conduwuit: mark as EOL

On April 11, 2025, the conduwuit project officially ceased development.
nixpkgs marks security-sensitive projects that have reached EOL as
vulnerable.

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -303,6 +303,8 @@
 - The behavior of `services.hostapd.radios.<name>.networks.<name>.authentication.enableRecommendedPairwiseCiphers` was changed to not include `CCMP-256` anymore.
   Since all configured pairwise ciphers have to be supported by the radio, this caused startup failures on many devices which is hard to debug in hostapd.
 
+- The `conduwuit` matrix server implementation has officially been discontinued by upstream and the package has thus been marked as vulnerable, as it is a security-sensitive package that has reached EOL.
+
 - `gkraken` software and `hardware.gkraken.enable` option have been removed, use `coolercontrol` via `programs.coolercontrol.enable` option instead.
 
 - To avoid delaying user logins unnecessarily the `multi-user.target` is no longer ordered after `network-online.target`.

pkgs/by-name/co/conduwuit/package.nix

@@ -98,6 +98,9 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://conduwuit.puppyirl.gay/";
     changelog = "https://github.com/girlbossceo/conduwuit/releases/tag/v${version}";
     license = lib.licenses.asl20;
+    knownVulnerabilities = [
+      "On April 11, 2025, the conduwuit project officially ceased development"
+    ];
     maintainers = with lib.maintainers; [ niklaskorz ];
     # Not a typo, conduwuit is a drop-in replacement for conduit.
     mainProgram = "conduit";