Mono is Not Updated to the Latest Version

[Joshua Martin]

Binary package hint: mono

Mono and related packages are not updated to the current versions released by the Mono Community. The version in the latest Ubuntu (8.10) is Mono 1.2.1 while the most stable version from the Mono Community is 2.0.1

Many new features and bug fixes are in the latest Mono release - it is important to many businesses and enterprise communities that we be able to run our .NET applications on Linux.

Mono 2.0.1 also fixes many security vulnerabilities that were present in version 1.2.1

[Chris Coulson (chrisccoulson)]

Thank you for taking the time to report this bug and help make Ubuntu better. Ubuntu has a policy for updating packages in the stable release, whicah can be found here: https://wiki.ubuntu.com/StableReleaseUpdates.

Updating to a new version of Mono because it provides extra features would probably not meet the criteria for a stable release update. However, it may be possible to backport the new version when it appears in Jaunty, using the backport procedure (see https://help.ubuntu.com/community/UbuntuBackports).

If you are experiencing specific bugs with the current version of Mono or can highlight specific security vulnerabilities, then please open separate bug reports for these problems, so they can be considered for fixing via the normal SRU process. This would normally involve patching the current version to fix the problem as opposed to introducing a new upstream version. Updating to the new upstream version would introduce risks of regression.

I'm removing the 'security vulnerability' status from this bug report, as you have not reported any specific security vulnerability

[Jo Shields (directhex)]

Firstly, the submitter's numbers are wrong - Intrepid ships with 1.9.1, not 1.2.1. I put it there myself.

Secondly, I'm fairly sure that Mono is excluded from the official backport process, due to being a "key framework" and as such the risk of regressions in dependent applications is considered too great. I've been packaging Mono backports unofficially for years, for LTS releases, though.

As for 2.0.1... Well, yes, but there are procedures for these things. Firstly, Mono is a major effort for packagers - 9 source packages , about a hundred binary packages, and every release introduces new things to check. the QA effort required is massive.

As such, collaboration is key - and with Jaunty, all Mono packaging work will be done with greater teamwork between Ubuntu & Debian than ever. 2.0.1 will be landing in the Debian Experimental repository whenever the FTP-Master team decide to bless it enough to migrate from the NEW queue. There are a LOT of other changes coming at the packager level, which take time, effort, and work on about another 50-100 packages. These will be worked on as time allows. Additionally, Mono 2.2 is beginning to be leaked to packagers, for testing purposes (I already have a mono-basic 2.2 package for experimentation prepared).

Short version: "soon, sooner if you help"