Code change:
The version of pillow rmfuse uses is vulnerable to CVE-2022-.
Since rmfuse is packaged using poetry2nix you are basically the only one willing to update it or its dependencies. That's problematic given that you don't do so even two weeks after being notified of a vulnerability.
I don't think interacting in this way is very constructive. There are different points of view regarding packaging Python packages, that's it. That an issue like this does not get picked up is not strange, people are typically busy. If you like to I suppose you could add the CVE to the expression. Whether the CVE can be considered a security issue in case of rmfuse should be considered as well.
Why not? I'm just articulating a problem with the way rmfuse is packaged right now that is obviously an actual problem. It's not technical though, just organizational.

Related discussion:
text: <del> { poetry2nix, pkgs, lib }: </del> <ins> { lib , python3 , fetchFromGitHub }: </ins> <del> let pythonPackages = (poetry2nix.mkPoetryPackages { projectDir = ./.; overrides = [ poetry2nix.defaultPoetryOverrides (import ./poetry-git-overlay.nix { inherit pkgs; }) (self: super: { </del> <ins> python3.pkgs.buildPythonApplication rec { pname = "rmfuse"; version = "unstable-2021-06-06"; </ins> <del> rmfuse = super.rmfuse.overridePythonAttrs(old: { meta = old.meta // { description = "RMfuse provides access to your reMarkable Cloud files in the form of a FUSE filesystem."; longDescription = '' RMfuse provides access to your reMarkable Cloud files in the form of a FUSE filesystem. These files are exposed either in their original format, or as PDF files that contain your annotations. This lets you manage files in the reMarkable Cloud using the same tools you use on your local system. ''; license = lib.licenses.mit; homepage = "https://github.com/rschroll/rmfuse"; maintainers = [ lib.maintainers.adisbladis ]; }; }); </del> <ins> format = "pyproject"; </ins> <del> reportlab = let ft = pkgs.freetype.overrideAttrs (oldArgs: { dontDisableStatic = true; }); in super.reportlab.overridePythonAttrs(old: { postPatch = '' substituteInPlace setup.py  --replace "mif = findFile(d,'ft2build.h')" "mif = findFile('${lib.getDev ft}','ft2build.h')" ''; </del> <ins> src = fetchFromGitHub { owner = "rschroll"; repo = "rmfuse"; rev = "3796b8610c8a965a60a417fc0bf8ea5200b71fd2"; hash = "sha256-W3kS6Kkmp8iWMOYFL7r1GyjSQvFotBXQCuTMK0vyHQ8="; }; </ins> <del> NIX_CFLAGS_COMPILE = "-I${pkgs.freetype}/include/freetype2"; </del> <ins> postPatch = '' substituteInPlace pyproject.toml  --replace 'bidict = "^' 'bidict = ">=' ''; </ins> <del> nativeBuildInputs = old.nativeBuildInputs ++ [ pkgs.pkg-config ]; buildInputs = old.buildInputs ++ [ pkgs.freetype ]; }); </del> <ins> nativeBuildInputs = with python3.pkgs; [ poetry-core ]; </ins> <del> }) ]; }).python.pkgs; in pythonPackages.rmfuse </del> <ins> propagatedBuildInputs = with python3.pkgs; [ bidict rmrl rmcl pyfuse3 xdg ]; meta = { description = "FUSE access to the reMarkable Cloud"; homepage = "https://github.com/rschroll/rmfuse"; license = lib.licenses.mit; longDescription = '' RMfuse provides access to your reMarkable Cloud files in the form of a FUSE filesystem. These files are exposed either in their original format, or as PDF files that contain your annotations. This lets you manage files in the reMarkable Cloud using the same tools you use on your local system. ''; maintainers = with lib.maintainers; [ adisbladis ]; }; } </ins>