People would have torches and pitchforks out.
But a deb maintainer does it and there is debate?
If there was a security issue then the insecure version should NOT be available. But again this is not the case.
In an App Store world, the role of mainainter has to change. The job is to make the software work with the distro, not keep the name and make some pseudo fork because you want it to be another way.
In this case, though, it's not even a patch - it's a build flag that is provided by upstream.
I imagine the reason this has blown up so much is that the maintainer never reached out to the upstream about this, and was rude and condescending when upstream reached out to them.
Oh, the horror of being in unstable/testing channel and ignoring the change notice which has been shown automatically during apt-get upgrade.
Deferring to “it’s in the notes!” means nothing if you have more than a handful of packages on your machine.
You should also clarify the assertion that packaging affecting testing target won’t eventually hit stable, because that would be a major change that I haven’t heard about.
An end user will get impacted by this eventually.
Your words, not mine.
It isn't buried somewhere, it's in NEWS.Debian file, and it's shown to user during the package update by default.
[0] https://salsa.debian.org/debian/keepassxc/-/blob/main/debian...