From f338f71d96bcb2f2bd48b78aac85a82fa4d3f586 Mon Sep 17 00:00:00 2001
From: lucasew <lucas59356@gmail.com>
Date: Mon, 29 Jun 2026 18:45:33 -0300
Subject: [PATCH] lepton: remove

Archived upstream with known vulnerabilities (CVE-2022-4104). Prefer
lepton-jpeg-util. gb-backup no longer depends on this package.

Assisted-by: Grok 4.3 (xAI)
---
 pkgs/by-name/le/lepton/package.nix | 38 ------------------------------
 pkgs/top-level/aliases.nix         |  1 +
 2 files changed, 1 insertion(+), 38 deletions(-)
 delete mode 100644 pkgs/by-name/le/lepton/package.nix

diff --git a/pkgs/by-name/le/lepton/package.nix b/pkgs/by-name/le/lepton/package.nix
deleted file mode 100644
index 336afe9a1b16..000000000000
--- a/pkgs/by-name/le/lepton/package.nix
+++ /dev/null
@@ -1,38 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  cmake,
-  git,
-  glibc,
-}:
-
-stdenv.mkDerivation {
-  version = "2019-08-20";
-  pname = "lepton-unstable";
-
-  src = fetchFromGitHub {
-    repo = "lepton";
-    owner = "dropbox";
-    rev = "3d1bc19da9f13a6e817938afd0f61a81110be4da";
-    sha256 = "0aqs6nvcbq8cbfv8699fa634bsz7csmk0169n069yvv17d1c07fd";
-  };
-
-  nativeBuildInputs = [
-    cmake
-    git
-  ];
-  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ glibc.static ];
-
-  meta = {
-    homepage = "https://github.com/dropbox/lepton";
-    description = "Tool to losslessly compress JPEGs";
-    license = lib.licenses.asl20;
-    platforms = [
-      "x86_64-linux"
-      "x86_64-darwin"
-    ];
-    maintainers = with lib.maintainers; [ artemist ];
-    knownVulnerabilities = [ "CVE-2022-4104" ];
-  };
-}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index ec0410759418..ba9694556446 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1164,6 +1164,7 @@ mapAliases {
   leaf = throw "'leaf' has been removed as it is unmaintained. Consider using 'fastfetch' instead"; # Added 2026-04-24
   ledger-agent = throw "ledger-agent has been removed because upstream dropped Ledger support"; # Added 2026-03-11
   ledger_agent = throw "ledger-agent has been removed because upstream dropped Ledger support"; # Added 2026-03-11
+  lepton = throw "'lepton' has been removed as it is archived upstream and has known vulnerabilities (CVE-2022-4104). Consider using 'lepton-jpeg-util' instead"; # Added 2026-06-29
   lesstif = throw "'lesstif' has been removed due to its being broken and unmaintained upstream. Consider using 'motif' instead."; # Added 2025-06-09
   lexical = throw "'lexical' has been removed because it was deprecated and archived upstream. Consider using 'beamPackages.expert' instead"; # Added 2026-02-24
   lfe = warnAlias "'lfe' is deprecated in favor of using the beamPackages sets. Use 'beam27Packages.lfe' instead." beam27Packages.lfe; # added 2026-06-15