Version 1.1.4-1 of python-geopandas is marked for autoremoval from testing on Sat 19 Sep 2026. It depends (transitively) on python-libcst, towncrier, affected by #1143428, #1144936. You should try to prevent the removal by fixing these RC bugs.
CVE-2025-69662:
SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.
1 issue left for the package maintainer to handle:
CVE-2025-69662:
(needs triaging)
SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/p/python-geopandas.png){kind=link}