diff --git a/doc/release-notes/rl-2605.section.md b/doc/release-notes/rl-2605.section.md
index 0554d2c3e90f..0029d6574530 100644
--- a/doc/release-notes/rl-2605.section.md
+++ b/doc/release-notes/rl-2605.section.md
@@ -87,6 +87,8 @@
 
 - `cargo-codspeed` has been updated from `3.0.5` to `4.2.0`. Version `4.0.0` includes breaking changes. For more information read the [changelog for 4.0.0](https://github.com/CodSpeedHQ/codspeed-rust/releases/tag/v4.0.0).
 
+- `commafeed` has been updated to version 7.0.0, which includes changes impacting its security. Please see [upstream's release notes](https://github.com/Athou/commafeed/releases/tag/7.0.0) for details.
+
 - `corepack_latest` has been removed, as Corepack is no longer distributed with Node.js.
 
 - `nodePackages.browser-sync` has been removed, as it was unmaintained within nixpkgs.
diff --git a/pkgs/by-name/co/commafeed/package.nix b/pkgs/by-name/co/commafeed/package.nix
index 3d8308e8a08d..a2744751b123 100644
--- a/pkgs/by-name/co/commafeed/package.nix
+++ b/pkgs/by-name/co/commafeed/package.nix
@@ -9,15 +9,16 @@
   unzip,
   nixosTests,
   writeText,
+  stdenv,
 }:
 let
-  version = "6.2.0";
+  version = "7.0.0";
 
   src = fetchFromGitHub {
     owner = "Athou";
     repo = "commafeed";
     tag = version;
-    hash = "sha256-M5p3nzlEIuIEMADZyQUqE6WAzlMmP/e4Zh9J8nbhZ9Q=";
+    hash = "sha256-hoRaegcpimIYfUv81txgXSSdwX8iCU4K5EtZMyozjFQ=";
   };
 
   frontend = buildNpmPackage {
@@ -27,7 +28,7 @@ let
 
     sourceRoot = "${src.name}/commafeed-client";
 
-    npmDepsHash = "sha256-XkUlsRdqIXwVExvSofZJLKMUSzjxJRRpV549UTP9Cjo=";
+    npmDepsHash = "sha256-z6W0xyOpGbTogqZ0UgVQMNPXjwLW0ulpwLBtXvf00bQ=";
 
     nativeBuildInputs = [ biome ];
 
@@ -53,7 +54,7 @@ maven.buildMavenPackage {
 
   pname = "commafeed";
 
-  mvnHash = "sha256-vZ7BPA2N3jgRnTwF3k9En2Pn+zTrXbtB9FGbmU4wJgY=";
+  mvnHash = "sha256-YY/etqDtnobarg8Cj4vDv7rmzPrOqz6YCyAxjIQlzeU=";
   mvnJdk = jdk25;
 
   mvnParameters = lib.escapeShellArgs [
@@ -100,5 +101,6 @@ maven.buildMavenPackage {
     license = lib.licenses.asl20;
     mainProgram = "commafeed";
     maintainers = [ ];
+    broken = stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isAarch64;
   };
 }