dotnet-sdk_7: mark as insecure due to support ending

[corngood]

Description of changes

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 24.11 Release Notes (or backporting 23.11 and 24.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[corngood]

.NET 7 went EOL on 14th May1. It should probably be marked as deprecated.

Footnotes

1. https://endoflife.date/dotnet [↩](#user-content-fnref-1-ef5507b2026dd4aebea1e9c27aa47088)

@JamieMagee what do you think of this? It looks like a dozen or so packages would be impacted by this.

[corngood]

Result of nixpkgs-review pr 326218 run on x86_64-linux 1

22 packages removed:
aspnetcore-runtime (†7.0.20) beatsabermodmanager (†0.0.5) certdump-unstable (†2023-07-12) clion (†2024.1.4) dotnet-outdated (†4.6.4) dotnet-runtime (†7.0.20) dotnet-sdk (†7.0.120) dotnet-sdk (†7.0.317) dotnet-sdk (†7.0.410) famistudio (†4.2.1) fsautocomplete (†0.73.2) lumafly (†3.2.0.0) netcoredbg (†3.0.0-1018) OpenUtau (†0.1.327) pablodraw (†3.3.13-beta) Pinta (†2.1.1) pupdate (†3.10.3) retrospy (†6.4.8) rider (†2024.1.4) roslyn-ls (†4.10.0-2.24124.2) vintagestory (†1.19.8) wasabibackend (†2.0.2.1)

[JamieMagee]

@corngood I expect we will handle this the same as the .NET Core 3.1 deprecation:

1. Some packages will build fine with a newer SDK regardless of what is declared
2. Some will have updates upstream we'll need to package
3. Some will require patching either upstream or in nixpkgs

I think it took us about 6 months to fully resolve the .NET Core 3.1 list of dependent packages.

[corngood]

@JamieMagee do you think we should mark it insecure immediately, wait until the dependencies are removed, or do neither and just remove it like 3.1?

I was thinking I could make a tracking issue for the dependencies by replacing all uses with .net 8. That should show what's actually broken, and ping the relevant people. Do you think that's a good idea?

[JamieMagee]

It looks like we didn't mark 3.1 as insecure prior to removal. See #222422 for the eventual removal.

I created #326335 to track the individual packages for .NET 7.

[gepbird]

Superseded by #358533