Oracle's JDK for 1.6 and 1.7 is no longer receiving public security updates. We should probably drop them from nixpkgs.
Reference:
Hm, maybe better would be to add flag meta.upstreamMaintained = false to indicate, that nobody is interested in adding fixes to this version. It is still inconvenient to pin nixpkgs to get needed package.
Software that is known or likely to be vulnerable _should_ be inconvenient to use, imo.
Maybe similar to how we have goPackages and nodePackages, have an unmaintainedPackages, so that you have to qualify you want one of those? That would also cut down on the size of the list of packages in all-packages :)
Done with:
https://github.com/NixOS/nixpkgs/pull/19057 and https://github.com/NixOS/nixpkgs/pull/19056 and oracledk6's PR above.
Most helpful comment
Software that is known or likely to be vulnerable _should_ be inconvenient to use, imo.