Where is Icedove version 38.x

In a given version of Trisquel, almost all packages are "frozen": they only receive security (or severe bug) fixes. The Web browser is an exception to the rule. And the repository has a "backports" section with newer versions of some programs (not Icedove though) too. It can be activated from the "Software & updates" utility (in the "System settings") if you wish.

To get a newer version of a program, you either wait for the next version of Trisquel or take the responsibility to install it by yourself (using a PPA, downloading it from the developers, etc.). It might create problems (the reason to freeze the versions of all packages is to be able to test the whole and "guarantee" its stability) and you must be aware that programs outside Trisquel's repositories might raise freedom issues. They can even be plain proprietary. You must trust whoever distributes the software too. He/She could include malware in it.

Trisquel alters the "icedove" package from upstream (Ubuntu). Probably to remove some proprietary software recommendations (just a guess).

security updates shouldn't be part of "wait till next release policy". That being said, I believe in the last couple of weeks I have gotten one or two updates to Icedove (and I only have Trisquel main repo active) so maybe those are indeed being taken care of :)

Finally version 38.x is available via a default repo. It is also installed addons called calendar-google-provider and iceowl-extension by default. Version 38.x has also added to the default repo in Debian 8.