Change:
, (nixos-20.03, nixos-unstable) Scanned versions: nixos-20.03: ; nixos-unstable: . May contain false positives.
According to this comment , should not be affected. Nontheless, this is a very old version and there are only two packages depends on it: rzmq (apparently supports 4.x but is broken since 2016) jzmq (support 3.x and looks unmaintained) jzmq is only needed by apache stom but the dependecy as since been dropped: see can you update apache storm so we can get rid of jzmq?

Discussion:
<del> { stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, zeromq3, jdk }: stdenv.mkDerivation rec { pname = "jzmq"; version = "3.1.0"; src = fetchFromGitHub { owner = "zeromq"; repo = "jzmq"; rev = "v${version}"; sha256 = "1wlzs604mgmqmrgpk4pljx2nrlxzdfi3r8k59qlm90fx8qkqkc63"; }; nativeBuildInputs = [ autoreconfHook pkgconfig ]; buildInputs = [ zeromq3 jdk ]; preConfigure = '' ${if stdenv.hostPlatform.system == "x86_64-darwin" then '' sed -i -e 's~/Headers~/include~' -e 's~_JNI_INC_SUBDIRS=".*"~_JNI_INC_SUBDIRS="darwin"~' configure '' else ""} ''; meta = { homepage = "http://www.zeromq.org"; description = "Java bindings for ZeroMQ"; platforms = stdenv.lib.platforms.unix; license = stdenv.lib.licenses.lgpl3; maintainers = [ stdenv.lib.maintainers.vizanto ]; }; } </del>

<del> { stdenv, fetchurl, libuuid }: stdenv.mkDerivation rec { name = "zeromq-3.2.5"; src = fetchurl { url = "http://download.zeromq.org/${name}.tar.gz"; sha256 = "0911r7q4i1x9gnfinj39vx08fnz59mf05vl75zdkws36lib3wr89"; }; buildInputs = [ libuuid ]; doCheck = false; # fails all the tests (ctest) meta = with stdenv.lib; { branch = "3"; homepage = "http://www.zeromq.org"; description = "The Intelligent Transport Layer"; license = licenses.gpl3; platforms = platforms.all; }; } </del>

rtiff = [ pkgs.libtiff.dev ]; runjags = [ pkgs.jags ]; RVowpalWabbit = [ pkgs.zlib.dev pkgs.boost ]; <del> rzmq = [ pkgs.zeromq3 ]; </del> <ins> rzmq = [ pkgs.zeromq ]; </ins> SAVE = [ pkgs.zlib pkgs.bzip2 pkgs.icu pkgs.lzma pkgs.pcre ]; sdcTable = [ pkgs.gmp pkgs.glpk ]; seewave = [ pkgs.fftw.dev pkgs.libsndfile.dev ];

{ stdenv, lib, fetchurl, zip, unzip <del> , jzmq, jdk, python , confFile ? "", extraLibraryPaths ? [], extraJars ? [] }: </del> <ins> , jdk, python , confFile ? "" , extraLibraryPaths ? [] , extraJars ? [] }: </ins> stdenv.mkDerivation rec { <del> name = "apache-storm-" + version; version = "1.2.1"; </del> <ins> pname = "apache-storm"; version = "2.1.0"; name = "${pname}-${version}"; </ins> src = fetchurl { <del> url = "mirror://apache/storm/${name}/${name}.tar.gz"; sha256 = "177dqgbviagrpvalg8h67mwiwwgmiqsg0hh97hcqqcjg71ypnjkv"; </del> <ins> url = "mirror://apache/storm/${name}/${name}.tar.gz"; sha256 = "1i3z08rfy7aavshrbrskv9dmlhx1fjgrhhqm0pczfam4vnas8yg2"; </ins> }; <del> buildInputs = [ zip unzip jzmq ]; </del> <ins> buildInputs = [ zip unzip ]; </ins> installPhase = '' mkdir -p $out/share/${name} mv public $out/docs mv examples $out/share/${name}/. <del> rm -f lib/jzmq* || exit 1 </del> mv external extlib* lib $out/. mv conf bin $out/. mv log4j2 $out/conf/.

-e "s|STORM_CONF_DIR = .*|STORM_CONF_DIR = os.getenv('STORM_CONF_DIR','$out/conf')|"  -e 's|STORM_LOG4J2_CONF_DIR =.*|STORM_LOG4J2_CONF_DIR = os.path.join(STORM_CONF_DIR, "log4j2")|'  $out/bin/storm.py # Default jdk location sed -i -e 's|#.*export JAVA_HOME=.*|export JAVA_HOME="${jdk.home}"|'  $out/conf/storm-env.sh <del> unzip  $out/lib/storm-core-${version}.jar defaults.yaml; zip -d $out/lib/storm-core-${version}.jar defaults.yaml; </del> <ins> ls -lh $out/lib unzip  $out/lib/storm-client-${version}.jar defaults.yaml; zip -d $out/lib/storm-client-${version}.jar defaults.yaml; </ins> sed -i  <del> -e 's|java.library.path: .*|java.library.path: "${jzmq}/lib:${lib.concatStringsSep ":" extraLibraryPaths}"|'  </del> <ins> -e 's|java.library.path: .*|java.library.path: "${lib.concatStringsSep ":" extraLibraryPaths}"|'  </ins> -e 's|storm.log4j2.conf.dir: .*|storm.log4j2.conf.dir: "conf/log4j2"|'  defaults.yaml ${if confFile != "" then ''cat ${confFile} >> defaults.yaml'' else ""} mv defaults.yaml $out/conf; <del> # Link to jzmq jar and extra jars </del> <ins> # Link to extra jars </ins> cd $out/lib; <del> ln -s ${jzmq}/share/java/*.jar; </del> ${lib.concatMapStrings (jar: "ln -s ${jar};n") extraJars} '';

# added 2019-09-06 zeroc_ice = pkgs.zeroc-ice; <ins> # added 2020-06-22 zeromq3 = throw "zeromq3 has been deprecated by zeromq4."; jzmq = throw "jzmq has been removed from nixpkgs, as it was unmaintained"; </ins> } // (with ocaml-ng; { # added 2016-09-14 ocaml_4_00_1 = ocamlPackages_4_00_1.ocaml; ocaml_4_01_0 = ocamlPackages_4_01_0.ocaml;

zlog = callPackage ../development/libraries/zlog { }; <del> zeromq3 = callPackage ../development/libraries/zeromq/3.x.nix {}; </del> zeromq4 = callPackage ../development/libraries/zeromq/4.x.nix {}; zeromq = zeromq4;

junixsocket = callPackage ../development/libraries/java/junixsocket { }; <del> jzmq = callPackage ../development/libraries/java/jzmq { }; </del> lombok = callPackage ../development/libraries/java/lombok { }; lucene = callPackage ../development/libraries/java/lucene { };