From 7797b9d44f476cae450fb039385d89a151104942 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= Date: Wed, 29 Apr 2026 18:48:45 -0700 Subject: [PATCH 1/2] python2Packages.pip: mark insecure --- pkgs/development/python2-modules/pip/default.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkgs/development/python2-modules/pip/default.nix b/pkgs/development/python2-modules/pip/default.nix index e0b6b001cb3e..31383a035c0f 100644 --- a/pkgs/development/python2-modules/pip/default.nix +++ b/pkgs/development/python2-modules/pip/default.nix @@ -40,6 +40,9 @@ buildPythonPackage rec { description = "PyPA recommended tool for installing Python packages"; license = with lib.licenses; [ mit ]; homepage = "https://pip.pypa.io/"; + knownVulnerabilities = [ + "CVE-2021-28363" + ]; priority = 10; }; } From e4f7a5a4301480a4fc6b40eea71e9150bb9953cf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= Date: Sun, 3 May 2026 17:44:50 -0700 Subject: [PATCH 2/2] resholve: override pip's knownVulnerabilities --- pkgs/development/misc/resholve/default.nix | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/pkgs/development/misc/resholve/default.nix b/pkgs/development/misc/resholve/default.nix index 9f4f1bc85715..a8061d19fe0d 100644 --- a/pkgs/development/misc/resholve/default.nix +++ b/pkgs/development/misc/resholve/default.nix @@ -33,8 +33,9 @@ let stripIdlelib = true; stripTests = true; enableOptimizations = false; - packageOverrides = prev: final: { - setuptools = removeKnownVulnerabilities final.setuptools; + packageOverrides = final: prev: { + pip = removeKnownVulnerabilities prev.pip; + setuptools = removeKnownVulnerabilities prev.setuptools; }; }; callPackage = lib.callPackageWith (pkgsBuildHost // { python27 = python27'; });