From 5bd32a7071c66dd1fedb1f8233193785fd3d370d Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Mon, 30 Jun 2025 12:16:23 +0200
Subject: [PATCH] treewide: add knownVulnerabilities to old libxml2

Users should be informed if they're using packages that are
deliberately opting in to using old versions of dependencies with
vulnerabilities that have otherwise been fixed in Nixpkgs.
---
 .../networking/remote/citrix-workspace/generic.nix       | 9 +++++++--
 pkgs/by-name/ci/ciscoPacketTracer7/package.nix           | 9 +++++++--
 pkgs/by-name/ci/ciscoPacketTracer8/package.nix           | 9 +++++++--
 3 files changed, 21 insertions(+), 6 deletions(-)

diff --git a/pkgs/applications/networking/remote/citrix-workspace/generic.nix b/pkgs/applications/networking/remote/citrix-workspace/generic.nix
index f0210e97a8ab..bbfd19e15745 100644
--- a/pkgs/applications/networking/remote/citrix-workspace/generic.nix
+++ b/pkgs/applications/networking/remote/citrix-workspace/generic.nix
@@ -90,13 +90,18 @@ let
     '';
   };
 
-  libxml2' = libxml2.overrideAttrs rec {
+  libxml2' = libxml2.overrideAttrs (oldAttrs: rec {
     version = "2.13.8";
     src = fetchurl {
       url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor version}/libxml2-${version}.tar.xz";
       hash = "sha256-J3KUyzMRmrcbK8gfL0Rem8lDW4k60VuyzSsOhZoO6Eo=";
     };
-  };
+    meta = oldAttrs.meta // {
+      knownVulnerabilities = oldAttrs.meta.knownVulnerabilities or [ ] ++ [
+        "CVE-2025-6021"
+      ];
+    };
+  });
 
 in
 
diff --git a/pkgs/by-name/ci/ciscoPacketTracer7/package.nix b/pkgs/by-name/ci/ciscoPacketTracer7/package.nix
index 01a9e7d6ee09..bbdead8e26a8 100644
--- a/pkgs/by-name/ci/ciscoPacketTracer7/package.nix
+++ b/pkgs/by-name/ci/ciscoPacketTracer7/package.nix
@@ -50,13 +50,18 @@ let
     ];
   };
 
-  libxml2' = libxml2.overrideAttrs rec {
+  libxml2' = libxml2.overrideAttrs (oldAttrs: rec {
     version = "2.13.8";
     src = fetchurl {
       url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor version}/libxml2-${version}.tar.xz";
       hash = "sha256-J3KUyzMRmrcbK8gfL0Rem8lDW4k60VuyzSsOhZoO6Eo=";
     };
-  };
+    meta = oldAttrs.meta // {
+      knownVulnerabilities = oldAttrs.meta.knownVulnerabilities or [ ] ++ [
+        "CVE-2025-6021"
+      ];
+    };
+  });
 
   fhs = buildFHSEnv {
     pname = "packettracer7";
diff --git a/pkgs/by-name/ci/ciscoPacketTracer8/package.nix b/pkgs/by-name/ci/ciscoPacketTracer8/package.nix
index 10472dc0f356..6032f5407ed5 100644
--- a/pkgs/by-name/ci/ciscoPacketTracer8/package.nix
+++ b/pkgs/by-name/ci/ciscoPacketTracer8/package.nix
@@ -41,13 +41,18 @@ let
     "8.2.2" = "CiscoPacketTracer822_amd64_signed.deb";
   };
 
-  libxml2' = libxml2.overrideAttrs rec {
+  libxml2' = libxml2.overrideAttrs (oldAttrs: rec {
     version = "2.13.8";
     src = fetchurl {
       url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor version}/libxml2-${version}.tar.xz";
       hash = "sha256-J3KUyzMRmrcbK8gfL0Rem8lDW4k60VuyzSsOhZoO6Eo=";
     };
-  };
+    meta = oldAttrs.meta // {
+      knownVulnerabilities = oldAttrs.meta.knownVulnerabilities or [ ] ++ [
+        "CVE-2025-6021"
+      ];
+    };
+  });
 
   unwrapped = stdenvNoCC.mkDerivation {
     name = "ciscoPacketTracer8-unwrapped";