From d5cc79557fbca3145c7a18cba6b1d44762cb0b9a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Tue, 30 Sep 2025 14:21:35 +0200
Subject: [PATCH 1/2] libwebsockets: hack-fix build with cmake 4

(cherry picked from commit 5c92060a39799da7a6edaae78ac7e982e5121188)
---
 pkgs/by-name/li/libwebsockets/package.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/li/libwebsockets/package.nix b/pkgs/by-name/li/libwebsockets/package.nix
index 928764569233..5e5b1d3dda89 100644
--- a/pkgs/by-name/li/libwebsockets/package.nix
+++ b/pkgs/by-name/li/libwebsockets/package.nix
@@ -21,6 +21,14 @@ stdenv.mkDerivation rec {
     hash = "sha256-KOAhIVn4G5u0A1TE75Xv7iYO3/i8foqWYecH0kJHdBM=";
   };
 
+  # Updating to 4.4.1 would bring some errors, and the patch doesn't apply cleanly
+  # https://github.com/warmcat/libwebsockets/commit/47efb8c1c2371fa309f85a32984e99b2cc1d614a
+  postPatch = ''
+    for f in $(find . -name CMakeLists.txt); do
+      sed '/^cmake_minimum_required/Is/VERSION [0-9]\.[0-9]/VERSION 3.5/' -i "$f"
+    done
+  '';
+
   outputs = [
     "out"
     "dev"

From e51631083c5104e2ba23f6f68c0faa71a5dcac2b Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas@gerbet.me>
Date: Tue, 28 Oct 2025 21:26:44 +0100
Subject: [PATCH 2/2] libwebsockets: apply patches for CVE-2025-11677 and
 CVE-2025-11678

https://libwebsockets.org/git/libwebsockets/commit?id=2f082ec31261f556969160143ba94875d783971a
https://libwebsockets.org/git/libwebsockets/commit?id=2bb9598562b37c942ba5b04bcde3f7fdf66a9d3a
(cherry picked from commit 8a8e9a8312c65a0bc28ec6b0c7fc19a0ce394a31)
---
 pkgs/by-name/li/libwebsockets/package.nix | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/pkgs/by-name/li/libwebsockets/package.nix b/pkgs/by-name/li/libwebsockets/package.nix
index 5e5b1d3dda89..3c6a144f0b40 100644
--- a/pkgs/by-name/li/libwebsockets/package.nix
+++ b/pkgs/by-name/li/libwebsockets/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   openssl,
   zlib,
@@ -21,6 +22,19 @@ stdenv.mkDerivation rec {
     hash = "sha256-KOAhIVn4G5u0A1TE75Xv7iYO3/i8foqWYecH0kJHdBM=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2025-11677.patch";
+      url = "https://libwebsockets.org/git/libwebsockets/patch?id=2f082ec31261f556969160143ba94875d783971a";
+      hash = "sha256-FeiZAbr1kpt+YNjhi2gfG2A6nXKiSssMFRmlALaneu4=";
+    })
+    (fetchpatch {
+      name = "CVE-2025-11678.patch";
+      url = "https://libwebsockets.org/git/libwebsockets/patch?id=2bb9598562b37c942ba5b04bcde3f7fdf66a9d3a";
+      hash = "sha256-1uQUkoMbK+3E/QYMIBLlBZypwHBIrWBtm+KIW07WRj8=";
+    })
+  ];
+
   # Updating to 4.4.1 would bring some errors, and the patch doesn't apply cleanly
   # https://github.com/warmcat/libwebsockets/commit/47efb8c1c2371fa309f85a32984e99b2cc1d614a
   postPatch = ''