electron-source.electron_36: remove, electron_36-bin: mark as insecure

[yuyuyureka]

Packages still using electron_36 (and will be transitively insecure when this PR is merged):

• webcord (@huantianad @NotAShelf)
• webcord-vencord (@FlafyDev @NotAShelf)
• netron (@flokli)
• feishin (@onny @jlbribeiro)
• lx-music-desktop (unmaintained)
• bitwarden-desktop (@amarshall)
• joplin-desktop (@fugidev)
• electron-fiddle (@andersk @TomaSajt)
• appium-inspector (@NyCodeGHG)
• breitbandmessing (@B4dM4n)
• heroic-unwrapped (@iedame)

Things done

• Built on platform:
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• Tested, as applicable:
  • NixOS tests in nixos/tests.
  • Package tests at passthru.tests.
  • Tests in lib/tests or pkgs/test for functions and "core" functionality.
• Ran nixpkgs-review on this PR. See nixpkgs-review usage.
• Tested basic functionality of all binary files, usually in ./result/bin/.
• Nixpkgs Release Notes
  • Package update: when the change is major or breaking.
• NixOS Release Notes
  • Module addition: when adding a new NixOS module.
  • Module update: when the change is significant.
• Fits CONTRIBUTING.md, pkgs/README.md, maintainers/README.md and other READMEs.

---

Add a 👍 reaction to pull requests you find important.

[SuperSandro2000]

bitwarden-desktop will update to electron 37 in the next release bitwarden/clients#16905 which should be any day.

[amarshall]

PR to backport electron_37 update to bitwarden-desktop: #458491

[iedame]

heroic's upstream just updated to 36.9.4, I will do some testing to see if we can update earlier or it burst into flames as that package needs some love. I adopted it recently so I will do the best I can.

[teutat3s]

For reference, previously: #442413

[yuyuyureka]

@pluiedev since gfn-electron was already behind in the last round and is now the last package depending on electron_35, and has also been officially abandoned upstream, I have removed it for now. Feel free to revert if you want to re-add your own updated fork.

[pluiedev]

No worries! It's sad that upstream is in this abandoned state, but I might consider packaging https://github.com/AstralVixen/GeForce-Infinity in its stead if I ever felt like it

[NotAShelf]

I wish you had waited until the weekend so that I had a chance to address this.

[iedame]

I also didn't expect it was going to be merged so fast, I was able to do some testing so I just went ahead and started a PR to bump electron for heroic. Please take a look, hopefully those two will reach unstable together.

[yuyuyureka]

Sorry, I'm in a bit of a hurry because I don't want to have 4 versions with different toolchain patches each, which gets worsened by Rust 1.90 (#459376).

The release cycles are planned out and it's predictable when a version becomes EOL, so this is the same every time. You can set yourself a calendar entry for <X> time before electron_37 goes EOL (2026-Jan-13), to get your packages ready for the next removal. I heard some of the chromium package maintainers have such a (physical) release calendar at home ;)

We can define a minimum announcement time of 7 days for the future though, if that helps.

[iedame]

Thank you, that will definitely help for next time. I will do that! No worries, I understand the hurry.

[fugidev]

joplin-desktop: #460058

[flokli]

netron: #460405

[teutat3s]

feishin: #461218