From 20ad7c9004673d537f38bd70be3de9fdde653c93 Mon Sep 17 00:00:00 2001
From: Tom Hunze <dev@thunze.de>
Date: Tue, 24 Feb 2026 22:25:44 +0100
Subject: [PATCH] helvum: drop

This package was marked as unmaintained upstream [1] and depends on
the vulnerable shlex 1.2.0 [2].

[1] https://gitlab.freedesktop.org/pipewire/helvum
[2] https://www.cve.org/CVERecord?id=CVE-2024-58266
---
 pkgs/by-name/he/helvum/package.nix | 63 ------------------------------
 pkgs/top-level/aliases.nix         |  1 +
 2 files changed, 1 insertion(+), 63 deletions(-)
 delete mode 100644 pkgs/by-name/he/helvum/package.nix

diff --git a/pkgs/by-name/he/helvum/package.nix b/pkgs/by-name/he/helvum/package.nix
deleted file mode 100644
index 0815bab941e1f..0000000000000
--- a/pkgs/by-name/he/helvum/package.nix
+++ /dev/null
@@ -1,63 +0,0 @@
-{
-  lib,
-  cargo,
-  desktop-file-utils,
-  fetchFromGitLab,
-  glib,
-  gtk4,
-  libadwaita,
-  meson,
-  ninja,
-  pipewire,
-  pkg-config,
-  rustPlatform,
-  rustc,
-  stdenv,
-  wrapGAppsHook4,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "helvum";
-  version = "0.5.1";
-
-  src = fetchFromGitLab {
-    domain = "gitlab.freedesktop.org";
-    owner = "pipewire";
-    repo = "helvum";
-    rev = version;
-    hash = "sha256-9vlzLPpyZ9qtCEbCDvYhWDcV+8T63ukdos1l2U6fD+E=";
-  };
-
-  cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit pname version src;
-    hash = "sha256-rwhhbEaUg7IiszmJUFh4vQV7cYyyh3tqr1z4QgmwIDY=";
-  };
-
-  nativeBuildInputs = [
-    meson
-    ninja
-    pkg-config
-    rustPlatform.cargoSetupHook
-    cargo
-    rustc
-    rustPlatform.bindgenHook
-    wrapGAppsHook4
-  ];
-
-  buildInputs = [
-    desktop-file-utils
-    glib
-    gtk4
-    libadwaita
-    pipewire
-  ];
-
-  meta = {
-    description = "GTK patchbay for pipewire";
-    homepage = "https://gitlab.freedesktop.org/pipewire/helvum";
-    license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [ fufexan ];
-    platforms = lib.platforms.linux;
-    mainProgram = "helvum";
-  };
-}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 54bd0b2218578..5743b73a8acb8 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -885,6 +885,7 @@ mapAliases {
   hacpack = throw "hacpack has been removed from nixpkgs, as it has been taken down upstream"; # Added 2025-09-26
   harmony-music = throw "harmony-music is unmaintained and has been removed"; # Added 2025-08-26
   helix-gpt = throw "helix-gpt was deprecated in January 2026 and has been since removed"; # Added 2026-02-05
+  helvum = throw "'helvum' has been removed as it was unmaintained upstream and relied on a vulnerable dependency. Consider using 'crosspipe' instead."; # Added 2026-03-04
   HentaiAtHome = throw "'HentaiAtHome' has been renamed to/replaced by 'hentai-at-home'"; # Converted to throw 2025-10-27
   hiawatha = throw "hiawatha has been removed, since it is no longer actively supported upstream, nor well maintained in nixpkgs"; # Added 2025-09-10
   hibernate = throw "hibernate has been removed due to lack of maintenance"; # Added 2025-09-10