From 4b94324556a0d802ad3316b936547dfed4842896 Mon Sep 17 00:00:00 2001
From: Ryan Omasta <git@ryand.ca>
Date: Wed, 25 Mar 2026 01:14:07 -0600
Subject: [PATCH] python3Packages.pygments: patch CVE-2026-4539

---
 .../pygments/CVE-2026-4539.patch              | 34 +++++++++++++++++++
 .../python-modules/pygments/default.nix       |  6 ++++
 2 files changed, 40 insertions(+)
 create mode 100644 pkgs/development/python-modules/pygments/CVE-2026-4539.patch

diff --git a/pkgs/development/python-modules/pygments/CVE-2026-4539.patch b/pkgs/development/python-modules/pygments/CVE-2026-4539.patch
new file mode 100644
index 000000000000..5bd27874c8ad
--- /dev/null
+++ b/pkgs/development/python-modules/pygments/CVE-2026-4539.patch
@@ -0,0 +1,34 @@
+From 2be805d86471efb8efd51886d4d11a33fa22a928 Mon Sep 17 00:00:00 2001
+From: "zam." <zamkorong12@gmail.com>
+Date: Wed, 25 Mar 2026 11:47:14 +0700
+Subject: [PATCH] fix(lexers): prevent ReDoS in archetype lexer GUID and ID
+ patterns
+
+---
+ pygments/lexers/archetype.py | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/pygments/lexers/archetype.py b/pygments/lexers/archetype.py
+index 5b3eb21ae7..977b02f751 100644
+--- a/pygments/lexers/archetype.py
++++ b/pygments/lexers/archetype.py
+@@ -35,8 +35,8 @@ class AtomsLexer(RegexLexer):
+             (r'([ \t]*)(--.*)$', bygroups(Whitespace, Comment)),
+         ],
+         'archetype_id': [
+-            (r'([ \t]*)(([a-zA-Z]\w+(\.[a-zA-Z]\w+)*::)?[a-zA-Z]\w+(-[a-zA-Z]\w+){2}'
+-             r'\.\w+[\w-]*\.v\d+(\.\d+){,2}((-[a-z]+)(\.\d+)?)?)',
++            (r'([ \t]*)(([a-zA-Z]\w{1,100}(\.[a-zA-Z]\w{1,100})*::)?[a-zA-Z]\w{1,100}(-[a-zA-Z]\w{1,100}){2}'
++             r'\.\w{1,100}[\w-]*\.v\d+(\.\d+){,2}((-[a-z]+)(\.\d+)?)?)',
+              bygroups(Whitespace, Name.Decorator)),
+         ],
+         'date_constraints': [
+@@ -293,7 +293,7 @@ class AdlLexer(AtomsLexer):
+             # numbers and version ids
+             (r'\d+(\.\d+)*', Literal),
+             # Guids
+-            (r'(\d|[a-fA-F])+(-(\d|[a-fA-F])+){3,}', Literal),
++            (r'[0-9a-fA-F]{1,36}(-[0-9a-fA-F]{1,36}){3,}', Literal),
+             (r'\w+', Name.Class),
+             (r'"', String, 'string'),
+             (r'=', Operator),
diff --git a/pkgs/development/python-modules/pygments/default.nix b/pkgs/development/python-modules/pygments/default.nix
index 94d10ee0aa75..c5fc77fd0f66 100644
--- a/pkgs/development/python-modules/pygments/default.nix
+++ b/pkgs/development/python-modules/pygments/default.nix
@@ -22,6 +22,12 @@ let
       hash = "sha256-Y2yyR3zsf4lSU2lwvFM7xDdDVC9wOSrgJjdGAK3VuIc=";
     };
 
+    patches = [
+      # https://github.com/NixOS/nixpkgs/issues/502540
+      # https://github.com/pygments/pygments/issues/3058
+      ./CVE-2026-4539.patch
+    ];
+
     nativeBuildInputs = [ hatchling ];
 
     # circular dependencies if enabled by default