python3Packages.pygments: patch CVE-2026-4539 (#503278)

pkgs/development/python-modules/pygments/CVE-2026-4539.patch

@@ -0,0 +1,34 @@
+From 2be805d86471efb8efd51886d4d11a33fa22a928 Mon Sep 17 00:00:00 2001
+From: "zam." <zamkorong12@gmail.com>
+Date: Wed, 25 Mar 2026 11:47:14 +0700
+Subject: [PATCH] fix(lexers): prevent ReDoS in archetype lexer GUID and ID
+ patterns
+
+---
+ pygments/lexers/archetype.py | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/pygments/lexers/archetype.py b/pygments/lexers/archetype.py
+index 5b3eb21ae7..977b02f751 100644
+--- a/pygments/lexers/archetype.py
++++ b/pygments/lexers/archetype.py
+@@ -35,8 +35,8 @@ class AtomsLexer(RegexLexer):
+             (r'([ \t]*)(--.*)$', bygroups(Whitespace, Comment)),
+         ],
+         'archetype_id': [
+-            (r'([ \t]*)(([a-zA-Z]\w+(\.[a-zA-Z]\w+)*::)?[a-zA-Z]\w+(-[a-zA-Z]\w+){2}'
+-             r'\.\w+[\w-]*\.v\d+(\.\d+){,2}((-[a-z]+)(\.\d+)?)?)',
++            (r'([ \t]*)(([a-zA-Z]\w{1,100}(\.[a-zA-Z]\w{1,100})*::)?[a-zA-Z]\w{1,100}(-[a-zA-Z]\w{1,100}){2}'
++             r'\.\w{1,100}[\w-]*\.v\d+(\.\d+){,2}((-[a-z]+)(\.\d+)?)?)',
+              bygroups(Whitespace, Name.Decorator)),
+         ],
+         'date_constraints': [
+@@ -293,7 +293,7 @@ class AdlLexer(AtomsLexer):
+             # numbers and version ids
+             (r'\d+(\.\d+)*', Literal),
+             # Guids
+-            (r'(\d|[a-fA-F])+(-(\d|[a-fA-F])+){3,}', Literal),
++            (r'[0-9a-fA-F]{1,36}(-[0-9a-fA-F]{1,36}){3,}', Literal),
+             (r'\w+', Name.Class),
+             (r'"', String, 'string'),
+             (r'=', Operator),

pkgs/development/python-modules/pygments/default.nix

@@ -22,6 +22,12 @@ let
       hash = "sha256-Y2yyR3zsf4lSU2lwvFM7xDdDVC9wOSrgJjdGAK3VuIc=";
     };
 
+    patches = [
+      # https://github.com/NixOS/nixpkgs/issues/502540
+      # https://github.com/pygments/pygments/issues/3058
+      ./CVE-2026-4539.patch
+    ];
+
     nativeBuildInputs = [ hatchling ];
 
     # circular dependencies if enabled by default