cotton: drop

pkgs/by-name/co/cotton/package.nix

@@ -1,34 +0,0 @@
-{
-  lib,
-  rustPlatform,
-  fetchFromGitHub,
-}:
-
-rustPlatform.buildRustPackage {
-  pname = "cotton";
-  version = "0-unstable-2023-09-13";
-
-  src = fetchFromGitHub {
-    owner = "danielhuang";
-    repo = "cotton";
-    rev = "df9d79a4b0bc4b140e87ddd7795924a93775a864";
-    sha256 = "sha256-ZMQaVMH8cuOb4PQ19g0pAFAMwP8bR60+eWFhiXk1bYE=";
-  };
-
-  cargoHash = "sha256-y162tjxPGZQiYBJxFk4QN9ZqSH8jrqa5Y961Sx2zrRs=";
-
-  meta = with lib; {
-    description = "Package manager for JavaScript projects";
-    mainProgram = "cotton";
-    homepage = "https://github.com/danielhuang/cotton";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [
-      dit7ya
-      figsoda
-    ];
-
-    knownVulnerabilities = [
-      "'cotton' is vulnerable to CVE-2025-62518"
-    ];
-  };
-}

pkgs/top-level/aliases.nix

@@ -683,6 +683,7 @@ mapAliases {
   coriander = throw "'coriander' has been removed because it depends on GNOME 2 libraries"; # Added 2024-06-27
   corretto19 = throw "Corretto 19 was removed as it has reached its end of life"; # Added 2024-08-01
   cosmic-tasks = tasks; # Added 2024-07-04
+  cotton = throw "'cotton' has been removed since it is vulnerable to CVE-2025-62518 and upstream is unmaintained"; # Added 2025-10-26
   cpp-ipfs-api = cpp-ipfs-http-client; # Project has been renamed. Added 2022-05-15
   crispyDoom = crispy-doom; # Added 2023-05-01
   cromite = throw "'cromite' has been removed from nixpkgs due to it not being maintained"; # Added 2025-06-12