From 582879a1327dd454988315b7b9c882fbe2735698 Mon Sep 17 00:00:00 2001 From: Leona Maroni Date: Wed, 6 May 2026 21:25:39 +0200 Subject: [PATCH 1/6] yojimbo: drop uses mbedtls_2 which is EOL and also build is broken. --- pkgs/by-name/yo/yojimbo/package.nix | 66 ------------------- .../silence-uninitialized-warning.patch | 13 ---- pkgs/top-level/aliases.nix | 1 + 3 files changed, 1 insertion(+), 79 deletions(-) delete mode 100644 pkgs/by-name/yo/yojimbo/package.nix delete mode 100644 pkgs/by-name/yo/yojimbo/silence-uninitialized-warning.patch diff --git a/pkgs/by-name/yo/yojimbo/package.nix b/pkgs/by-name/yo/yojimbo/package.nix deleted file mode 100644 index d2493df0cb41..000000000000 --- a/pkgs/by-name/yo/yojimbo/package.nix +++ /dev/null @@ -1,66 +0,0 @@ -{ - lib, - stdenv, - fetchFromGitHub, - premake5, - doxygen, - libsodium, - mbedtls_2, - nix-update-script, -}: - -stdenv.mkDerivation (finalAttrs: { - pname = "yojimbo"; - version = "1.2.3"; - - src = fetchFromGitHub { - owner = "mas-bandwidth"; - repo = "yojimbo"; - tag = "v${finalAttrs.version}"; - sha256 = "sha256-GMYkWQTwHm7fGRSTIt2phv01CjEcw0l4iPQD4uTQ5yM="; - }; - - nativeBuildInputs = [ - premake5 - doxygen - ]; - propagatedBuildInputs = [ - libsodium - mbedtls_2 - ]; - - patches = [ - # https://github.com/mas-bandwidth/serialize/pull/6 - ./silence-uninitialized-warning.patch - ]; - - postBuild = '' - doxygen doxygen.config - ''; - - installPhase = '' - install -Dm755 -t $out/lib bin/libyojimbo.a - cp -r -t $out include - mkdir -p $out/share/doc/yojimbo - cp -r docs/html $out/share/doc/yojimbo - ''; - - doCheck = true; - - enableParallelBuilding = true; - - passthru.updateScript = nix-update-script { }; - - meta = { - description = "Network library for client/server games with dedicated servers"; - longDescription = '' - yojimbo is a network library for client/server games with dedicated servers. - It's designed around the networking requirements of competitive multiplayer games like first person shooters. - As such it provides a time critical networking layer on top of UDP, with a client/server architecture supporting up to 64 players per-dedicated server instance. - ''; - homepage = "https://github.com/mas-bandwidth/yojimbo"; - license = lib.licenses.bsd3; - platforms = lib.platforms.x86_64; - maintainers = [ ]; - }; -}) diff --git a/pkgs/by-name/yo/yojimbo/silence-uninitialized-warning.patch b/pkgs/by-name/yo/yojimbo/silence-uninitialized-warning.patch deleted file mode 100644 index d90b7af06114..000000000000 --- a/pkgs/by-name/yo/yojimbo/silence-uninitialized-warning.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff --git a/serialize.h b/serialize.h -index 6e977ac..4d7413d 100644 ---- a/serialize/serialize.h -+++ b/serialize/serialize.h -@@ -1400,7 +1400,7 @@ namespace serialize - - template bool serialize_float_internal( Stream & stream, float & value ) - { -- uint32_t int_value; -+ uint32_t int_value = 0; - if ( Stream::IsWriting ) - { - memcpy( (char*) &int_value, &value, 4 ); diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index b99ec6ad47d5..13e178fbc407 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -2557,6 +2557,7 @@ mapAliases { yarn2nix = throw "'yarn2nix' and its tooling has been removed as it was unusable within nodePackages. Use the standard yarn v1 hooks available in nixpkgs instead."; # Added 2026-04-25 yarn2nix-moretea = throw "'yarn2nix' and its tooling has been removed as it was unusable within nodePackages. Use the standard yarn v1 hooks available in nixpkgs instead."; # Added 2026-04-25 yeahwm = throw "'yeahwm' has been removed, as it was broken and unmaintained upstream."; # Added 2025-06-12 + yojimbo = throw "'yojimbo' has been removed as it used an EOL TLS library and was broken."; # Added 2026-05-06 yosys-synlig = throw "yosys-synlig has been removed because it is unmaintained upstream and incompatible with current Yosys versions."; # Added 2026-01-06 youtube-music = lib.warnOnInstantiate "'youtube-music' has been renamed to 'pear-desktop'" pear-desktop; # Added 2025-12-23 yubikey-manager-qt = throw "'yubikey-manager-qt' has been removed due to being archived upstream. Consider using 'yubioath-flutter' instead."; # Added 2025-06-07 From 782c3cd83f157b11a7ce9392c31152c9e92e2a56 Mon Sep 17 00:00:00 2001 From: Leona Maroni Date: Wed, 6 May 2026 21:38:14 +0200 Subject: [PATCH 2/6] ustream-ssl-mbedtls: use mbedtls 3 OpenWRT themself uses 3: https://github.com/openwrt/openwrt/blob/openwrt-25.12/package/libs/mbedtls/Makefile#L11 https://github.com/openwrt/openwrt/blob/openwrt-25.12/package/libs/ustream-ssl/Makefile#L44 --- pkgs/top-level/all-packages.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 947fcf6bc63e..16ad0721ee95 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -6070,7 +6070,7 @@ with pkgs; ustream-ssl = callPackage ../development/libraries/ustream-ssl { ssl_implementation = openssl; }; ustream-ssl-mbedtls = callPackage ../development/libraries/ustream-ssl { - ssl_implementation = mbedtls_2; + ssl_implementation = mbedtls; }; # Make bdb5 the default as it is the last release under the custom From a0cd7b06eac75174f14fad12d916737a90bd7410 Mon Sep 17 00:00:00 2001 From: Leona Maroni Date: Wed, 6 May 2026 21:45:30 +0200 Subject: [PATCH 3/6] python3Packages.python-mbedtls: drop EOL and used EOL mbedtls_2 --- .../python-modules/python-mbedtls/default.nix | 49 ------------------- pkgs/top-level/python-aliases.nix | 1 + pkgs/top-level/python-packages.nix | 2 - 3 files changed, 1 insertion(+), 51 deletions(-) delete mode 100644 pkgs/development/python-modules/python-mbedtls/default.nix diff --git a/pkgs/development/python-modules/python-mbedtls/default.nix b/pkgs/development/python-modules/python-mbedtls/default.nix deleted file mode 100644 index 20bfc02d6bde..000000000000 --- a/pkgs/development/python-modules/python-mbedtls/default.nix +++ /dev/null @@ -1,49 +0,0 @@ -{ - lib, - buildPythonPackage, - fetchFromGitHub, - certifi, - cython, - mbedtls_2, - pytestCheckHook, - setuptools, - typing-extensions, -}: - -buildPythonPackage rec { - pname = "python-mbedtls"; - version = "2.10.1"; - pyproject = true; - - src = fetchFromGitHub { - owner = "Synss"; - repo = "python-mbedtls"; - rev = version; - hash = "sha256-eKKb12G/0QAcwtv5Yk/92QXhMipeKOfKR1JEaNHDIlg="; - }; - - build-system = [ - cython - setuptools - ]; - - buildInputs = [ mbedtls_2 ]; - - dependencies = [ - certifi - typing-extensions - ]; - - __darwinAllowLocalNetworking = true; - - nativeCheckInputs = [ pytestCheckHook ]; - - pythonImportsCheck = [ "mbedtls" ]; - - meta = { - description = "Cryptographic library with an mbed TLS back end"; - homepage = "https://github.com/Synss/python-mbedtls"; - license = lib.licenses.mit; - maintainers = with lib.maintainers; [ SuperSandro2000 ]; - }; -} diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix index 6e18b1443885..d43fa6b041d1 100644 --- a/pkgs/top-level/python-aliases.nix +++ b/pkgs/top-level/python-aliases.nix @@ -477,6 +477,7 @@ mapAliases { python-jsonrpc-server = throw "python-jsonrpc-server has been removed because it was no longer used by anything"; # added 2025-11-11 python-Levenshtein = throw "'python-Levenshtein' has been renamed to/replaced by 'levenshtein'"; # Converted to throw 2025-10-29 python-lz4 = throw "'python-lz4' has been renamed to/replaced by 'lz4'"; # Converted to throw 2025-10-29 + python-mbedtls = throw "'python-mbedtls' has been removed as it is unmaintained"; python-qt = throw "python-qt has been removed, because hard to maintain and not required by anything"; # Added 2025-01-14 python-simple-hipchat = throw "'python-simple-hipchat' has been removed because it was broken and unmaintained"; # added 2025-08-26 python-subunit = throw "'python-subunit' has been renamed to/replaced by 'subunit'"; # Converted to throw 2025-10-29 diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index ca460d0fe62c..a8654a7cf3cf 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -15875,8 +15875,6 @@ self: super: with self; { python-matter-server = callPackage ../development/python-modules/python-matter-server { }; - python-mbedtls = callPackage ../development/python-modules/python-mbedtls { }; - python-melcloud = callPackage ../development/python-modules/python-melcloud { }; python-memcached = callPackage ../development/python-modules/python-memcached { From 95b5d5dc76e53c4c2daf5cb97832e1bfea3a30b2 Mon Sep 17 00:00:00 2001 From: Leona Maroni Date: Wed, 6 May 2026 21:45:30 +0200 Subject: [PATCH 4/6] haxe_4_0: drop EOL since 2020 --- pkgs/development/compilers/haxe/default.nix | 8 +------- pkgs/top-level/aliases.nix | 1 + pkgs/top-level/all-packages.nix | 1 - 3 files changed, 2 insertions(+), 8 deletions(-) diff --git a/pkgs/development/compilers/haxe/default.nix b/pkgs/development/compilers/haxe/default.nix index 370163a096f4..75a90e4d6be7 100644 --- a/pkgs/development/compilers/haxe/default.nix +++ b/pkgs/development/compilers/haxe/default.nix @@ -57,9 +57,7 @@ let dune ] ++ (if lib.versionAtLeast version "4.3" then [ pcre2 ] else [ pcre ]) - ++ lib.optional (lib.versionAtLeast version "4.1") ( - if lib.versionAtLeast version "4.3" then mbedtls else mbedtls_2 - ) + ++ (if lib.versionAtLeast version "4.3" then [ mbedtls ] else [ mbedtls_2 ]) ++ ocamlDependencies version; src = fetchFromGitHub { @@ -150,10 +148,6 @@ let }; in { - haxe_4_0 = generic { - version = "4.0.5"; - hash = "sha256-Ck/py+tZS7dBu/uikhSLKBRNljpg2h5PARX0Btklozg="; - }; haxe_4_1 = generic { version = "4.1.5"; hash = "sha256-QP5/jwexQXai1A5Iiwiyrm+/vkdAc+9NVGt+jEQz2mY="; diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index 13e178fbc407..f2254d378f12 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -927,6 +927,7 @@ mapAliases { gxneur = throw "'gxneur' has been removed due to lack of maintenance and reliance on gnome2 and 2to3."; # Added 2025-08-17 hacpack = throw "hacpack has been removed from nixpkgs, as it has been taken down upstream"; # Added 2025-09-26 harmony-music = throw "harmony-music is unmaintained and has been removed"; # Added 2025-08-26 + haxe_4_0 = throw "'haxe_4_0' has been removed as it reached its end of life. Migrate to 'haxe_4_3'."; helix-gpt = throw "helix-gpt was deprecated in January 2026 and has been since removed"; # Added 2026-02-05 helvum = throw "'helvum' has been removed as it was unmaintained upstream and relied on a vulnerable dependency. Consider using 'crosspipe' instead."; # Added 2026-03-04 HentaiAtHome = throw "'HentaiAtHome' has been renamed to/replaced by 'hentai-at-home'"; # Converted to throw 2025-10-27 diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 16ad0721ee95..85552cdaef1c 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -4146,7 +4146,6 @@ with pkgs; }) haxe_4_3 haxe_4_1 - haxe_4_0 ; haxe = haxe_4_3; From 4be745c94828fca8788b11230e927f027646a498 Mon Sep 17 00:00:00 2001 From: Leona Maroni Date: Wed, 6 May 2026 21:45:30 +0200 Subject: [PATCH 5/6] haxe_4_1: drop EOL since 2021 and uses EOL version of mbedtls --- pkgs/development/compilers/haxe/default.nix | 48 ++++++--------------- pkgs/top-level/aliases.nix | 1 + pkgs/top-level/all-packages.nix | 1 - 3 files changed, 14 insertions(+), 36 deletions(-) diff --git a/pkgs/development/compilers/haxe/default.nix b/pkgs/development/compilers/haxe/default.nix index 75a90e4d6be7..f7a7bafc31e8 100644 --- a/pkgs/development/compilers/haxe/default.nix +++ b/pkgs/development/compilers/haxe/default.nix @@ -6,41 +6,23 @@ ocaml-ng, dune, zlib, - pcre, pcre2, neko, - mbedtls_2, mbedtls, }: let ocamlDependencies = - version: - if lib.versionAtLeast version "4.3" then - with ocaml-ng.ocamlPackages; - [ - ocaml - findlib - sedlex - xml-light - ptmap - camlp5 - sha - luv - extlib - ] - else - with ocaml-ng.ocamlPackages_4_10; - [ - ocaml - findlib - sedlex - xml-light - ptmap - camlp5 - sha - luv-0-5-12 - extlib-1-7-7 - ]; + version: with ocaml-ng.ocamlPackages; [ + ocaml + findlib + sedlex + xml-light + ptmap + camlp5 + sha + luv + extlib + ]; generic = { @@ -55,9 +37,9 @@ let zlib neko dune + pcre2 + mbedtls ] - ++ (if lib.versionAtLeast version "4.3" then [ pcre2 ] else [ pcre ]) - ++ (if lib.versionAtLeast version "4.3" then [ mbedtls ] else [ mbedtls_2 ]) ++ ocamlDependencies version; src = fetchFromGitHub { @@ -148,10 +130,6 @@ let }; in { - haxe_4_1 = generic { - version = "4.1.5"; - hash = "sha256-QP5/jwexQXai1A5Iiwiyrm+/vkdAc+9NVGt+jEQz2mY="; - }; haxe_4_3 = generic { version = "4.3.7"; hash = "sha256-sQb7MCoH2dZOvNmDQ9P0yFYrSXYOMn4FS/jlyjth39Y="; diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index f2254d378f12..9228adf94dc4 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -928,6 +928,7 @@ mapAliases { hacpack = throw "hacpack has been removed from nixpkgs, as it has been taken down upstream"; # Added 2025-09-26 harmony-music = throw "harmony-music is unmaintained and has been removed"; # Added 2025-08-26 haxe_4_0 = throw "'haxe_4_0' has been removed as it reached its end of life. Migrate to 'haxe_4_3'."; + haxe_4_1 = throw "'haxe_4_1' has been removed as it reached its end of life. Migrate to 'haxe_4_3'."; helix-gpt = throw "helix-gpt was deprecated in January 2026 and has been since removed"; # Added 2026-02-05 helvum = throw "'helvum' has been removed as it was unmaintained upstream and relied on a vulnerable dependency. Consider using 'crosspipe' instead."; # Added 2026-03-04 HentaiAtHome = throw "'HentaiAtHome' has been renamed to/replaced by 'hentai-at-home'"; # Converted to throw 2025-10-27 diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 85552cdaef1c..c2dc69324293 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -4145,7 +4145,6 @@ with pkgs; (callPackage ../development/compilers/haxe { }) haxe_4_3 - haxe_4_1 ; haxe = haxe_4_3; From b19da3c7a8092c3b616d85dd46dcaeccf8d3d187 Mon Sep 17 00:00:00 2001 From: Leona Maroni Date: Wed, 6 May 2026 21:45:30 +0200 Subject: [PATCH 6/6] mbedtls_2: drop EOL (support end 2024) and that's not a good state for a TLS library. --- pkgs/development/libraries/mbedtls/2.nix | 29 ------------------- .../development/libraries/mbedtls/generic.nix | 3 -- pkgs/top-level/aliases.nix | 1 + pkgs/top-level/all-packages.nix | 1 - 4 files changed, 1 insertion(+), 33 deletions(-) delete mode 100644 pkgs/development/libraries/mbedtls/2.nix diff --git a/pkgs/development/libraries/mbedtls/2.nix b/pkgs/development/libraries/mbedtls/2.nix deleted file mode 100644 index 773f2eb75d40..000000000000 --- a/pkgs/development/libraries/mbedtls/2.nix +++ /dev/null @@ -1,29 +0,0 @@ -{ callPackage, fetchpatch }: - -callPackage ./generic.nix { - version = "2.28.10"; - hash = "sha256-09XWds45TFH7GORrju8pVQQQQomU8MlFAq1jJXrLW0s="; - - patches = [ - # cmake 4 compatibility - (fetchpatch { - url = "https://github.com/Mbed-TLS/mbedtls/commit/be4af04fcffcfebe44fa12d39388817d9949a9f3.patch"; - hash = "sha256-CbDm6CchzoTia7Wbpbe3bo9CmHPOsxY2d055AfbCS0g="; - }) - # fix build against Clang >= 20 (https://github.com/Mbed-TLS/mbedtls-framework/pull/173) - (fetchpatch { - name = "Add-__attribute__-nonstring-to-remove-unterminated-s.patch"; - url = "https://github.com/Mbed-TLS/mbedtls-framework/commit/e811994babf84e29e56ebf97265f5fefdf18050f.patch"; - hash = "sha256-PGXh7tMnl7VqBOWVZP3UqT5pEd0yh4oszEJNMiVOcGo="; - }) - # fix build against Clang >= 20 (https://github.com/Mbed-TLS/mbedtls/pull/10215) - (fetchpatch { - name = "Add-__attribute__-nonstring-to-remove-unterminated-s.patch"; - url = "https://github.com/Mbed-TLS/mbedtls/commit/2e1399f1e1ed6fa1072cf9584f5771322b0d001b.patch"; - includes = [ "tests/*" ]; - # drop some context in order to apply the backported patch cleanly - decode = "interdiff -U1 /dev/null -"; - hash = "sha256-OTRnYw7Og6eAsB9pue1jkxO1xnkR48efz5QKjN9H0I8="; - }) - ]; -} diff --git a/pkgs/development/libraries/mbedtls/generic.nix b/pkgs/development/libraries/mbedtls/generic.nix index 2a7f436e9c67..cd7afc8abc90 100644 --- a/pkgs/development/libraries/mbedtls/generic.nix +++ b/pkgs/development/libraries/mbedtls/generic.nix @@ -89,8 +89,5 @@ stdenv.mkDerivation rec { ]; platforms = lib.platforms.all; maintainers = with lib.maintainers; [ raphaelr ]; - knownVulnerabilities = lib.optionals (lib.versionOlder version "3.0") [ - "Mbed TLS 2 is not maintained anymore. Please migrate to newer versions" - ]; }; } diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index 9228adf94dc4..e22da3c937ea 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -1367,6 +1367,7 @@ mapAliases { matrix-appservice-slack = throw "'matrix-appservice-slack' has been removed, as it relies on Classic Slack Apps, which no longer exist, and is abandoned upstream"; # Added 2025-11-11 matrix-synapse-tools.rust-synapse-compress-state = throw "'matrix-synapse-tools.rust-synapse-compress-state' has been renamed to/replaced by 'rust-synapse-compress-state'"; # Converted to throw 2025-10-27 matrix-synapse-tools.synadm = throw "'matrix-synapse-tools.synadm' has been renamed to/replaced by 'synadm'"; # Converted to throw 2025-10-27 + mbedtls_2 = throw "'mbedtls_2' has been removed as it reached its end of life. Migrate to 'mbedtls'."; mcomix3 = throw "'mcomix3' has been renamed to/replaced by 'mcomix'"; # Converted to throw 2025-10-27 mdbook-alerts = throw "'mdbook-alerts' has been removed because it is deprecated and natively supported by mdbook since version 0.5.0"; # Added 2026-01-07 mdbook-linkcheck = throw "'mdbook-linkcheck' has been removed and replaced by 'mdbook-linkcheck2' due to incompatibility with mdbook version 0.5.0+"; # Added 2026-03-03 diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index c2dc69324293..dfb2592bf56f 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -6792,7 +6792,6 @@ with pkgs; ) haskellPackages.matterhorn; - mbedtls_2 = callPackage ../development/libraries/mbedtls/2.nix { }; mbedtls = callPackage ../development/libraries/mbedtls/3.nix { }; simple-dftd3 = callPackage ../development/libraries/science/chemistry/simple-dftd3 { };