src = fetchFromGitHub {
	owner = "qtwebkit";
	repo = "qtwebkit";
	rev = "qtwebkit-${version}";
	sha256 = "11lc5sk10d9cyg8jqkbgkqiap72b9rax7hy61nm90zw9749y2yfg";
	};
	version = "5.212.0-alpha4";
	};

In some cases, applications already provide support for using QtWebEngine instead, we just need to enable it. The advantage of using QtWebEngine is that it is supported by the Qt upstream.

This issue is to track progress (or lack thereof) in deprecation of QtWebKit.

Overview

Legend: ✔︎ - dependency can be removed, ✘ - no straightforward solution was found, ? - dependency can be removed at a cost

• apitrace - ✔︎ judging by upstream git master it doesn't need qtwebkit
• apmplanner2
• bibletime - bibletime: 2.11.2 -> 3.0 #125162
• blink - python
• cadence - python
• calibre - calibre: add missing dependency, fixes #78642 #79608 calibre: use webengine i/o webkit #92118
• calligra - Unbreak qt5.full, add qt3d, qtgamepad, qtremoteobjects #102490 ? ["QWebPage needed for webpage plugin"] (https://github.com/KDE/calligra/blob/2c601b660e8845ca3ffeeb1509db386bfcddec70/CMakeLists.txt#L1023)
• capybara-webkit - ruby
• cb2bib - ✔︎ https://www.molspaces.com/cb2bib/doc/overview/ Requirements: "QtWebKit or QtWebEngine library (optional) to compile cb2Bib Annote viewer"
• copyq - CopyQ: 3.13.0 -> 4.1.0 #130670
• brewtarget - ✔︎ qtwebkit is not in the list of the dependencies
• digikam - digikam: switch from QtWebKit to QtWebEngine #53083
• freecad - freecad: 0.18.4 -> unstable-2020-09-25 #98845
• frescobaldi - frescobaldi: 3.0.0 -> 3.1 #76889
• ghostwriter - 6b73aa9
• google-musicmanager - ✘ see comment below
• golden-cheetah - golden-cheetah: Add libusb (ANT+ sensors), 3.5-DEV1903 -> 3.5-RC2X #76172
• goldendict - ✘ QtWebKit is deprecated now, will be remove in Qt 5.6 goldendict/goldendict#677
• kde
  • alkimia - kmymoney: switch from qtwebkit to qtwebengine #201953
  • k3b - k3b: remove qtwebkit dependency #103164
  • kdenlive - 2ff2ef1
  • kdevelop5 - ✔︎ both QtWebKit and QtWebEngine are supported https://github.com/KDE/kdevelop/blob/5e17ba4cd7a50816825a279c70a6b1c64a701926/kdevplatform/documentation/CMakeLists.txt#L3-L16
  • kdewebkit - kmymoney: switch from qtwebkit to qtwebengine #201953
  • kmymoney - kmymoney: switch from qtwebkit to qtwebengine #201953
  • kreport - Unbreak qt5.full, add qt3d, qtgamepad, qtremoteobjects #102490 https://phabricator.kde.org/T3565
  • konqueror - Unbreak qt5.full, add qt3d, qtgamepad, qtremoteobjects #102490
  • marble - marble: switch from qtwebkit to qtwebengine #94826
  • messagelib - c2366ae
  • rocs - Unbreak qt5.full, add qt3d, qtgamepad, qtremoteobjects #102490
• kexi - ✘ upstream task https://phabricator.kde.org/T10389
• ksysguard, libksysguard - 505f0c2
• lsd2dsl
• mendeley - ✔︎ our current expression depends on both qtwebkit and qtwebengine, AUR manages with qtwebengine only https://aur.archlinux.org/packages/mendeleydesktop/
• merkaartor - merkaartor: 0.18.4 → 0.19.0 #135925
• mindforger - mindforger: remove use of deprecated QtWebKit #122476
• minizincide - expression we have depends on both qtwebengine and qtwebkit
• musescore - musescore: 2.3.2 -> 3.0 #52835
• mythtv - ✘ https://github.com/MythTV/mythtv/blob/master/mythtv/configure#L6526
• nextcloud-client - nextcloud-client: disable shibboleth #75202
• nixnote2 - ✔︎ should be already using QtWebEngine https://github.com/notepadqq/notepadqq/projects/1
• nmapsi4 - nmapsi4: 0.5.0-alpha1 -> 0.4.80-20180430 #59266
• notepadqq - ✔︎ should be using qtwebengine already https://github.com/notepadqq/notepadqq/blob/master/README.md#build-it-yourself
• oilrush
• openshot-qt - ✔︎ Initial support for QtWebEngine and Async callbacks for timeline/Qt Integration OpenShot/openshot-qt#3604
• owncloud-client - owncloud-client: disable shibboleth #75206
• p4v - upgrade perforce packages: p4, p4v #110168
• phantomjs2 - ✘ QtWebEngine instead of QtWebKit ? ariya/phantomjs#14366
• psi-plus - 8f5bafe
• rstudio - Rstudio upgrade #59512
• shotcut - ✘ https://forum.shotcut.org/t/is-that-any-plan-for-porting-from-qt-webkit-to-qt-webengine/5816
• scudcloud - ✘ python, abandonware Archiving project raelgc/scudcloud#628
• sigil - ✘ no port to QtWebEngine so far
• skrooge - skrooge: remove QtWebKit dependency #55930
• sleepyhead - ✔︎ very light use of QWebView can be fixed to use QtWebEngine with some simple patches from https://gitlab.com/sleepyhead/sleepyhead-code/merge_requests/21
• smtube - ✘ no traces of QtWebEngine support in svn trunk
• subsurface - ? "QtWebKit is needed, if you want to print"
• supercollider - supercollider: 3.9.3 -> 3.10.2 #63812
• swift-im - ✘ dependency on QtWebKit is mentioned in https://github.com/swift/swift/blob/master/README.md and https://wiki.xmpp.org/web/Summer_of_Code_2017#Design_a_Chat_View_Free_of_QtWebKit.2FQtWebEngine
• teamviewer - ✘ checked version 15.0.8397: still links to libQt5WebKitWidgets.so.5 libQt5WebKit.so.5
• toggldesktop - toggldesktop: bump qt-oauth-lib (see #53676) #54587
• trojita - ✘ https://bugs.kde.org/show_bug.cgi?id=365299
• qlandkartegt - ✘ abandonware
• qmc2 - ✘ no traces of QtWebEngine support in SVN trunk
• qsyncthingtray - supports qtwebkit optionally
• qtwebkit-plugins
• quiterss - ? migrate to https://github.com/QuiteRSS/quiterss2 ?
• wkhtmltopdf - ✘ Any plan for wkhtmltopdf to switch from QtWebKit to QtWebEngine? wkhtmltopdf/wkhtmltopdf#3391, needs to be ported to qt5 though
• yacas - yacas: Fix gui and jupyter build #147826
• zeal - ✔︎ feat(browser,ui): port to Qt WebEngine zealdocs/zeal#1125

How to help?

1. Take an open item from the list that doesn't have a comment, google "<itemname> qtwebengine" and "<itemname> qtwebkit". Report what you find (or add a comment if you can edit the post).
2. Take an open item from the list that does have a comment and ping a maintainer if the fix is possible. Alternatively try fixing it yourself.

[bhipple]

I don't think we'll be able to kill the dependency easily in google-musicmanager, since we're already on Google's latest release, which lists this as an explicit dependency:

$ curl http://dl.google.com/linux/musicmanager/deb/dists/stable/main/binary-amd64/Packages
Package: google-musicmanager-beta
Version: 1.0.467.4929-r0
Architecture: amd64
Maintainer: Google Music Team <[email protected]>
Installed-Size: 16766
Pre-Depends: dpkg (>= 1.14.0)
Depends: libc6 (>= 2.16), libexpat1 (>= 2.0.1), libflac8 (>= 1.3.0), libgcc1 (>= 1:4.1.1), libidn11 (>= 1.13), libqt5core5a (>= 5.2.0), libqt5gui5 (>= 5.0.2) | libqt5gui5-gles (>= 5.0.2), libqt5network5 (>= 5.0.2), libqt5webkit5, libqt5widgets5 (>= 5.2.0), libstdc++6 (>= 4.6), libvorbisfile3 (>= 1.1.2), xdg-utils (>= 1.0.2)

[KAMiKAZOW]

We are now using an outdated unofficial port

Not unofficial – endorsed by Qt: https://code.qt.io/cgit/qt/qtwebkit.git/ And currently in the process of a massive overhaul thanks to Patreon funding.

[veprbl]

@KAMiKAZOW This is definitely a good news for qtwebkit and its users. However, we are using a specific 5.212-alpha version that is outdated and contains known CVE's. Looking at the repo at your link, it doesn't seem to contain any significant update to address those issues. I doubt anyone would endorse this software in its current state.

[KAMiKAZOW]

Looking at the repo at your link, it doesn't seem to contain any significant update to address those issues.

The development happens here on Github. "My" link was solely a reference proving that it's not unofficial but instead adopted by upstream Qt.

As you can read under https://github.com/qtwebkit/qtwebkit/blob/qtwebkit-dev/ReadMe.md#this-repository-development the qtwebkit-dev branch is the update to current WebKit master.

[sikmir]

zeal ported to qtwebengine (zealdocs/zeal#1125), not released yet.

[bachp]

Freecad will be ported with the 0.19 release FreeCAD/FreeCAD@75fd723, not released yet

[bachp]

messagelib no longer depends on qtwebengine since c2366ae

[gebner]

freecad no longer depends on qtwebkit since we switched to the 0.19 prerelease in #98845/#100972.

[jerith666]

The issue for OpenShot linked in the description is outdated; it's been superseded by OpenShot/openshot-qt#3604.

[milahu]

no straightforward solution was found

example: scrapinghub/splash#349

splash is not in nixpkgs. its needed for the legacy project portia (a GUI for scrapy)

[impl]

p4v doesn't depend on qtwebkit since #110168.

[K900]

apitrace is done: #201032

[gador]

teamviewer builds and runs fine without qtwebkit in version 15.29.4
I cannot test the connectivity, though, since I don't have a teamviewer partner to test it with
@jagajaga and @jraygauthier as maintainers

[aidalgol]

@das-g How are you going with fixing the kmymoney build? I'm hitting build errors in my attempts to build against qtwebengine.

[das-g]

@aidalgol working on it, should be ready in some minutes.

[das-g]

@aidalgol PR to switch kmymoney from qtwebkit to qtwebengine: #201953

[LunNova]

qgis depends on it and isn't in the main list.

Looks like it can build with QtWebEngine but won't work due to some bugs, see qgis/QGIS@7c1d616

[totoroot]

yacas does not rely on QtWebKit, since PR #147826 got merged.
I think we can tick its box ☑️

[totoroot]

quiterss seems to be unmaintained (see QuiteRSS/quiterss#1566) so the issue dealing with the removal of QtWebKit (QuiteRSS/quiterss#1573) will probably never be resolved.

The suggested move to QuiteRSS2 (https://github.com/QuiteRSS/quiterss2) might make sense, since it uses QtWebEngine, but I'm unsure about any unwanted implications this could lead to.
Also, it too hasn't had commits since May 2020 and there is no stable release.

[totoroot]

qlandkartegt hasn't seen any updates since 2015 and can therefore probably be considered unmaintained/abandoned:
https://sourceforge.net/projects/qlandkartegt/

On the AUR (patches fetched from there) it has been unmaintained as well:
https://aur.archlinux.org/packages/qlandkartegt

I'd suggest changing the ✔︎ to a ✘ for its entry.

[totoroot]

copyq does not rely on QtWebKit, since PR #130670 got merged.
I think we can tick its box ☑️

[totoroot]

Issue for a port from QtWebKit to QtWebEngine for kexi and kreport are still open:
pkgs/development/libraries/kreport/

[K900]

Qtwebkit has been marked insecure since #201028. No point in trying to check every single box.

[totoroot]

Fantastic 😅
Thanks for the notice!