From f41d7f335578cbef1c1d76193cc9f47526e6507f Mon Sep 17 00:00:00 2001
From: Gerhard Schwanzer <geri@sdf.org>
Date: Mon, 17 Aug 2026 21:08:29 +0200
Subject: [PATCH] perlPackages.NetOAuth: 0.28 -> 0.33

Fixes CVE-2025-22376, CVE-2026-72887, CVE-2026-72888,
CVE-2026-72889 and CVE-2026-75589.

Version 0.33 requires callers that verify messages to configure
allowed_signature_methods.

Changelog: https://metacpan.org/dist/Net-OAuth/changes

The Nixpkgs 26.11 release-note entry is intentionally omitted because this
backport targets release-26.05.

(cherry picked from commit 4222e966acfffe88f0b650e6c7d50644568205cb)

Assisted-by: pi coding agent / Mika (OpenAI gpt-5.6-sol)
---
 pkgs/top-level/perl-packages.nix | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 818bc05a361b..80754256cb66 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -25991,19 +25991,18 @@ with self;
     };
   };
 
-  NetOAuth = buildPerlModule {
+  NetOAuth = buildPerlPackage {
     pname = "Net-OAuth";
-    version = "0.28";
+    version = "0.33";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/K/KG/KGRENNAN/Net-OAuth-0.28.tar.gz";
-      hash = "sha256-e/wxnaCsV44Ali81o1DPUREKOjEwFtH9wwciAooikEw=";
+      url = "mirror://cpan/authors/id/R/RR/RRWO/Net-OAuth-0.33.tar.gz";
+      hash = "sha256-BqKQwTvBycKs7jOnkImzLzBHlkkl1OqZLrbBzD2N9sE=";
     };
     buildInputs = [ TestWarn ];
     propagatedBuildInputs = [
       ClassAccessor
       ClassDataInheritable
-      DigestHMAC
-      DigestSHA1
+      CryptSysRandom
       LWP
     ];
     meta = {