From 6004c4f5d2c9237baa455e10dcc2a025e2096e08 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Sat, 8 Aug 2026 16:56:10 +0000
Subject: [PATCH] perlPackages.JSONXS: 4.03 -> 4.04

4.04 contains the upstream fix for CVE-2025-40928.

Assisted-by: Claude Code (Claude Opus 5)
Signed-off-by: Stig Palmquist <git@stig.io>
(cherry picked from commit eb5ca223180217b72d0b28da37f8f41e241ff9bc)
---
 .../perl-modules/JSON-XS-CVE-2025-40928.patch | 31 -------------------
 pkgs/top-level/perl-packages.nix              |  7 ++---
 2 files changed, 3 insertions(+), 35 deletions(-)
 delete mode 100644 pkgs/development/perl-modules/JSON-XS-CVE-2025-40928.patch

diff --git a/pkgs/development/perl-modules/JSON-XS-CVE-2025-40928.patch b/pkgs/development/perl-modules/JSON-XS-CVE-2025-40928.patch
deleted file mode 100644
index f1d258c12a3d..000000000000
--- a/pkgs/development/perl-modules/JSON-XS-CVE-2025-40928.patch
+++ /dev/null
@@ -1,31 +0,0 @@
---- a/XS.xs	2025-09-06 08:34:51.376455632 -0300
-+++ b/XS.xs	2025-09-06 08:35:30.725873619 -0300
-@@ -253,16 +253,16 @@
-   // if we recurse too deep, skip all remaining digits
-   // to avoid a stack overflow attack
-   if (expect_false (--maxdepth <= 0))
--    while (((U8)*s - '0') < 10)
-+    while ((U8)(*s - '0') < 10)
-       ++s;
- 
-   for (;;)
-     {
--      U8 dig = (U8)*s - '0';
-+      U8 dig = *s - '0';
- 
-       if (expect_false (dig >= 10))
-         {
--          if (dig == (U8)((U8)'.' - (U8)'0'))
-+          if (dig == (U8)('.' - '0'))
-             {
-               ++s;
-               json_atof_scan1 (s, accum, expo, 1, maxdepth);
-@@ -282,7 +282,7 @@
-               else if (*s == '+')
-                 ++s;
- 
--              while ((dig = (U8)*s - '0') < 10)
-+              while ((dig = (U8)(*s - '0')) < 10)
-                 exp2 = exp2 * 10 + *s++ - '0';
- 
-               *expo += neg ? -exp2 : exp2;
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index b634f0e3f075..703f003d4e09 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -18668,12 +18668,11 @@ with self;
 
   JSONXS = buildPerlPackage {
     pname = "JSON-XS";
-    version = "4.03";
+    version = "4.04";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/M/ML/MLEHMANN/JSON-XS-4.03.tar.gz";
-      hash = "sha256-UVU29F8voafojIgkUzdY0BIdJnq5y0U6G1iHyKVrkGg=";
+      url = "mirror://cpan/authors/id/M/ML/MLEHMANN/JSON-XS-4.04.tar.gz";
+      hash = "sha256-jv8enzBMViW1mre0IlhBX20+NoHB3atrclUYoBin9eA=";
     };
-    patches = [ ../development/perl-modules/JSON-XS-CVE-2025-40928.patch ];
     propagatedBuildInputs = [ TypesSerialiser ];
     buildInputs = [ CanaryStability ];
     meta = {