That's not correct. Me and many other Qt developers known to me still use older versions like Qt 4.8 or 5.4 without any need to upgrade. Upgrading causes a lot of effort and risks. If you don't depend on the new new feature (e.g. all of my projects would still work with Qt 4.4) why should you spend that effort?
back
2 comments
The same reason I tell people to stop running PHP 5.6:
If a security vulnerability is discovered, you always want to be on the latest version.
If updating requires a lot of effort and risks, the solution isn't "don't update". The solution is "fix those problems".
Well, maybe if you have implemented a server in Qt which is accessible to open internet, such as PHP in your example. 99% of the Qt applications I'm aware of are desktop or "embedded". I'm working with Qt since 20 years now and had never a security issue or a known vulnerability relevant to my projects.
There is also qtwebkit, the wrappers around ssl which could have issues validating certificates, qml could have issues with untrusted content etc.
WebKit is a web client library. I'm not even sure why a Qt developer would use it. That's among the first things I delete before compiling the Qt 4.x framework. OpenSSL is yet another third party library which can easily be replaced if need be without affecting Qt. And of course each application is a security risk, but definitely a smaller one than the user in front of the screen.
Library providers make this really, really hard though. They should do what used to be common practice -- separate security updates from feature updates, so that applications relying on the library don't have to be on the total upgrade treadmill.
Maybe to reduce the burden of the open source maintainers that have to keep old versions of the app working?
Applications I've written using Qt twenty years ago still run with Qt 4.4 on all relevant platforms (Windows, Linux, even MacOS under Darwin) without any need for a change. As long as the old Qt version compiles on a specific OS version, there is no need to change and no one has to spend time for maintenance of the Qt version.
If a customer pays you to do the maintenance and update, I hope you're doing it.
But regardless, this is why integration testing is important.
"What will break if I update to Qt-latest?" being one click away.
I go the other way round. The project should not depend on stuff only available with the new new version of the library. Even if I use Qt 5.4 or 5.9 on some projects most of it would still run on Qt 4.4. And these are not only open source spare time projects.