Change:
I just filed a to update our version of CEF to fix a . The previous version was released on 2019-07-27— that's almost 2 years! For a piece of software that's functionally a web browser, we certainly shouldn't be using an out-of-date version: web browsers have a massive attack surface and it's very important to keep them updated at all times. I don't have the time to work on this right at the moment, but it shouldn't be too difficult. There's a containing metadata for every CEF release. All that should be necessary is to grab the latest stable version for the right platform. While we're at it, we could also consider building for i686 and AArch64. Tagging the maintainer
IDK how it works, but it sounds like a job for the bot ().

Discussion:
, at-spi2-core , cups , libxshmfence <ins> , obs-studio </ins> }: let

"aarch64-linux" = { platformStr = "linuxarm64"; projectArch = "arm64"; <del> sha256 = "01ny1k10dklsqrrqmxqd9433413wmpk4ddsmkjp9dzv52dvpcl08"; </del> }; "i686-linux" = { platformStr = "linux32"; projectArch = "x86"; <del> sha256 = "000j6pc336c43xczl1rs5zf8nsf17y76f1kpy14gqgpwyzl8my0w"; </del> }; "x86_64-linux" = { platformStr = "linux64"; projectArch = "x86_64"; <del> sha256 = "1ydjckld89dkpy5zrvk7jjpz70mnlmbm8yinkfpzgcwbkcakk6k7"; </del> }; }; <ins> platforms."aarch64-linux".sha256 = "0m12adzcs6xsmgnqsdc5g0xs6xmjbj560x4d9rnv9fpf1p7jv2fa"; platforms."i686-linux".sha256 = "00cy5kxx8hpifkwhn9qbfch7ng3crx0zb6ypllzip6qms956mama"; platforms."x86_64-linux".sha256 = "1f1hxx4xl0wljyrgj0m3zq47yz2cyqd52qigrkpcvavr1d2sx6m3"; </ins> platformInfo = builtins.getAttr stdenv.targetPlatform.system platforms; in stdenv.mkDerivation rec { pname = "cef-binary"; <del> version = "96.0.18"; gitRevision = "fe551e4"; chromiumVersion = "96.0.4664.110"; </del> <ins> version = "98.1.21"; gitRevision = "9782362"; chromiumVersion = "98.0.4758.102"; </ins> src = fetchurl { url = "https://cef-builds.spotifycdn.com/cef_binary_${version}+g${gitRevision}+chromium-${chromiumVersion}_${platformInfo.platformStr}_minimal.tar.bz2";

cp -r ../include $out/ ''; <ins> passthru.tests = { inherit obs-studio; # frequently breaks on CEF updates }; passthru.updateScript = ./update.sh; </ins> meta = with lib; { description = "Simple framework for embedding Chromium-based browsers in other applications"; homepage = "https://cef-builds.spotifycdn.com/index.html";

<ins> #!/usr/bin/env nix-shell #!nix-shell -i bash -p curl gnused jq set -x -eu -o pipefail cd $(dirname "${BASH_SOURCE[0]}") VERSION_JSON=$(curl --silent https://cef-builds.spotifycdn.com/index.json | jq '[.linux64.versions[] | select (.channel == "stable")][0]') CEF_VERSION=$(echo ${VERSION_JSON} | jq -r '.cef_version' | cut -d'+' -f1) GIT_REVISION=$(echo ${VERSION_JSON} | jq -r '.cef_version' | cut -d'+' -f2 | cut -c 2-) CHROMIUM_VERSION=$(echo ${VERSION_JSON} | jq -r '.chromium_version') SHA256_LINUX64=$(nix-prefetch-url --quiet https://cef-builds.spotifycdn.com/cef_binary_${CEF_VERSION}+g${GIT_REVISION}+chromium-${CHROMIUM_VERSION}_linux64_minimal.tar.bz2) SHA256_LINUX32=$(nix-prefetch-url --quiet https://cef-builds.spotifycdn.com/cef_binary_${CEF_VERSION}+g${GIT_REVISION}+chromium-${CHROMIUM_VERSION}_linux32_minimal.tar.bz2) SHA256_LINUXARM64=$(nix-prefetch-url --quiet https://cef-builds.spotifycdn.com/cef_binary_${CEF_VERSION}+g${GIT_REVISION}+chromium-${CHROMIUM_VERSION}_linuxarm64_minimal.tar.bz2) setKV () { sed -i "s|$1 = ".*"|$1 = "${2:-}"|" ./default.nix } setKV version ${CEF_VERSION} setKV gitRevision ${GIT_REVISION} setKV chromiumVersion ${CHROMIUM_VERSION} setKV 'platforms."aarch64-linux".sha256' ${SHA256_LINUXARM64} setKV 'platforms."i686-linux".sha256' ${SHA256_LINUX32} setKV 'platforms."x86_64-linux".sha256' ${SHA256_LINUX64} </ins>