diff --git a/pkgs/development/python-modules/geocoder/default.nix b/pkgs/development/python-modules/geocoder/default.nix index c15fe2d183a3..bb2de7f3e2de 100644 --- a/pkgs/development/python-modules/geocoder/default.nix +++ b/pkgs/development/python-modules/geocoder/default.nix @@ -2,8 +2,8 @@ lib, buildPythonPackage, click, + fetchpatch2, fetchPypi, - future, ratelim, requests, setuptools, @@ -20,11 +20,19 @@ buildPythonPackage rec { hash = "sha256-yZJTdMlhV30K7kA7Ceb46hlx2RPwEfAMpwx2vq96d+c="; }; + patches = [ + # Remove future package to address CVE-2025-50817, https://github.com/DenisCarriere/geocoder/pull/488 + (fetchpatch2 { + name = "remove-future.patch"; + url = "https://github.com/DenisCarriere/geocoder/commit/b15f3bb227414e90020a560176eb06fd39660df5.patch"; + hash = "sha256-v1sFe8xMzJjaPkRVdzW8MK3eYgFORxl+iug/qHvc26U="; + }) + ]; + build-system = [ setuptools ]; dependencies = [ click - future ratelim requests six