Change:
confPkg = pkgs.runCommand "fontconfig-conf" { preferLocalBuild = true; } '' <del> support_folder=$out/etc/fonts/conf.d latest_folder=$out/etc/fonts/${latestVersion}/conf.d mkdir -p $support_folder mkdir -p $latest_folder </del> <ins> dst=$out/etc/fonts/${pkg.configVersion}/conf.d mkdir -p $dst </ins> # fonts.conf <del> ln -s ${supportFontsConf} $support_folder/../fonts.conf ln -s ${latestPkg.out}/etc/fonts/fonts.conf  $latest_folder/../fonts.conf </del> <ins> ln -s ${pkg.out}/etc/fonts/fonts.conf  $dst/../fonts.conf </ins> # fontconfig default config files <del> ln -s ${supportPkg.out}/etc/fonts/conf.d/*.conf  $support_folder/ # Latest fontconfig is configured to look for the upstream defaults inside the package. </del> <ins> ln -s ${pkg.out}/etc/fonts/conf.d/*.conf  $dst/ # update 51-local.conf path to look at local.conf rm  $dst/51-local.conf substitute ${pkg.out}/etc/fonts/conf.d/51-local.conf  $dst/51-local.conf  --replace local.conf /etc/fonts/${pkg.configVersion}/local.conf </ins> # 00-nixos-cache.conf <del> ln -s ${cacheConfSupport}  $support_folder/00-nixos-cache.conf ln -s ${cacheConfLatest}  $latest_folder/00-nixos-cache.conf </del> <ins> ln -s ${cacheConf}  $dst/00-nixos-cache.conf </ins> # 10-nixos-rendering.conf <del> ln -s ${renderConf}       $support_folder/10-nixos-rendering.conf ln -s ${renderConf}       $latest_folder/10-nixos-rendering.conf </del> <ins> ln -s ${renderConf}       $dst/10-nixos-rendering.conf </ins> # 50-user.conf ${optionalString (!cfg.includeUserConf) '' <del> rm $support_folder/50-user.conf ''} # Since latest fontconfig looks for default files inside the package, # we had to move this one elsewhere to be able to exclude it here. ${optionalString cfg.includeUserConf '' ln -s ${latestPkg.out}/etc/fonts/conf.d.bak/50-user.conf $latest_folder/50-user.conf </del> <ins> rm $dst/50-user.conf </ins> ''} # local.conf (indirect priority 51) ${optionalString (cfg.localConf != "") '' <del> ln -s ${localConf}        $support_folder/../local.conf ln -s ${localConf}        $latest_folder/../local.conf </del> <ins> ln -s ${localConf}        $dst/../local.conf </ins> ''} # 52-nixos-default-fonts.conf <del> ln -s ${defaultFontsConf} $support_folder/52-nixos-default-fonts.conf ln -s ${defaultFontsConf} $latest_folder/52-nixos-default-fonts.conf </del> <ins> ln -s ${defaultFontsConf} $dst/52-nixos-default-fonts.conf </ins> # 53-no-bitmaps.conf <del> ln -s ${rejectBitmaps} $support_folder/53-no-bitmaps.conf ln -s ${rejectBitmaps} $latest_folder/53-no-bitmaps.conf </del> <ins> ln -s ${rejectBitmaps} $dst/53-no-bitmaps.conf </ins> ${optionalString (!cfg.allowType1) '' # 53-nixos-reject-type1.conf <del> ln -s ${rejectType1} $support_folder/53-nixos-reject-type1.conf ln -s ${rejectType1} $latest_folder/53-nixos-reject-type1.conf </del> <ins> ln -s ${rejectType1} $dst/53-nixos-reject-type1.conf </ins> ''} '';

Discussion:
, CVSSv3=7.8 (nixos-20.03) Scanned versions: nixos-20.03: . May contain false positives.
See also:
PR for unstable: PR for 20.03:
This is still an issue.
oops, sorry
We only use config files. We could probably just delete everything but from the derivation, or remove it from top-level.
Yeah, but we still ship the fontconfig binary in nixpkgs. Is there any reason we still need to provide config files parse-able by 2.10.x fontconfig implementations?
I doubt there is much of a reason these days, nobody will be running programs compiled against fontconfig 2.10. I just do not want to remove it now so that possible breakage caused by is not mixed with potential downfall from removing the unversioned path.
is a new attempt to address this.