That is a question I hear more and more, and I felt it had to be answered publicly. Short answer: when it's ready. The current target for Squeeze is 3.5, for various reasons, but the main is that it shares the same Gecko version as Iceape (SeaMonkey) and Icedove (Thunderbird), which means that while the security team (or myself) will have to update these three for security updates, they will share