Bitwarden EOL Electron 39

EdgeLordKirito · July 15, 2026, 6:19pm

Hey I just upgraded my system from 25.11 to 26.05.
The rebuild command was complaining that Bitwarden is using an EOL Electron version as a dependency.

I did as recommended by the command output and added the version to the allowed insecure packages.

But it did make me wonder either nobody in the community is using Bitwarden or everybody is permitting this EOL package.

I am not all that familiar with the entire package development side of nix. So i was wondering what could be done about this. If it is just a few line changes or a massive undertaking.

Kind regards to any kind strangers listening to my crazy ramblings

pbsds · July 15, 2026, 6:46pm

It is indeed locked to v39 in the current release

github.com/bitwarden/clients

package.json

39f07436c


      
          "autoprefixer": "10.4.22",
          "axe-playwright": "2.2.2",
          "babel-loader": "10.1.1",
          "base64-loader": "1.0.0",
          "browserslist": "4.28.2",
          "chromatic": "13.3.4",
          "concurrently": "9.2.1",
          "copy-webpack-plugin": "14.0.0",
          "cross-env": "10.1.0",
          "css-loader": "7.1.4",
          "electron": "39.8.5",
          "electron-builder": "26.8.2",
          "electron-log": "5.4.3",
          "electron-reload": "2.0.0-alpha.1",
          "electron-store": "11.0.2",
          "electron-updater": "6.6.4",
          "eslint": "9.39.4",
          "eslint-config-prettier": "10.1.8",
          "eslint-import-resolver-typescript": "4.4.4",
          "eslint-plugin-import": "2.32.0",
          "eslint-plugin-jest": "29.15.2",

but bumping bitwarden-desktop can move it to v41

github.com/bitwarden/clients

package.json

afc51a7ce


      
          "autoprefixer": "10.4.22",
          "axe-playwright": "2.2.2",
          "babel-loader": "10.1.1",
          "base64-loader": "1.0.0",
          "browserslist": "4.28.2",
          "chromatic": "13.3.4",
          "concurrently": "9.2.1",
          "copy-webpack-plugin": "14.0.0",
          "cross-env": "10.1.0",
          "css-loader": "7.1.4",
          "electron": "41.7.2",
          "electron-builder": "26.9.0",
          "electron-log": "5.4.3",
          "electron-reload": "2.0.0-alpha.1",
          "electron-store": "11.0.2",
          "electron-updater": "6.8.3",
          "eslint": "9.39.4",
          "eslint-config-prettier": "10.1.8",
          "eslint-import-resolver-typescript": "4.4.4",
          "eslint-plugin-import": "2.32.0",
          "eslint-plugin-jest": "29.15.2",

PR welcome

Optionally you can file an update request and ping the maintainers

waffle8946 · July 16, 2026, 12:09am

bitwarden-desktop is affected but I think most people are using the browser extension.
It took a while to get bitwarden themselves to update to the newest electron, see [PM-34331] Update electron to 41 by dani-garcia · Pull Request #20448 · bitwarden/clients · GitHub. Then we have to wait for them to make a release, then we can bump it on our end in nixpkgs.

nadir · July 16, 2026, 12:53am

I find the usual Electron hate tiring and see the value it brings, but NixOS maintenance has opened my eyes to how ridiculously bad open and closed source devs are at keeping Electron up-to-date. Obsidian, feishin, bitwarden desktop - the list goes on.

I’m not trying to shame these people, but if upgrading is a big enough effort for them to avoid it, that in itself seems like a big downside of Electron.

Oh and to answer OP: Either I accept the insecure packages in situation like this, or I just move to the flatpak (via GitHub - gmodena/nix-flatpak: Install flatpaks declaratively · GitHub).

Doesn’t solve the underlying issue but for the very few programs I use that have this problem, it’s the path of least friction.

Bitwarden Desktop specifically is, as has been said already, not something that I think many people find very useful. I’m a long time Bitwarden user and removed it without feeling I lost anything.

What do you use it for?

andrewzah · July 16, 2026, 7:25am

There is an open issue about this: bitwarden-desktop depends on EOL electron · Issue #526914 · NixOS/nixpkgs · GitHub.

Workarounds mentioned there:

Updating permittedInsecurePackages to allow using EOL Electron (accepting the risk).

Optionally, adding an overlay e.g. bitwarden-desktop = prev.bitwarden-desktop.override { electron_39 = final.electron_39-bin; }; to avoid having to build Electron from source.

While I’m waiting for bitwarden to update to 41 or whatever, I just use the web interface from a self-hosted vaultwarden instance.