From b958384f3dac47fa6e65f1cfd8bab16b6537b26c Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas@gerbet.me>
Date: Thu, 26 Feb 2026 16:13:30 +0100
Subject: [PATCH] binaryen: 125 -> 126

Fixes CVE-2025-14956 and CVE-2025-14957.

https://github.com/WebAssembly/binaryen/blob/version_126/CHANGELOG.md
---
 pkgs/development/compilers/binaryen/default.nix | 16 ++--------------
 1 file changed, 2 insertions(+), 14 deletions(-)

diff --git a/pkgs/development/compilers/binaryen/default.nix b/pkgs/development/compilers/binaryen/default.nix
index 5955fea3e628..2da75d6c9dd2 100644
--- a/pkgs/development/compilers/binaryen/default.nix
+++ b/pkgs/development/compilers/binaryen/default.nix
@@ -4,7 +4,6 @@
   cmake,
   python3,
   fetchFromGitHub,
-  fetchpatch2,
   emscripten,
   gtest,
   lit,
@@ -21,26 +20,15 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "binaryen";
-  version = "125";
+  version = "126";
 
   src = fetchFromGitHub {
     owner = "WebAssembly";
     repo = "binaryen";
     rev = "version_${version}";
-    hash = "sha256-QG8ZhvjcTbhIfYkVfrjxd97v9KaG/A8jO69rPg99/ME=";
+    hash = "sha256-6KnPVIEtguuMHopm2vf6s+KZ3Ymf2rjFE/aXy1Kbn5E=";
   };
 
-  patches = [
-    # TODO: remove at next release
-    # fix build on aarch64/riscv64 with gcc15 but bug exists on all platforms.
-    (fetchpatch2 {
-      name = "fix-uninitialized-small-vector.patch";
-      # https://github.com/WebAssembly/binaryen/pull/8094
-      url = "https://github.com/WebAssembly/binaryen/commit/3ff3762bf7c83edcdfccad522de640f2b0928ae2.patch?full_index=1";
-      hash = "sha256-lhrXQJAaQ/4ofnpyVqhD08IuDxPRc7UPyZ8DoCfM9NE=";
-    })
-  ];
-
   nativeBuildInputs = [
     cmake
     python3