From 5a3bf2b1a4a5b3a8a7e92766a5d0eadebe04caa3 Mon Sep 17 00:00:00 2001
From: Benjamin Sparks <b.sparks@alugha.com>
Date: Sun, 26 Oct 2025 20:40:05 +0100
Subject: [PATCH] cotton: drop

---
 pkgs/by-name/co/cotton/package.nix | 34 ------------------------------
 pkgs/top-level/aliases.nix         |  1 +
 2 files changed, 1 insertion(+), 34 deletions(-)
 delete mode 100644 pkgs/by-name/co/cotton/package.nix

diff --git a/pkgs/by-name/co/cotton/package.nix b/pkgs/by-name/co/cotton/package.nix
deleted file mode 100644
index cfa45e587c4f..000000000000
--- a/pkgs/by-name/co/cotton/package.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{
-  lib,
-  rustPlatform,
-  fetchFromGitHub,
-}:
-
-rustPlatform.buildRustPackage {
-  pname = "cotton";
-  version = "0-unstable-2023-09-13";
-
-  src = fetchFromGitHub {
-    owner = "danielhuang";
-    repo = "cotton";
-    rev = "df9d79a4b0bc4b140e87ddd7795924a93775a864";
-    sha256 = "sha256-ZMQaVMH8cuOb4PQ19g0pAFAMwP8bR60+eWFhiXk1bYE=";
-  };
-
-  cargoHash = "sha256-y162tjxPGZQiYBJxFk4QN9ZqSH8jrqa5Y961Sx2zrRs=";
-
-  meta = with lib; {
-    description = "Package manager for JavaScript projects";
-    mainProgram = "cotton";
-    homepage = "https://github.com/danielhuang/cotton";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [
-      dit7ya
-      figsoda
-    ];
-
-    knownVulnerabilities = [
-      "'cotton' is vulnerable to CVE-2025-62518"
-    ];
-  };
-}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index dc6dc101c845..6407e2409fd1 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -683,6 +683,7 @@ mapAliases {
   coriander = throw "'coriander' has been removed because it depends on GNOME 2 libraries"; # Added 2024-06-27
   corretto19 = throw "Corretto 19 was removed as it has reached its end of life"; # Added 2024-08-01
   cosmic-tasks = tasks; # Added 2024-07-04
+  cotton = throw "'cotton' has been removed since it is vulnerable to CVE-2025-62518 and upstream is unmaintained"; # Added 2025-10-26
   cpp-ipfs-api = cpp-ipfs-http-client; # Project has been renamed. Added 2022-05-15
   crispyDoom = crispy-doom; # Added 2023-05-01
   cromite = throw "'cromite' has been removed from nixpkgs due to it not being maintained"; # Added 2025-06-12