I expect the KeepassXC people are mostly bothered by the naming of the package because the version called "keepassxc" is now the basic one. Anyway, the maintainer has offered to call them -minimal and -full and to make "keepassxc" a metapackage that pops up a debconf dialog telling users that install it to choose one. There is precedent with other complex packages that are split into basic and full. This should solve things nicely for everyone.

I find it a lot of unnecessary fuss over unstable. Sid is supposed to make breaking changes, you offer feedback and you follow it through politely. The next Debian stable is one year away, this is not an urgent matter

And no, it wasn’t just the favicons feature that was removed (which like … is that really such a big privacy issue that you need to remove it from the binary?)

Fetching a favicon means raising a network connection with a predictable endpoint. That's already three concerns (four on the modern internet) to handle security-wise, and it's absolutely an unneeded feature. Favicons could just be shipped on something like keepassxc-data or keepassxc-contrib to handle locally, no need to raise a network call.

There's already a report from a user who can't access their passwords because yubikey support was suddenly removed.

Yeah, well, this is Sid. It's called unstable for a reason. You have to read the changelogs or bad things will happen.

By the time it lands in stable it will most likely have a debconf dialog warning users and letting them transition smoothly to the version they want.