From f703a3a04a657b569c0881326ffaffad31ac0bca Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Fri, 10 Jan 2020 16:58:10 +0100
Subject: [PATCH] firefox-esr-60: mark as vulnerable

The last release was in September, so it's surely "vulnerable" now.
https://www.mozilla.org/en-US/firefox/60.9.0/releasenotes/

This is the same appproach we've taken for esr-52.
---
 pkgs/applications/networking/browsers/firefox/packages.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/applications/networking/browsers/firefox/packages.nix b/pkgs/applications/networking/browsers/firefox/packages.nix
index 0032e607ec82..7903a345e1fb 100644
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@@ -89,6 +89,7 @@ rec {
 
     meta = firefox.meta // {
       description = "A web browser built from Firefox Extended Support Release source tree";
+      knownVulnerabilities = [ "Support ended around October 2019." ];
     };
     updateScript = callPackage ./update.nix {
       attrPath = "firefox-esr-60-unwrapped";