IceCat should release new versions from the upstream release as soon as it has been released. Users of delayed libre-upstream forks are exploited by the NSA:


From https://en.wikipedia.org/wiki/Vault_7

Vault 7 is a series of documents that WikiLeaks began to release on March 7, 2017 that detail activities of the United States Central Intelligence Agency to perform electronic surveillance and cyber warfare. According to WikiLeaks founder Julian Assange, Vault 7 is the most comprehensive release of US spying files ever made public.[1] The files, dated from 2013–2016, include details on software capabilities of the agency, such as the ability to compromise smart TVs,[2] smartphones, including Apple's iPhone and phones running Google's Android operating system, as well as operating systems such as Microsoft Windows, macOS, and Linux.

It also said that it would postpone releasing the source code for the cyber weapons, which is reportedly several hundred million lines long, "until a consensus emerges on the technical and political nature of the C.I.A.'s program and how such 'weapons' should be analyzed, disarmed and published."

The CIA lost control of the majority of its hacking arsenal including malware, weaponized zero day exploits, malware remote control systems and associated documentation. This extraordinary collection, which amounts to more than several hundred million lines of code, gives its possessor the entire hacking capacity of the CIA

See "Attached Files" on this page for diagrams of icecat package delay in Trisquel GNU/Linux.