Isn't webkitgtk 2.4 horribly insecure and unsupported? I was of the impression that we should be getting rid of it. @grahamc?

Well, yes, migration away from it should be the first thing to try. I think it's been discussed multiple times, e.g. in #18312 EDIT: I'd hope that after so many months there are more packages that can be switched to the newer webkitgtk API.

Right -- when it was removed as a dependency of eclipse (in 49ea0e2), I noticed because it significantly degraded the usability of its javadoc browsing. I tried updating to a newer version at that point, but it didn't work. So I'm just preserving the status quo here. :-/

@jerith666: Perhaps we can tell eclipse to use $BROWSER instead?

I've read https://www.eclipse.org/swt/faq.php, but still don't really understand if that's feasible or how eclipse finds and loads the webkitgtk library. I would say that "remove eclipse dependency on webkitgtk24" should really be opened as a separate issue, though -- while webkitgtk24 remains in nixpkgs, I think it ought to build. :)

Using this version for an internal doc browser like eclipse does should be OK but having (multiple) mail clients and browsers exposed to the internet using this version makes me quite uneasy.

I'll merge this to fix the build for now but what is the proper way to mark the externally facing applications that depend on this? Just broken = true; ?

No need to mark it broken, 2.4 is already marked as insecure, which causes transitive packages to fail unless the user approves the issue: https://github.com/NixOS/nixpkgs/blob/master/pkgs/development/libraries/webkitgtk/2.4.nix#L26