On Wed, Oct 19, 2016, at 12:13, Darac Marjal wrote:
Well, in theory, once bug 863347 is fixed, yes, it'll get released at
some point. The bug is marked as "grave" AND has a patch, so it
shouldn't be too hard to get it into the next release of Debian
(stretch). With regards to Jessie, well it's not a security-related
change so it probably wouldn't be released, but it may well be
back-ported, but I don't know what the policy is there (does someone
need to request the backport, for example?)
The policy is that we want to, and do fix grave bugs in stable (and even
in oldstable) when possible, yes.
That said, for it to happen at all, the maintainer needs to prepare and
thoroughly test the update, and file a bug requesting approval from the
stable release managers. The procedure is in the developer's manual,
and "reportbug release.debian.org" knows about it, too.
AFAIK (and IME) *regression risk* and *impact* are the main reasons why
an update would be (or wouldn't be) considered suitable for stable or
oldstable. I have no idea where people got the notion that we would
restrict stable updates to security fixes only, but it is incorrect.