alist: mark as insecure

(cherry picked from commit 5fa650c801)
2026-01-11 18:32:23 +08:00 · 2025-06-13 10:53:36 +08:00
parent 52402bd675
commit 01bc10725a
1 changed files with 4 additions and 0 deletions
--- a/pkgs/by-name/al/alist/package.nix
+++ b/pkgs/by-name/al/alist/package.nix
@@ -103,6 +103,10 @@ buildGoModule rec {
      # alist-web
      mit
    ];
+    knownVulnerabilities = [
+      "Alist was acquired by Bugotech, a company distrusted by the community"
+      "Uses a questionable API server alist.nn.ci for account creation for certain drivers"
+    ];
    maintainers = with lib.maintainers; [ moraxyc ];
    sourceProvenance = with lib.sourceTypes; [
      fromSource