Skip to content

Tracking: Vendored Chromium/Electron versions #559231

Open
Open
Tracking: Vendored Chromium/Electron versions#559231
Labels
1.severity: securityIssues which raise a security issue, or PRs that fix one5.scope: trackingLong-lived issue tracking long-term fixes or multiple sub-problems

Description

@RossSmyth
RossSmyth
opened on Sep 2, 2026

This issue shall track the versions of Electron and CEF that are vendored into Nixpkgs. We want to ensure that the ones with EOL versions are marked as insecure. Notably this tracker cannot track packages that are marked as unfree.

Current EOL schedules show that these are the current oldest supported versions:

Electron: https://endoflife.date/electron (v42 as of 2026-09-02)
Chromium: https://chromiumembedded.github.io/cef/branches_and_building.html#current-release-branches-supported (v144, v150, v151, and v152 as of 2026-09-02)

These do not necessarily need to be removed from Nixpkgs, they just need to be monitored to ensure they are kept up-to-date, or that they are using properly secured downstream forks.

  • CEF = Chromium embedded framework
  • Electron = Electron
  • Unknown = Has Chromium files, but unable to detect what it is. Most likely case is that the package was devendored to use Nixpkg's CEF/Electron, but old vestigial files were left behind in the process.

The below search is not exhaustive, primarily due to FHS sandbox wrappers.

Packages assumed good:

  • qtwebengine
  • electron*
  • cef-binary

Vendored Electron/Chromium Packages

attribute Version Electron/CEF CEF/Electron Version
vscodium.out 1.126.04524 Electron Electron 42.2.0
vacuum-tube.out 1.8.2 Electron Electron 43.7.7
trilium-desktop.out 0.106.0 Unknown Unknown
kdePackages.qtwebengine.out 6.11.2 CEF Chrome 140.0.733
obs-studio.out 32.2.2 Unknown Unknown
nwjs.out 0.117.0 CEF Chrome 154.0.8037.58
nwjs-sdk.out 0.117.0 CEF Chrome 154.0.8037.58
nextcloud-talk-desktop.out 2.3.2 Electron Electron 44.3.0
linux-wallpaperengine.out 0.0.1-unstable-2026-06-09 CEF Chrome 135.0.7049.52
keybase-gui.out 6.6.3 Electron Electron 39.2.7
joplin-desktop.out 3.7.21 Electron Electron 43.7.7
jetbrains.jdk.out 25.0.3-b508.4 CEF Chrome 144.0.7559.172
jetbrains.jdk-21.out 21.0.10-b1163.110 CEF Chrome 144.0.7559.172
jetbrains.jcef-21.out 1207 CEF Chrome 144.0.7559.172
jetbrains.jcef.out 1207 CEF Chrome 144.0.7559.172
isabelle.out 2025-2 Unknown Unknown
emuflight-configurator.out 0.4.3 Unknown Unknown
electron_44-bin.out 44.5.1 Electron Electron 44.5.1
electron-bin.out 43.7.7 Electron Electron 43.7.7
electron_42-bin.out 42.11.10 Electron Electron 42.11.10
deezer-enhanced.out 1.5.1 Electron Electron 37.10.3
cef-binary.out 151.3.16 CEF Chrome 151.0.7922.109
brave.out 1.96.61 CEF Chrome 154.0.8037.98
brave-origin.out 1.96.61 CEF Chrome 154.0.8037.98
betaflight-configurator.out 10.10.0 Unknown Unknown

Additional packages (did not match the nix-locate search):

  • pulsar
  • sidequest

Unfree packages to check

via rg -U '(?s)fetchurl.*libdrm' --files-with-matches with a bit of manual filtering

  • discord
  • android-studio
  • bluemail
  • hey-mail
  • zoom-us
  • tk-safe
  • viviladi
  • viber
  • tana
  • ticktick
  • rgp
  • nordpass
  • qq
  • staruml
  • binaryninja-free
  • feishu
  • lightworks
  • xmind
  • airtame
  • tradingview
  • unityhub
  • snapmaker-luban
  • teamspeak6-client
  • mdk-sdk
  • foxglove-studio
  • wemeet
  • webex
  • wechat-uos
  • webull-desktop
  • intel-oneapi-toolkit
  • azuredatastudio
  • burpsuite
  • plex-htpc
  • mullvad-browser
  • ddcutil
  • mutter48
  • plasticity
  • plex-desktop
  • dyalog
  • multiviewer-for-f1
  • mutter
  • microsoft-edge
  • mongodb-compass
  • spotify
  • todesk
  • appgate-sdp
attribute Version Electron/CEF CEF/Electron Version
android-studio 2026.1.3.8 Unknown Unknown
bluemail 1.140.93 Electron Electron 25.8.4
hey-mail 1.3.7 Electron Electron 43.4.1
zoom-us 7.1.5.4332 Unknown Unknown
tk-safe 26.2.6 Electron Electron 40.8.5
viber 27.3.0.2 CEF Chrome 108.0.5359.98
tana 1.520.0 Electron Electron 39.2.6
ticktick 8.0.10 Electron Electron 39.8.7
rgp 2.7 Unknown Unknown
nordpass 7.6.18 Unknown Unknown
qq 3.2.32-2026-08-12 Electron Electron 40.0.0
staruml 7.1.0 Electron Electron 29.4.6
binaryninja-free 6.0.10601 Unknown Unknown
feishu 7.66.11 CEF Chrome 76.0.3809.132
lightworks 2025.2 Unknown Unknown
xmind 26.01.03145-202510170359 Electron Electron 36.9.4
airtame 4.16.0 Electron Electron 29.1.0
tradingview 3.4.0 Electron Electron 41.7.1
unityhub 3.19.5 Electron Electron 42.4.1
teamspeak6-client 6.0.0-beta4.1 CEF Chrome 146.0.7680.0
mdk-sdk 0.37.0 Unknown Unknown
foxglove-studio 2.56.0 Electron Electron 42.2.0
wemeet 3.26.10.401 CEF Chrome 87.0.4280.144
webex 46.8.0.35631 CEF Chrome 141.0.7390.123
wechat-uos 4.1.1.7 Unknown Unknown
intel-oneapi-toolkit 2026.0.1.27 Electron Electron 42.0.0
azuredatastudio 1.49.1 Electron Electron 25.9.8
burpsuite 2026.8 Unknown Unknown
plex-htpc 1.71.1 Unknown Unknown
mullvad-browser 15.0.21 Unknown Unknown
ddcutil 2.2.7 Unknown Unknown
mutter48 48.7 Unknown Unknown
plasticity 26.1.4 Electron Electron 26.6.9
plex-desktop 1.112.0 Unknown Unknown
multiviewer-for-f1 2.8.4 Electron Electron 43.0.0
mutter 50.4 Unknown Unknown
microsoft-edge 152.0.4191.66 CEF Chrome 152.0.0.0
mongodb-compass 1.49.15 Electron Electron 43.4.1
spotify 1.2.95.453.g0eeebbed CEF Chrome 146.0.7680.179
todesk 4.7.2.0 Unknown Unknown
appgate-sdp 6.5.4 Electron Electron 36.9.2

Activity

  1. RossSmyth
    added
    1.severity: securityIssues which raise a security issue, or PRs that fix one
    5.scope: trackingLong-lived issue tracking long-term fixes or multiple sub-problems
    on Sep 2, 2026

  2. RossSmyth commented on Sep 2, 2026

    @RossSmyth
    RossSmyth
    on Sep 2, 2026
    ContributorAuthor

    To drop (no maintainers):

    Needs to be updated:

    Will be opening PRs shortly to mark these as insecure. Edit: Done

  3. RossSmyth commented on Sep 2, 2026

    @RossSmyth
    RossSmyth
    on Sep 2, 2026
    ContributorAuthor

    Oh my checkout is a couple weeks old, so I will rerun it with the latest checkout.

  4. ryand56 commented on Sep 2, 2026

    @ryand56
    ryand56
    on Sep 2, 2026
    Member

    keybase-gui bumped in #497751, would be nice to get it reviewed and merged

  5. ShadowRZ commented on Sep 3, 2026

    @ShadowRZ
    ShadowRZ
    on Sep 3, 2026
    Member

  6. siraben commented on Sep 3, 2026

    @siraben
    siraben
    on Sep 3, 2026
    Member

    We can resolve 3 more versions:

    • trilium-desktop: share/trilium/resources/app.asar contains an Electron version declaration of 43.4.0, Nixpkgs removes its libraries and launches with 43.4.1
    • obs-studio: Release/libcef.so contains Chrome/127.0.6533.120
    • isabelle: bundled VSCodium installation contains an Electron declaration of 37.6.0 / Chromium 138.0.7204.251, Nixpkgs replaces it with Electron 43.4.1

  7. siraben commented on Sep 3, 2026

    @siraben
    siraben
    on Sep 3, 2026
    Member

    For betaflight-configurator, NW.js 0.72.0 / Chromium 109.0.5414.87 is bundled along with it but Nixpkgs deletes every bundled lib*.so so we actually exec NW.js 0.102.1 / Chromium 139.0.7258.128.

    For emuflight-configurator, I see NW.js 0.50.3 / Chromium 87.0.4280.141, but because of the wrapper we override it and use NW.js 0.102.1 / Chromium 139.0.7258.128 instead

  8. RossSmyth commented on Sep 3, 2026

    @RossSmyth
    RossSmyth
    on Sep 3, 2026
    ContributorAuthor

    Ok, as expected these just fall into the "they are devendored but there are left-over files." Thanks for looking into it.

  9. RossSmyth commented on Sep 3, 2026

    @RossSmyth
    RossSmyth
    on Sep 3, 2026
    ContributorAuthor

    The maintainer of the nwjs package is no longer active within Nixpkgs, and nwjs in Nixpkgs is about a year old. This is not a framework I care about so I will not be taking over.

    @guylamar2006 you seem to be the last one to express interest here #462257, any more interest?

  10. sikmir commented on Sep 3, 2026

    @sikmir
    sikmir
    on Sep 3, 2026
    Member

    keeweb @sikmir this is also extremely out of date, please update as soon as possible

    1.18.7 is latest one, no new releases

  11. RossSmyth commented on Sep 3, 2026

    @RossSmyth
    RossSmyth
    on Sep 3, 2026
    ContributorAuthor

    I'd open an issue upstream as they are shipping very old software that has many known vulnerabilities as a password manager which is pretty irresponsible IMO. I'm sure it talks to the internet for syncing and other activities.

  12. phanirithvij commented on Sep 7, 2026

    @phanirithvij
    phanirithvij
    on Sep 7, 2026
    Member

    keeweb/keeweb#2275 is relevant.

  13. RossSmyth commented on Sep 9, 2026

    @RossSmyth
    RossSmyth
    on Sep 9, 2026
    ContributorAuthor

    Added an initial pass at unfree packages. Not all are correctly detected, and some use bwrap which makes it hard to tell what has the electron files.

  14. ShadowRZ commented on Sep 17, 2026

    @ShadowRZ
    ShadowRZ
    on Sep 17, 2026
    Member

    I'd open an issue upstream (keeweb) as they are shipping very old software that has many known vulnerabilities as a password manager which is pretty irresponsible IMO. I'm sure it talks to the internet for syncing and other activities.

    @RossSmyth ➡️🗑️✅ (Dropped): #564151

  15. RossSmyth commented on Sep 17, 2026

    @RossSmyth
    RossSmyth
    on Sep 17, 2026
    ContributorAuthor

    Thanks!

  16. ShadowRZ commented on Sep 18, 2026

    @ShadowRZ
    ShadowRZ
    on Sep 18, 2026
    Member

    Qt WebEngine can probably consult https://wiki.qt.io/QtWebEngine/ChromiumVersions for their corresponding Chromium versions

  17. ShadowRZ commented on Sep 18, 2026

    @ShadowRZ
    ShadowRZ
    on Sep 18, 2026
    Member

  18. RossSmyth commented on Sep 18, 2026

    @RossSmyth
    RossSmyth
    on Sep 18, 2026
    ContributorAuthor

    @coreyoconnor Please update nordpass. The version in-tree right now is using an EOL Electron version. I'd recommend devendoring Electron so that security patches are kept up-to-date.

  19. coreyoconnor commented on Sep 19, 2026

    @coreyoconnor
    coreyoconnor
    on Sep 19, 2026
    Contributor

    @RossSmyth update is at #565071

    This is a snap application - how does one "devendor electron" for a snap application?

  20. ShadowRZ commented on Sep 20, 2026

    @ShadowRZ
    ShadowRZ
    on Sep 20, 2026
    Member

    This is a snap application - how does one "devendor electron" for a snap application?

    @coreyoconnor I think it means to use our system Electron to run the app.asar from the original application

  21. coreyoconnor commented on Sep 20, 2026

    @coreyoconnor
    coreyoconnor
    on Sep 20, 2026
    Contributor

    This is a snap application - how does one "devendor electron" for a snap application?

    @coreyoconnor I think it means to sse our system Electron to run the app.asar from the original application

    Actually, nm best to delete this package as I have no interest in maintaining it: #565126

  22. eclairevoyant commented on Oct 5, 2026

    @eclairevoyant
    eclairevoyant
    on Oct 5, 2026
    Contributor

    beeper uses EOL electron (41). #561494 needs merging to bump this to electron 44.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    1.severity: securityIssues which raise a security issue, or PRs that fix one5.scope: trackingLong-lived issue tracking long-term fixes or multiple sub-problems

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions