diff --git a/python-xmltodict.spec b/python-xmltodict.spec
index fad46fa87b12bebf73ca17707cabfda3867dfdb1..d466cb1a6701db7d8b1121557efe9db707fc4e9f 100644
--- a/python-xmltodict.spec
+++ b/python-xmltodict.spec
@@ -1,12 +1,12 @@
 %bcond_with bootstrap
 
 Name:           python-xmltodict
-Version:        0.14.2
+Version:        1.0.0
 Release:        1
 Summary:        Python module that makes working with XML feel like you are working with JSON 
 License:        MIT
 URL:            https://github.com/martinblech/xmltodict
-Source0:        https://files.pythonhosted.org/packages/98/f7/d29b8cdc9d8d075673be0f800013c1161e2fd4234546a140855a1bcc9eb4/xmltodict-%{version}.tar.gz
+Source0:        %{pypi_source xmltodict}
 
 BuildArch:      noarch
 
@@ -24,7 +24,7 @@ BuildRequires:       python3-setuptools
 Python module that makes working with XML feel like you are working with JSON 
 
 %prep
-%autosetup -n xmltodict-%{version}
+%autosetup -n xmltodict-%{version} -p1
 
 %build
 %py3_build
@@ -42,6 +42,9 @@ Python module that makes working with XML feel like you are working with JSON
 
 
 %changelog
+* Wed Sep 17 2025 yaoxin <1024769339@qq.com> - 1.0.0-1
+- Update to 1.0.0 for fix CVE-2025-9375
+
 * Fri May 30 2025 liwenqiang <liwq@teligen.net> - 0.14.2-1
 - Upgrade package to version 0.14.2
 
diff --git a/python-xmltodict.yaml b/python-xmltodict.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..91a5deef1a7ea53f1600ba9eb66dfba8a36d26d0
--- /dev/null
+++ b/python-xmltodict.yaml
@@ -0,0 +1,4 @@
+version_control: github
+src_repo: martinblech/xmltodict
+tag_prefix: "^v"
+separator: "."
diff --git a/xmltodict-0.14.2.tar.gz b/xmltodict-0.14.2.tar.gz
deleted file mode 100644
index 1eb3ebb871f0093dd7e7985fc329074e9a115966..0000000000000000000000000000000000000000
Binary files a/xmltodict-0.14.2.tar.gz and /dev/null differ
diff --git a/xmltodict-1.0.0.tar.gz b/xmltodict-1.0.0.tar.gz
new file mode 100644
index 0000000000000000000000000000000000000000..e1f7bb863ce5a2cb59a3006ee070ea3f9ce034fa
Binary files /dev/null and b/xmltodict-1.0.0.tar.gz differ