python3.pkgs.django-mdeditor: drop (#515503)

doc/release-notes/rl-2605.section.md

@@ -197,6 +197,8 @@
 
 - `python3Packages.pikepdf` no longer builds with mupdf support by default, which may be nice in Jupyter and iPython. Build with `withMupdf = true` if this is required.
 
+- `python3Packages.django-mdeditor` has been removed, as it was unmaintained upstream and the latest release was vulnerable to a [critical security vulnerability](https://github.com/NixOS/nixpkgs/issues/515462).
+
 - `vicinae` has been updated to v0.20. This includes, among several other breaking changes, a complete overhaul of the configuration system. For update instructions, see the [upstream configuration documentation](https://docs.vicinae.com/config#migration-from-v0-16-x-to-v0-17-x).
 
 - `percona-server_8_4` has been removed. Please update to `percona-server_8_0`, `mysql84` or `mariadb`.

pkgs/development/python-modules/django-mdeditor/Bump-KaTeX-and-replace-bootcdn-with-jsdelivr.patch

@@ -1,63 +0,0 @@
-From c5af641cccf663dffb4a47d32e28404f609badce Mon Sep 17 00:00:00 2001
-From: Tomo <tomodachi94@protonmail.com>
-Date: Sat, 12 Oct 2024 03:39:12 +0000
-Subject: [PATCH 1/2] chore(KaTeX): bump to 0.7.1
-
-Many bugfixes. This KaTeX is still quite old,
-but versions beyond this have backwards-incompatibilities
-(starting in 0.8).
----
- mdeditor/static/mdeditor/js/editormd.js | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/mdeditor/static/mdeditor/js/editormd.js b/mdeditor/static/mdeditor/js/editormd.js
-index be0005d..8aacb56 100644
---- a/mdeditor/static/mdeditor/js/editormd.js
-+++ b/mdeditor/static/mdeditor/js/editormd.js
-@@ -4179,8 +4179,8 @@
-     // 使用国外的CDN，加载速度有时会很慢，或者自定义URL
-     // You can custom KaTeX load url.
-     editormd.katexURL  = {
--        css : "//cdn.bootcdn.net/ajax/libs/KaTeX/0.3.0/katex.min",
--        js  : "//cdn.bootcdn.net/ajax/libs/KaTeX/0.3.0/katex.min"
-+        css : "//cdn.bootcdn.net/ajax/libs/KaTeX/0.7.1/katex.min",
-+        js  : "//cdn.bootcdn.net/ajax/libs/KaTeX/0.7.1/katex.min"
-     };
-     
-     editormd.kaTeXLoaded = false;
--- 
-2.46.2
-
-
-From 3d082a738262b057d33b9aa8c777d50113143952 Mon Sep 17 00:00:00 2001
-From: Tomo <tomodachi94@protonmail.com>
-Date: Mon, 7 Oct 2024 17:44:39 -0700
-Subject: [PATCH 2/2] fix(KaTeX): Use jsdelivr instead of bootcdn
-
-Bootcdn was compromised by a malicious actor:
-https://sansec.io/research/polyfill-supply-chain-attack
-
-KaTeX recommends using jsdelivr, so I used that:
-https://katex.org/docs/browser
----
- mdeditor/static/mdeditor/js/editormd.js | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/mdeditor/static/mdeditor/js/editormd.js b/mdeditor/static/mdeditor/js/editormd.js
-index 8aacb56..a31e817 100644
---- a/mdeditor/static/mdeditor/js/editormd.js
-+++ b/mdeditor/static/mdeditor/js/editormd.js
-@@ -4179,8 +4179,8 @@
-     // 使用国外的CDN，加载速度有时会很慢，或者自定义URL
-     // You can custom KaTeX load url.
-     editormd.katexURL  = {
--        css : "//cdn.bootcdn.net/ajax/libs/KaTeX/0.7.1/katex.min",
--        js  : "//cdn.bootcdn.net/ajax/libs/KaTeX/0.7.1/katex.min"
-+        css : "//cdn.jsdelivr.net/npm/katex@0.7.1/dist/katex.min.css",
-+        js  : "//cdn.jsdelivr.net/npm/katex@0.7.1/dist/katex.min.js"
-     };
-     
-     editormd.kaTeXLoaded = false;
--- 
-2.46.2
-

pkgs/development/python-modules/django-mdeditor/default.nix

@@ -1,43 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  django,
-}:
-let
-  version = "0.1.20";
-in
-buildPythonPackage {
-  pname = "django-mdeditor";
-  inherit version;
-  format = "setuptools";
-
-  src = fetchFromGitHub {
-    owner = "pylixm";
-    repo = "django-mdeditor";
-    rev = "v${version}";
-    hash = "sha256-t57j1HhjNQtBwlbqe4mAHQ9WiNcIhMKYmrZkiqh+k5k=";
-  };
-
-  patches = [
-    ./Bump-KaTeX-and-replace-bootcdn-with-jsdelivr.patch
-  ];
-
-  propagatedBuildInputs = [ django ];
-
-  # no tests
-  doCheck = false;
-  pythonImportsCheck = [ "mdeditor" ];
-
-  meta = {
-    description = "Markdown Editor plugin application for django based on Editor.md";
-    homepage = "https://github.com/pylixm/django-mdeditor";
-    changelog = "https://github.com/pylixm/django-mdeditor/releases";
-    license = lib.licenses.gpl3;
-    maintainers = with lib.maintainers; [ augustebaum ];
-    knownVulnerabilities = [
-      # https://nvd.nist.gov/vuln/detail/CVE-2025-13030
-      "CVE-2025-13030"
-    ];
-  };
-}

pkgs/top-level/python-aliases.nix

@@ -155,6 +155,7 @@ mapAliases {
   django-crispy-bootstrap4 = crispy-bootstrap4; # added 2025-06-11
   django-crispy-bootstrap5 = crispy-bootstrap5; # added 2025-06-11
   django-cryptography = throw "'django-cryptography' has been removed as it was unmaintained upstream"; # Added 2026-03-22
+  django-mdeditor = throw "'django-mdeditor' has been removed as it was unmaintained upstream and the latest release was vulnerable"; # Added 2026-05-02
   django-modelsearch = modelsearch; # added 2026-03-02
   django_3 = throw "Django 3 has reached it's EOL in 2024-04 and has therefore been removed."; # added 2025-01-25
   django_4 = throw "Django 4 has reached it's EOL in 2026-04 and has therefore been removed."; # added 2026-03-30

pkgs/top-level/python-packages.nix

@@ -4288,8 +4288,6 @@ self: super: with self; {
 
   django-mcp-server = callPackage ../development/python-modules/django-mcp-server { };
 
-  django-mdeditor = callPackage ../development/python-modules/django-mdeditor { };
-
   django-mfa3 = callPackage ../development/python-modules/django-mfa3 { };
 
   django-minify-html = callPackage ../development/python-modules/django-minify-html { };