From 95b8afde029581eae8bfd57efe00f3310651de4a Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sat, 25 Jul 2026 10:51:31 -0700
Subject: [PATCH 1/2] openspec: 1.4.1 -> 1.7.0

---
 pkgs/by-name/op/openspec/package.nix | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/op/openspec/package.nix b/pkgs/by-name/op/openspec/package.nix
index 47133c832d37..4c256057ccaf 100644
--- a/pkgs/by-name/op/openspec/package.nix
+++ b/pkgs/by-name/op/openspec/package.nix
@@ -3,7 +3,7 @@
   stdenvNoCC,
   fetchFromGitHub,
   nodejs,
-  pnpm_11,
+  pnpm_10, # upstream uses pnpm 9 which is insecure. pnpm 11 breaks when fetching deps.
   fetchPnpmDeps,
   pnpmConfigHook,
   makeWrapper,
@@ -13,26 +13,28 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "openspec";
-  version = "1.4.1";
+  version = "1.7.0";
+  __structuredAttrs = true;
+  strictDeps = true;
 
   src = fetchFromGitHub {
     owner = "Fission-AI";
     repo = "OpenSpec";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VZZ/ukjciXqiebwei2JizyOnxx0T3IeoowFWElKec4o=";
+    hash = "sha256-mkwQQRjc/kWwhTj0pfJj264wIoL9FHb3B8flevyM8bs=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
-    pnpm = pnpm_11;
-    fetcherVersion = 4;
-    hash = "sha256-p44ctVCA3d1CXoq+zzhswVqhScF23ZhvpLUVVcrgQlM=";
+    pnpm = pnpm_10;
+    fetcherVersion = 3;
+    hash = "sha256-riT2qV8FUKdF4PI7Zcw7nZw6ZR9u4/qpeDKZ5oFPuH4=";
   };
 
   nativeBuildInputs = [
     nodejs
     pnpmConfigHook
-    pnpm_11
+    pnpm_10
     makeWrapper
     installShellFiles
   ];
@@ -51,8 +53,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     mkdir -p $out/bin $out/lib/openspec
 
     substituteInPlace bin/openspec.js \
-      --replace '#!/usr/bin/env node' '#!${nodejs}/bin/node' \
-      --replace "../dist" "$out/lib/openspec/dist"
+      --replace-fail '#!/usr/bin/env node' '#!${nodejs}/bin/node' \
+      --replace-fail "../dist" "$out/lib/openspec/dist"
     install -Dm755 bin/openspec.js $out/bin/openspec
 
     cp -r dist $out/lib/openspec/

From e4cda1086938a9cc0525a62f65cd16514064666e Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Thu, 30 Jul 2026 10:24:33 -0700
Subject: [PATCH 2/2] openspec: add sarahec as maintainer

---
 pkgs/by-name/op/openspec/package.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/op/openspec/package.nix b/pkgs/by-name/op/openspec/package.nix
index 4c256057ccaf..3a9bc80b2a75 100644
--- a/pkgs/by-name/op/openspec/package.nix
+++ b/pkgs/by-name/op/openspec/package.nix
@@ -78,7 +78,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     description = "AI-native system for spec-driven development";
     homepage = "https://github.com/Fission-AI/OpenSpec";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ kalbasit ];
+    maintainers = with lib.maintainers; [
+      kalbasit
+      sarahec
+    ];
     platforms = lib.platforms.all;
     mainProgram = "openspec";
   };