From d1bdaa9a99b32fb2e6884be00508ef989eacdf5c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 4 Jun 2022 16:44:42 +0000
Subject: [PATCH] poetry: mark insecure

The version of cleo in poetry.lock (1.0.0a5) is vulnerable to
CVE-2022-42966.
---
 .../tools/poetry2nix/poetry2nix/pkgs/poetry/default.nix        | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/default.nix b/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/default.nix
index d175bfe01f30..da0e6e1683f3 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/default.nix
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/pkgs/poetry/default.nix
@@ -52,5 +52,8 @@ poetry2nix.mkPoetryApplication {
   meta = with lib; {
     inherit (python.meta) platforms;
     maintainers = with maintainers; [ adisbladis jakewaksbaum ];
+    knownVulnerabilities = [
+      "CVE-2022-42966"  # cleo version in poetry.lock is vulnerable
+    ];
   };
 }