Change:
stdenv.mkDerivation rec { name = "nmap${optionalString graphicalSupport "-graphical"}-${version}"; <del> version = "7.90"; </del> <ins> version = "7.80"; </ins> src = fetchurl { url = "https://nmap.org/dist/nmap-${version}.tar.bz2"; <del> sha256 = "1s20i84m9bci70lrl0p2j7h3kpbi9snmvyhc3lzc9s3mh92w6msm"; </del> <ins> sha256 = "1aizfys6l9f9grm82bk878w56mg0zpkfns3spzj157h98875mypw"; </ins> }; patches = [ ./zenmap.patch ]

Discussion:
Seems like nmap changed the licence with the 7.90 release from GPL-2 to NPSL (Nmap public source licence). NPSL is "based" on GPL but adds some nasty things such as: Which conflicts with the freedom 0: Discussions about this: Debian: Gentoo: Upstream: The actual license file: They also seem to bundle a GPL library, and their license doesn't seem to be GPL compatible. So we should probably add this new license at least. NPSL looks non-free to me. Non-free is a good default until FSF or anyone has looked at it. We can always follow suit with what Debian does as well.
Another option would be to revert to 7.80 for now. The new license seems to be a legal minefield even if you're ok with closed source.
Yeah while looking at the issue in the train I thought of the same as well, will do that now.
I just read the release annoncement for 7.90: Just to see if the license change was mentioned there. Which it is: Do I read this right they weren't really GPLv2 to begin with and just clarified that? That's like a major thing...
First of all I just realized that I merged the original PR, so I really have to apologize for missing that license thing back then! cc in case you currently have time and energy for that, would you mind taking a look at the issue? I'm pretty sure that you have way more knowledge and insights about that kind of licensing issue than we have :). Is there any kind of statement from OSI or FSF yet? Also, I'm wondering if other distros that are even more focused on free software than we are (such as Guix) have e.g. started a new fork that we may want to use as well.
More details from the changelog: I must say that I'm not sure if it's worth to roll the package back since it actually haven't seemed to change really. It just was weird to begin with and just now got a name on the weirdness.
It's not just a new name, apparently they also new requirements in 7.90:
I don't think we should revert it either. Add the new license and mark it unfree until this is clarified.
Oof.... that's actually another reason for reverting.

I'm in favor of marking as nonfree until the FSF or some other authoritative organisation decides otherwise.
Either revert, or mark as non-free. Or, revert and add the new, non-free, version next to it.
The nmap update has already been reverted. Let's wait what upstream and the legal teams of debian/fedora say. See also the upstream issue
Fedora's stance
That's the old license (until version 7.80). This issue is about the new license (in version 7.90).
Fedora the new licence to the bad list and marked it as "not acceptable for use in Fedora" due to being incompatible to the open source definition
So, now there's an update here that we may want to act on: To quote the post: This means that 7.91 is now available under the same license as 7.80 is. The license that 7.80 uses is still a "bad license" because it's still a custom license. But it's a license that we and other distributions have considered good because it was assumed to be GPLv2. So I'm thinking that we could upgrade to 7.91 by now, because it's still not good, but it's not worse than before except we are aware of it now. Then we just hope that they do some good re-licensing in a future release.
Merged which removed nmap-unfree. This issue is done for now. Thanks everyone.