From dffc539de18ff28e34232bced75ab271311e57a5 Mon Sep 17 00:00:00 2001 From: Alexander Foremny Date: Thu, 24 Sep 2026 10:53:00 +0200 Subject: [PATCH] radicle-node: mark insecure Following their disclosure, we should mark all seeding radicle packages as insecure. This can only be potentially lifted on the next major (breaking) release, as per the disclosure. (cherry picked from commit c082683d1cfebfdf86a3c3314e87c762239315bc) --- pkgs/by-name/ra/radicle-node/package.nix | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/pkgs/by-name/ra/radicle-node/package.nix b/pkgs/by-name/ra/radicle-node/package.nix index 156e1a1b5936..ea0e22803f3c 100644 --- a/pkgs/by-name/ra/radicle-node/package.nix +++ b/pkgs/by-name/ra/radicle-node/package.nix @@ -173,5 +173,9 @@ rustPlatform.buildRustPackage (finalAttrs: { platforms = lib.platforms.unix; teams = [ lib.teams.radicle ]; mainProgram = "rad"; + knownVulnerabilities = [ + # https://radicle.dev/2026/09/23/disclosure-of-vulnerability-in-network-protocol + "Private repositories are insecure: traffic between nodes is not encrypted and not authenticated." + ]; }; })