python3Packages.geocoder: remove future

2026-05-05 08:56:46 +02:00
parent 6346ca6ec9
commit c2a7df4855
1 changed files with 10 additions and 2 deletions
@@ -2,8 +2,8 @@
  lib,
  buildPythonPackage,
  click,
+  fetchpatch2,
  fetchPypi,
-  future,
  ratelim,
  requests,
  setuptools,
@@ -20,11 +20,19 @@ buildPythonPackage rec {
    hash = "sha256-yZJTdMlhV30K7kA7Ceb46hlx2RPwEfAMpwx2vq96d+c=";
  };

+  patches = [
+    # Remove future package to address CVE-2025-50817, https://github.com/DenisCarriere/geocoder/pull/488
+    (fetchpatch2 {
+      name = "remove-future.patch";
+      url = "https://github.com/DenisCarriere/geocoder/commit/b15f3bb227414e90020a560176eb06fd39660df5.patch";
+      hash = "sha256-v1sFe8xMzJjaPkRVdzW8MK3eYgFORxl+iug/qHvc26U=";
+    })
+  ];
+
  build-system = [ setuptools ];

  dependencies = [
    click
-    future
    ratelim
    requests
    six