gogs: mark as insecure

gogs is affected by the recent vulnerabilities reported by the forgejo
team. There is little/no real development activities in the gogs
repository and the upstream maintainers do not seem to have
acknowledged the security issues.

1 files changed, 7 insertions, 0 deletions

diff --git a/pkgs/applications/version-management/gogs/default.nix b/pkgs/applications/version-management/gogs/default.nix
index e0f20d1467f61..0f3c106a7e1fb 100644
--- a/pkgs/applications/version-management/gogs/default.nix
+++ b/pkgs/applications/version-management/gogs/default.nix
@@ -45,5 +45,12 @@ buildGoModule rec {
     license = licenses.mit;
     maintainers = [ maintainers.schneefux ];
     mainProgram = "gogs";
+    knownVulnerabilities = [ ''
+      Gogs has known unpatched vulnerabilities and upstream maintainers appears to be unresponsive.
+
+      More information can be found in forgejo's blogpost: https://forgejo.org/2023-11-release-v1-20-5-1/
+
+      You might want to consider migrating to Gitea or forgejo.
+    '' ];
   };
 }