From ea3f21a911f4148c0de364d7824c77920c29bb62 Mon Sep 17 00:00:00 2001 From: Michael Daniels Date: Mon, 1 Dec 2025 18:19:16 -0500 Subject: [PATCH 1/2] termbook: mark vulnerable Unmaintained upstream; dependencies have security issues like: * CVE-2020-26297 * CVE-2022-24713 * CVE-2024-58266 * CVE-2020-26235 * and 6 others --- pkgs/by-name/te/termbook/package.nix | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/pkgs/by-name/te/termbook/package.nix b/pkgs/by-name/te/termbook/package.nix index f4ecd33b6bb6..6e28888f3e74 100644 --- a/pkgs/by-name/te/termbook/package.nix +++ b/pkgs/by-name/te/termbook/package.nix @@ -50,6 +50,14 @@ rustPlatform.buildRustPackage rec { meta = with lib; { description = "Runner for `mdbooks` to keep your documentation tested"; mainProgram = "termbook"; + knownVulnerabilities = [ + "Unmaintained upstream; dependencies have security issues like:" + "CVE-2020-26297" + "CVE-2022-24713" + "CVE-2024-58266" + "CVE-2020-26235" + "and 6 others" + ]; homepage = "https://github.com/Byron/termbook/"; changelog = "https://github.com/Byron/termbook/blob/${src.rev}/CHANGELOG.md"; license = licenses.asl20; From e3d8497388ebc23891f98bdb1e511c1569a100be Mon Sep 17 00:00:00 2001 From: Michael Daniels Date: Mon, 1 Dec 2025 18:19:16 -0500 Subject: [PATCH 2/2] termbook: drop Unmaintained upstream; dependencies have security issues like: * CVE-2020-26297 * CVE-2022-24713 * CVE-2024-58266 * CVE-2020-26235 * and 6 others --- pkgs/by-name/te/termbook/bump-tendril.patch | 28 --------- pkgs/by-name/te/termbook/package.nix | 66 --------------------- pkgs/top-level/aliases.nix | 1 + 3 files changed, 1 insertion(+), 94 deletions(-) delete mode 100644 pkgs/by-name/te/termbook/bump-tendril.patch delete mode 100644 pkgs/by-name/te/termbook/package.nix diff --git a/pkgs/by-name/te/termbook/bump-tendril.patch b/pkgs/by-name/te/termbook/bump-tendril.patch deleted file mode 100644 index 0263bcf69077..000000000000 --- a/pkgs/by-name/te/termbook/bump-tendril.patch +++ /dev/null @@ -1,28 +0,0 @@ -diff --git a/Cargo.lock b/Cargo.lock -index 73e86d7..68d37b7 100644 ---- a/Cargo.lock -+++ b/Cargo.lock -@@ -507,9 +509,9 @@ checksum = "3dcaa9ae7725d12cdb85b3ad99a434db70b468c09ded17e012d86b5c1010f7a7" - - [[package]] - name = "futf" --version = "0.1.4" -+version = "0.1.5" - source = "registry+https://github.com/rust-lang/crates.io-index" --checksum = "7c9c1ce3fa9336301af935ab852c437817d14cd33690446569392e65170aac3b" -+checksum = "df420e2e84819663797d1ec6544b13c5be84629e7bb00dc960d6917db2987843" - dependencies = [ - "mac", - "new_debug_unreachable", -@@ -1964,9 +1966,9 @@ dependencies = [ - - [[package]] - name = "tendril" --version = "0.4.1" -+version = "0.4.3" - source = "registry+https://github.com/rust-lang/crates.io-index" --checksum = "707feda9f2582d5d680d733e38755547a3e8fb471e7ba11452ecfd9ce93a5d3b" -+checksum = "d24a120c5fc464a3458240ee02c299ebcb9d67b5249c8848b09d639dca8d7bb0" - dependencies = [ - "futf", - "mac", diff --git a/pkgs/by-name/te/termbook/package.nix b/pkgs/by-name/te/termbook/package.nix deleted file mode 100644 index 6e28888f3e74..000000000000 --- a/pkgs/by-name/te/termbook/package.nix +++ /dev/null @@ -1,66 +0,0 @@ -{ - lib, - rustPlatform, - fetchFromGitHub, - installShellFiles, - pkg-config, - oniguruma, - stdenv, -}: - -rustPlatform.buildRustPackage rec { - pname = "termbook-cli"; - version = "1.4.6"; - - src = fetchFromGitHub { - owner = "Byron"; - repo = "termbook"; - rev = "v${version}"; - sha256 = "Bo3DI0cMXIfP7ZVr8MAW/Tmv+4mEJBIQyLvRfVBDG8c="; - }; - - cargoPatches = [ - # update dependencies to fix build failure caused by unaligned packed structs - # generated by running `cargo update tendril` - ./bump-tendril.patch - ]; - - cargoHash = "sha256-CVZpOaRXCSuU739Ef8ObLQBvry7C9iRWWnM+4ATufQA="; - - nativeBuildInputs = [ - installShellFiles - pkg-config - ]; - - buildInputs = [ - oniguruma - ]; - - env = { - RUSTONIG_SYSTEM_LIBONIG = true; - }; - - postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) '' - installShellCompletion --cmd termbook \ - --bash <($out/bin/termbook completions bash) \ - --fish <($out/bin/termbook completions fish) \ - --zsh <($out/bin/termbook completions zsh) - ''; - - meta = with lib; { - description = "Runner for `mdbooks` to keep your documentation tested"; - mainProgram = "termbook"; - knownVulnerabilities = [ - "Unmaintained upstream; dependencies have security issues like:" - "CVE-2020-26297" - "CVE-2022-24713" - "CVE-2024-58266" - "CVE-2020-26235" - "and 6 others" - ]; - homepage = "https://github.com/Byron/termbook/"; - changelog = "https://github.com/Byron/termbook/blob/${src.rev}/CHANGELOG.md"; - license = licenses.asl20; - maintainers = with maintainers; [ phaer ]; - }; -} diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index ccfac491f87b..825d9a97ce0d 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -1555,6 +1555,7 @@ mapAliases { temurin-jre-bin-23 = throw "Temurin 23 has been removed as it has reached its end of life"; # Added 2025-11-04 temurin-jre-bin-24 = throw "Temurin 24 has been removed as it has reached its end of life"; # Added 2025-10-04 tepl = throw "'tepl' has been renamed to/replaced by 'libgedit-tepl'"; # Converted to throw 2025-10-27 + termbook = throw "'termbook' has been removed because it is not maintained upstream and has insecure dependencies."; # Added 2025-12-01 terminus-nerdfont = throw "'terminus-nerdfont' has been renamed to/replaced by 'nerd-fonts.terminess-ttf'"; # Converted to throw 2025-10-27 testVersion = throw "'testVersion' has been renamed to/replaced by 'testers.testVersion'"; # Converted to throw 2025-10-27 tet = throw "'tet' has been removed for lack of maintenance"; # Added 2025-10-12