From 3f880d9fc723cf65e62ce3c4f3fadbafcc976c92 Mon Sep 17 00:00:00 2001
From: Pavol Rusnak <pavol@rusnak.io>
Date: Sun, 8 Feb 2026 09:07:01 +0100
Subject: [PATCH] micropython: fix CVE-2026-1998

closes https://github.com/NixOS/nixpkgs/issues/488034
---
 pkgs/by-name/mi/micropython/package.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/by-name/mi/micropython/package.nix b/pkgs/by-name/mi/micropython/package.nix
index 22bdf0d7d156..bb7745fd2849 100644
--- a/pkgs/by-name/mi/micropython/package.nix
+++ b/pkgs/by-name/mi/micropython/package.nix
@@ -46,6 +46,13 @@ stdenv.mkDerivation rec {
     })
     ./fix-cross-compilation.patch
     ./fix-mpy-cross-path.patch
+    # fix CVE-2026-1998
+    # https://github.com/micropython/micropython/issues/18639
+    # https://github.com/micropython/micropython/pull/18671
+    (fetchpatch {
+      url = "https://github.com/dpgeorge/micropython/commit/570744d06c5ba9dba59b4c3f432ca4f0abd396b6.patch";
+      hash = "sha256-j8xr4oqmrsYumJvyA71bx+/dg2HiUxSxdjKUR/2sclI=";
+    })
   ];
 
   postPatch = ''