orogene: drop

Vulnerable to CVE-2025-62518 without replacement

pkgs/by-name/or/orogene/package.nix

@@ -1,61 +0,0 @@
-{
-  lib,
-  rustPlatform,
-  fetchFromGitHub,
-  pkg-config,
-  openssl,
-  versionCheckHook,
-}:
-
-rustPlatform.buildRustPackage rec {
-  pname = "orogene";
-  version = "0.3.34";
-
-  src = fetchFromGitHub {
-    owner = "orogene";
-    repo = "orogene";
-    tag = "v${version}";
-    hash = "sha256-GMWrlvZZ2xlcvcRG3u8jS8KiewHpyX0brNe4pmCpHbM=";
-    fetchSubmodules = true;
-  };
-
-  cargoPatches = [
-    # Workaround to avoid "error[E0282]"
-    # ref: https://github.com/orogene/orogene/pull/315
-    ./update-outdated-lockfile.patch
-  ];
-
-  cargoHash = "sha256-I08mqyogEuadp+V10svMmCm0i0zOZWiocOpM9E3lgag=";
-
-  nativeBuildInputs = [
-    pkg-config
-  ];
-
-  buildInputs = [
-    openssl
-  ];
-
-  preCheck = ''
-    export CI=true
-    export HOME=$(mktemp -d)
-  '';
-
-  doInstallCheck = true;
-  nativeInstallCheckInputs = [
-    versionCheckHook
-  ];
-  versionCheckProgram = "${placeholder "out"}/bin/oro";
-  versionCheckProgramArg = "--version";
-
-  meta = with lib; {
-    description = "Package manager for tools that use node_modules";
-    homepage = "https://github.com/orogene/orogene";
-    changelog = "https://github.com/orogene/orogene/blob/${src.rev}/CHANGELOG.md";
-    license = with licenses; [
-      asl20
-      isc
-    ];
-    maintainers = with maintainers; [ figsoda ];
-    mainProgram = "oro";
-  };
-}

pkgs/top-level/aliases.nix

@@ -2030,6 +2030,7 @@ mapAliases {
   openvdb_11 = throw "'openvdb_11' has been removed in favor of the latest version'"; # Added 2025-05-03
   opera = throw "'opera' has been removed due to lack of maintenance in nixpkgs"; # Added 2025-05-19
   orchis = throw "'orchis' has been renamed to/replaced by 'orchis-theme'"; # Converted to throw 2024-10-17
+  orogene = throw "'orogene' uses a wasm-specific fork of async-tar that is vulnerable to CVE-2025-62518, which is not supported by its upstream"; # Added 2025-10-24
   ortp = throw "'ortp' has been moved to 'linphonePackages.ortp'"; # Added 2025-09-20
   omping = throw "'omping' has been removed because its upstream has been archived"; # Added 2025-05-10
   onlyoffice-bin = onlyoffice-desktopeditors; # Added 2024-09-20