1password-gui: 8.10.9 -> 8.10.16

[savannidgerinel]

Description of changes

1Password has had several releases since the last NixOS update.

1Password for Linux | 1Password Releases

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 23.11 Release Notes (or backporting 23.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

[amaxine]

Thank you! Could you please alter the message to match the derivation name (_1password-gui)? I'll merge after that's fixed.

[jeffdik]

Hi, thanks for your work on this!

I think this fixes CVE-2023-4863 for 1password[1] and maybe should be listed on CVE-2023-4863 (libwebp heap buffer overflow) tracking · Issue #254798 · NixOS/nixpkgs.

Security advisory for 1Password 8 for Mac, Windows and Linux mentions that 1password 8.10.15 contains the fix for CVE-2023-4863.

If you use strings and grep, it looks like 1password 8.10.9 uses Electron 25.0.1:

> strings /nix/store/xfwqr8vykb3gixqqflq6x07kd3afbnll-1password-8.10.9/share/1password/1password | grep '^Chrome/[0-9.]* Electron/[0-9]'
Chrome/114.0.5735.45 Electron/25.0.1

1password 8.10.16 uses Electron 25.8.1:

> strings /nix/store/ifxm9pagcf70dk01zf6yzbb0jzfrffb5-1password-8.10.16/share/1password/1password | grep '^Chrome/[0-9.]* Electron/[0-9]'
Chrome/114.0.5735.289 Electron/25.8.1

Based on the above, I think 1password doesn't use the system libwebp and has a bundled version of Electron.

Release electron v25.8.1 · electron/electron says Electron 25.8.1 has the fix for CVE-2023-4863.

Does this look right to you, and should this release be listed on CVE-2023-4863 (libwebp heap buffer overflow) tracking · Issue #254798 · NixOS/nixpkgs and backported to NixOS 23.05?

[1]: Security advisory for 1Password 8 for Mac, Windows and Linux