#18312 basically did this in an elegant way, but we can for sure remove this now.

#18312 basically did this in an elegant way, but we can for sure remove this now.

Looks like there is no interest claws upstream https://www.thewildbeast.co.uk/claws-mail/bugzilla/show_bug.cgi?id=3763

But emacs should support that: https://git.savannah.gnu.org/cgit/emacs.git/commit/configure.ac?id=d781662873f228b110a128f7a2b6583a4d5e0a3a

https://gist.github.com/GrahamcOfBorg/e121c3e97e1dfd6adf83bab9f193f157, is rather interesting...

See mmex in all-packages

@jtojnar Running unpackPhase on emacs25 shows

  WEBKIT_REQUIRED=1.4.0
  WEBKIT_MODULES="webkitgtk-3.0 >= $WEBKIT_REQUIRED"

So I think the source in nixpkgs predates this commit.

See mmex in all-packages

Did 3e1ee5b.
This reminds me wxGTK needs to default to gtk3 #73145, but it's pretty tedious TBH.

https://git.savannah.gnu.org/cgit/emacs.git/commit/src/xwidget.c?id=a36ed9b5e95afea5716256bac24d883263aefbaf seems to build:

diff --git a/pkgs/applications/editors/emacs/25.nix b/pkgs/applications/editors/emacs/25.nix
index f3989be52c0..15e9fbdd726 100644
--- a/pkgs/applications/editors/emacs/25.nix
+++ b/pkgs/applications/editors/emacs/25.nix
@@ -48,7 +48,16 @@ stdenv.mkDerivation rec {
     })
   ] ++ [
     # Backport patch so we can use webkitgtk with xwidgets.
-    ./0001-xwidget-Use-WebKit2-API.patch
+    (fetchurl {
+      name = "0001-Omit-unnecessary-includes-from-xwidget-c.patch";
+      url = "https://git.savannah.gnu.org/cgit/emacs.git/patch?id=a36ed9b5e95afea5716256bac24d883263aefbaf";
+      sha256 = "0a4ax1kjcn6g4c59a0wikplx47r6r3lh5igc9vrlqkpk5lw30j0j";
+    })
+    (fetchurl {
+      name = "0002-xwidget-Use-WebKit2-API.patch";
+      url = "https://git.savannah.gnu.org/cgit/emacs.git/patch?id=d781662873f228b110a128f7a2b6583a4d5e0a3a";
+      sha256 = "1m2fnblsk4dg3scxiawz6vsa83bvyg9bxis9mhrjd5f7cdmcnn4z";
+    })
   ];
 
   nativeBuildInputs = [ pkgconfig autoconf automake texinfo ]

@jtojnar Fetched those patches. I had to do it from the GitHub mirror because of the ongoing DOS (or maybe I'm blacklisted).

Claws Mail will build with a supported WebKit once it switches to GTK 3, which seems to progress well:
https://git.claws-mail.org/?p=claws.git;a=shortlog;h=refs/heads/gtk3
https://git.claws-mail.org/?p=claws.git;a=history;f=src/plugins/fancy;hb=refs/heads/gtk3
Meanwhile Claws Mail 3.17.4 has added a new litehtml-based HTML renderer plugin. I suppose I'll try to package it, since lack of HTML support noticebly reduces its usability. Alternatively it would make sense to provide a gtk3 branch snapshot of Claws Mail.
EDIT: Note that Claws Mail uses webkitgtk with javascript disabled, and therefore does not put its users at risk of known security issues.

I have tried the litehtml plugin — it is as simple as adding gumbo to claws-mail build inputs (and enabling it in Configuration > Plugins) — but it's rendering is very bad, with huge spacing between words and lines, and the text can not be selected and copied.

Claws Mail will build with a supported WebKit once it switches to GTK 3, which seems to progress well:
https://git.claws-mail.org/?p=claws.git;a=shortlog;h=refs/heads/gtk3
https://git.claws-mail.org/?p=claws.git;a=history;f=src/plugins/fancy;hb=refs/heads/gtk3
Meanwhile Claws Mail 3.17.4 has added a new litehtml-based HTML renderer plugin. I suppose I'll try to package it, since lack of HTML support noticebly reduces its usability. Alternatively it would make sense to provide a gtk3 branch snapshot of Claws Mail.

It seems the only mostly working solution would be a gtk3 variant package. Though it's not good to distribute non-released/non-production code (some people even request that you don't), it's an option.

EDIT: Note that Claws Mail uses webkitgtk with javascript disabled, and therefore does not put its users at risk of known security issues.

While disabling JavaScript will reduce the attack surface greatly, I doubt JavaScriptCore is the only vulnerable component.