When does Debian update a package? And how does it decide when to?

These both can be answered in depth at Debian’s releases page, but the short answer is:

Debian developers work in a repo called “unstable” or “sid,” and you can get those packages if you so desire. They will be the most up to date, but also the most likely to introduce breaking changes.

When the devs decide these packages are “stable enough,” (breaking changes are highly unlikely) they get moved into “testing” (the release candidate repo) where users can do QA for the community. Testing is the repo for the next version of debian.

When the release cycle hits the ~1.5 year mark, debian maintainers introduce a series of incremental “freezes,” whereby new versions of packages will slowly stop being accepted into the testing repo. You can see a table that explains each freeze milestone for Trixie (Debian 13) here.

After all the freezes have gone into effect, Debian migrates the current Testing version (currently Trixie, Debian 13) into the new Stable, and downgrades the current stable version to old-stable. Then the cycle begins again

As for upgrades to packages in the stable/old-stable repos: see the other comments here. The gist is that they will not accept any changes other than security patches and minor bug fixes, except for business critical software that cannot just be patched (e.g. firefox).

Some software is so complex and difficult that Debian does not maintain it on their own, and instead follows the upstream release cycle.

Browsers are one such example, and as you’ve discovered for me, Thunderbird is probably another.

Also, please do not recommend testing for daily usage. It does not receive critical security updates in a timely manner, including for things that would effect desktop users. Use stable, Sid, or another distro. Testing is for testing Debian ONLY, and by using Debian Testing, you are losing the advantage of immediate security fixes that come from literally any other distro.

I’m aware of Debian’s reputation for not having the most up-to-date software in its repository

Yes, it’s a stable distro. Contrary to what most Linux users think, that term only means that the distro is unchanging. That means only necessary updates are released (security fixes for example).

when it will make available the upcoming major release of GIMP to 3.0.

Maybe in the next version, if the gimp release happens soon enough it gets tested.

Just use an external package manager like flatpak to install fresh packages. The only reason I could run MX (Debian) for about a year was because I installed almost every user package through nix, and used Debian ones for the system packages.

Gimp 3 is scheduled to be released in May, around the time that Debian 13 is about to come out. Given that Gimp is never on time, and that Debian will only include stable software in their repo, you won’t see Gimp 3.x on Debian for another 2.5 years (the next major release).

However, don’t fret. There’s a way to run Gimp 3, even now, without overwriting the 2.10.x version of Gimp that comes with Debian: https://github.com/ivan-hc/GIMP-appimage/releases That’s how I run gimp 3 on my Debian too, I just download the 3.0-rc1 .appimage file, make it executable, and it’s up and running.

You can always use APT Pinning to grab GIMP and its dependencies from testing without touching the rest of the system.

Or you can just run testing or sid as your base system. My gaming rig is based on testing but pulling Mesa and video derivers from experimental and sid and I haven’t had any issues with it. Been running it for about 2 years now this way.

https://wiki.debian.org/AptConfiguration

Some people will probably disagree with me but I consider Debian stable as a server distribution not as a daily drive system.

Debian testing is probably the better choice if you want to daily drive Debian or consider or more up to date distro. If you’re relatively new to GNU/Linux, don’t bother with bleeding edge distros or exotics ones like Arch, EndeavourOS, Gentoo, NixOS…

If you find your way to distrowatch.com you will see EndeavourOS very high in the rankings, but it’s a rolling release distribution. While it’s easier to maintain/install than Arch, it has a learning curve and needs regular attention and reading the docs/forum.

I have seen a lot of people recommend the following:

• Linux mint
• Pop! OS
• Fedora
• OpenSUSE

They get all the patches and minor upgrades in a timely fashion, similar to other distros. The major version updates do not come as readily though.

When they’re ready.

GIMP 3.0 will come with the next Debian release.
When will that come out?
When it’s ready.
You can get a bit of an idea where in the release process we are by looking at this graph:

Where the green and blue lines dip close to zero, there was a new release.
Next release is probably planned for October 2025.

Between releases, packages are only updated when it’s relevant for security or to fix bugs.
Thunderbird and Firefox are a bit of an exception. Those programs are so complex that backporting security fixes to the current Debian version isn’t feasible. So Debian is forced to ship the new version when security issues in the current version become known.
And they’re also not needed on servers, so the reduced stability doesn’t affect them.

/joke outside security patches? about every 2-3 years /joke

@Churbleyimyam@lemm.ee @ARuy91305DGgrQiOZ6.linux@lemmy.ml I am guessing they have a short list of security-critical packages that they always keep up-to-date and at the latest versions, for things like SuDo and OpenSSL. Firefox, Chrome, and Thunderbird are so critical to end-user security, they probably have those on the list as well. But I am only guessing.

Usually if you want more recent versions of an application, you can install a FlatPak via FlatHub.

You can also install the Guix package manager on Debian, which has its own separate local repository that does not interfere with installed Debian packages. Guix usually has more recent packages, and it also makes it easy to install package dependencies and build the latest developer releases of applications from source code.

Approximately 100 years once or twice, depending on how urgent it is.