Unverified Commit b21c3ab5 authored by Michael Daniels's avatar Michael Daniels
Browse files

serverless: drop 

Version 3.x of Serverless is no longer maintained by Serverless, and
has various security vulnerabilities.

Version 4.x is maintained upstream, but it is now closed-source.
We cannot simply switch the license to "unfree" because, although there
is a way to download the current release binary from Serverless,
it is no longer suitable for packaging in Nixpkgs.

Specifically:
* The only way to download a binary is unversioned, so builds of old
  versions would either fail, happen to work if it is cached, or would
  silently build the new version.
* Automatic updates are enabled, and the updates go to your home
  directory (and the updated binary either does nothing or silently
  replaces the packaged version in your PATH).

These could be worked around if it were possible to build from source,
but it isn't: see serverless/serverless#12761.

In light of all of this, I think this package should be removed.
parent ae6aee06

pkgs/by-name/se/serverless/package-lock.json

deleted100644 → 0
+0 −15639

File deleted.

Preview size limit exceeded, changes collapsed.

pkgs/by-name/se/serverless/package.nix

deleted100644 → 0
+0 −34
Original line number Diff line number Diff line 
{

  lib,

  buildNpmPackage,

  fetchFromGitHub,

}:



buildNpmPackage rec {

  pname = "serverless";

  version = "3.38.0";



  src = fetchFromGitHub {

    owner = "serverless";

    repo = "serverless";

    rev = "v${version}";

    hash = "sha256-DplJRJOdIpZfIvpyPo9VcaXCHVPWB8FwhOH4vISUh3Q=";

  };



  postPatch = ''

    cp ${./package-lock.json} ./package-lock.json

  '';



  npmDepsHash = "sha256-k5/oTINK/G+wtuANAEDTai2mDNPYvsocUokIswuYrRM=";



  dontNpmBuild = true;



  meta = {

    changelog = "https://github.com/serverless/serverless/blob/${src.rev}/CHANGELOG.md";

    description = "Build applications on AWS Lambda and other next-gen cloud services, that auto-scale and only charge you when they run";

    homepage = "https://serverless.com";

    license = lib.licenses.mit;

    mainProgram = "serverless";

    maintainers = [ ];

  };

}

pkgs/top-level/aliases.nix

+1 −0
Original line number Diff line number Diff line
@@ -1406,6 +1406,7 @@ mapAliases { 
  seahub = throw "'seahub' has been removed as it is unmaintained"; # Added 2025-08-21

  semiphemeral = throw "'semiphemeral' has been removed as it is archived upstream"; # Added 2025-11-06

  sequoia = throw "'sequoia' has been renamed to/replaced by 'sequoia-sq'"; # Converted to throw 2025-10-27

  serverless = throw "'serverless' has been removed because version 3.x is unmaintained upstream and vulnerable, and version 4.x lacks a suitable binary or source download."; # Added 2025-11-22

  session-desktop-appimage = throw "'session-desktop-appimage' has been renamed to/replaced by 'session-desktop'"; # Converted to throw 2025-10-27

  setserial = throw "'setserial' has been removed as it had been abandoned upstream"; # Added 2025-05-18

  sexp = throw "'sexp' has been renamed to/replaced by 'sexpp'"; # Converted to throw 2025-10-27