handling [out-of-date] dependencies

[Reflexe]

Introduction

To make sure we deliver consistent results for a variety of platforms, we deliver dependencies packaged with lmms. That makes us responsible to keep them up to date and secure.

Current state

Windows

We use MinGW and toby's ppa, which is very out of date and lacks of many security updates.

Linux

We use AppImage on xenial, which delivers pretty old Qt. That causes many bugs.

Mac

We are pretty good here with homebrew.

Handling dependencies updates

Currently, we don't keep track of changes and bug fixes in dependencies in order to release a new lmms package.
For example, if SDL would release a critical bugfix now, we won't release a new bugfix version for lmms.

[Reflexe]

My solution

• For windows, use vcpkg on mingw (see https://github.com/reflexe/vcpkg) for everything but qt.
• For linux, add another ppa for a newer qt.

The second problem

I don't really know how to handle it. However, it is possible to get notifications for new releases and then open an issue (and it is automatable).

[DomClark]

Do you plan to open a pull request against upstream for vcpkg mingw support, or will we always be working off a fork? Is there a reason to continue to use mingw once everything is made fully compatible with MSVC?

[PhysSong]

@tobydox's MinGW PPA has some additional issues such as #5979 (comment), #5810 (comment). Any ideas for alternatives?