From a9855787eea2f8cb87b225a07c35ccd36aee43fe Mon Sep 17 00:00:00 2001
From: Gerhard Schwanzer <geri@sdf.org>
Date: Sun, 19 Jul 2026 14:51:17 +0200
Subject: [PATCH] invidious: patch CVE-2026-58447

https://github.com/iv-org/invidious/commit/77ad41678b45c4f6815940123f1796fc51259f45

https://tracker.security.nixos.org/suggestions/by-id/10419/

Assisted-by: pi coding agent / Mika (OpenAI gpt-5.6-sol)
(cherry picked from commit 4c54c8b8794c7a32970827d34d61974464a03bcf)
---
 pkgs/by-name/in/invidious/package.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pkgs/by-name/in/invidious/package.nix b/pkgs/by-name/in/invidious/package.nix
index 589f0e55d209..57d6250fee35 100644
--- a/pkgs/by-name/in/invidious/package.nix
+++ b/pkgs/by-name/in/invidious/package.nix
@@ -3,6 +3,7 @@
   callPackage,
   crystal,
   fetchFromGitHub,
+  fetchpatch2,
   librsvg,
   pkg-config,
   libxml2,
@@ -41,6 +42,15 @@ crystal.buildCrystalPackage rec {
     inherit (versions.invidious) hash;
   };
 
+  patches = [
+    # Remove with the first release containing this commit.
+    (fetchpatch2 {
+      name = "CVE-2026-58447.patch";
+      url = "https://github.com/iv-org/invidious/commit/77ad41678b45c4f6815940123f1796fc51259f45.patch?full_index=1";
+      hash = "sha256-0pf6eu0ckQ2gYHLr2tEDy+1dvAhVjepG26kuxuHbZl8=";
+    })
+  ];
+
   postPatch =
     let
       # Replacing by the value (templates) of the variables ensures that building