Code change:
headers = "1v7ap1v520hhghw358k41aahpnaif54qbg6a9dwgmg1di0qwn735"; }; <del> electron_26-bin = mkElectron "26.1.0" { armv7l-linux = "4a4a6587bddce4554657f40fd9d39645ede03a375a1c42455c9b8d556698e5f5"; aarch64-linux = "1ed0996a06e97f5c23ceb8ae767873915c432c0aca5ffd4b37ab5fb1002d9d65"; x86_64-linux = "de78aed71ce17395675a29dcd20c1370473713eb234143dd0fa3e4c5a39504eb"; x86_64-darwin = "39a336baca218058011f39c4fa9a4275348ec7f411789262799d23c9669060d9"; aarch64-darwin = "f39aafcf480ef581161d3dc0b89a91c556dcaed45927ee0b612368016afe7b89"; headers = "134iqsjg6b80jwywccrhkhlrk6vj12d1nmfqbvlcl0d6cyqw6hys"; </del> <ins> electron_26-bin = mkElectron "26.2.1" { armv7l-linux = "27469331e1b19f732f67e4b3ae01bba527b2744e31efec1ef76748c45fe7f262"; aarch64-linux = "fe634b9095120d5b5d2c389ca016c378d1c3ba4f49b33912f9a6d8eb46f76163"; x86_64-linux = "be4ca43f4dbc82cacb4c48a04f3c4589fd560a80a77dbb9bdf6c81721c0064df"; x86_64-darwin = "007413187793c94cd248f52d3e00e2d95ed73b7a3b2c5a618f22eba7af94cd1a"; aarch64-darwin = "4e095994525a0e97e897aad9c1940c8160ce2c9aaf7b6792f31720abc3e04ee6"; headers = "02z604nzcm8iw29s5lsgjlzwn666h3ikxpdfjg2h0mffm82d0wfk"; </ins> }; }

Related discussion:
text: Since the released upstream deb package has not fixed CVE-2023-4863 ( fixed it, but it is not released yet), we have to wait a while for a new koreader release.
To make it better, I reported them this like 2 weeks ago! They're still working on running the npm command on the stable branch, give them some time!
fluffychat and flutter updates have been backported now:
I made a draft PR that contains the caprine-bin update (), but the updated app turns out to be unusable (sindresorhus/caprine).
The above issue is resolved in Caprine 2.58.3. Please take a look at .
it was brought to my attention that the Darwin version for Discord was not bumped in 6 months, and is thus still vulnerable to this libwebp vuln. If nobody maintains this software can it be removed and/or marked as knownVulnerable? Thanks!
I'd say that after a bit of wait you mark packages as vulnerable and that is the main way of finding out whether someone is really willing to keep it alive.
I have bumped them in . The main issue is that r-ryantm isn't helping us out here, as there is no for the darwin packaging. Not sure if any of the other Discord maintainers are using Darwin, but I certainly don't and would need some assistance testing these.
is affected. I created mifi/lossless-cut to remind the LosslessCut upstream to make a new patch release, so that me can update .
is affected, fix:
All the packages I evaluated as being high-risk have now been taken care of (and most of them did actually get updates, woo! only marked 2 or 3 as insecure). Right now I don't think anyone has the bandwidth to try and track the rest. I'm going to close this bug - if someone does want to take over the remediation for the rest of the impacted packages, feel free to reopen and assign yourself. (Note however that there is a large overlap between vulnerable to this libwebp vuln and vulnerable to the recent libvpx vuln... so maybe just go help over there instead of reusing this bug.)
Unpinning due to closing
This issue has been mentioned on NixOS Discourse. There might be relevant details there: