When Do Debian Packages Receive Updates?

Some software is so complex and difficult that Debian does not maintain it on their own, and instead follows the upstream release cycle.

Browsers are one such example, and as you've discovered for me, Thunderbird is probably another.

Also, please do not recommend testing for daily usage. It does not receive critical security updates in a timely manner, including for things that would effect desktop users. Use stable, Sid, or another distro. Testing is for testing Debian ONLY, and by using Debian Testing, you are losing the advantage of immediate security fixes that come from literally any other distro.

When does Debian update a package? And how does it decide when to?

These both can be answered in depth at Debian's releases page, but the short answer is:

Debian developers work in a repo called "unstable" or "sid," and you can get those packages if you so desire. They will be the most up to date, but also the most likely to introduce breaking changes.

When the devs decide these packages are "stable enough," (breaking changes are highly unlikely) they get moved into "testing" (the release candidate repo) where users can do QA for the community. Testing is the repo for the next version of debian.

When the release cycle hits the ~1.5 year mark, debian maintainers introduce a series of incremental "freezes," whereby new versions of packages will slowly stop being accepted into the testing repo. You can see a table that explains each freeze milestone for Trixie (Debian 13) here.

After all the freezes have gone into effect, Debian migrates the current Testing version (currently Trixie, Debian 13) into the new Stable, and downgrades the current stable version to old-stable. Then the cycle begins again

As for upgrades to packages in the stable/old-stable repos: see the other comments here. The gist is that they will not accept any changes other than security patches and minor bug fixes, except for business critical software that cannot just be patched (e.g. firefox).

I'm aware of Debian's reputation for not having the most up-to-date software in its repository

Yes, it's a stable distro. Contrary to what most Linux users think, that term only means that the distro is unchanging. That means only necessary updates are released (security fixes for example).

when it will make available the upcoming major release of GIMP to 3.0.

Maybe in the next version, if the gimp release happens soon enough it gets tested.

Just use an external package manager like flatpak to install fresh packages. The only reason I could run MX (Debian) for about a year was because I installed almost every user package through nix, and used Debian ones for the system packages.

The rule is that apps are only updated for security reasons. Not because of new features.

So, new versions of apps may (or may not) be added to the next version of Debian.

Gimp 3 is scheduled to be released in May, around the time that Debian 13 is about to come out. Given that Gimp is never on time, and that Debian will only include stable software in their repo, you won't see Gimp 3.x on Debian for another 2.5 years (the next major release).

However, don't fret. There's a way to run Gimp 3, even now, without overwriting the 2.10.x version of Gimp that comes with Debian: https://github.com/ivan-hc/GIMP-appimage/releases That's how I run gimp 3 on my Debian too, I just download the 3.0-rc1 .appimage file, make it executable, and it's up and running.

it usually updates most packages when a new patch version is released (eg 2.3.1 -> 2.3.2). besides that, they will not update packages to new releases that add features

there are some special cases where it might choose to update more often. debian uses firefox esr by default, but it will update to a newer esr version no matter what, for security reasons. the same must be true for thunderbird.

You can always use APT Pinning to grab GIMP and its dependencies from testing without touching the rest of the system.

Or you can just run testing or sid as your base system. My gaming rig is based on testing but pulling Mesa and video derivers from experimental and sid and I haven’t had any issues with it. Been running it for about 2 years now this way.

https://wiki.debian.org/AptConfiguration

They get all the patches and minor upgrades in a timely fashion, similar to other distros. The major version updates do not come as readily though.

Some people will probably disagree with me but I consider Debian stable as a server distribution not as a daily drive system.

Debian testing is probably the better choice if you want to daily drive Debian or consider or more up to date distro. If you're relatively new to GNU/Linux, don't bother with bleeding edge distros or exotics ones like Arch, EndeavourOS, Gentoo, NixOS...

If you find your way to distrowatch.com you will see EndeavourOS very high in the rankings, but it's a rolling release distribution. While it's easier to maintain/install than Arch, it has a learning curve and needs regular attention and reading the docs/forum.

I have seen a lot of people recommend the following:

• Linux mint
• Pop! OS
• Fedora
• OpenSUSE

GIMP 3.0 will come with the next Debian release.
When will that come out?
When it's ready.
You can get a bit of an idea where in the release process we are by looking at this graph:

Where the green and blue lines dip close to zero, there was a new release.
Next release is probably planned for October 2025.

Between releases, packages are only updated when it's relevant for security or to fix bugs.
Thunderbird and Firefox are a bit of an exception. Those programs are so complex that backporting security fixes to the current Debian version isn't feasible. So Debian is forced to ship the new version when security issues in the current version become known.
And they're also not needed on servers, so the reduced stability doesn't affect them.

/joke outside security patches? about every 2-3 years /joke

When they're ready.