From fcba5839652976f3cbadc809ee13837d3de9cc68 Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Fri, 29 May 2026 14:21:46 -0400
Subject: [PATCH 1/2] gpx-viewer: migrate from libchamplain to
 libchamplain_libsoup3

These packages are API compatible, and libsoup 2.4 is insecure.
---
 pkgs/by-name/gp/gpx-viewer/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gp/gpx-viewer/package.nix b/pkgs/by-name/gp/gpx-viewer/package.nix
index 4323b4e91ab5..a9e745ccd49e 100644
--- a/pkgs/by-name/gp/gpx-viewer/package.nix
+++ b/pkgs/by-name/gp/gpx-viewer/package.nix
@@ -9,7 +9,7 @@
   vala,
   pkg-config,
   adwaita-icon-theme,
-  libchamplain,
+  libchamplain_libsoup3,
   gdl,
   wrapGAppsHook3,
 }:
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     gdl
-    libchamplain
+    libchamplain_libsoup3
     adwaita-icon-theme
     libxml2
   ];

From 7120192808393c57284df8fd54fbacf63139e834 Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Fri, 29 May 2026 14:27:36 -0400
Subject: [PATCH 2/2] libchamplain: remove libsoup 2.4 variant

`libchamplain` has referred to the version that links to libsoup 2.4 by
default, and has thus been marked insecure for quite some time. All of
the (few) dependents support building with the libsoup 3 version, so we
drop the insecure version entirely.
---
 .../{libchamplain => libchamplain_libsoup3}/package.nix   | 8 +++-----
 pkgs/by-name/li/lifeograph/package.nix                    | 4 ++--
 pkgs/top-level/aliases.nix                                | 1 +
 pkgs/top-level/all-packages.nix                           | 2 --
 4 files changed, 6 insertions(+), 9 deletions(-)
 rename pkgs/by-name/li/{libchamplain => libchamplain_libsoup3}/package.nix (91%)

diff --git a/pkgs/by-name/li/libchamplain/package.nix b/pkgs/by-name/li/libchamplain_libsoup3/package.nix
similarity index 91%
rename from pkgs/by-name/li/libchamplain/package.nix
rename to pkgs/by-name/li/libchamplain_libsoup3/package.nix
index 547aa3902c56..0f1449b98c9a 100644
--- a/pkgs/by-name/li/libchamplain/package.nix
+++ b/pkgs/by-name/li/libchamplain_libsoup3/package.nix
@@ -15,10 +15,8 @@
   sqlite,
   gnome,
   clutter-gtk,
-  libsoup_2_4,
   libsoup_3,
   gobject-introspection, # , libmemphis
-  withLibsoup3 ? false,
 }:
 
 stdenv.mkDerivation rec {
@@ -51,7 +49,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     sqlite
-    (if withLibsoup3 then libsoup_3 else libsoup_2_4)
+    libsoup_3
   ];
 
   propagatedBuildInputs = [
@@ -64,7 +62,7 @@ stdenv.mkDerivation rec {
   mesonFlags = [
     (lib.mesonBool "gtk_doc" (stdenv.buildPlatform == stdenv.hostPlatform))
     "-Dvapi=true"
-    (lib.mesonBool "libsoup3" withLibsoup3)
+    (lib.mesonBool "libsoup3" true)
   ];
 
   passthru = {
@@ -89,7 +87,7 @@ stdenv.mkDerivation rec {
        OpenCycleMap, OpenAerialMap, and Maps for free.
     '';
 
-    teams = lib.optionals withLibsoup3 [
+    teams = [
       lib.teams.gnome
       lib.teams.pantheon
     ];
diff --git a/pkgs/by-name/li/lifeograph/package.nix b/pkgs/by-name/li/lifeograph/package.nix
index 2e0d441dd900..5542cc8815ce 100644
--- a/pkgs/by-name/li/lifeograph/package.nix
+++ b/pkgs/by-name/li/lifeograph/package.nix
@@ -8,7 +8,7 @@
   wrapGAppsHook4,
   enchant,
   gtkmm4,
-  libchamplain,
+  libchamplain_libsoup3,
   libgcrypt,
   shared-mime-info,
   libshumate,
@@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
     libgcrypt
     enchant
     gtkmm4
-    (libchamplain.override { withLibsoup3 = true; })
+    libchamplain_libsoup3
     libshumate
   ];
 
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 3d4c509b845b..5f135c716fcb 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1108,6 +1108,7 @@ mapAliases {
   libbpf_1 = throw "'libbpf_1' has been renamed to/replaced by 'libbpf'"; # Converted to throw 2025-10-27
   libbson = throw "'libbson' has been renamed to/replaced by 'mongoc'"; # Converted to throw 2025-10-27
   libcef = throw "'libcef' has been removed, as no packages depend on it"; # Added 2025-11-06
+  libchamplain = throw "'libchamplain' has been removed due to reliance on insecure libsoup 2.4. Consider using 'libchamplain_libsoup3' instead"; # Added 2026-05-29
   libdbiDrivers = warnAlias "'libdbiDrivers' has been renamed to 'libdbi-drivers'" libdbi-drivers; # Added 2026-02-08
   libdbiDriversBase = warnAlias "'libdbiDriversBase' has been renamed to 'libdbi-drivers-base'" libdbi-drivers-base; # Added 2026-02-08
   libdevil = throw "libdevil has been removed, as it was unmaintained in Nixpkgs and upstream since 2017"; # Added 2025-09-16
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 830b6b0ce329..4ef70e0d4c57 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6432,8 +6432,6 @@ with pkgs;
     else
       pkgs.libcanberra-gtk2;
 
-  libchamplain_libsoup3 = libchamplain.override { withLibsoup3 = true; };
-
   libchipcard = callPackage ../development/libraries/aqbanking/libchipcard.nix { };
 
   libdbi-drivers-base = libdbi-drivers.override {