From ecd827db1f2fd41e347fb72ef1accd67df6aa896 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Wed, 27 May 2026 08:53:19 +0200
Subject: [PATCH] thunderbird-esr: 140.7.2esr -> 140.11.1esr

Uh, I'm sorry.  I forgot to keep updating after r-ryantm
stopped doing so unexpectedly (because this upstream bug).
There are basically no changes beyond security improvements.

(further info composed by mweinelt)
https://www.thunderbird.net/en-US/thunderbird/140.8.0esr/releasenotes/
https://www.thunderbird.net/en-US/thunderbird/140.8.1esr/releasenotes/
https://www.thunderbird.net/en-US/thunderbird/140.9.0esr/releasenotes/
https://www.thunderbird.net/en-US/thunderbird/140.9.1esr/releasenotes/
https://www.thunderbird.net/en-US/thunderbird/140.10.0esr/releasenotes/
https://www.thunderbird.net/en-US/thunderbird/140.10.1esr/releasenotes/
https://www.thunderbird.net/en-US/thunderbird/140.10.2esr/releasenotes/
https://www.thunderbird.net/en-US/thunderbird/140.11.0esr/releasenotes/
https://www.thunderbird.net/en-US/thunderbird/140.11.1esr/releasenotes/

Fixes:
CVE-2025-59375, CVE-2026-2757, CVE-2026-2758, CVE-2026-2759,
CVE-2026-2760, CVE-2026-2761, CVE-2026-2762, CVE-2026-2763,
CVE-2026-2764, CVE-2026-2765, CVE-2026-2766, CVE-2026-2767,
CVE-2026-2768, CVE-2026-2769, CVE-2026-2770, CVE-2026-2771,
CVE-2026-2772, CVE-2026-2773, CVE-2026-2774, CVE-2026-2775,
CVE-2026-2776, CVE-2026-2777, CVE-2026-2778, CVE-2026-2779,
CVE-2026-2780, CVE-2026-2781, CVE-2026-2782, CVE-2026-2783,
CVE-2026-2784, CVE-2026-2785, CVE-2026-2786, CVE-2026-2787,
CVE-2026-2788, CVE-2026-2789, CVE-2026-2790, CVE-2026-2791,
CVE-2026-2792, CVE-2026-2793, CVE-2026-3889, CVE-2026-4371,
CVE-2026-4684, CVE-2026-4685, CVE-2026-4686, CVE-2026-4687,
CVE-2026-4688, CVE-2026-4689, CVE-2026-4690, CVE-2026-4691,
CVE-2026-4692, CVE-2026-4693, CVE-2026-4694, CVE-2026-4695,
CVE-2026-4696, CVE-2026-4697, CVE-2026-4698, CVE-2026-4699,
CVE-2026-4700, CVE-2026-4701, CVE-2026-4702, CVE-2026-4704,
CVE-2026-4705, CVE-2026-4706, CVE-2026-4707, CVE-2026-4708,
CVE-2026-4709, CVE-2026-4710, CVE-2026-4711, CVE-2026-4712,
CVE-2026-4713, CVE-2026-4714, CVE-2026-4715, CVE-2026-4716,
CVE-2026-4717, CVE-2026-4718, CVE-2026-4719, CVE-2026-4720,
CVE-2026-4721, CVE-2026-5731, CVE-2026-5732, CVE-2026-5734,
CVE-2026-6746, CVE-2026-6747, CVE-2026-6748, CVE-2026-6749,
CVE-2026-6750, CVE-2026-6751, CVE-2026-6752, CVE-2026-6753,
CVE-2026-6754, CVE-2026-6757, CVE-2026-6759, CVE-2026-6761,
CVE-2026-6762, CVE-2026-6763, CVE-2026-6764, CVE-2026-6765,
CVE-2026-6766, CVE-2026-6767, CVE-2026-6769, CVE-2026-6770,
CVE-2026-6771, CVE-2026-6772, CVE-2026-6776, CVE-2026-6785,
CVE-2026-6786, CVE-2026-7320, CVE-2026-7321, CVE-2026-7322,
CVE-2026-7323, CVE-2026-8090, CVE-2026-8091, CVE-2026-8092,
CVE-2026-8094, CVE-2026-8388, CVE-2026-8391, CVE-2026-8401,
CVE-2026-8946, CVE-2026-8947, CVE-2026-8949, CVE-2026-8950,
CVE-2026-8953, CVE-2026-8954, CVE-2026-8955, CVE-2026-8956,
CVE-2026-8957, CVE-2026-8958, CVE-2026-8959, CVE-2026-8961,
CVE-2026-8962, CVE-2026-8968, CVE-2026-8970, CVE-2026-8974,
CVE-2026-8975
---
 .../mailreaders/thunderbird/packages.nix        | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
index 8a78d99b79c8..71d6cb7a2fa6 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@@ -32,11 +32,14 @@ let
       # FIXME: let's hope that upstream will fix this soon and we can drop this hack again.
       # https://bugzilla.mozilla.org/show_bug.cgi?id=2040877
       extraPostPatch =
-        lib.optionalString (lib.versionAtLeast version "151" && lib.versionOlder version "152")
-          ''
-            echo https://hg.mozilla.org/releases/comm-release/rev/becfb8fb2c70f1603882a2787e2170d5d8013949 >> sourcestamp.txt
-            echo https://hg.mozilla.org/releases/mozilla-release/rev/fc12dc911f904307729760a817deb829cbf8feb4 >> sourcestamp.txt
-          '';
+        lib.optionalString (lib.versionAtLeast version "151" && lib.versionOlder version "152") ''
+          echo https://hg.mozilla.org/releases/comm-release/rev/becfb8fb2c70f1603882a2787e2170d5d8013949 >> sourcestamp.txt
+          echo https://hg.mozilla.org/releases/mozilla-release/rev/fc12dc911f904307729760a817deb829cbf8feb4 >> sourcestamp.txt
+        ''
+        # https://bugzilla.mozilla.org/show_bug.cgi?id=2006630
+        + lib.optionalString (lib.versionAtLeast version "140.8" && lib.versionOlder version "151") ''
+          find . -name .cargo-checksum.json | xargs sed 's/"[^"]*\.gitmodules":"[a-z0-9]*",//g' -i
+        '';
 
       meta = {
         changelog = "https://www.thunderbird.net/en-US/thunderbird/${version}/releasenotes/";
@@ -88,8 +91,8 @@ rec {
   thunderbird-140 = common {
     applicationName = "Thunderbird ESR";
 
-    version = "140.7.2esr";
-    sha512 = "513bcaa496f987d0f3906aeb6fe3ea651331470646b0c58479c91bb2c8eb52e389bc8aa646437a03b611ab78bda1df7252545960ffe38086d1fc462e65421819";
+    version = "140.11.1esr";
+    sha512 = "93dfdd26e6f4c7dd2f7dcc2e4994980d017868341c60c93775721467abd9192b815f2de63928e7d10c965fc045ed72ca5b49ed6502a61e50104ee5cd00941d1e";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-140";