From e47f2d529c2e20b95114b0bebe05b50652af0d3a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 21 Jun 2026 00:37:40 +0000
Subject: [PATCH 01/20] libffiReal: 3.5.2 -> 3.6.0

(cherry picked from commit 559ec51b02722903e0c8ac6560c9896a7c9a94ff)
---
 pkgs/by-name/li/libffiReal/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libffiReal/package.nix b/pkgs/by-name/li/libffiReal/package.nix
index 0869a82c1d16..8b91df2f4ebf 100644
--- a/pkgs/by-name/li/libffiReal/package.nix
+++ b/pkgs/by-name/li/libffiReal/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libffi";
-  version = "3.5.2";
+  version = "3.6.0";
 
   src = fetchurl {
     url =
       with finalAttrs;
       "https://github.com/libffi/libffi/releases/download/v${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-86MIKiOzfCk6T80QUxR7Nx8v+R+n6hsqUuM1Z2usgtw=";
+    hash = "sha256-Mf8f4y3q6/uziHJ/Mmd7slS/KkE4LFFGTAsYN8numCg=";
   };
 
   # Note: this package is used for bootstrapping fetchurl, and thus

From cd11ebe6d821faf318a4215cc77bbf903d81a215 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Fri, 3 Jul 2026 21:32:03 +0200
Subject: [PATCH 02/20] uvwasi: add support for static-only builds

(cherry picked from commit 17e6e533cc76bc80c9d502c02180f11598283483)
---
 pkgs/by-name/uv/uvwasi/package.nix | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/pkgs/by-name/uv/uvwasi/package.nix b/pkgs/by-name/uv/uvwasi/package.nix
index 8d48132e945e..5194fdc7ab07 100644
--- a/pkgs/by-name/uv/uvwasi/package.nix
+++ b/pkgs/by-name/uv/uvwasi/package.nix
@@ -8,6 +8,7 @@
   stdenv,
   testers,
   validatePkgConfig,
+  static ? stdenv.hostPlatform.isStatic, # generates static libraries *only*
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -21,6 +22,20 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-+vz/qTMRRDHV1VE4nny9vYYtarZHk1xoM4EZiah3jnY=";
   };
 
+  patches = [
+    # FIXME: remove when included in a release
+    (fetchpatch2 {
+      url = "https://github.com/nodejs/uvwasi/commit/0820128569533c855d60c0f6382acbb14aa62ad2.patch?full_index=1";
+      hash = "sha256-psjivoarqisOuCdVJAWuFH0aITzwb/obmal3ewVXvG4=";
+    })
+  ];
+  postPatch = lib.optionalString static ''
+    substituteInPlace CMakeLists.txt --replace-fail 'TARGETS uvwasi_a uvwasi' 'TARGETS uvwasi_a'
+  '';
+  cmakeFlags = [
+    (lib.cmakeBool "UVWASI_BUILD_SHARED" (!static))
+  ];
+
   outputs = [
     "out"
   ];

From f7bf67a87391cada64e24f98a57fce360d3e49d1 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Wed, 8 Jul 2026 21:27:20 +0200
Subject: [PATCH 03/20] libffiReal: 3.6.0 -> 3.7.0

(cherry picked from commit ddab585265ba2f87f813bba9e51e382c4f8ee344)
---
 pkgs/by-name/li/libffiReal/package.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libffiReal/package.nix b/pkgs/by-name/li/libffiReal/package.nix
index 8b91df2f4ebf..3ccee9419fc5 100644
--- a/pkgs/by-name/li/libffiReal/package.nix
+++ b/pkgs/by-name/li/libffiReal/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libffi";
-  version = "3.6.0";
+  version = "3.7.0";
 
   src = fetchurl {
     url =
       with finalAttrs;
       "https://github.com/libffi/libffi/releases/download/v${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-Mf8f4y3q6/uziHJ/Mmd7slS/KkE4LFFGTAsYN8numCg=";
+    hash = "sha256-IlXFpjjftRv2fCChKnu3DRf+senqurrAX1VzFG9YZDY=";
   };
 
   # Note: this package is used for bootstrapping fetchurl, and thus
@@ -32,6 +32,9 @@ stdenv.mkDerivation (finalAttrs: {
     ./freebsd-tsan-pthread.patch
   ];
 
+  # To workaround https://github.com/libffi/libffi/issues/993, we empty the test file:
+  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin "echo 'int main (void) { return 0; }' > testsuite/libffi.call/i128-1.c";
+
   strictDeps = true;
   outputs = [
     "out"

From 7b197115da3f5868c128b4d11ae674356166b357 Mon Sep 17 00:00:00 2001
From: Julian Stecklina <julian.stecklina@cyberus-technology.de>
Date: Wed, 1 Jul 2026 10:47:23 +0200
Subject: [PATCH 04/20] glibc: fix CVE-2026-5435 and CVE-2026-6238

The fixes were backported from glibc master and had some slight
conflicts.
0001-resolv-Check-for-inet_ntop-failure-in-ns_sprintrrf.patch was
backported to avoid having to modify the fix for CVE-2026-6238.

(cherry picked from commit 8515b91b88f3a27584324effe33a24df2ed15fae)
---
 ...or-inet_ntop-failure-in-ns_sprintrrf.patch |  69 +++++++++
 ...s-as-unknown-in-ns_sprintrrf-CVE-202.patch | 134 ++++++++++++++++++
 ...r-overreads-in-ns_sprintrrf-CVE-2026.patch |  66 +++++++++
 pkgs/development/libraries/glibc/common.nix   |   9 ++
 4 files changed, 278 insertions(+)
 create mode 100644 pkgs/development/libraries/glibc/0001-resolv-Check-for-inet_ntop-failure-in-ns_sprintrrf.patch
 create mode 100644 pkgs/development/libraries/glibc/0002-resolv-More-types-as-unknown-in-ns_sprintrrf-CVE-202.patch
 create mode 100644 pkgs/development/libraries/glibc/0003-resolv-Fix-buffer-overreads-in-ns_sprintrrf-CVE-2026.patch

diff --git a/pkgs/development/libraries/glibc/0001-resolv-Check-for-inet_ntop-failure-in-ns_sprintrrf.patch b/pkgs/development/libraries/glibc/0001-resolv-Check-for-inet_ntop-failure-in-ns_sprintrrf.patch
new file mode 100644
index 000000000000..5e55d1242bb4
--- /dev/null
+++ b/pkgs/development/libraries/glibc/0001-resolv-Check-for-inet_ntop-failure-in-ns_sprintrrf.patch
@@ -0,0 +1,69 @@
+From 4d9c6b19fcb34fab03fb7dab8f6d36a2cc4ef982 Mon Sep 17 00:00:00 2001
+From: Florian Weimer <fweimer@redhat.com>
+Date: Fri, 19 Jun 2026 18:22:20 +0200
+Subject: [PATCH 1/3] resolv: Check for inet_ntop failure in ns_sprintrrf
+
+This makes the output more consistent (either failure or complete
+output) and helps with systematic testing with varying buffer
+sizes.
+
+Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+(cherry picked from commit cd0db208d56a2cecd528b8ae96df752ba5344d9a)
+---
+ resolv/ns_print.c | 18 +++++++++++-------
+ 1 file changed, 11 insertions(+), 7 deletions(-)
+
+diff --git a/resolv/ns_print.c b/resolv/ns_print.c
+index cef2212fd2..cb680fb74e 100644
+--- a/resolv/ns_print.c
++++ b/resolv/ns_print.c
+@@ -140,8 +140,9 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ 	switch (type) {
+ 	case ns_t_a:
+ 	  if (rdlen != (size_t)NS_INADDRSZ)
+-			goto formerr;
+-		(void) inet_ntop(AF_INET, rdata, buf, buflen);
++		  goto formerr;
++		if (inet_ntop (AF_INET, rdata, buf, buflen) == NULL)
++		  return -1;
+ 		addlen(strlen(buf), &buf, &buflen);
+ 		break;
+ 
+@@ -307,9 +308,10 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ 	    }
+ 
+ 	case ns_t_aaaa:
+-	  if (rdlen != (size_t)NS_IN6ADDRSZ)
+-			goto formerr;
+-		(void) inet_ntop(AF_INET6, rdata, buf, buflen);
++		if (rdlen != (size_t)NS_IN6ADDRSZ)
++		  goto formerr;
++		if (inet_ntop (AF_INET6, rdata, buf, buflen) == NULL)
++		  return -1;
+ 		addlen(strlen(buf), &buf, &buflen);
+ 		break;
+ 
+@@ -400,7 +402,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ 			goto formerr;
+ 
+ 		/* Address. */
+-		(void) inet_ntop(AF_INET, rdata, buf, buflen);
++		if (inet_ntop (AF_INET, rdata, buf, buflen) == NULL)
++		  return -1;
+ 		addlen(strlen(buf), &buf, &buflen);
+ 		rdata += NS_INADDRSZ;
+ 
+@@ -542,7 +545,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ 			if (rdata + pbyte >= edata) goto formerr;
+ 			memset(&a, 0, sizeof(a));
+ 			memcpy(&a.s6_addr[pbyte], rdata, sizeof(a) - pbyte);
+-			(void) inet_ntop(AF_INET6, &a, buf, buflen);
++			if (inet_ntop (AF_INET6, &a, buf, buflen) == NULL)
++			  return -1;
+ 			addlen(strlen(buf), &buf, &buflen);
+ 			rdata += sizeof(a) - pbyte;
+ 		}
+-- 
+2.54.0
+
diff --git a/pkgs/development/libraries/glibc/0002-resolv-More-types-as-unknown-in-ns_sprintrrf-CVE-202.patch b/pkgs/development/libraries/glibc/0002-resolv-More-types-as-unknown-in-ns_sprintrrf-CVE-202.patch
new file mode 100644
index 000000000000..5b39165a43b0
--- /dev/null
+++ b/pkgs/development/libraries/glibc/0002-resolv-More-types-as-unknown-in-ns_sprintrrf-CVE-202.patch
@@ -0,0 +1,134 @@
+From 103658e72f5aaeb36a5e405f9abaa1b687488fc1 Mon Sep 17 00:00:00 2001
+From: Florian Weimer <fweimer@redhat.com>
+Date: Fri, 19 Jun 2026 18:22:20 +0200
+Subject: [PATCH 2/3] resolv: More types as unknown in ns_sprintrrf
+ (CVE-2026-5435)
+
+Specifically, CERT, TKEY, TSIG, OPT.  This removes the buggy
+implementations of TSIG, fixing bug 34033, and partially
+fixing bug 34069.
+
+Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+(cherry picked from commit ca44a6609c29a683b03575fa035c6d17aa591e72)
+---
+ resolv/ns_print.c | 96 -----------------------------------------------
+ 1 file changed, 96 deletions(-)
+
+diff --git a/resolv/ns_print.c b/resolv/ns_print.c
+index cb680fb74e..8c876b147e 100644
+--- a/resolv/ns_print.c
++++ b/resolv/ns_print.c
+@@ -437,96 +437,6 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ 		break;
+ 	    }
+ 
+-	case ns_t_cert: {
+-		u_int c_type, key_tag, alg;
+-		int n;
+-		unsigned int siz;
+-		char base64_cert[8192], tmp[40];
+-		const char *leader;
+-
+-		c_type  = ns_get16(rdata); rdata += NS_INT16SZ;
+-		key_tag = ns_get16(rdata); rdata += NS_INT16SZ;
+-		alg = (u_int) *rdata++;
+-
+-		len = SPRINTF((tmp, "%d %d %d ", c_type, key_tag, alg));
+-		T(addstr(tmp, len, &buf, &buflen));
+-		siz = (edata-rdata)*4/3 + 4; /* "+4" accounts for trailing \0 */
+-		if (siz > sizeof(base64_cert) * 3/4) {
+-			const char *str = "record too long to print";
+-			T(addstr(str, strlen(str), &buf, &buflen));
+-		}
+-		else {
+-			len = b64_ntop(rdata, edata-rdata, base64_cert, siz);
+-
+-			if (len < 0)
+-				goto formerr;
+-			else if (len > 15) {
+-				T(addstr(" (", 2, &buf, &buflen));
+-				leader = "\n\t\t";
+-				spaced = 0;
+-			}
+-			else
+-				leader = " ";
+-
+-			for (n = 0; n < len; n += 48) {
+-				T(addstr(leader, strlen(leader),
+-					 &buf, &buflen));
+-				T(addstr(base64_cert + n, MIN(len - n, 48),
+-					 &buf, &buflen));
+-			}
+-			if (len > 15)
+-				T(addstr(" )", 2, &buf, &buflen));
+-		}
+-		break;
+-	    }
+-
+-	case ns_t_tkey: {
+-		/* KJD - need to complete this */
+-		u_long t;
+-		int mode, err, keysize;
+-
+-		/* Algorithm name. */
+-		T(addname(msg, msglen, &rdata, origin, &buf, &buflen));
+-		T(addstr(" ", 1, &buf, &buflen));
+-
+-		/* Inception. */
+-		t = ns_get32(rdata);  rdata += NS_INT32SZ;
+-		len = SPRINTF((tmp, "%lu ", t));
+-		T(addstr(tmp, len, &buf, &buflen));
+-
+-		/* Expiration. */
+-		t = ns_get32(rdata);  rdata += NS_INT32SZ;
+-		len = SPRINTF((tmp, "%lu ", t));
+-		T(addstr(tmp, len, &buf, &buflen));
+-
+-		/* Mode , Error, Key Size. */
+-		/* Priority, Weight, Port. */
+-		mode = ns_get16(rdata);  rdata += NS_INT16SZ;
+-		err  = ns_get16(rdata);  rdata += NS_INT16SZ;
+-		keysize  = ns_get16(rdata);  rdata += NS_INT16SZ;
+-		len = SPRINTF((tmp, "%u %u %u ", mode, err, keysize));
+-		T(addstr(tmp, len, &buf, &buflen));
+-
+-		/* XXX need to dump key, print otherdata length & other data */
+-		break;
+-	    }
+-
+-	case ns_t_tsig: {
+-		/* BEW - need to complete this */
+-		int n;
+-
+-		T(len = addname(msg, msglen, &rdata, origin, &buf, &buflen));
+-		T(addstr(" ", 1, &buf, &buflen));
+-		rdata += 8; /*%< time */
+-		n = ns_get16(rdata); rdata += INT16SZ;
+-		rdata += n; /*%< sig */
+-		n = ns_get16(rdata); rdata += INT16SZ; /*%< original id */
+-		sprintf(buf, "%d", ns_get16(rdata));
+-		rdata += INT16SZ;
+-		addlen(strlen(buf), &buf, &buflen);
+-		break;
+-	    }
+-
+ 	case ns_t_a6: {
+ 		struct in6_addr a;
+ 		int pbyte, pbit;
+@@ -561,12 +471,6 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ 		break;
+ 	    }
+ 
+-	case ns_t_opt: {
+-		len = SPRINTF((tmp, "%u bytes", class));
+-		T(addstr(tmp, len, &buf, &buflen));
+-		break;
+-	    }
+-
+ 	default:
+ 		snprintf (errbuf, sizeof (errbuf), "unknown RR type %d", type);
+ 		comment = errbuf;
+-- 
+2.54.0
+
diff --git a/pkgs/development/libraries/glibc/0003-resolv-Fix-buffer-overreads-in-ns_sprintrrf-CVE-2026.patch b/pkgs/development/libraries/glibc/0003-resolv-Fix-buffer-overreads-in-ns_sprintrrf-CVE-2026.patch
new file mode 100644
index 000000000000..8bde49f159e0
--- /dev/null
+++ b/pkgs/development/libraries/glibc/0003-resolv-Fix-buffer-overreads-in-ns_sprintrrf-CVE-2026.patch
@@ -0,0 +1,66 @@
+From 2290143edc27486196815874dca5a528c118a73f Mon Sep 17 00:00:00 2001
+From: Florian Weimer <fweimer@redhat.com>
+Date: Fri, 19 Jun 2026 18:22:20 +0200
+Subject: [PATCH 3/3] resolv: Fix buffer overreads in ns_sprintrrf
+ (CVE-2026-6238)
+
+Check that the RDATA payload does not require more than RDATALEN
+bytes while processing it.  The fixes cover A6, LOC records.
+(CERT, TKEY, TSIG were fixed before, by switching to the generic
+formatter.)
+
+The vulnerable LOC record handling was first introduced before
+glibc 2.0, in commit ee188d555b8c32ad9704a7440cab400af967292f.
+
+CERT, TSIG, TKEY handling came with commit
+b43b13ac2544b11f35be301d1589b51a8473e32b, released with glibc 2.2.
+
+A6 record handling was introduced in commit
+91633816430e7ec5a19fe3ff510a7c4822a9557e ("* resolv/ns_print.c
+(ns_sprintrrf): Handle ns_t_a6 and ns_t_opt."), which went into glibc
+2.7.
+
+This fixes bug 34069.
+
+Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+(cherry picked from commit a7b60d23bbb56eaef59f4962e4140062e552600a)
+---
+ resolv/ns_print.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/resolv/ns_print.c b/resolv/ns_print.c
+index 8c876b147e..6832255a25 100644
+--- a/resolv/ns_print.c
++++ b/resolv/ns_print.c
+@@ -318,7 +318,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ 	case ns_t_loc: {
+ 		char t[255];
+ 
+-		/* XXX protocol format checking? */
++		if (rdlen != 16)
++		  goto formerr;
+ 		(void) loc_ntoa(rdata, t);
+ 		T(addstr(t, strlen(t), &buf, &buflen));
+ 		break;
+@@ -452,13 +453,14 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ 
+ 		/* address suffix: provided only when prefix len != 128 */
+ 		if (pbit < 128) {
+-			if (rdata + pbyte >= edata) goto formerr;
++			unsigned int bytelen = sizeof(a) - pbyte;
++			if (edata - rdata < bytelen) goto formerr;
+ 			memset(&a, 0, sizeof(a));
+-			memcpy(&a.s6_addr[pbyte], rdata, sizeof(a) - pbyte);
++			memcpy(&a.s6_addr[pbyte], rdata, bytelen);
+ 			if (inet_ntop (AF_INET6, &a, buf, buflen) == NULL)
+ 			  return -1;
+ 			addlen(strlen(buf), &buf, &buflen);
+-			rdata += sizeof(a) - pbyte;
++			rdata += bytelen;
+ 		}
+ 
+ 		/* prefix name: provided only when prefix len > 0 */
+-- 
+2.54.0
+
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index b6c6a6c86445..577682f7cd96 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -116,6 +116,15 @@ stdenv.mkDerivation (
       # enable parallel & reproducible build of glibcLocales
       ./0001-localedata-allow-reproducible-parallel-install-of-lo.patch
       ./0002-Makeconfig-make-inst_complocaledir-overridable.patch
+
+      # Security fixes.
+      #
+      # Can be dropped on 2.44. The first patch is only to make it
+      # easier to backport the fix for CVE-2026-6238 and it seems
+      # useful in its own right anyhow.
+      ./0001-resolv-Check-for-inet_ntop-failure-in-ns_sprintrrf.patch
+      ./0002-resolv-More-types-as-unknown-in-ns_sprintrrf-CVE-202.patch
+      ./0003-resolv-Fix-buffer-overreads-in-ns_sprintrrf-CVE-2026.patch
     ]
     /*
       NVCC does not support ARM intrinsics. Since <math.h> is pulled in by almost

From 55da30f019696bbf3e8eb75ef347e4b67659c460 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 27 May 2026 23:51:26 +0000
Subject: [PATCH 05/20] vim: 9.2.0389 -> 9.2.0541

(cherry picked from commit fea17e2a81c81a3a8141d23f4dc306d246db9487)
---
 pkgs/applications/editors/vim/common.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
index 05ac73b9f13e..71848004202f 100644
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@@ -4,7 +4,7 @@
   stdenv,
 }:
 rec {
-  version = "9.2.0389";
+  version = "9.2.0541";
 
   outputs = [
     "out"
@@ -15,7 +15,7 @@ rec {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-shhdJn1bPJ/68a54UZMn1fla7P4tjVUN4DGLbx3ohOg=";
+    hash = "sha256-M2vdIAM3P2MZdcMvFX/3/fixliTosR06nvPIX7NXFNo=";
   };
 
   enableParallelBuilding = true;

From 3cf65c6a089eae3b3ba30c9f6170c52f5edf3703 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sun, 12 Jul 2026 19:30:22 +0100
Subject: [PATCH 06/20] libseccomp: 2.6.0 -> 2.6.1

Changes: https://github.com/seccomp/libseccomp/releases/tag/v2.6.1
(cherry picked from commit 5a147b95c69153d76ae3d4422123ad9717af1039)
---
 pkgs/by-name/li/libseccomp/package.nix | 23 ++---------------------
 1 file changed, 2 insertions(+), 21 deletions(-)

diff --git a/pkgs/by-name/li/libseccomp/package.nix b/pkgs/by-name/li/libseccomp/package.nix
index 222bda60e16a..64677eb94051 100644
--- a/pkgs/by-name/li/libseccomp/package.nix
+++ b/pkgs/by-name/li/libseccomp/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  fetchpatch,
   getopt,
   util-linuxMinimal,
   which,
@@ -13,31 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libseccomp";
-  version = "2.6.0";
+  version = "2.6.1";
 
   src = fetchurl {
     url = "https://github.com/seccomp/libseccomp/releases/download/v${finalAttrs.version}/libseccomp-${finalAttrs.version}.tar.gz";
-    hash = "sha256-g7YIUjLRWIw3ncm5yuR7s3QHzyYubnSZPGG6ctKnhNw=";
+    hash = "sha256-UB9mxmciXVN5G5fh18+Fq3ZMKX0EiB9g849FHEsO4b4=";
   };
 
-  patches = [
-    # Remove when version > 2.6.0
-    # Fixes test failures on big-endian archs
-    (fetchpatch {
-      name = "0001-libseccomp-remove-fuzzer-from-test-62-sim-arch_transactions.patch";
-      url = "https://github.com/seccomp/libseccomp/commit/2f0f3b0e9121720108431c5d054164016f476230.patch";
-      hash = "sha256-AKAQyALJlLgxnS23OEoqfyDswp0kU2vmja5ohgvFojw=";
-    })
-
-    # Remove when version > 2.6.0
-    # Fixes OOB reads & tests on musl
-    (fetchpatch {
-      name = "0002-libseccomp-fix-seccomp_export_bpf_mem-out-of-bounds-read.patch";
-      url = "https://github.com/seccomp/libseccomp/commit/dd759e8c4f5685b526638fba9ec4fc24c37c9aec.patch";
-      hash = "sha256-TdfQ5T8FrGE6+P24MIi9rKSC3fQu/Jlr4bsFiJd4yVY=";
-    })
-  ];
-
   outputs = [
     "out"
     "lib"

From dce3ac2abf4fc6af33e7dea2bd1caa6f74945417 Mon Sep 17 00:00:00 2001
From: Julian Stecklina <julian.stecklina@cyberus-technology.de>
Date: Wed, 15 Jul 2026 15:54:51 +0200
Subject: [PATCH 07/20] gst_all_1.gst-plugins-good: fix GStreamer-SA-2026-0021

Fixes: GStreamer-SA-2026-0021
Not-cherry-picked-because: unstable is already on 1.28
---
 .../libraries/gstreamer/good/default.nix            | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/pkgs/development/libraries/gstreamer/good/default.nix b/pkgs/development/libraries/gstreamer/good/default.nix
index 9c531daf1486..27c2381462b8 100644
--- a/pkgs/development/libraries/gstreamer/good/default.nix
+++ b/pkgs/development/libraries/gstreamer/good/default.nix
@@ -95,6 +95,19 @@ stdenv.mkDerivation (finalAttrs: {
     (replaceVars ./souploader.diff {
       nixLibSoup3Path = "${lib.getLib libsoup_3}/lib";
     })
+    # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11262
+    (fetchpatch {
+      name = "GStreamer-SA-2026-0021-1.patch";
+      url = "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/35a905a92f4cfc85941c6c820009ac9219f755b2.patch";
+      sha256 = "sha256-1SgQo+wb2Adcgrz3zn6/qn248vnBdPuk2oJ1v9+Dbzo=";
+      stripLen = 2;
+    })
+    (fetchpatch {
+      name = "GStreamer-SA-2026-0021-2.patch";
+      url = "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/0d819ceb654b06bbdd54381da5363c16751758a2.patch";
+      sha256 = "sha256-a8P1YxLNMkYka01+8MhBO+uSzGbR186sumlQk5LuGfY=";
+      stripLen = 2;
+    })
   ];
 
   strictDeps = true;

From 3ccc7aca5f42158f09b799be1ee53c3dd9fe4b6e Mon Sep 17 00:00:00 2001
From: Julian Stecklina <julian.stecklina@cyberus-technology.de>
Date: Wed, 15 Jul 2026 15:55:49 +0200
Subject: [PATCH 08/20] gst_all_1.gst-plugins-good: fix GStreamer-SA-2026-0022

Fixes: GStreamer-SA-2026-0022
Not-cherry-picked-because: unstable is already on 1.28
---
 pkgs/development/libraries/gstreamer/good/default.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/development/libraries/gstreamer/good/default.nix b/pkgs/development/libraries/gstreamer/good/default.nix
index 27c2381462b8..b40675d820b4 100644
--- a/pkgs/development/libraries/gstreamer/good/default.nix
+++ b/pkgs/development/libraries/gstreamer/good/default.nix
@@ -108,6 +108,13 @@ stdenv.mkDerivation (finalAttrs: {
       sha256 = "sha256-a8P1YxLNMkYka01+8MhBO+uSzGbR186sumlQk5LuGfY=";
       stripLen = 2;
     })
+    # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11263
+    (fetchpatch {
+      name = "GStreamer-SA-2026-0022.patch";
+      url = "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/6db6dd058ebc3607452311b7dc47b0359b40b293.patch";
+      sha256 = "sha256-gaBUpEdZB0PrnI1IR53jtM0kecHpUIzavUdADN1NNlQ=";
+      stripLen = 2;
+    })
   ];
 
   strictDeps = true;

From bbffc29d60de77330153226a6e12c3200ef0fe56 Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Thu, 9 Jul 2026 11:19:52 +0200
Subject: [PATCH 09/20] tzdata: 2026b -> 2026c

https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/NVHSX2PAQIT44U5FCCEVNJJYXQMMTJSA/
(cherry picked from commit 5526f30e5aced751a1c48f11d9114d9749b0e0ec)
---
 pkgs/by-name/tz/tzdata/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/tz/tzdata/package.nix b/pkgs/by-name/tz/tzdata/package.nix
index ad04029c4b80..75cb3cc49134 100644
--- a/pkgs/by-name/tz/tzdata/package.nix
+++ b/pkgs/by-name/tz/tzdata/package.nix
@@ -8,16 +8,16 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tzdata";
-  version = "2026b";
+  version = "2026c";
 
   srcs = [
     (fetchurl {
       url = "https://data.iana.org/time-zones/releases/tzdata${finalAttrs.version}.tar.gz";
-      hash = "sha256-EUVD2fGaa/61vKQ2hq6hc9OHVaPbHy7sESZHrpLG9UQ=";
+      hash = "sha256-5KF4pEd/PQ6nfMMYKP9yqjj+/41hqhPn6Z4ULp2QK+Q=";
     })
     (fetchurl {
       url = "https://data.iana.org/time-zones/releases/tzcode${finalAttrs.version}.tar.gz";
-      hash = "sha256-N+nthCf101IcIvxY4pPL+wQ9cO7fEAOHCzPzY/Yco0Q=";
+      hash = "sha256-sc/8Os5MTHzQ77ovet2G7D0LedpIvPA1gmcf08j+rOg=";
     })
   ];
 

From dff953e92f37bb8d1b2e92ace5edc2c74c90181b Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Wed, 8 Jul 2026 08:13:49 -0400
Subject: [PATCH 10/20] xvfb: 21.1.23 -> 21.1.24, drop rebuild avoidance

announcement: https://lists.x.org/archives/xorg-announce/2026-July/003718.html
advisory: https://lists.x.org/archives/xorg-announce/2026-July/003716.html
(cherry picked from commit d14289b44548ffacf8503650acd977a307cb2c6d)
---
 pkgs/by-name/xv/xvfb/package.nix | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/pkgs/by-name/xv/xvfb/package.nix b/pkgs/by-name/xv/xvfb/package.nix
index 17cc2e9418ca..934fade5a795 100644
--- a/pkgs/by-name/xv/xvfb/package.nix
+++ b/pkgs/by-name/xv/xvfb/package.nix
@@ -38,14 +38,7 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "xvfb";
 
-  # TODO: commented out for rebuild avoidance after xorg-server update. revert
-  # on staging.
-  # inherit (xorg-server) src version;
-  version = "21.1.23";
-  src = fetchurl {
-    url = "mirror://xorg/individual/xserver/xorg-server-${finalAttrs.version}.tar.xz";
-    hash = "sha256-45gy5WF9ra8HL9+fDhnl0uHCoTYHrCgLrBq6n4/hRjQ=";
-  };
+  inherit (xorg-server) src version;
 
   strictDeps = true;
 

From c06c8bc716fec0b74d6bf98ccac0feefcea94635 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Tue, 2 Jun 2026 21:24:48 +0100
Subject: [PATCH 11/20] graphite2: 1.3.14 -> 1.3.15

Changes: https://github.com/silnrsi/graphite/releases/tag/1.3.15
(cherry picked from commit 622480b3b0a933d5e80ef1306ae5b97c0e7ad75d)
---
 .../libraries/silgraphite/graphite2.nix       | 32 +++----------------
 1 file changed, 5 insertions(+), 27 deletions(-)

diff --git a/pkgs/development/libraries/silgraphite/graphite2.nix b/pkgs/development/libraries/silgraphite/graphite2.nix
index b5ed5a969db7..40ae39918d8c 100644
--- a/pkgs/development/libraries/silgraphite/graphite2.nix
+++ b/pkgs/development/libraries/silgraphite/graphite2.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   llvmPackages,
-  fetchpatch,
+  python3,
   fetchurl,
   pkg-config,
   freetype,
@@ -12,14 +12,14 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "1.3.14";
+  version = "1.3.15";
   pname = "graphite2";
 
   src = fetchurl {
     url =
       with finalAttrs;
       "https://github.com/silnrsi/graphite/releases/download/${version}/${pname}-${version}.tgz";
-    sha256 = "1790ajyhk0ax8xxamnrk176gc9gvhadzy78qia4rd8jzm89ir7gr";
+    hash = "sha256-xryLQlJyRmUpf3ytDFWJcoXGc/m45ts1IqzoM1k/4LE=";
   };
 
   outputs = [
@@ -29,6 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     pkg-config
+    (python3.withPackages (ps: [ ps.fonttools ]))
     cmake
   ];
   buildInputs = [
@@ -40,14 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
     }
   );
 
-  patches = [
-    # Fix build with gcc15
-    (fetchpatch {
-      url = "https://src.fedoraproject.org/rpms/graphite2/raw/deba28323b0a3b7a3dcfd06df1efc2195b102ed7/f/graphite2-1.3.14-gcc15.patch";
-      hash = "sha256-vkkGkHkcsj1mD3OHCHLWWgpcmFDv8leC4YQm+TsbIUw=";
-    })
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [ ./macosx.patch ];
+  patches = lib.optionals stdenv.hostPlatform.isDarwin [ ./macosx.patch ];
   postPatch = ''
     # disable broken 'nametabletest' test, fails on gcc-13:
     #   https://github.com/silnrsi/graphite/pull/74
@@ -61,22 +55,6 @@ stdenv.mkDerivation (finalAttrs: {
     # headers are located in the dev output:
     substituteInPlace CMakeLists.txt \
       --replace-fail ' ''${CMAKE_INSTALL_PREFIX}/include' " ${placeholder "dev"}/include"
-
-    # Fix the build with CMake 4.
-    #
-    # See: <https://github.com/silnrsi/graphite/issues/98>
-    badCmakeFiles=(
-      CMakeLists.txt
-      src/CMakeLists.txt
-      tests/{bittwiddling,json,sparsetest,utftest}/CMakeLists.txt
-      gr2fonttest/CMakeLists.txt
-    )
-    for file in "''${badCmakeFiles[@]}"; do
-      substituteInPlace "$file" \
-        --replace-fail \
-          'CMAKE_MINIMUM_REQUIRED(VERSION 2.8.0 FATAL_ERROR)' \
-          'CMAKE_MINIMUM_REQUIRED(VERSION 3.10 FATAL_ERROR)'
-    done
   '';
 
   cmakeFlags = lib.optionals static [

From e92481103ed5dc10d1b21876ec1c26e894260220 Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Tue, 14 Jul 2026 16:46:51 -0400
Subject: [PATCH 12/20] Reapply "gawk: 5.4.0 -> 5.4.1"

This reverts commit 4169bd40634aa5500d0ded4a74a90fed86b3aad9.

(cherry picked from commit 293df3a7b17e35fb556ffd9f6463cfed0efb056b)
---
 pkgs/tools/text/gawk/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/text/gawk/default.nix b/pkgs/tools/text/gawk/default.nix
index 2cbdfd2fa593..bb345afdd482 100644
--- a/pkgs/tools/text/gawk/default.nix
+++ b/pkgs/tools/text/gawk/default.nix
@@ -25,11 +25,11 @@ assert (doCheck && stdenv.hostPlatform.isLinux) -> glibcLocales != null;
 
 stdenv.mkDerivation rec {
   pname = "gawk" + lib.optionalString interactive "-interactive";
-  version = "5.4.0";
+  version = "5.4.1";
 
   src = fetchurl {
     url = "mirror://gnu/gawk/gawk-${version}.tar.xz";
-    hash = "sha256-PdQw8M07RCjGw/avwCG5zTwfjJP3pojcJoykKKkLSsE=";
+    hash = "sha256-B/b3NCt/6+QxP8LCVCrZPWT+IK2HFyABCfEFqCb1/Tc=";
   };
 
   # When we do build separate interactive version, it makes sense to always include man.

From ea232a222752dd98eec8d286fee67ee8edb302f8 Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Tue, 14 Jul 2026 16:45:42 -0400
Subject: [PATCH 13/20] gawk: apply upstream patch for bug when building
 without gmp/mpfr

when using gawk 5.4.1 without gmp and mpfr, some alignment is broken in
a NODE struct. this causes build failures in downstream packages such
as `libpng` and `gcc16`. a discussion of the latter occurred on
bug-gawk (https://lists.gnu.org/archive/html/bug-gawk/2026-07/msg00013.html)
where the issue was found and pushed to the relevant branch, but has not
been released. accordingly, we fetch (manually, since fetchpatch
infrecs) the patch from the savannah gitweb. this fixes `libpng` and
`gcc16`.

(cherry picked from commit 63d29caff2227b36d40af22912af315f2aabd01b)
---
 pkgs/tools/text/gawk/default.nix              | 11 +++
 .../gawk/node-struct-without-gmp-mpfr.patch   | 79 +++++++++++++++++++
 2 files changed, 90 insertions(+)
 create mode 100644 pkgs/tools/text/gawk/node-struct-without-gmp-mpfr.patch

diff --git a/pkgs/tools/text/gawk/default.nix b/pkgs/tools/text/gawk/default.nix
index bb345afdd482..87d2946e6160 100644
--- a/pkgs/tools/text/gawk/default.nix
+++ b/pkgs/tools/text/gawk/default.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
   removeReferencesTo,
   runtimeShellPackage,
   texinfo,
@@ -32,6 +33,16 @@ stdenv.mkDerivation rec {
     hash = "sha256-B/b3NCt/6+QxP8LCVCrZPWT+IK2HFyABCfEFqCb1/Tc=";
   };
 
+  patches = [
+    # When building gawk without gmp and mpfr, gawk 5.4.1 causes build failures
+    # in downstream packages such as GCC and libpng.
+    # Discussion on bug-gawk:
+    # https://lists.gnu.org/archive/html/bug-gawk/2026-07/msg00013.html
+    # Vendored since we can't use fetchpatch:
+    # https://gitweb.git.savannah.gnu.org/gitweb/?p=gawk.git;a=commit;h=bf85f8a3175af703597082d4c7e0abc2066a44d3
+    ./node-struct-without-gmp-mpfr.patch
+  ];
+
   # When we do build separate interactive version, it makes sense to always include man.
   outputs = [
     "out"
diff --git a/pkgs/tools/text/gawk/node-struct-without-gmp-mpfr.patch b/pkgs/tools/text/gawk/node-struct-without-gmp-mpfr.patch
new file mode 100644
index 000000000000..01f660c191e8
--- /dev/null
+++ b/pkgs/tools/text/gawk/node-struct-without-gmp-mpfr.patch
@@ -0,0 +1,79 @@
+From bf85f8a3175af703597082d4c7e0abc2066a44d3 Mon Sep 17 00:00:00 2001
+From: "Arnold D. Robbins" <arnold@skeeve.com>
+Date: Tue, 14 Jul 2026 10:14:50 +0300
+Subject: [PATCH] Workaround fix for systems without MPFR and GMP.
+
+---
+ ChangeLog |  8 ++++++++
+ awk.h     | 23 ++++++++++++++---------
+ 2 files changed, 22 insertions(+), 9 deletions(-)
+
+diff --git a/ChangeLog b/ChangeLog
+index 6a955eed..42bd2c48 100644
+--- a/ChangeLog
++++ b/ChangeLog
+@@ -3,6 +3,14 @@
+ 	* builtin.c (do_dump_node): Add the size of each object to
+ 	the printout.
+ 
++	Unrelated: Make things works when built on systems without
++	the GMP and MPFR libraries.  Thanks to Thomas Trepl <ttrepl@yahoo.de>
++	and Bruce Dubbs <bdubbs@linuxfromscratch.org> for the reports.
++
++	* awk.h (struct exp_node): Add alignment padding when we don't
++	have MPFR. This is a hack, pending a total refactoring of
++	the NODE structure.
++
+ 2026-07-08         Arnold D. Robbins     <arnold@skeeve.com>
+ 
+ 	* 5.4.1: Release tar ball made.
+diff --git a/awk.h b/awk.h
+index dbad0d81..f4a84300 100644
+--- a/awk.h
++++ b/awk.h
+@@ -406,17 +406,24 @@ typedef struct exp_node {
+ 		} nodep;
+ 
+ 		struct {
+-#ifdef HAVE_MPFR
+ 			union {
+ 				AWKNUM fltnum;
++#ifdef HAVE_MPFR
+ 				mpfr_t mpnum;
+ 				mpz_t mpi;
+-			} nm;
+-			int rndmode;
+ #else
+-			AWKNUM fltnum;
+-			int for_alignment_only;	// especially on 32-bit
+-#endif
++				// 7/2026:
++				// This is a workaround for systems that build
++				// gawk without MPFR and GMP.  The NODE struct
++				// desperately needs to be refactored.
++#if SIZEOF_VOID_P == 4
++				char alignment[28];
++#else	// SIZEOF_VOID_P != 4
++				char alignment[48];
++#endif	// SIZEOF_VOID_P != 4
++#endif	// HAVE_MPFR
++			} nm;
++			int rndmode;	// only used for MPFR.
+ 			char *sp;
+ 			size_t slen;
+ 			int idx;
+@@ -561,10 +568,8 @@ typedef struct exp_node {
+ #ifdef HAVE_MPFR
+ #define mpg_numbr	sub.val.nm.mpnum
+ #define mpg_i		sub.val.nm.mpi
+-#define numbr		sub.val.nm.fltnum
+-#else
+-#define numbr		sub.val.fltnum
+ #endif
++#define numbr		sub.val.nm.fltnum
+ #define typed_re	sub.val.typre
+ 
+ /*
+-- 
+2.54.0
+

From 0301fee6c9cef55cffbc067b09b7536307080959 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 4 Feb 2026 00:28:07 +0000
Subject: [PATCH 14/20] libmysofa: 1.3.3 -> 1.3.4

(cherry picked from commit 0565c966047ffa8a76f9a1baf5b3bdcab037ce7c)
---
 pkgs/by-name/li/libmysofa/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libmysofa/package.nix b/pkgs/by-name/li/libmysofa/package.nix
index b32265cc07a7..ae140ada101d 100644
--- a/pkgs/by-name/li/libmysofa/package.nix
+++ b/pkgs/by-name/li/libmysofa/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libmysofa";
-  version = "1.3.3";
+  version = "1.3.4";
 
   src = fetchFromGitHub {
     owner = "hoene";
     repo = "libmysofa";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-jvib1hGPJEY2w/KjlD7iTtRy1s8LFG+Qhb2d6xdpUyc=";
+    hash = "sha256-gP/RjKzMx8JIYcyiivBGvy3kIdwHMEKY6abssyVUKNQ=";
   };
 
   outputs = [

From 54094d3252b24ac99fdcadca8a5098419bae8bff Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 18 Jul 2026 11:17:44 +0200
Subject: [PATCH 15/20] cacert: 3.125 -> 3.126

https://github.com/mozilla/nss/blob/master/doc/rst/releases/nss_3_126.rst
(cherry picked from commit 9652e1332dde25759901369a315c665da85fb214)
---
 pkgs/by-name/ca/cacert/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ca/cacert/package.nix b/pkgs/by-name/ca/cacert/package.nix
index df6b082a92bc..c4052964cd91 100644
--- a/pkgs/by-name/ca/cacert/package.nix
+++ b/pkgs/by-name/ca/cacert/package.nix
@@ -20,7 +20,7 @@ let
     lib.concatStringsSep "\n\n" extraCertificateStrings
   );
 
-  version = "3.125";
+  version = "3.126";
   meta = {
     homepage = "https://firefox-source-docs.mozilla.org/security/nss/runbooks/rootstore.html#root-store-consumers";
     description = "Bundle of X.509 certificates of public Certificate Authorities (CA)";
@@ -52,7 +52,7 @@ stdenv.mkDerivation {
         "https://hg-edge.mozilla.org/projects/nss/raw-file/${tag}/${file}"
         "https://raw.githubusercontent.com/nss-dev/nss/refs/tags/${tag}/${file}"
       ];
-    hash = "sha256-5XkSgI2u97Kw+k3yzPF+R66vJsg5o4+Fx2AD66/YZr0=";
+    hash = "sha256-gbfyV2MzouNg5nP5Etewt6dl2DbHMQA+NIpGysXTcZg=";
   };
 
   unpackPhase = ''

From 6bc479868ec76f8e69e7d59e418c23fa7f083c09 Mon Sep 17 00:00:00 2001
From: Ivan Mincik <ivan.mincik@gmail.com>
Date: Mon, 20 Jul 2026 09:45:40 +0200
Subject: [PATCH 16/20] gdal: add patch for buffer overflow in netCDF driver

Closes #525297
---
 pkgs/by-name/gd/gdal/package.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/gd/gdal/package.nix b/pkgs/by-name/gd/gdal/package.nix
index 0c686129dc89..05cb62c60046 100644
--- a/pkgs/by-name/gd/gdal/package.nix
+++ b/pkgs/by-name/gd/gdal/package.nix
@@ -116,6 +116,14 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://github.com/OSGeo/gdal/commit/7b8b8de28bbd200b0fd3b09147fdc68b5bf5ce20.patch";
       hash = "sha256-BxWMpiUwM3h7Vo9vxJ4H4A8aQfE3jcSRfRYwaLw/60w=";
     })
+
+    # Fix stack buffer overflow in netCDF driver
+    # https://github.com/OSGeo/gdal/issues/14594
+    (fetchpatch {
+      name = "0005-netcdf-avoid-reading-attributes-without-checking-length.patch";
+      url = "https://github.com/OSGeo/gdal/commit/50eea7456d83c9586f112ef96b43249372839dea.patch";
+      hash = "sha256-m1FsBC37h2uuaEeYezPZJFsDR6Ix/FDIZnuZZiSAYcw=";
+    })
   ];
 
   nativeBuildInputs = [

From e212d6cda732ce51704243a3a62366a5767f88dd Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Sun, 5 Jul 2026 18:53:22 -0400
Subject: [PATCH 17/20] libtiff: 4.7.1 -> 4.7.2

changes: https://libtiff.gitlab.io/libtiff/releases/v4.7.2.html
diff: https://gitlab.com/libtiff/libtiff/-/compare/v4.7.1...v4.7.2
(cherry picked from commit 3259398327131f38738e0971c8eca677f2df24de)
---
 pkgs/by-name/li/libtiff/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libtiff/package.nix b/pkgs/by-name/li/libtiff/package.nix
index 3b6ba2345148..ed35ef461bf8 100644
--- a/pkgs/by-name/li/libtiff/package.nix
+++ b/pkgs/by-name/li/libtiff/package.nix
@@ -37,13 +37,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libtiff";
-  version = "4.7.1";
+  version = "4.7.2";
 
   src = fetchFromGitLab {
     owner = "libtiff";
     repo = "libtiff";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-UiC6s86i7UavW86EKm74oPVlEacvoKmwW7KETjpnNaI=";
+    hash = "sha256-60Lpg5WRfWMzlOoOUA+C6KLlYIZ+3BjXidOVqv4M2GA=";
   };
 
   patches = [

From 113d68d960290e9d2468f4a1957f92dd30611933 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Mon, 20 Jul 2026 12:40:40 +0200
Subject: [PATCH 18/20] duckdb: work around the excessive logging

(cherry picked from commit 4f1b1fac3d3d16854a998e3f2171f2f42e18dbae)
https://hydra.nixos.org/build/338857607#tabs-buildsteps
---
 pkgs/by-name/du/duckdb/package.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/du/duckdb/package.nix b/pkgs/by-name/du/duckdb/package.nix
index 401df7d6762b..4497dbf3e10e 100644
--- a/pkgs/by-name/du/duckdb/package.nix
+++ b/pkgs/by-name/du/duckdb/package.nix
@@ -152,11 +152,13 @@ stdenv.mkDerivation (finalAttrs: {
       );
       LD_LIBRARY_PATH = lib.optionalString stdenv.hostPlatform.isDarwin "DY" + "LD_LIBRARY_PATH";
     in
+    # FIXME: do something about the excessive logging on x86_64-linux (> 250 MiB).
     ''
       runHook preInstallCheck
       (($(ulimit -n) < 1024)) && ulimit -n 1024
 
-      HOME="$(mktemp -d)" ${LD_LIBRARY_PATH}="$lib/lib" ./test/unittest ${toString excludes}
+      HOME="$(mktemp -d)" ${LD_LIBRARY_PATH}="$lib/lib" ./test/unittest ${toString excludes}${
+        lib.optionalString stdenv.hostPlatform.isx86_64 " >/dev/null" }
 
       runHook postInstallCheck
     '';

From 598cde6ca85081f06c69c5ad065b3a8724ec7d9c Mon Sep 17 00:00:00 2001
From: Tom Hunze <dev@thunze.de>
Date: Tue, 21 Jul 2026 10:41:34 +0200
Subject: [PATCH 19/20] gdal: fix tests with libtiff 4.7.2

https://github.com/OSGeo/gdal/commit/06ffb0333fe557cde262aa1e81466dda42684c53

Hydra: https://hydra.nixos.org/build/338860757

Not-cherry-picked-because: Unstable is on gdal 3.13, which will receive the upstream commit.
---
 pkgs/by-name/gd/gdal/package.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pkgs/by-name/gd/gdal/package.nix b/pkgs/by-name/gd/gdal/package.nix
index 05cb62c60046..1c4f5c0f5990 100644
--- a/pkgs/by-name/gd/gdal/package.nix
+++ b/pkgs/by-name/gd/gdal/package.nix
@@ -124,6 +124,16 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://github.com/OSGeo/gdal/commit/50eea7456d83c9586f112ef96b43249372839dea.patch";
       hash = "sha256-m1FsBC37h2uuaEeYezPZJFsDR6Ix/FDIZnuZZiSAYcw=";
     })
+
+    # Fix tests with libtiff 4.7.2
+    # FAILED gcore/tiff_read.py::test_tiff_read_stripbytecounts_count_not_same_as_stripoffsets_count -
+    #     AssertionError: assert '170' is None
+    (fetchpatch {
+      name = "0006-Internal-libtiff-resync-with-4.7.2rc3-and-adjust-tes.patch";
+      url = "https://github.com/OSGeo/gdal/commit/06ffb0333fe557cde262aa1e81466dda42684c53.patch";
+      hash = "sha256-teZ9cv8JQ2ua4tEWl3I8D9DYo8srGIBYIc2NfkgNMe4=";
+      includes = [ "autotest/gcore/tiff_read.py" ];
+    })
   ];
 
   nativeBuildInputs = [

From 61af2273a8a60e41bccf1bdec45225e1dcb2fb41 Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Mon, 20 Jul 2026 11:06:37 -0400
Subject: [PATCH 20/20] duckdb: fix treefmt

regressed in 4f1b1fac3d3d16854a998e3f2171f2f42e18dbae (unstable).
regressed in 113d68d960290e9d2468f4a1957f92dd30611933 (26.05).

(cherry picked from commit 7197da8faaf7a3bf729a787e7f5c65c3f5ccd789)
---
 pkgs/by-name/du/duckdb/package.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/by-name/du/duckdb/package.nix b/pkgs/by-name/du/duckdb/package.nix
index 4497dbf3e10e..9c86d318fa57 100644
--- a/pkgs/by-name/du/duckdb/package.nix
+++ b/pkgs/by-name/du/duckdb/package.nix
@@ -157,8 +157,7 @@ stdenv.mkDerivation (finalAttrs: {
       runHook preInstallCheck
       (($(ulimit -n) < 1024)) && ulimit -n 1024
 
-      HOME="$(mktemp -d)" ${LD_LIBRARY_PATH}="$lib/lib" ./test/unittest ${toString excludes}${
-        lib.optionalString stdenv.hostPlatform.isx86_64 " >/dev/null" }
+      HOME="$(mktemp -d)" ${LD_LIBRARY_PATH}="$lib/lib" ./test/unittest ${toString excludes}${lib.optionalString stdenv.hostPlatform.isx86_64 " >/dev/null"}
 
       runHook postInstallCheck
     '';