Code change:
headers = "1v7ap1v520hhghw358k41aahpnaif54qbg6a9dwgmg1di0qwn735"; }; <del> electron_26-bin = mkElectron "26.1.0" { armv7l-linux = "4a4a6587bddce4554657f40fd9d39645ede03a375a1c42455c9b8d556698e5f5"; aarch64-linux = "1ed0996a06e97f5c23ceb8ae767873915c432c0aca5ffd4b37ab5fb1002d9d65"; x86_64-linux = "de78aed71ce17395675a29dcd20c1370473713eb234143dd0fa3e4c5a39504eb"; x86_64-darwin = "39a336baca218058011f39c4fa9a4275348ec7f411789262799d23c9669060d9"; aarch64-darwin = "f39aafcf480ef581161d3dc0b89a91c556dcaed45927ee0b612368016afe7b89"; headers = "134iqsjg6b80jwywccrhkhlrk6vj12d1nmfqbvlcl0d6cyqw6hys"; </del> <ins> electron_26-bin = mkElectron "26.2.1" { armv7l-linux = "27469331e1b19f732f67e4b3ae01bba527b2744e31efec1ef76748c45fe7f262"; aarch64-linux = "fe634b9095120d5b5d2c389ca016c378d1c3ba4f49b33912f9a6d8eb46f76163"; x86_64-linux = "be4ca43f4dbc82cacb4c48a04f3c4589fd560a80a77dbb9bdf6c81721c0064df"; x86_64-darwin = "007413187793c94cd248f52d3e00e2d95ed73b7a3b2c5a618f22eba7af94cd1a"; aarch64-darwin = "4e095994525a0e97e897aad9c1940c8160ce2c9aaf7b6792f31720abc3e04ee6"; headers = "02z604nzcm8iw29s5lsgjlzwn666h3ikxpdfjg2h0mffm82d0wfk"; </ins> }; }

Related discussion:
text: It will count once the backport to release-23.05 has happened.
I had already reported the issue to mautrix-whatsapp in private to lessen the chance of exploitation (they use the webp dependency to decode webp images and are thus vulnerable). I've had no response yet though.
Heh, I don't think there's much value in reporting this in private (and making coordination/tracking harder) given that it's a publicly disclosed vulnerability already. I noticed you said you'd talk to upstream but couldn't find any trace of that, so I went ahead and filed that bug... Sorry for stepping on your toes - it's hard for me to know exactly how actively maintainers are going to handle the remediation by themselves, so I've been proactive in making sure upstream issues are filed when I don't see one
Godot (godot3, godot_4, godot3-headless, godot3-server, godot3-export-templates): upstream has merged which I think is getting backported to the 3.x branch. But it also appears that, at least for 4.x, libwebp can be unvendored: I think that's what we should be doing while waiting for new releases, and this is likely true of many other dependencies that can be unvendored via the same mechanism. cc maintainers: (please cc me on any fix PR and make sure to backport to 23.05).
Fix for mautrix-whatsapp here: (backport here: )
Worth noting is vulnerable, upstream fix was in PR Kong/insomnia, though it hasn't gotten a release yet.
is a fix for signal-desktop-beta, thanks
:heart: to all who have contributed to this.
Explicitly pinging the maintainers for the remaining high-risk use cases: armcord still uses vulnerable Electron 26.1.0. Please get upstream to fix their security vulnerabilities. caprine-bin is presumably built by upstream from Electron 24.1.3 from 151 days ago. Please get upstream to fix their security vulnerabilities. (Additionnally, why is this a binary build instead of something we build from source?) - mailspring uses Electron 17, which is hopelessly out of date, EOL, and insecure. Please get upstream to fix their security vulnerabilities.