From e795159dc2f85628ff3a61fbfb67f10076757de3 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Tue, 8 Apr 2025 23:09:00 +0200 Subject: [PATCH] discourse: mark vulnerable The 3.3.3, 3.3.4 and 3.4.2 releases shipped with security fixues. We will not backport newer Discourse versions to NixOS 24.11. If you are affected consider migrating to NixOS Unstable or 25.05 once available. --- pkgs/servers/web-apps/discourse/default.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/pkgs/servers/web-apps/discourse/default.nix b/pkgs/servers/web-apps/discourse/default.nix index 9b0e635d9ba8..d63236129d1c 100644 --- a/pkgs/servers/web-apps/discourse/default.nix +++ b/pkgs/servers/web-apps/discourse/default.nix @@ -444,6 +444,12 @@ let maintainers = with maintainers; [ talyz ]; license = licenses.gpl2Plus; description = "Discourse is an open source discussion platform"; + knownVulnerabilities = [ + "Various security issues were fixed in newer releases that cannot be backported to NixOS 24.11." + "https://meta.discourse.org/t/3-3-3-security-and-maintenance-release/343239" + "https://meta.discourse.org/t/3-3-4-security-and-maintenance-release/349301" + "https://meta.discourse.org/t/3-4-2-security-and-bug-fix-release/358152" + ]; }; passthru = {