From 8308b7cec6eb1d4ebdedbb1d7e3a70dae80b0490 Mon Sep 17 00:00:00 2001
From: Gerhard Schwanzer <geri@sdf.org>
Date: Wed, 12 Aug 2026 07:43:27 +0200
Subject: [PATCH] python3Packages.pymdown-extensions: fix security
 vulnerabilities

Update to 10.21.3 and backport upstream fixes for CVE-2026-61632 and CVE-2026-67422 while retaining the stable 10.x series.

https://redirect.github.com/facelessuser/pymdown-extensions/blob/10.21.3/docs/src/markdown/about/changelog.md

Assisted-by: pi coding agent / Mika (OpenAI gpt-5.6-sol)
Not-cherry-picked-because: master uses breaking 11.x; stable retains 10.x with backported fixes
---
 .../pymdown-extensions/default.nix            | 24 +++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pymdown-extensions/default.nix b/pkgs/development/python-modules/pymdown-extensions/default.nix
index 7ba31d5ed9ab..a359e408c86e 100644
--- a/pkgs/development/python-modules/pymdown-extensions/default.nix
+++ b/pkgs/development/python-modules/pymdown-extensions/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch2,
   hatchling,
   pytestCheckHook,
   markdown,
@@ -45,16 +46,35 @@ let
 in
 buildPythonPackage rec {
   pname = "pymdown-extensions";
-  version = "10.21.2";
+  version = "10.21.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "facelessuser";
     repo = "pymdown-extensions";
     tag = version;
-    hash = "sha256-BKnrq8m+xQYZs6V+x+3al7yS8531UvvaC4V+ny+f+Qg=";
+    hash = "sha256-hu9fXjZxlris3AhPS7bz3kcSyQtSeh0B6ZAZBsCO4+g=";
   };
 
+  patches = [
+    # Remove when updating to 11.0.0 or later.
+    (fetchpatch2 {
+      name = "CVE-2026-61632.patch";
+      url = "https://github.com/facelessuser/pymdown-extensions/commit/edce35586d11a1ef78bb187bc60497fe6dbf3b64.patch?full_index=1";
+      hash = "sha256-0J/ruQG73Lku/z+lFnb8XWT5WK+psiJyHq3/3ezUY8k=";
+    })
+    # Remove when updating to 11.0.1 or later.
+    (fetchpatch2 {
+      name = "CVE-2026-67422.patch";
+      url = "https://github.com/facelessuser/pymdown-extensions/commit/c68498598d7b13011bb4571350b6e3612a4ce44b.patch?full_index=1";
+      excludes = [
+        "docs/src/markdown/about/changelog.md"
+        "pymdownx/__meta__.py"
+      ];
+      hash = "sha256-r69jhMjTR/1oeSLifjZzG+wXYceSlkUk0KIPsGkOi1E=";
+    })
+  ];
+
   build-system = [ hatchling ];
 
   dependencies = [