From 2e405c907a5aa63864b6da7e159aaacfbb4ff04c Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Wed, 3 Jun 2026 17:11:02 -0400
Subject: [PATCH] wasm3: drop

wasm3 has been in a minimal maintenance mode for several years, and has
seen no commits since mid 2024. Given that it has several known
vulnerabilities (which have been marked in Nixpkgs since 2022), doesn't
seem very maintained, and is not used anywhere else in Nixpkgs, there
does not seem to be reason to keep it around.
---
 pkgs/by-name/wa/wasm3/package.nix | 51 -------------------------------
 pkgs/top-level/aliases.nix        |  1 +
 2 files changed, 1 insertion(+), 51 deletions(-)
 delete mode 100644 pkgs/by-name/wa/wasm3/package.nix

diff --git a/pkgs/by-name/wa/wasm3/package.nix b/pkgs/by-name/wa/wasm3/package.nix
deleted file mode 100644
index 7342011a21aa..000000000000
--- a/pkgs/by-name/wa/wasm3/package.nix
+++ /dev/null
@@ -1,51 +0,0 @@
-{
-  lib,
-  stdenv,
-  cmake,
-  fetchFromGitHub,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "wasm3";
-  version = "0.5.0";
-
-  src = fetchFromGitHub {
-    owner = "wasm3";
-    repo = "wasm3";
-    rev = "v${version}";
-    sha256 = "07zzmk776j8ydyxhrnnjiscbhhmz182a62r6aix6kfk5kq2cwia2";
-  };
-
-  nativeBuildInputs = [ cmake ];
-
-  cmakeFlags = [
-    "-DBUILD_WASI=simple"
-  ];
-
-  installPhase = ''
-    runHook preInstall
-    install -Dm755 wasm3 -t $out/bin
-    runHook postInstall
-  '';
-
-  meta = {
-    homepage = "https://github.com/wasm3/wasm3";
-    description = "Fastest WebAssembly interpreter, and the most universal runtime";
-    platforms = lib.platforms.all;
-    maintainers = with lib.maintainers; [ malbarbo ];
-    license = lib.licenses.mit;
-    knownVulnerabilities = [
-      # wasm3 expects all wasm code to be pre-validated, any users
-      # should be aware that running unvalidated wasm will potentially
-      # lead to RCE until upstream have added a builtin validator
-      "CVE-2022-39974"
-      "CVE-2022-34529"
-      "CVE-2022-28990"
-      "CVE-2022-28966"
-      "CVE-2021-45947"
-      "CVE-2021-45946"
-      "CVE-2021-45929"
-      "CVE-2021-38592"
-    ];
-  };
-}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index cc7501f1f5bb..7c8a63fa094a 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -2250,6 +2250,7 @@ mapAliases {
   warsow = throw "'warsow' has been removed as it is unmaintained and is broken"; # Added 2025-10-09
   warsow-engine = throw "'warsow-engine' has been removed as it is unmaintained and is broken"; # Added 2025-10-09
   wasistlos = throw "'wasistlos' has been removed because it was unmaintained and archived upstream. Consider using 'karere' instead"; # Added 2026-04-13
+  wasm3 = throw "'wasm3' has been removed as it is unmaintained upstream and has many known vulnerabilities"; # Added 2026-06-03
   wasm-bindgen-cli = wasm-bindgen-cli_0_2_121;
   wasm-strip = throw "'wasm-strip' has been removed due to upstream deprecation. Use 'wabt' instead."; # Added 2025-11-06
   wavebox = throw "'wavebox' has been removed due to lack of maintenance in nixpkgs"; # Added 2025-06-24