From aa629d9877cdeac2638223c8e75936657a590647 Mon Sep 17 00:00:00 2001 From: Thomas Gerbet Date: Sat, 2 Dec 2023 00:55:04 +0100 Subject: [PATCH] gogs: mark as insecure gogs is affected by the recent vulnerabilities reported by the forgejo team. There is little/no real development activities in the gogs repository and the upstream maintainers do not seem to have acknowledged the security issues. --- pkgs/applications/version-management/gogs/default.nix | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/pkgs/applications/version-management/gogs/default.nix b/pkgs/applications/version-management/gogs/default.nix index e0f20d1467f6..0f3c106a7e1f 100644 --- a/pkgs/applications/version-management/gogs/default.nix +++ b/pkgs/applications/version-management/gogs/default.nix @@ -45,5 +45,12 @@ buildGoModule rec { license = licenses.mit; maintainers = [ maintainers.schneefux ]; mainProgram = "gogs"; + knownVulnerabilities = [ '' + Gogs has known unpatched vulnerabilities and upstream maintainers appears to be unresponsive. + + More information can be found in forgejo's blogpost: https://forgejo.org/2023-11-release-v1-20-5-1/ + + You might want to consider migrating to Gitea or forgejo. + '' ]; }; }