wasm3: drop

wasm3 has been in a minimal maintenance mode for several years, and has
seen no commits since mid 2024. Given that it has several known
vulnerabilities (which have been marked in Nixpkgs since 2022), doesn't
seem very maintained, and is not used anywhere else in Nixpkgs, there
does not seem to be reason to keep it around.

pkgs/by-name/wa/wasm3/package.nix

@@ -1,51 +0,0 @@
-{
-  lib,
-  stdenv,
-  cmake,
-  fetchFromGitHub,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "wasm3";
-  version = "0.5.0";
-
-  src = fetchFromGitHub {
-    owner = "wasm3";
-    repo = "wasm3";
-    rev = "v${version}";
-    sha256 = "07zzmk776j8ydyxhrnnjiscbhhmz182a62r6aix6kfk5kq2cwia2";
-  };
-
-  nativeBuildInputs = [ cmake ];
-
-  cmakeFlags = [
-    "-DBUILD_WASI=simple"
-  ];
-
-  installPhase = ''
-    runHook preInstall
-    install -Dm755 wasm3 -t $out/bin
-    runHook postInstall
-  '';
-
-  meta = {
-    homepage = "https://github.com/wasm3/wasm3";
-    description = "Fastest WebAssembly interpreter, and the most universal runtime";
-    platforms = lib.platforms.all;
-    maintainers = with lib.maintainers; [ malbarbo ];
-    license = lib.licenses.mit;
-    knownVulnerabilities = [
-      # wasm3 expects all wasm code to be pre-validated, any users
-      # should be aware that running unvalidated wasm will potentially
-      # lead to RCE until upstream have added a builtin validator
-      "CVE-2022-39974"
-      "CVE-2022-34529"
-      "CVE-2022-28990"
-      "CVE-2022-28966"
-      "CVE-2021-45947"
-      "CVE-2021-45946"
-      "CVE-2021-45929"
-      "CVE-2021-38592"
-    ];
-  };
-}

pkgs/top-level/aliases.nix

@@ -2250,6 +2250,7 @@ mapAliases {
   warsow = throw "'warsow' has been removed as it is unmaintained and is broken"; # Added 2025-10-09
   warsow-engine = throw "'warsow-engine' has been removed as it is unmaintained and is broken"; # Added 2025-10-09
   wasistlos = throw "'wasistlos' has been removed because it was unmaintained and archived upstream. Consider using 'karere' instead"; # Added 2026-04-13
+  wasm3 = throw "'wasm3' has been removed as it is unmaintained upstream and has many known vulnerabilities"; # Added 2026-06-03
   wasm-bindgen-cli = wasm-bindgen-cli_0_2_121;
   wasm-strip = throw "'wasm-strip' has been removed due to upstream deprecation. Use 'wabt' instead."; # Added 2025-11-06
   wavebox = throw "'wavebox' has been removed due to lack of maintenance in nixpkgs"; # Added 2025-06-24