From b0f76f96c8a73c5e0ac52afccef2ba298aa4f4d3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= Date: Wed, 26 Nov 2025 18:32:18 -0800 Subject: [PATCH 1/3] python3Packages.aio-georss-client: mark broken --- pkgs/development/python-modules/aio-georss-client/default.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/development/python-modules/aio-georss-client/default.nix b/pkgs/development/python-modules/aio-georss-client/default.nix index 2dc971567df3..fe7665a2f9a3 100644 --- a/pkgs/development/python-modules/aio-georss-client/default.nix +++ b/pkgs/development/python-modules/aio-georss-client/default.nix @@ -51,6 +51,8 @@ buildPythonPackage rec { pythonImportsCheck = [ "aio_georss_client" ]; meta = with lib; { + # https://github.com/exxamalte/python-aio-georss-client/issues/63 + broken = lib.versionAtLeast xmltodict.version "1"; description = "Python library for accessing GeoRSS feeds"; homepage = "https://github.com/exxamalte/python-aio-georss-client"; changelog = "https://github.com/exxamalte/python-aio-georss-client/blob/v${version}/CHANGELOG.md"; From 4cedbdbf29310a01803b8809e72ac836ed5dc3c7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= Date: Wed, 26 Nov 2025 18:33:07 -0800 Subject: [PATCH 2/3] python3Packages.georss-client: mark broken --- pkgs/development/python-modules/georss-client/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/development/python-modules/georss-client/default.nix b/pkgs/development/python-modules/georss-client/default.nix index 8229681e723a..77660982bcaf 100644 --- a/pkgs/development/python-modules/georss-client/default.nix +++ b/pkgs/development/python-modules/georss-client/default.nix @@ -39,6 +39,7 @@ buildPythonPackage rec { pythonImportsCheck = [ "georss_client" ]; meta = with lib; { + broken = lib.versionAtLeast xmltodict.version "1"; description = "Python library for accessing GeoRSS feeds"; homepage = "https://github.com/exxamalte/python-georss-client"; changelog = "https://github.com/exxamalte/python-georss-client/releases/tag/${src.tag}"; From 170685da9c57a82282aa300d9992100552afd08d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= Date: Wed, 26 Nov 2025 18:36:57 -0800 Subject: [PATCH 3/3] home-assistant: remove xmltodict override This breks some components that depend (aio-)georss-client but xmltodict is vulnerable to CVE-2025-9375 before version 1.0.0. --- pkgs/servers/home-assistant/default.nix | 12 ------------ 1 file changed, 12 deletions(-) diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix index f11d03c0a70e..ebfc5e9c7d2a 100644 --- a/pkgs/servers/home-assistant/default.nix +++ b/pkgs/servers/home-assistant/default.nix @@ -263,18 +263,6 @@ let }; }; - # xmltodict>=1.0 not compatible with georss-client and aio-georss-client - # https://github.com/exxamalte/python-aio-georss-client/issues/63 - xmltodict = super.xmltodict.overridePythonAttrs rec { - version = "0.15.1"; - src = fetchFromGitHub { - owner = "martinblech"; - repo = "xmltodict"; - tag = "v${version}"; - hash = "sha256-j3shoXjAoAWFd+7k+0w6eoNygS2wkbhDkIq7QG+TmSM="; - }; - }; - # internal python packages only consumed by home-assistant itself hass-web-proxy-lib = self.callPackage ./python-modules/hass-web-proxy-lib { }; home-assistant-frontend = self.callPackage ./frontend.nix { };